Safeguarding Data at Scale: Architecting a Serverless 'Dual-Key' Tokenization System

Executive Summary

With increasing data privacy regulations and evolving cyber threats, protecting sensitive information - from PII to financial records - is a top priority.

Our production-grade Serverless Tokenization System on AWS implements a Zero-Plaintext environment, ensuring that sensitive data is never exposed over the network or stored in its raw form. By decoupling transport encryption from storage encryption, we achieve defense-in-depth while maintaining developer velocity.

---

The Architecture: Three-Tier Isolation

To maximize security and maintainability, the system is structured into three logical layers:

1. Consumer SDK
   A TypeScript library that abstracts complex cryptography, enabling internal teams to integrate security features with minimal code.

2. Core Tokenization Service
   A hardened, serverless backend managing token lifecycle, cryptographic handshakes, and persistent storage.

3. Integration Layer
   Event-driven patterns that notify downstream services of token expiration or deletion in real time.

---

Core Security: The "Dual-Key" Strategy

Traditional encryption often relies on a single key for both transit and rest. Our system implements a multi-layer cryptographic design:

1. Transport Encryption (The Handshake)

• Sensitive data is encrypted client-side using a Transport KMS Key
• Payloads remain opaque during transit and in the Lambda environment until authorized

2. Internal Storage Encryption (The Vault)

• Core Service decrypts with the Transport Key and immediately re-encrypts with a separate Storage KMS Key before persisting
• Limits the "blast radius" of key compromise - stored data remains unreadable

---

The Tokenization Lifecycle

Tokens are treated as living entities with strict workflow control.

Token Creation: Encrypting at the Source

1. Client-Side Shielding: SDK encrypts data locally
2. Secure Handoff: Encrypted payload sent via secure path
3. Persistence: Data stored in DynamoDB with TTL

Detokenization: Lazy Decryption Pattern

• Tokens are returned as Proxy Objects
• Decryption occurs only when .decrypt() is explicitly called
• Context Binding ensures each decryption is tied to a specific Lambda ARN and Nonce, mitigating replay attacks

---

High-Security Features

• Single-Use Tokens: Burn-on-read support for ephemeral sensitive data
• Event-Driven Observability: DynamoDB Streams + SNS broadcast token lifecycle events
• Infrastructure as Code (IaC): Full stack deployed serverlessly, version-controlled, and auditable

---

Business Benefits

• Zero-Plaintext Footprint: Data exists in memory for milliseconds during re-encryption
• Developer Velocity: SDK abstracts KMS & IAM complexity, enabling security in a few lines of code
• Regulatory Alignment: Simplifies compliance for GDPR, CCPA, and PCI-DSS

---

Conclusion

Tokenization is more than replacing data with references; it’s about creating an ecosystem of cryptographic trust.

By decoupling transport and storage layers, this serverless architecture provides robust defense-in-depth, securing enterprise data while maintaining high developer productivity.