Multiple Table Tokenization

• US 20130103685A1
• Filed: 08/27/2012
• Published: 04/25/2013
• Est. Priority Date: 09/01/2011
• Status: Abandoned Application

• Current Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Original Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Inventors: Mattsson, Ulf, Preneel, Bart Karel Benedikt
• Application Number:
  US13/595,438
• Publication Number:
  US 20130103685A1
• Time in Patent Office: Days
• US Class Current: 707/736
• CPC Class Codes: G06F 16/2282 Tablespace storage structures; Management thereof
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0625 with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

Data is tokenized using multiple token tables. An initialization vector is generated based on a first data portion and a first set of token tables. The initialization vector can be generated by querying a first token table with the first data portion. A second data portion is tokenized based on the initialization vector and a second set of token tables. The second data portion can be modified with the initialization vector, and a second token table can be queried with the modified second data portion to form a tokenized second data portion. The first set and second set of token tables can be generated based on a received tokenization key, or can be previously generated. The first portion of the input data and the tokenized second data portion of the input data can be concatenated to form tokenized data.

Claims

1. A computer implemented method of tokenizing data, the method comprising:

receiving a tokenization request, the tokenization request comprising input data, a tokenization key, and a requested tokenization scheme, the input data comprising a first input data portion and a second input data portion, the requested tokenization scheme identifying a token table generation method, an initialization vector generation method, and a tokenization method;

generating a first set of token tables and a second set of token tables based on the tokenization key and the token table generation method;

generating one or more initialization vectors based on the first input data portion, the first set of token tables, and the initialization vector generation method;

tokenizing the second input data portion based on the one or more initialization vectors, the second set of token tables, and the identified tokenization method to produce a first tokenized data portion;

concatenating the first input data portion and the first tokenized data portion to produce a tokenized data output; and

storing the tokenized data output in a non-transitory computer readable storage medium.

2. The method of claim 1, wherein the identified token table generation method comprises a token table input size and a token table output size.

3. The method of claim 1, wherein the identified token table generation method comprises the Knuth shuffle algorithm with inputs generated using AES seeded with the tokenization key.

4. The method of claim 1, wherein the initialization vector generation method comprises:

querying a first token table with a first input data portion to produce a first token table output;

iteratively querying successive token tables with token table outputs from previous token tables to produce successive token table outputs for a pre-determined number of iterations; and

outputting the successive token table output from the last iterated token table as an initialization vector.

5. The method of claim 1, wherein the identified initialization vector generation method comprises:

generating a first portion of an initialization vector based on querying a first token table with a first portion of the input data portion and querying a second token table with a second portion of the input data portion;

generating a second portion of an initialization vector based on querying a third token table with the first portion of the input data portion and querying a fourth token table with the second portion of the input data portion; and

concatenating the first portion of the initialization vector and the second portion of the initialization vector to produce the initialization vector.

6. The method of claim 1, wherein the identified tokenization method comprises:

tokenizing a sum of a first portion of an initialization vector and an input data portion using a first token table to produce a partial tokenized output; and

adding a second portion of the initialization vector to the partial tokenized output to produce a tokenized output.

7. The method of claim 1, wherein the identified tokenization method comprises:

tokenizing a sum of a first portion of an initialization vector and an input data portion using a first token table to produce a first partial tokenized output;

tokenizing a sum of a second portion of the initialization vector and the first partial tokenized output using a second token table to produce a second partial tokenized output;

tokenizing a sum of the first portion of the initialization vector, the second portion of the initialization vector, and the second partial tokenized output using a third token table to produce a third partial tokenized output;

tokenizing a sum of the second portion of the initialization vector and the third partial tokenized output with a fourth token table to produce a fourth partial tokenized output; and

adding the first portion of the initialization vector and the fourth partial tokenized output to produce a tokenized output.

8. A computer implemented method of tokenizing data, the method comprising:

accessing input data to be tokenized, the input data comprising a first portion and a second portion;

generating an initialization vector based on the first input data portion and a first set of token tables;

tokenizing the second input data portion based on the initialization vector and a second set of token tables;

concatenating the first input data portion and the tokenized second input data portion to generate a tokenized data output; and

storing the tokenized data output in a non-transitory computer readable storage medium.

9. The computer implemented method of claim 8, further comprising:

receiving a key for generating token tables; and

generating the first set of token tables and the second set of token tables based on the key.

10. The computer implemented method of claim 9, wherein the sets of token tables are generated using the Knuth shuffle algorithm with inputs generated using AES seeded with the key.

11. The computer implemented method of claim 9, wherein the sets of token tables are stored for subsequent use.

12. The computer implemented method of claim 8, further comprising:

retrieving the first set of token tables and the second set of token tables from storage.

13. The computer implemented method of claim 8, wherein generating an initialization vector comprises:

querying a first token table from the first set of token tables with the first input data portion, wherein the output of the first token table comprises the initialization vector.

14. The computer implemented method of claim 8, wherein tokenizing the second input data portion comprises:

modifying the second input data portion based on the initialization vector to produce a modified second input data portion; and

querying a second token table from the second set of token tables with the modified second input data portion to produce a tokenized second input portion.

15. A non-transitory computer-readable storage medium having executable computer program instructions embodied therein for tokenizing data, the actions of the computer program instructions comprising:

accessing input data to be tokenized, the input data comprising a first portion and a second portion;

generating an initialization vector based on the first input data portion and a first set of token tables;

tokenizing the second input data portion based on the initialization vector and a second set of token tables;

concatenating the first input data portion and the tokenized second input data portion to generate a tokenized data output; and

storing the tokenized data output in a non-transitory computer readable storage medium.

16. The non-transitory computer-readable storage medium of claim 15, the actions of the computer program instructions further comprising:

receiving a key for generating token tables; and

generating the first set of token tables and the second set of token tables based on the key.

17. The non-transitory computer-readable storage medium of claim 16, wherein the sets of token tables are generated using the Knuth shuffle algorithm with inputs generated using AES seeded with the key.

18. The non-transitory computer-readable storage medium of claim 16, wherein the sets of token tables are stored for subsequent use.

19. The non-transitory computer-readable storage medium of claim 15, the actions of the computer program instructions further comprising:

retrieving the first set of token tables and the second set of token tables from storage.

20. The non-transitory computer-readable storage medium of claim 15, wherein generating an initialization vector comprises:

querying a first token table from the first set of token tables with the first input data portion, wherein the output of the first token table comprises the initialization vector.

21. The non-transitory computer-readable storage medium of claim 15, wherein tokenizing the second input data portion comprises:

modifying the second input data portion based on the initialization vector to produce a modified second input data portion; and

querying a second token table from the second set of token tables with the modified second input data portion to produce a tokenized second input portion.