TOKENISATION - THE NEW FRONTIER

Tokenisation is a process by which the primary account number (PAN) is replaced with a surrogate value called a "token." De- Tokenisation is the reverse process of redeeming a token for its associated PAN value. The security of an individual token relies predominantly on the unfeasibility of determining the original PAN knowing only the surrogate value.

Depending on the particular implementation of a Tokenisation solution, tokens used within merchant systems and applications may not need the same level of security protection associated with the use of PAN. Storing tokens instead of PANs is one alternative that can help to reduce the amount of cardholder data in the environment, potentially reducing the merchant's effort to implement PCI DSS requirements.

The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information. The PCI DSS was created jointly in 2004 by four major credit-card companies: Visa, MasterCard, Discover and American Express.

The following key principles relate to the use of Tokenisation and its relationship to PCI DSS:

• Tokenisation solutions do not eliminate the need to maintain and validate PCI DSS compliance, but they may simplify a merchant's validation efforts by reducing the number of system components for which PCI DSS requirements apply.
• Verifying the effectiveness of a Tokenisation implementation is necessary and includes confirming that PAN is not retrievable from any system component removed from the scope of PCI DSS.
• Tokenisation systems and processes must be protected with strong security controls and monitoring to ensure the continued effectiveness of those controls.
• Tokenisation solutions can vary greatly across different implementations, including:
• differences in deployment models
• Tokenisation and de-Tokenisation methods
• technologies
• processes
• Merchants considering the use of Tokenisation should perform a thorough evaluation and risk analysis to identify and document the unique characteristics of their particular implementation, including all interactions with payment card data and the particular Tokenisation systems and processes.
• One of the primary goals of a Tokenisation solution should be to replace sensitive PAN values with non-sensitive token values. For a token to be considered non-sensitive, and thus not require any security or protection, the token must have no value to an attacker.
• Tokens come in many sizes and formats.
• Tokens can be generally identified as either single-use or multi-use. A single-use token is typically used to represent a specific, single transaction. A multi-use token represents a specific PAN, and may be used to track an individual PAN across multiple transactions. A multi-use token always maps a particular PAN value to the same token value within the Tokenisation system. Determining whether single-use or multi-use tokens, or a combination of both, are appropriate for a particular merchant environment will depend on the merchant's specific business need for retaining tokens.

The above summary is taken from the reference below:
https://www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf