Authors:
Sandra Díaz-Santiago
;
Lil Maria Rodriguez-Henriquez
and
Debrup Chakraborty
Affiliation:
CINVESTAV-IPN, Mexico
Keyword(s):
Payment Card Industry Standard, Tokenization, Symmetric Encryption, Format Preserving Encryption, Provable Security.
Related
Ontology
Subjects/Areas/Topics:
Applied Cryptography
;
Cryptographic Techniques and Key Management
;
Data and Application Security and Privacy
;
Data Engineering
;
Data Protection
;
Databases and Data Security
;
Information and Systems Security
;
Security Protocols
Abstract:
Payments through cards have become very popular in today’s world. All businesses now have options to receive payments through this instrument, moreover most organizations store card information of its customers in some way to enable easy payments in future. Credit card data is a very sensitive information and its theft is a serious threat to any company. Any organization that stores such data needs to achieve payment card industry (PCI) compliance, which is an intricate process. Recently a new paradigm called “tokenization” has been proposed to solve the problem of storage of payment card information. In this paradigm instead of the real credit card data a token is stored. To our knowledge, a formal cryptographic study of this new paradigm has not yet been done. In this paper we formally define the syntax of a tokenization system, and several notions of security for such systems. Finally, we provide some constructions of tokenizers and analyze their security in the light of our defin
itions.
(More)