Downloaded 14 times
Uploaded byPriyanka Aash
Cybersecurity vsTokenization
The document discusses the fundamentals and implementation issues related to tokenization in cybersecurity, emphasizing the process of replacing sensitive data with surrogate values called tokens. It outlines various definitions of tokenization, types of tokens, and the distinctions between payment and non-payment tokens, along with challenges in detokenization, system isolation, and cryptographic methods. Key conclusions highlight the importance of defining a tokenization strategy and incorporating it into broader cybersecurity policies while recognizing that tokenization may not be suitable for all scenarios.
![[CONFidence 2016] Marco Ortisi - Recover a RSA private key from a TLS session...](https://cdn.slidesharecdn.com/ss_thumbnails/marcoortisi-recoverarsaprivatekeyfromatlssessionwithperfectforwardsecrecy-160601113555-thumbnail.jpg?width=640&height=640&fit=bounds)
Cybersecurity vsTokenization
- 1.
- 2.
- 3.
- 4.
- 5.
- 6. #RSAC When Can It Be Used? 6 • For example: primary account number (PAN) • Token 1: middle 6 digits, note check digit •Token 2: whole PAN, ignore check digit • Any 16-digits might be a legitimate PAN somewhere • Same issues for SSN or other things PAN 4 80801 000000 000 5 Token 1 4 80801 123456 000 4 Token 2 9 21456 332157 278 3 Backwards compatibility Separate channel Issues • Format • Length • Syntax Check digit
- 7.
- 8.
- 9.
- 10.
- 11.
- 12. #RSAC EMV Payment Tokenization 12 4400 1111 1111 1113 Alice Smith TSP Issuer Wallet PAN EMV EMV PAN Merchant EMV Post-auth tokens are non-payment tokens EMV tokens can only be used for authorization Step 1: Issuer issues card to cardholder Brick & Mortar Merchant EMV Chip Card Step 3: Cardholder shops online AMEX VisaMasterCard Discover Acquirer PAN Û EMV Step 2: Cardholder gets EMV token EMV EMV PAN EMV PAN Authorization to Issuer is EMV or PAN
- 13. #RSAC Non-Payment Tokenization 13 Tokenization Requesting Interface (TRI) Tokenization Service (TS) USV Token Tokenization System • Encryption • MAC •Random • Table Requesting Entity RE RE USV Û Token Token ¹ EMV Post Authorization (Payment Related) Applications Non-Payment Applications Storage • Tokenization • Detokenization
- 14.
- 15.
- 16.
- 17. #RSAC Tokenization Environments: Multiple 17 Issues Multi-tokenization systems interoperability Multi-tokenization systems migration Multi-tokenization systems backup and recovery TRI TS USV ÛToken RE RE TRITSUSV Û Token RE RE Tokenization System A Tokenization System B
- 18.
- 19.
- 20.
- 21.
- 22.
- 23. #RSAC Cryptography: Random Method 23 Random USV Token Tokenization Detokenization USV Û Token Tokenization Service RNGHSM Random is difficult to achieve Quantum mechanics Available quantum randomness products
- 24.
- 25.
- 26.
- 27.
- 28.