User's Guide: Tokenization

Introduction

The Fortanix DSM tokenization feature eliminates the link to sensitive data and is used in credit card processing and other use cases to reduce or eliminate breaches. This is a highly secure method of protecting payment credentials which include substituting sensitive data such as credit card/ account numbers with a one-time number known as a token that has no relationship to a person or their account. The 16-digit account number is replaced with a randomly generated alphanumeric ID.

Tokenizer Data Types

A security object token can belong to any of the following categories:

• Custom
• General
• Identification Numbers (USA)
• Military Service Numbers 

Depending on the type of data the users want to protect, they can create security objects belonging to any of the four tokenizer data type groups.

Tokenization replaces a customer’s data type (for example, credit card number, SSN, IMSI, custom, and so on) token with a randomly generated code, or token, obfuscating the original data.

General

When you select General, Fortanix DSM provides the following data types:

• Credit card
• IMSI
• IMEI
• IP address (v4)
• Phone number (USA)
• Fax number (USA)
• Email address

Credit Card Tokenization

A typical credit card number comes with a Personal Account Number (PAN) which can be tokenized. When a merchant swipes a customer’s credit card, the PAN is automatically replaced with a format-preserving numeric ID (“token”). The minimum supported length is 13 and the maximum supported length is 19.

A Fortanix DSM user can choose to tokenize certain digits of a credit card number using a pattern. There are 4 types of tokenization patterns that can be applied:

• Fully tokenize the credit card number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the last four digits of the credit card number – token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the last four digits since these digits of the credit card number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the first six digits of the credit card number – 6 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits since those digits of the credit card number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the first six digits and last four digits of the credit card number – 6 digits + token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits and the last four digits, as those digits of the credit card number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

IMSI Tokenization

The IMSI is a 15-digit number that uniquely identifies every user of a cellular network. For IMSI, the minimum supported length is 14 and the maximum supported length is 15. It is stored as a 64-bit field and is sent by the mobile device to the network.

The phone identifies the subscriber by transmitting the IMSI number. To prevent eavesdroppers from identifying and tracking the subscriber on the radio interface using the IMSI number, a Fortanix DSM user can tokenize the IMSI number so that it is automatically replaced with a format-preserving numeric ID (“token”).

A Fortanix DSM user can choose to tokenize certain digits of an IMSI number using a pattern. There are 4 types of tokenization patterns that can be applied:

• Fully tokenize the IMSI number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the last four digits of the IMSI number – token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the last four since these digits of the IMSI number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the 1^st six digits of the IMSI number – 6 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits since these digits of the IMSI number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the first six digits and last four digits of the IMSI number – 6 digits + token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits and the last four digits since these digits of the IMSI number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

IMEI

The International Mobile Equipment Identity (IMEI) is a 15-digit number that uniquely identifies every mobile phone of a cellular network.

A Fortanix DSM user can choose to tokenize certain digits of an IMEI number using a pattern. There are 4 types of tokenization patterns that can be applied:

• Fully tokenize the IMEI number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first six digits of the IMSI number – first 6 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the 1^st six digits since these digits of the IMEI number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last four digits of the IMEI number – token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the last four since these digits of the IMEI number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the first six digits and the last four digits of the IMEI number – first 6 digits + token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six and last four since these digits of the IMEI number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

IP Address (v4)

An Internet Protocol Version 4 (IPv4) address is a numerical label that is used to identify a network interface of a computer or a network node participating in an IPv4 computer network and for locating the computer or the network node in the network. An IPv4 address consists of 32 bits divided into four 8-bit blocks.

A Fortanix DSM user can choose to tokenize certain digits of an IPv4 address using a pattern. There are 4 types of tokenization patterns that can be applied:

• Fully tokenize the IP address – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last three digits of the IPv4 address – token + 3 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the last three digits since those digits of the IPv4 address are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first six digits of the IPv4 address – 6 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits since these digits of the IPv4 address are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first six digits and last three digits of the IPv4 address – 6 digits + token + 3 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits and the last three digits since these digits of the IPv4 address are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

Phone Number (USA)

The standard American telephone number is ten digits, such as (555) 555-1234. The first three digits are the "area code," followed by a seven-digit phone number.

A Fortanix DSM user can choose to tokenize certain digits of a phone number using a pattern. There are 3 types of tokenization patterns that can be applied:

• Fully tokenize the phone number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last four digits of the phone number – token + 4 digits. For example:
  
  
  
  
  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the last four since these digits of the phone number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.
  
  
  
  

• Tokenize all but the first six digits of the phone number – 6 digits + token. For example:
  
  
  
  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits since these digits of the phone number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.
  
  
  
  

Fax Number (USA)

A USA fax number is just a phone number that has a fax machine (or fax service, fax server, computer with fax software, and so on) connected to it.

A Fortanix DSM user can choose to tokenize certain digits of a fax number using a pattern. There are 3 types of tokenization patterns that can be applied:

• Fully tokenize the fax number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last four digits of the fax number – token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the last four since these digits of the fax number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first six digits of the fax number – 6 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first six digits since these digits of the fax number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

Email Address

The following is the structure of an email address:

A typical email address consists of a ‘username’ and ‘domain’ name. The following is the typical format of an email:

local-part@domain

A Fortanix DSM user can choose to tokenize certain digits of an email address using a pattern. There are 3 types of tokenization patterns that can be applied:

• Fully tokenize the email address – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize the first character of the email address – first character + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the first character of the email address since it is set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.
  
  
  
  

• Tokenize all but the local part of the email address – local part + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the local part since these digits of the email address are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the domain part of the email address – token + domain. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the domain part since these digits of the email address are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

Date

The following Date formats are supported:

• MM/DD/YYYY
• DD/MM/YYYY

The default date format is MM/DD/YYYY with a full token. The input token allows the following delimiters:

• slash (/)
• dot (.)
• hyphen (-)
• space ( )

A Fortanix DSM user can choose to tokenize certain digits of a date using a pattern. There are 3 types of tokenization patterns that can be applied:

• Fully tokenize the date in both date formats (MM DD YYYY) and (DD MM YYYY) – full token. For example:
  
  
  
  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the date token’s identity.
  
  
  
  
• Tokenize the year YYYY in the input date token – mm dd + token or dd mm + token. For example:
  
  
  
  With this pattern, a Fortanix DSM user can choose to mask only the year part of the input date token (YYYY) but not the month (MM) and day (DD) in the token since it is set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.
  
  
  
  
• Tokenize the month (MM) and the day (DD) – token + yyyy. For example:
  
  
  
  With this pattern, a Fortanix DSM user can choose to mask only the month and day part of the input date token (MM and DD) but not the year (YYYY) in the token since it is set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.
  
  
  
  Fortanix DSM also allows you to enter a date range as an input token that should be in MM DD YYYY format where all the dates from the starting date to the ending date will be tokenized. For example:
  If the starting date is 02-20-2021 and the ending date is 10-27-2021, then we can tokenize all the dates from 02-20-2021 to 10-27-2021.
  To specify a date range,
  
  1. Click Add Date Range link in the "Date" section.
     
     
     
     
  2. Enter the starting date and the ending date in MM DD YYYY format.
     
     
     
     All the dates in the above date range will be tokenized.

Identification Numbers (USA)

When you select Identification numbers (USA), Fortanix DSM provides the following data types:

• SSN
• Passport Number (USA)
• Driver’s license
• Individual Taxpayer Identification Number (USA)
• Employer Identification Number (USA)

SSN Tokenization

This method of tokenization converts sensitive data, such as a Social Security Number, into a random string of characters (called a token) that has no meaningful value if breached. A typical Social Security number consists of 9 digits. A token representing an SSN may need to retain the real last 4 digits. This enables representatives to verify user identities without access to the rest of the SSN.

A Fortanix DSM user can choose to tokenize an SSN using the following two patterns.

• Fully tokenize the SSN – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the last four digits of the SSN – token + 4 digits. For example:
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except for the last four digits since these digits of the SSN are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

Passport Number (USA)

A US Passport number consists of six and nine alphanumeric characters (letters and numbers).

A Fortanix DSM user can choose to tokenize a passport number using the below patterns.

• Fully tokenize the passport number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last 4 digits of the passport number– token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except the last four digits since these digits of the passport number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first 4 digits of the passport number – first 4 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except the first four digits since these digits of the passport number are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

Driver's License Number

A Driver’s License Number is a nine-digit number used as a tracking number by the U.S. It supports a minimum 2 characters. Any letter must be in upper case.

You can fully tokenize the Driver’s license number. For example:

Individual Taxpayer Identification Number (USA)

A Tax Identification Number (TIN) is a nine-digit number used as a tracking number by the U.S. Internal Revenue Service (IRS) and is required information on all tax returns filed with the IRS.

A Fortanix DSM user can choose to tokenize a TIN using the below two patterns.

• Fully tokenize the TIN – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last four digits of the TIN – token + 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can choose to mask the complete token except the last four digits since these digits of the TIN are set to be visible by the user. Masking can be applied using the Add masking pattern option in the UI. The masking pattern replaces the selected digits of the token with asterisks (*), further securing the token’s identity.

  
  
  

Employer Identification Number (USA)

Employer Identification Number (EIN) is a unique 9-digit number. It is used by Internal Revenue Service (IRS) to report employment taxes.

A Fortanix DSM user can choose to tokenize an EIN using the below patterns.

• Fully tokenize EIN – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first 2 digits of EIN – first 2 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the first 2 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last 4 digits of EIN – token + last four digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the last 4 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

Military Service Numbers (USA)

When you select ‘Military Service Number’, Fortanix DSM provides the following data types:

• Army and Air Force Service Number (USA)
• Navy Service Number (USA)
• Coast Guard Service Number (USA)
• Marine Corps Service Number (USA)
• Military Officers Service Numbers (USA)

Army and Air Force Service Number (USA)

An Army and Air Force Service Number (USA) is an 8-digit number assigned to the US Army and Air Force personnel.

A Fortanix DSM user can choose to tokenize an Army and Air Force Service Number (USA) using the below patterns.

• Fully tokenize Army and Air Force Service Number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first 2 digits of Army and Air Force Service Number – first 2 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the first 2 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last 3 digits of Army and Air Force Service Number – token + last 3 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the last 3 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

Navy Service Number (USA)

A Navy Service Number (USA) is a 7-digit number assigned to the US Navy personnel.

A Fortanix DSM user can choose to tokenize a Navy Service Number (USA) using the below patterns.

• Fully tokenize Navy Service Number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first 3 digits of Navy Service Number – first 3 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the first 3 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last 2 digits of Navy Service Number – token + last 2 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the last 2 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

Coast Guard Service Number (USA)

A Coast Guard Service Number (USA) is a 7-digit number assigned to the US Coast Guard personnel.

A Fortanix DSM user can choose to tokenize a Coast Guard Service Number (USA) using the below patterns.

• Fully tokenize Coast Guard Service Number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first 4 digits of Coast Guard Service Number – first 4 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the first 4 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last 3 digits of Coast Guard Service Number – token + last 3 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the last 3 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

Marine Corps Service Number (USA)

A Marine Corps Service Number (USA) is a 6-digit number assigned to the US Marine Corps personnel.

A Fortanix DSM user can choose to tokenize a Marine Corps Service Number (USA) using the below patterns.

• Fully tokenize Marine Corps Service Number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first 4 digits of Marine Corps Service Number – first 4 digits + token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the first 4 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the last 4 digits of Marine Corps Service Number – token + last 4 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the last 4 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

Military Officers Service Numbers (USA)

A Military Officers Service Number (USA) is a 5-digit number assigned to the US Military officers.

A Fortanix DSM user can choose to tokenize a Marine Corps Service Number (USA) using the below patterns.

• Fully tokenize Military Officers Service Number – full token. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  

• Tokenize all but the first 3 digits of Military Officers Service Number – first 3 digits + token. For example:

  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the first 4 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  
  
  
• Tokenize all but the last 3 digits of Military Corps Service Number – token + last 3 digits. For example:
  
  
  
  

  With this pattern, a Fortanix DSM user can also choose to mask the complete token except the last 3 digits using the Add masking pattern option in the UI. The masking pattern replaces the complete token with asterisks (*), further securing the token’s identity.

  

Custom

A Fortanix DSM user can use this method of tokenization to protect any kind of data other than the available categories. You can choose to tokenize any combination of any characters in the data.

This data type must have a minimum size of 6 which can be any of the following types:

• Numbers
• Hexadecimal
• Alphanumeric
• Characters

• Number: If you want the data type as ‘number, then use this option to create a custom token containing only numbers.
  
  
  
  
  • If you want the token input to be within a minimum and maximum value range, then type the minimum and maximum values in the Minimum value and Maximum value fields, respectively. For example, if you type the minimum value as 10 and the maximum value as 100, then, the input value(tokenization value) should be in the range of 10 to 100.
  • Special characters are printable ASCII characters that are not letters or numbers. If you want to use special characters in the customized token, select the Allow special characters check box. Selecting this will disable the Minimum value and Maximum value fields since the special characters in a custom token cannot be attributed to minimum or maximum values.
  • A LUHN check is a mathematical formula used to verify various identification numbers. If you want to perform LUHN check on the characters, select the Perform LUHN check option. 
• Hexadecimal: If you want the data type as ‘hexadecimal’, then use this option to create a custom token containing hexadecimal values.
  • A hexadecimal token can be only Lowercase, only Uppercase, or a combination of Lowercase and uppercase letters.
  
  
  
• Alphanumeric: If you want the data type as ‘alphanumeric’, then use this option to create a custom token containing alphanumeric values.
  • An alphanumeric token can be only Lowercase, only Uppercase, or a combination of Lowercase and uppercase letters.
  • Select the Allow special characters check box if you want to use special characters.
  
  
  
• Characters: If your data is of type ‘Characters’, then use this option to create a custom token containing customized character values.
  • A Character token can be only Lowercase, only Uppercase, or a combination of Lowercase and uppercase letters.
  • Select the Allow special characters check box if you want to use special characters.
  
  
  

A Fortanix DSM user can choose to either tokenize the entire input string (token) or preserve some characters in that string. For example, in the figure below, the 2nd and 4th characters are preserved and will not be tokenized.

A Fortanix DSM user can also choose to mask the complete token with asterisks (*), further securing the token’s identity. Masking can be applied to any combination of digits using the Masking pattern option in the UI. You can click on the characters that you want to mask. The remaining character values will be retained. For example, the following is an example of masking patterns for the custom token where the first three digits are masked by clicking them. If you want to mask all the characters, click on the first character, and drag the mouse to the right till you reach the last digit.

Create Your Own Token

You can also customize all the characters using the Create your own token option in the UI. This option is used when you want to create a token consisting of different parts, where each part can be of type number/Alphanumeric/Characters/Hexadecimal with delimiters.

• Using this feature, you can create a token that consists of maximum five parts.
• Each part can have a maximum of 10 characters.
• Each part can start with a suffix or end with a prefix.
• For the suffix/prefix you can select any of the five available delimiters values provided in the UI or create your own custom delimiter using the add button.
  
  
  
  

To create your own custom token:

1. Click Create your own token
2. To create the first part, select the data type for the token – Numbers/Alphanumeric/Characters/Hexadecimal.
3. Enter the length of the first part.
4. Optionally add a suffix or a prefix or both for the first part.
5. To add a prefix, select from the available prefix values or create your own prefix.
6. To add a suffix, select from the available suffix values or create your own suffix/delimiter.
7. You will now see the token generated based on your selection in the Token pattern panel.
8. Click ADD NEXT PART.
9. Repeat steps 2-6 to create the remaining parts and complete creating your own custom token.

Example:

Let us look at a simple example to understand how the custom tokenization works.

In this example, we will tokenize an Indian driving license.

The following are the conditions for a valid driver’s license:

• It must consist of 16 characters, including space or hyphen.
• The format should be HR-0619850034761.
  Where,
  
  • The first 2 characters represent the state code. They must be upper case letters.
  • The next 2 characters represent the RTO code and must be digits.
  • The next 4 characters represent the license issued year and must be digits.
  • The last 7 characters must consist of digits from 0 to 9.

The following is an example of tokenizing an Indian driver’s license satisfying the above conditions:

1. In the example, the first 2 characters (state code) are alphabets, so select the Alphanumeric option.
2. In the Enter length field, type 2 as the length of the first part and select the Uppercase radio button since the characters are uppercase.
   
   
   
   
3. Now, let us add a suffix/delimiter by clicking ‘-‘ (Hyphen).
   
   
   
   
4. Now, click ADD NEXT PART to configure the second part. Select the Numbers option since the second part consists of characters that are digits.
5. In the Enter length field, type 2 as the length of the second part (RTO code).
   
   
   
   
6. Now, click ADD NEXT PART to configure the third part. Select the Numbers option since the third part consists of characters that are digits.
7. In the Enter length field, type 4 as the length of the third part (License issued year).
   
   
   
   
8. Now, click ADD NEXT PART to configure the fourth and the last part. Select the Numbers option since the last part consists of characters that are digits.
9. In the Enter length field, type 7 as the length of the last part (any digit from 0-7).
   
   
   
   The final tokenized driver’s license will look like this:
   
   
   
   

Create a Tokenizer Security Object

To create a tokenizer security object, follow the steps below:

1. Log in to your Fortanix DSM account using the URL: https://sdkms.fortanix.com.
2. On the Fortanix DSM UI left panel, click the Security Objects tab, and then click the CREATE SECURITY OBJECT button ('+' sign) in the Security Objects page.
    
   Figure 1: Create a Tokenizer Security Object
3. In the Add New Security Object page, enter a name for your new security object, and then select the GENERATE option, to generate a security object.
4. Select the GENERATE option, to generate a security object.
    
   Figure 2: Generate Tokenizer Object
5. Select the type of security object as Tokenization.
6. In the Data type list, select the tokenization type for the tokenizer security object. There are four categories of data types to select from, namely:
   • General
   • Identification Numbers (USA)
   • Military Service Numbers (USA)
   • Custom
   Refer to the previous section for more details about these data types.
   
   Figure 3: Select Security Object Type
7. If you want to mask your token, then select Add masking pattern. 
8. Move the slider below the token to choose a masking pattern.
9. Enter a key size for the security object. The allowed values are 128 bits, 192 bits, and 256 bits.
10. Select the permitted key operations on this security object. The key operations that are permitted for a Tokenization key are:
    • Tokenize (encrypt)
    • Detokenize (decrypt)
    • App Manageable
    • Export
    
    
    Figure 4: Select Key Operations
11. Lastly, click GENERATE to generate a tokenizer security object.
12. The new tokenizer security object is created.
    
    Figure 5: Tokenizer Security Object Created

Tokenization Operations Using API

Once the tokenization object is created, it can be used to tokenize and de-tokenize data. For the examples shown in this section the following tokenization object will be used:

Figure 6: Create a New Token

Generating a Token

To generate a token from the data given in Figure 6, the following API request should be used:>

POST https://{{server}}/crypto/v1/keys/{{token_key_uuid}}/encrypt

 Request body:

{
 "alg": "AES",
 "mode": "FPE",
 "plain": "MDEyMzQ1Njc4OTEyMzQ1Ng=="
}

 the "plain" field is the base64 encoded value of the data to tokenize. For this example, the base64 encoding of “0123456789123456” was used.

The request-response is:

{
 "kid": "034a9879-8206-4898-bb6e-05e4cb69782d",
 "cipher": "MDEyMzQ1OTEyMDY1MTY4Mg=="
}

 The base64 decoded value of the returned "cipher" is “0123459120651682”. The first 6 digits of the text (credit card number) are identical to the original plain text and the rest of the digits are tokenized.

Obtaining Original Data

To obtain the original data from a given token, the following API request should be used:

POST https://{{server}}/crypto/v1/keys/{{token_key_uuid}}/decrypt

 Request body:

{
 "alg": "AES",
 "mode": "FPE",
 "cipher": "MDEyMzQ1OTEyMDY1MTY4Mg=="
}

The "cipher" field is the base64 encoded value of the token. For this example, the cipher received from the previous version was used.

The request-response is:

{
 "kid": "034a9879-8206-4898-bb6e-05e4cb69782d",
 "plain": "MDEyMzQ1Njc4OTEyMzQ1Ng=="
}

 The "plain" field is the base64 encoded value of the original data. The result of decoding the "plain" field is “0123456789123456”, the original data provided.