Vaultless Format-Preserving Encryption for Database-Free Tokenization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security methods face challenges in protecting sensitive information without the need for a vaulted solution, as vaulted tokenization requires a database to store the relationship between sensitive values and tokens, making them vulnerable to breaches, while traditional encryption risks exposure if the key is compromised.
Innovation Solution
A vaultless format-preserving encryption (FPE) and tokenization system that uses lookup tables and secure tweaks to transform sensitive data into tokens without storing the original data, ensuring security through format-preserving encryption and tokenization without a vault.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vaulted tokenization is used to protect sensitive data, then data security is improved, but system complexity increases due to the requirement of a database to store the relationship between sensitive values and tokens
Solution Approach 1:
The patent extracts the vulnerable vaulted database component from the tokenization system and replaces it with a vaultless architecture. Instead of storing sensitive data in a centralized database that requires protection, the system uses format-preserving encryption to transform sensitive data into tokens directly at the point of entry, eliminating the need for a secure vault while maintaining security.
Solution Approach 2:
The patent introduces format-preserving encryption as an intermediary mechanism between the original sensitive data and the tokenized form. This intermediary process allows data to be transformed into a secure token format that preserves the original structure and length, enabling use in existing systems without requiring a traditional vaulted database infrastructure.
2Reliability
If traditional encryption is used to protect sensitive data, then data confidentiality is improved, but vulnerability increases if the encryption key is compromised
Solution Approach 1:
The patent segments the encryption process into multiple components including the sensitive data input, format-preserving encryption transformation, and token output. By dividing the process and eliminating the need to store the relationship between original data and tokens in a centralized vault, the system reduces the impact of potential key compromise since there is no central repository of encrypted data to breach.
Solution Approach 2:
The patent employs disposable tokenization where each sensitive value is transformed into a token that does not need to be stored or reused. The token serves its purpose immediately and can be discarded, eliminating the long-term storage of encrypted data that would be vulnerable to key compromise. This approach treats encryption tokens as single-use, short-lived objects rather than persistent stored values.
3Reliability
If format-preserving encryption is applied to transform sensitive data into tokens, then data security is improved, but processing complexity increases
Solution Approach 1:
The patent designs the format-preserving encryption system to be universal and compatible with existing data structures and protocols. The FPE transformation maintains the original format, length, and structure of sensitive data, allowing tokens to be processed by existing systems without requiring specialized handling or complex processing logic. This multi-functionality reduces processing complexity despite the enhanced security.
Data Source
AI summary
Embodiments of the present disclosure relate to vaultless format-preserving tokenization systems and methods. Some methods include encoding a first data set to produce encoded input data; generating a secure tweak for the encoded input data based on a token format schema by: encoding a tweak input to produce an encoded tweak input; and hashing the encoded tweak input along with a unique hashing key to generate the secure tweak; applying a format preserving encryption algorithm that utilizes the encoded input data, the secure tweak, and a unique encryption key to generate ciphertext output; and generating a token from the ciphertext output.