Token-based data security systems and methods with embeddable markers in unstructured data

A tokenization system, comprising:

• a processor;
• a non-transitory computer-readable medium;
• and
• stored instructions translatable by the processor for:
• receiving, from a first client computing system, a request for data anonymization, the request referencing unstructured or semi-structured content that contains values of interest for the data anonymization;
• performing a tokenization operation on the unstructured or semi-structured content, the tokenization operation comprising generating a self-describing token for replacing a value of interest in the unstructured or semi-structured content, the self-describing token having a preconfigured pattern, an indication of a protection strategy, and a token value, the tokenization operation producing an anonymized version of the unstructured or semi-structured content with self-describing tokens, each self-describing token anonymizing and corresponding to one or more of the values of interest in the unstructured or semi-structured content;
• storing the values of interest in a secure data vault;
• communicating the anonymized version of the unstructured or semi-structured content to the first client computing system;
• receiving, from the first client computing system or a second client computing system, a request for revealing the anonymized version of the unstructured or semi-structured content;
• performing a reveal operation on the anonymized version of the unstructured or semi-structured content, the reveal operation comprising searching the anonymized version of the unstructured or semi-structured content for the preconfigured pattern, identifying the self-describing tokens in the anonymized version of the unstructured or semi-structured content using the preconfigured pattern, and retrieving the values of interest from the secure data vault using the protection strategy and the self-describing tokens, the reveal operation producing a detokenized version of the unstructured or semi-structured content containing the values of interest;
• and
• communicating the detokenized version of the unstructured or semi-structured content to the first client computing system or to the second client computing system.

A computer program product for tokenization, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of a tokenization system for:

• receiving, from a first client computing system, a request for data anonymization, the request referencing unstructured or semi-structured content that contains values of interest for the data anonymization;
• performing a tokenization operation on the unstructured or semi-structured content, the tokenization operation comprising generating a self-describing token for replacing a value of interest in the unstructured or semi-structured content, the self-describing token having a preconfigured pattern, an indication of a protection strategy, and a token value, the tokenization operation producing an anonymized version of the unstructured or semi-structured content with self-describing tokens, each self-describing token anonymizing and corresponding to one or more of the values of interest in the unstructured or semi-structured content;
• storing the values of interest in a secure data vault;
• communicating the anonymized version of the unstructured or semi-structured content to the first client computing system;
• receiving, from the first client computing system or a second client computing system, a request for revealing the anonymized version of the unstructured or semi-structured content;
• performing a reveal operation on the anonymized version of the unstructured or semi-structured content, the reveal operation comprising searching the anonymized version of the unstructured or semi-structured content for the preconfigured pattern, identifying the self-describing tokens in the anonymized version of the unstructured or semi-structured content using the preconfigured pattern, and retrieving the values of interest from the secure data vault using the protection strategy and the self-describing tokens, the reveal operation producing a detokenized version of the unstructured or semi-structured content containing the values of interest;
• and
• communicating the detokenized version of the unstructured or semi-structured content to the first client computing system or to the second client computing system.