ShieldConex^® Vaultless Tokenization Solution

ShieldConex is Bluefin’s vaultless tokenization platform that secures any PII, PHI or payment element entered online. Our cloud-based solution can be implemented via API or an iFrame. Users can choose to protect their data with either Format Preserving Tokenization (FPT) or Format Preserving Encryption (FPE). ShieldConex also provides omnichannel tokenization across the POS and online, and in 2023, will support network tokenization.

The use of an iFrame allows ShieldConex customers to outsource the capturing of sensitive data, in a scenario where the end-user sends its data directly to Bluefin for tokenization without traversing the customer’s production systems. This allows for greater scope (and therefore risk) reduction of the Page customer environment as no sensitive data is ever handled by those front-end systems in terms of transmission, processing or storage. The responsibility for the capture and encryption of this data rests with Bluefin as a Tokenization Service Provider.

The use of iFrame Forms in the capture of data means that once the end-user enters the data to a data capture form, the sensitive data is sent directly to Bluefin’s servers for tokenization and only the tokenized data need be received by the partner. This removes the transmission, processing and storage of the sensitive data elements from the partner environment and Bluefin effectively acts as a tokenization service provider without the need to store its own copy of the tokenized data. Neither the partner organization nor Bluefin possesses the original clear text data.

ShieldConex has the ability to always create the same token for the same input value. For example, the same credit card number can always generate the same token. So, if the credit card number comes from a mobile phone, a website, or even a payment terminal, ShieldConex can always generate the same token from the same credit card number. This gives the business the ability to affiliate the tokenized card number with the customer – so whenever that token is used, the business can immediately identify the customer while never having access to the real credit card number. This feature, when combined with the partner token sharing feature in ShieldConex, can solve some complex business requirements for the business and their affiliates.

In legacy “vaulted” tokenization solutions, data is stored on a token server and must be retrieved to use. This form of tokenization requires large databases to map tokens to their original data.

Unlike those legacy vaulted solutions, ShieldConex leverages vaultless tokenization. In this case, tokens are generated using Hardware Security Modules (HSMs), eliminating the need for storing any sensitive data. Typical response times are about 1/10th of a second – not perceptible by humans – meaning data is available instantaneously.

ShieldConex is a “vaultless” token solution, so the actual data is never stored in a “vault” or database. Secured data can be unmasked at any time by calling the ShieldConex service using your assigned API key.

Yes, ShieldConex also protects data in a mobile environment. If the app is written in a native app framework, the app would need to call Bluefin’s ShieldConex API. If the app is written within a web app framework, it will be able to either leverage the ShieldConex API or leverage the ShieldConex iFrame, depending on your organization’s preference.

ShieldConex can add protection. When using the ShieldConex iFrame, the sensitive data is being captured by ShieldConex directly – not on the webpage of the customer. It also requires an out-of-band, 2-step process to retrieve this data from ShieldConex, adding an additional layer of security. Even with this in place, Bluefin recommends:

• Regularly analyze all of your own website scripts throughout the development lifecycle
• Implement client-side protections such as web skimming or malware protection
• Deploy a bot management solution that is able to detect and defend against sophisticated botnets that result from browser-based attacks.

ShieldConex is an entirely cloud-based product that leverages APIs and secure iFrames configured through our ShieldConex Manager administration portal. Bluefin will provide access to the ShieldConex APIs, login credentials to ShieldConex Manager, and online integration documentation. We also provide integration assistance as needed to get your organization live with ShieldConex in a timely and successful manner.

The iFrame is specifically intended to capture data entered by a person into a web form. Typically, when PCI data is captured on a website, this brings the site into PCI scope, requiring additional work to make it PCI DSS compliant. With the iFrame, Bluefin hosts the data capture and is responsible for maintaining a PCI DSS compliant site, thereby reducing the time and effort required to implement PCI data capture.

If you’re capturing data in a web form, but have strict controls and requirements for the user interface, then API tokenization allows you to maintain full control over the user interface. However, the additional overhead of maintaining compliance should be considered.

If you need to tokenize data that is not being manually entered, then API tokenization is the right solution for you.