Self-Identifying Tokens for Distributed Tokenization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The current tokenization architecture experiences performance bottlenecks due to the Tokenization Server servicing all data-related requests, which is inefficient in complex organizations like payment processors where multiple systems need access to data.
Innovation Solution
Distributing some data-related requests to other systems while maintaining security by producing tokens with a second set of bits satisfying a superset of constraints, allowing clients to verify tokens without accessing the database, using techniques such as allocating hold bits, check bits, codeword bits, and message authentication code (MAC) bits, and employing a keyed hash function.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the Tokenization Server services all data-related requests, then security is maintained, but system efficiency deteriorates due to performance bottlenecks
Solution Approach 1:
The patent segments the tokenization system into multiple independent Tokenization Servers that can distribute and process data-related requests in parallel. This segmentation allows the system to maintain security through distributed validation while improving efficiency by eliminating the single-point bottleneck, enabling multiple systems to access tokens simultaneously without overloading a single server.
2Ease of operation
If the Tokenization Server services all data-related requests, then centralized control is maintained, but workload concentration increases causing performance bottlenecks
Solution Approach 1:
The patent divides the centralized Tokenization Server into multiple distributed servers that can independently process requests. Each server maintains the ability to validate tokens and manage data access, distributing the workload across the network while preserving centralized security policies through shared validation logic and coordinate management.
Solution Approach 2:
The patent creates universal Tokenization Servers that can handle multiple types of data-related requests (token generation, validation, lookup) and serve multiple client systems simultaneously. Each server is designed to be multi-functional, capable of performing various operations without requiring specialized dedicated servers for each function, thus distributing workload effectively while maintaining operational simplicity.
Data Source
AI summary
A technique of protecting a datum within a set of sensitive data is presented. In this technique, the datum includes a first set of bits satisfying a first set of constraints, and a computer receives the set of sensitive data from an authorized client. The technique involves producing a token corresponding to the datum, the token including a second set of bits distinct from the first set of bits, the second set of bits satisfying a second set of constraints, the second set of constraints being a superset of the first set of constraints. The technique further involves storing the datum and the corresponding token. The technique further involves sending the token to the authorized client, the authorized client enabled to perform, using the second set of bits, a verification that the token satisfies the second set of constraints, the verification being performed apart from the database.