Patent ID: 8452965

Claim:
A computer-implemented method of protecting a datum within a set of sensitive data, the datum including a first set of bits satisfying a first set of constraints, the set of sensitive data received at a computer from an authorized client, the computer-implemented method comprising: producing, by the computer upon receipt of a tokenization request, a token corresponding to the datum, the token including a second set of bits distinct from the first set of bits, the second set of bits satisfying a second set of constraints, the second set of constraints being a superset of the first set of constraints; storing, by the computer in a database entry on a database, the datum and the corresponding token, the database entry having an address within the database; and sending, by the computer, the token to the authorized client, the authorized client enabled to perform, using the second set of bits, a verification that the token satisfies the second set of constraints, the verification being performed apart from the database; wherein producing the token includes: forming a set of codeword bits; allocating bits from the set of codeword bits for a set of index bits and a set of message authentication code (MAC) bits; mapping at least a subset of the set of index bits to a pointer to the address belonging to the database entry; applying a keyed hash function to the set of index bits, a value of the keyed hash function specified by a cryptographic key and a set of index bits; and setting values of the bits in the set of MAC bits according to the value of the keyed hash function; and wherein allocating bits from the set of codeword bits includes: subdividing the set of codeword bits into a set of index bits and a set of MAC bits according to a set of control bits; and wherein the set of control bits varies according to values of the bits in the first set of bits; wherein the first set of constraints includes a requirement that bits of the first set of bits satisfies a first mathematical relationship; and wherein the second set of constraints includes a requirement that bits of the second set of bits satisfies the first mathematical relationship and a second mathematical relationship.