Tokenization Device Substring Iteration Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tokenization methods for securing payment data strings, such as PANs, face inefficiencies in storage and security risks due to reliance on either large replacement tables or insecure mathematical functions for generating tokens.
Innovation Solution
A computer-implemented method that generates tokens by dividing the data string into substrings, using a replacement table with random entries indexed by a mathematical function applied to the data string, allowing for efficient and secure tokenization without storing the original data string, and enabling secure recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a replacement table with randomly generated tokens is used, then security is improved, but storage capacity requirements increase
Solution Approach 1:
The data string is divided into multiple substrings, and the tokenization process is applied iteratively to each substring. This segmentation allows the system to work with smaller data units, reducing the overall storage requirements while maintaining security through multiple rounds of tokenization.
Solution Approach 2:
Instead of tokenizing the entire data string at once, the method applies partial tokenization iteratively to substrings. This partial action approach reduces the storage burden on any single replacement table while achieving comprehensive security through multiple passes.
2Quantity of substance
If a mathematical function is used to generate tokens, then storage requirements are reduced, but security decreases
Solution Approach 1:
The method merges two previously separate approaches: random replacement table lookup and mathematical function transformation. By combining these methods in an iterative process where the output of one round becomes the input for the next, the system achieves both reduced storage requirements and enhanced security.
Solution Approach 2:
The tokenization process is applied continuously in multiple iterative rounds. Each round takes the previous round's output and applies further tokenization, creating a continuous chain of transformation that progressively enhances security while maintaining efficient storage utilization.
3Reliability
If replacement tables are used for tokenization, then security is improved, but device complexity increases
Solution Approach 1:
The complex tokenization task is segmented into multiple simpler iterative steps, each handling a substring. This segmentation reduces the complexity of individual operations while maintaining overall security through the cumulative effect of multiple rounds.
Solution Approach 2:
The system dynamically applies the tokenization process in multiple adaptive rounds. The iterative nature allows the system to adjust and refine the tokenization progressively, making the overall process more manageable and less statically complex.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a computer-implemented method for replacing a security-relevant, unencrypted data string from a data record with a token in a tokenization device. It is an object of the present invention to improve such a method in such a way that it operates more efficiently than a replacement table with randomly generated tokens and/or is more secure than generating tokens by solely applying a mathematical function to the unencrypted data string. To this end, the invention proposes to provide a computer-implemented method for replacing a security-relevant, unencrypted data string from a data record with a token in a tokenization device, wherein the method comprises the steps of: receiving the security-relevant,From an unencrypted data string, a processing unit generates a token associated with the unencrypted data string by the following steps: providing a replacement table with random entries, where each entry is assigned an index of the replacement table; splitting the unencrypted data string into two substrings, where the first substring consists only of the first character of the unencrypted string and the second substring consists of the remaining characters of the unencrypted string; calculating an index of the replacement table from the second substring such that an entry of the replacement table is determined; generating a replacement character from the entry determined by the index; replacing the single character of the first substring with the replacement character; swapping the first and second substrings.so that the replaced character of the first substring becomes the last character or the first character of the second substring, and the first character or the last character of the second substring becomes the only character of the first substring, and repeating the preceding steps so that a token associated with the unencrypted data string is generated, passing the token to the processing device, receiving the token from the processing device, restoring the unencrypted data string from the token associated with the unencrypted data string, with the steps of providing the substitution table, splitting the token into two substrings, the first substring consisting of all characters except the last character of the token, and the second substring consisting only of the last character of the token, calculating an index of the substitution table from the first substring so that a specific entry of the substitution table is determined,Generating a replacement character from the entry in the replacement table determined by the index, such that the single character of the second substring is replaced by the replacement character; swapping the first and second substrings so that the single character of the second substring becomes the first or last character of the first substring, and the last or first character of the first substring becomes the single character of the second substring; and repeating the preceding steps so that the unencrypted data string associated with the token is restored; passing the unencrypted data string to the processing device.