How Tokenization Works

Tokenization is a data security technique where data is replaced by non-sensitive equivalents, called tokens. These tokens can be used in the system without exposing the sensitive data.

Where is Tokenization Used?

This is commonly used in sectors handling sensitive information such as finance, healthcare and e-commerce. It’s widely used in payment processing systems, databases, and applications that handle Personally Identifiable Information (PII).

Why is Tokenization Used?

It reduces the risk of data breaches since tokens are useless if intercepted, some regulations like PCI DSS require this type of security measure to protect the cardholder data, and it limits the amount of sensitive data exposed, thus reducing the potential impact of a data breach.

Security Measures to Prevent Token Spoofing:

• Authentication and Authorization
• Token Validation
• Secure Communication
• Rate Limiting and Throttling
• Token Format and Structure
• Detokenization Controls (Verify the context in which a detokenization request is made)

How is Tokenization Performed?

Example of a Purchase on an E-commerce store:

• Data Input
  • Customer: Enters their credit card number on an e-commerce website to make a purchase.
  • Credit Card Number: 4111-1111-1111-1111
• Token Generation
  • E-Commerce Website: Encrypts and sends the encrypted credit card number to the tokenization service.
    • Encrypted Data: kjsd89f2jhfsd98f (Encrypted credit card number)
  • Tokenization Service: Decrypts the data and generates a unique token.
    • Decrypted Data: 4111-1111-1111-1111
    • Generated Token: TKN-0987-6543-3210
• Secure Data Storage
  • Tokenization Service: Stores the mapping of the token to the original credit card number in a secure database known as a token vault.
    • Token Vault Entry:
      • Token: TKN-0987-6543-3210
      • Original Data: 4111-1111-1111-1111
• Data Usage
  • E-Commerce Database: Stores the token (TKN-0987-6543-3210) instead of the actual credit card number.
  • Tokenization Service: Uses the token vault to retrieve the original data when needed.
• Transaction Processing
  • E-commerce Website: Uses the token to process the payment with the payment gateway.
  • Payment Gateway: Sends the token to the tokenization service to retrieve the original credit card number.
  • Tokenization Service: Looks up the token in the token vault and retrieves the corresponding credit card number.
    • Token Lookup: TKN-0987-6543-3210 → 4111-1111-1111-1111
  • Payment Gateway: Completes the transaction using the retrieved credit card number.
• Data Retrieval (if needed):
  • E-Commerce Website: Sends the token to the tokenization service to retrieve the original data for refunds or other processing.
  • Tokenization Service: Retrieves and decrypts the original data from the token vault and securely transmits it back.