Secure Token Generation via Encrypted Function Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional tokenization systems pose a security risk due to the potential compromise of tokenization algorithms, allowing hackers to invert tokens and retrieve original credit card numbers, as merchants often store tokenization functions in accessible locations for quick retrieval.
Innovation Solution
A secure execution environment, such as a virtual machine or ASIC, is used to generate and invert tokens within a token database, employing an encrypted tokenization function that is decrypted and executed within the secure environment, ensuring secure token generation and inversion while deleting sensitive information to prevent data breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the tokenization function is stored in a readily-accessible location for quick retrieval, then the inversion speed is improved, but the security is worsened as hackers can easily acquire the function
Solution Approach 1:
The system separates the tokenization function into two parts: an encrypted version stored in the token database and a decryption key stored securely in the secure execution environment. This segmentation allows the function to be retrieved quickly when needed while preventing unauthorized access, as the encrypted portion alone is useless without the secure key.
Solution Approach 2:
The patent introduces an intermediary mechanism (the secure execution environment) that acts as a mediator between the stored encrypted tokenization function and the actual decryption process. This intermediary protects the core cryptographic key while enabling legitimate inversion operations, resolving the conflict between accessibility and security.
2Object-affected harmful factors
If the tokenization function is encrypted and stored securely, then the security is improved, but the retrieval and execution time is worsened
Solution Approach 1:
The system performs preliminary encryption of the tokenization function and stores it in the token database in advance. The secure execution environment also pre-stores the decryption key. When inversion is needed, the pre-prepared encrypted function and key are quickly retrieved and combined, eliminating the need for real-time encryption/decryption setup and reducing execution time.
3Productivity
If the character string is retained for later processing, then the processing efficiency is improved, but the security risk is worsened due to potential data breaches
Solution Approach 1:
The system extracts and removes the sensitive character string from storage after token generation, retaining only the non-sensitive token in the token database. This extraction eliminates the security risk of storing sensitive data while maintaining processing efficiency, as the token can be stored and retrieved without compromising security.
Data Source
AI summary
Described herein are various technologies related to secure generation of tokens and secure inversion of tokens. A tokenization system executes in a secure execution environment, and is configured to receive a string and an encrypted tokenization function. The tokenization system decrypts the encrypted tokenization function, and executes the tokenization function over the string to generate a token. The token is transmitted to a logically separate computing environment, and the tokenization system deletes the tokenization function and the string.