Tokenization using multiple reversible transformations

One or more machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution by a computing device, cause the computing device to:

• extract plaintext data from an input file to be tokenized;
• perform data domain-specific format-preserving encryption on the extracted plaintext data based on a first cryptographic key to generate encrypted data;
• replace one or more portions of the encrypted data with corresponding portions of alternative data based on a mapping table that maps encrypted data to alternative data;
• perform data domain-specific format-preserving encryption on the alternative data based on a second cryptographic key to generate a token;
• and
• store the token in an output file.

A computing device for detokenizing data, the computing device comprising:

• a data extraction module to extract a token from an input file to be detokenized;
• a cryptography module to perform data domain-specific format-preserving decryption on the extracted token based on a first cryptographic key to generate decrypted data;
• a data mapping module to replace one or more portions of the decrypted data with corresponding portions of alternative data based on a mapping table that maps decrypted data to alternative data;
• wherein the cryptography module is further to perform data domain-specific format-preserving decryption on the alternative data based on a second cryptographic key to generate plaintext data;
• and
• a data repackaging module to store the plaintext data in an output file.