Collision avoidance in a distributed tokenization environment

• US 10,019,596 B2
• Filed: 04/27/2017
• Issued: 07/10/2018
• Est. Priority Date: 09/30/2013
• Status: Active Grant

• Current Assignee: Protegrity US Holding LLC
• Original Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Inventors: Mattsson, Ulf, Ferentz, Zvika
• Primary Examiner(s): Li, Meng
• Application Number:
  US15/499,764
• Publication Number:
  US 20170235972A1
• Time in Patent Office: 439 Days
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 16/24553 of query operations
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]

Abstract

A client receives sensitive data to be tokenized. The client queries a token table with a portion of the sensitive data to determine if the token table includes a token mapped to the value of the portion of the sensitive data. If the mapping table does not include a token mapped to the value of the portion of the sensitive data, a candidate token is generated. The client queries a central token management system to determine if the candidate token collides with a token generated by or stored at another client. In some embodiments, the candidate token includes a value from a unique set of values assigned by the central token management system to the client, guaranteeing that the candidate token does not cause a collision. The client then tokenizes the sensitive data with the candidate token and stores the candidate token in the token table.

Claims

1. A computer-implemented method for tokenizing data in a distributed network comprising:

accessing, by a client, data to be tokenized;

responsive to a determination that a locally stored token table does not include a token mapped to a value of a pre-determined portion of the accessed data;

generating, by the client, a candidate token;

querying, by the client, a central token management system communicatively coupled to the client to determine if the generated candidate token causes a collision within the distributed network, the central token management system configured to query one or more other clients communicatively coupled to the central token management system to determine if the queried clients include a token that causes a collision with the candidate token; and

responsive to a determination that the generated candidate token does not cause a collision, replacing, by the client, the pre-determined portion of the accessed data with the candidate token to form tokenized data and storing the candidate token in the locally stored token table.

2. The method of claim 1, further comprising:

responsive to a determination that the generated candidate token causes a collision;

generating a second candidate token;

querying the central token management system to determine if the second candidate token causes a collision within the distributed network; and

responsive to a determination that the second candidate token does not cause a collision within the distributed network, replacing the pre-determined portion of the accessed data with the second candidate token to form tokenized data and storing the second candidate token in the locally stored token table.

3. The method of claim 1, wherein storing the candidate token in the locally stored token table comprises storing the value of the pre-determined portion of the accessed data as an input value within the locally stored token table and storing the candidate token as an output value within the locally stored token table mapped to the value of the pre-determined portion of the accessed data.

4. The method of claim 1, wherein querying a client to determine if the queried client includes a token that causes a collision with the candidate token comprises querying a token table stored by the queried client with the candidate token to determine if the token table stored by the queried client includes the candidate token.

5. The method of claim 1, wherein the central token management system is configured to store tokens generated by each client communicatively coupled to the central token management system, and wherein determining if the queried clients include a token that causes a collision with the candidate token comprises determining if a token stored by the central token management system is equivalent to the candidate token.

6. The method of claim 1, further comprising, responsive to a determination that the generated candidate token does not cause a collision, providing the candidate token to the central token management system for storage.

7. The method of claim 1, wherein the pre-determined portion of the accessed data comprises a data length equivalent to a data length of input values of the locally stored token table.

8. A non-transitory computer-readable medium storing executable computer instructions for tokenizing data in a distributed network, the instructions configured to:

access, by a client, data to be tokenized;

responsive to a determination that a locally stored token table does not include a token mapped to a value of a pre-determined portion of the accessed data;

generate, by the client, a candidate token;

query, by the client, a central token management system communicatively coupled to the client to determine if the generated candidate token causes a collision within the distributed network, the central token management system configured to query one or more other clients communicatively coupled to the central token management system to determine if the queried clients include a token that causes a collision with the candidate token; and

responsive to a determination that the generated candidate token does not cause a collision, replace, by the client, the pre-determined portion of the accessed data with the candidate token to form tokenized data and store the candidate token in the locally stored token table.

9. The non-transitory computer-readable medium of claim 8, further comprising instructions that when executed by the processor cause the processor to:

responsive to a determination that the generated candidate token causes a collision;

generate a second candidate token;

query the central token management system to determine if the second candidate token causes a collision within the distributed network; and

responsive to a determination that the second candidate token does not cause a collision within the distributed network, replacing the pre-determined portion of the accessed data with the second candidate token to form tokenized data and storing the second candidate token in the locally stored token table.

10. The non-transitory computer-readable medium of claim 8, wherein storing the candidate token in the locally stored token table comprises storing the value of the pre-determined portion of the accessed data as an input value within the locally stored token table and storing the candidate token as an output value within the locally stored token table mapped to the value of the pre-determined portion of the accessed data.

11. The non-transitory computer-readable medium of claim 8, wherein querying a client to determine if the queried client includes a token that causes a collision with the candidate token comprises querying a token table stored by the queried client with the candidate token to determine if the token table stored by the queried client includes the candidate token.

12. The non-transitory computer-readable medium of claim 8, wherein the central token management system is configured to store tokens generated by each client communicatively coupled to the central token management system, and wherein determining if the queried clients include a token that causes a collision with the candidate token comprises determining if a token stored by the central token management system is equivalent to the candidate token.

13. The non-transitory computer-readable medium of claim 8, further comprising instructions that when executed by the processor cause the processor to responsive to a determination that the generated candidate token does not cause a collision, providing the candidate token to the central token management system for storage.

14. The non-transitory computer-readable medium of claim 8, wherein the pre-determined portion of the accessed data comprises a data length equivalent to a data length of input values of the locally stored token table.

15. A client system for tokenizing data in a distributed network, comprising:

a hardware processor; and

a non-transitory computer readable medium storing computer instructions configured to;

access, by the client system, data to be tokenized;

responsive to a determination that a locally stored token table does not include a token mapped to a value of a pre-determined portion of the accessed data;

generate, by the client system, a candidate token;

query, by the client system, a central token management system communicatively coupled to the client to determine if the generated candidate token causes a collision within the distributed network, the central token management system configured to query one or more other clients communicatively coupled to the central token management system to determine if the queried clients include a token that causes a collision with the candidate token; and

responsive to a determination that the generated candidate token does not cause a collision, replace, by the client system, the pre-determined portion of the accessed data with the candidate token to form tokenized data and store the candidate token in the locally stored token table.

16. The system of claim 15, wherein the non-transitory computer readable medium further stores executable computer instructions configured to:

responsive to a determination that the generated candidate token causes a collision;

generate a second candidate token;

query the central token management system to determine if the second candidate token causes a collision within the distributed network; and

responsive to a determination that the second candidate token does not cause a collision within the distributed network, replacing the pre-determined portion of the accessed data with the second candidate token to form tokenized data and storing the second candidate token in the locally stored token table.

17. The system of claim 15, wherein storing the candidate token in the locally stored token table comprises storing the value of the pre-determined portion of the accessed data as an input value within the locally stored token table and storing the candidate token as an output value within the locally stored token table mapped to the value of the pre-determined portion of the accessed data.

18. The system of claim 15, wherein querying a client to determine if the queried client includes a token that causes a collision with the candidate token comprises querying a token table stored by the queried client with the candidate token to determine if the token table stored by the queried client includes the candidate token.

19. The system of claim 15, wherein the central token management system is configured to store tokens generated by each client communicatively coupled to the central token management system, and wherein determining if the queried clients include a token that causes a collision with the candidate token comprises determining if a token stored by the central token management system is equivalent to the candidate token.

20. The system of claim 15, wherein the non-transitory computer readable medium further stores executable computer instructions configured to responsive to a determination that the generated candidate token does not cause a collision, providing the candidate token to the central token management system for storage.