Tokenization

Tokenization - for passing tokens across multiple parties on internet or a network. Common examples are passing tokens in credit card or user Personal Account Information.

The idea of tokenization is to send a token to a remote party instead of actual credentials. Once credentials have been accepted by a verifying party, from there on tokens are sent between remote parties. Token is a random but unique identifier for a particular session between various parties. A new token is used for another session so that it cannot be replayed back.

The key advantage here is that the transactions to the remote party uses this token instead of revealing the actual Account No of a user (Privacy). This not only protects the user's identity but also minimizes the risk of transmitting a user credential over unsecure channel or eavesdropping (Security). 

Example Use Case: Pay via Tokenization without giving your personal card/credit card number to the merchant.

Token transferred from Device to Merchant payment Terminal via NFC (Near Field Communication)

Cell phone/Device ------- Terminal ------- Acquirer --------- Bank

Bank issues the token to the Acquirer, which in turn transfers to the Merchant Terminal. Bank maintains the secure vault which contains the users' PAN or Personal Account Number. Bank generates a secure token for the user's transaction and his Personal Account.

Advantage: Each transaction that the user does, a new token is being exchanged with the third party Merchant who is never revealed user's Personal Account Number.


PAN: Personal Account Number
NFC: Near Field Communication
Token: a unique identifier (a string of characters) for a particular session