What is Tokenization and How Does it Improve Online Data Security?

Image courtesy Medici

Let’s start with an example.

You want to make an online purchase with your MasterCard. Obviously, you’d like the transaction to be as secure as possible; to prevent criminals from accessing your credit card data as it is submitted to the vendor.

There are two common security methods to protect data — encryption and tokenization.

Encryption, by far the most widely used method, uses an algorithm to translate plaintext data into a secret code, called ciphertext. The person or vendor on the receiving end of the data must have access to a key or password in order to decrypt the ciphertext back into plaintext. VPN connections and WhatsApp messaging are two primary examples of end-to-end encryption in use.

Tokenization, meanwhile, secures sensitive data by replacing it with a randomly generated set of numbers, letters, and special characters called a token. This token is the non-sensitive equivalent of original data is it meant to protect. The sensitive data is stored in a token service provider’s highly secure centralized vault. When the data arrives at the vault, a token is generated and passed on to the recipient. The recipient never sees the original data, and the token has no extrinsic or exploitable meaning or value. They can also only use it for the specific purpose for which it was intended — to carry out your online purchase, for example.

The advantages of tokenization are plentiful. Because the token has no mathematical relationship to original data, it is impossible to reverse-engineer it. In the case of encryption, hackers could crack the mathematical algorithm and decrypt the ciphertext back to its sensitive plaintext. That is to say, they could unscramble your credit card information if they access the decrypted data. Imagine if all your most sensitive information could be unlocked by solving a Rubik’s cube.

If someone hacks a server with tokenized assets (credit card numbers, passport details, contracts), the information would have no value because it is completely independent of the sensitive data, which is shielded from transactional activity in the vault. Your tokens could be leaked to the front page reddit and criminals would have no idea what to do with them. It’s like a Rubik’s cube with no solution.

While the majority of tokenization as it pertains to data security concerns credit card payments, we’re also starting to see the tokenization of “real world” assets like stocks, real estate, ETFs and gold, aided by blockchain technology and smart contracts. A token can also represent many other crypto assets, including coin-traded funds, the market for which is still in its infancy but offers an enticing investment opportunity.

Tokenizing transactions on the blockchain — from order through to proof of assets — offers the most secure method of data protection and asset security in the digital economies of the present and future. Further benefits include cheaper transaction costs, less complex financial systems, and fully transparent agreements between customers, brokers, and vendors.