TOKENIZED DATA SECURITY

• US 20110154466A1
• Filed: 12/20/2010
• Published: 06/23/2011
• Est. Priority Date: 12/18/2009
• Status: Active Grant

• Current Assignee: Sabre GLBL Inc. (Sabre Corp.)
• Original Assignee: Sabre Incorporated (Sabre Corp.)
• Inventors: Bomar, Kevin B., Harper, Glenn E.
• Granted Patent: US 8,739,262 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions

Abstract

Provided are devices, methods, systems, computer readable storage media and other means for tokenizing data. In some examples, credit card numbers are tokenized using a pre-generated token map and absent the use of a networked database that stores a relatively large quantity of credit card numbers in a central location. The token map may be generated by a token map generator such that the token map can be used by a tokenizer to replace a portion of an account number with a token, and by a detokenizer to replace the token with the original portion of the account number. A pre-parser and parser may also be used to locate an account number and/or token in a message received over a network.

Claims

1. A method of tokenizing an account number comprising:

receiving at least a portion of the account number;

accessing a token map associated with a version identifier;

retrieving, from the token map, a randomly assigned token value that was pre-associated with the portion of the account number;

converting the token value to a different numeric system;

generating a token by combining the version identifier with the token value; and

transmitting at least the token.

2. The method of claim 1 further comprising:

determining a length of the account number; and

selecting the token map based on the length of the account number.

3. The method of claim 2, wherein the token value'"'"'s length is dependent on the length of the account number.

4. The method of claim 1, wherein the receiving at least the portion of the account number comprises receiving the entire account number and the method further comprising:

extracting a middle digits value from the account number, wherein retrieving the token value comprises using the middle digits value as a linking mechanism.

5. The method of claim 1, wherein:

receiving at least the portion of the account number comprises receiving a binary representation of a base10 number; and

converting the token value to the different numeric system comprises converting the token to a base36 numeric system.

6. The method of claim 1, wherein:

receiving at least the portion of the account number is from a source device; and

transmitting at least the token is to the source device.

7. The method of claim 1, wherein:

receiving at least the portion of the account number is from a source device; and

transmitting at least the token to a device that is different than the source device.

8. The method of claim 1, wherein accessing the token map comprises decrypting the token map.

9. The method of claim 1 further comprising storing the entire token map on a server'"'"'s random access memory.

10. The method of claim 1, wherein generating the token comprises generating the token to have a length that is the same as the entire account number.

11. A system comprising:

a storage device configured to store a token map pre-associating a token value with a partial account number; and

a processor configured to generate a token for an account number associated with the partial account number by retrieving the token value from the token map.

12. The system of claim 11, wherein the storage device is random access memory of a server.

13. The system of claim 11, wherein the processor is further configured to generate the token map by randomly associating token values with array location values.

14. The system of claim 11, wherein the processor is further configured to parse the account number and extract the partial account number, wherein the partial account number is a string of middle digits.

15. The system of claim 11, wherein the processor is further configured to receive a tokenized account number and extract a second token using the token map.

16. A method of detokenizing a token comprising:

receiving at least a portion of a tokenized account number;

parsing a token from the tokenized account number;

parsing a version identifier from the token;

accessing a token map associated with the version identifier;

retrieving, from the token map, a portion of a detokenized account number; and

transmitting at least the portion of the detokenized account number.

17. The method of claim 16 further comprising converting the token from a base36 numerical scheme to a base10 numerical scheme before retrieving the portion of the detokenized account number.

18. The method of claim 16 further comprising constructing the detokenized account number by inserting the portion of the detokenized account number between two sets of digits included in the tokenized account number.

19. A method of transmitting an account number, comprising transmitting a string of characters comprising between ten and nineteen numeric digits that represent the account number, wherein at least six of the numeric digits are tokenized characters and at least four of the numeric digits are untokenized characters.

20. The method of claim 19, wherein the tokenized characters are represented alphanumerically and the untokenized characters are represented numerically with a base10 numerical scheme.