The Use of Tokenization, Encryption, and Masking in Database Systems for Data Security

Abstract

The rising frequency of data breaches in Southeast Asia, combined with the enforcement of Indonesia's Personal Data Protection Law (UUPDP), has made database security a critical priority for organizations.

This study evaluates the effectiveness of three data protection methods: tokenization, encryption, and data masking. Using a qualitative descriptive approach, semi-structured interviews were conducted with IT professionals who have experience in database management and information security.

The findings suggest that encryption is commonly used as the foundational layer of protection, tokenization is selectively applied to highly sensitive data, and masking is mainly used in development and testing environments. Together, these methods create a layered defense strategy that improves data protection and supports regulatory compliance.

Publication

This paper was published by IEEE as part of the 2025 13th International Conference on Cyber and IT Service Management (CITSM).

• Published in: 2025 13th International Conference on Cyber and IT Service Management (CITSM)
• Conference date: 25-26 September 2025
• Date added to IEEE Xplore: 22 December 2025
• DOI: 10.1109/CITSM67730.2025.11291375
• Publisher: IEEE
• Conference location: Jakarta, Indonesia
• Electronic ISBN: 979-8-3315-7585-4
• Print on Demand ISBN: 979-8-3315-7586-1
• Electronic ISSN: 2770-159X
• Print on Demand ISSN: 2770-1581

Introduction

The rapid digitalization of organizations has significantly increased the importance of protecting sensitive information stored in databases. Modern databases often contain financial transactions, healthcare records, customer identifiers, employee information, and other forms of personal data.

Because of this, databases are attractive targets for attackers. A single breach can expose large volumes of confidential information and create legal, operational, and reputational consequences.

In response to these risks, organizations are expected to adopt stronger technical controls. Regulations such as GDPR, CCPA, and Indonesia's Personal Data Protection Law emphasize accountability, confidentiality, integrity, and appropriate technical safeguards.

Among the most widely recognized database protection techniques are:

• Tokenization.
• Encryption.
• Data masking.

Each method protects data in a different way. When implemented together, they can form a defense-in-depth strategy that reduces exposure risk while supporting compliance requirements.

Research Focus

The main question explored in this research is:

How can tokenization, encryption, and masking be combined to provide practical database security and regulatory compliance without significantly compromising system performance?

The study focuses on how these techniques are applied in real environments, what challenges organizations face during implementation, and how the three methods complement each other as part of a layered security model.

Data Security in Databases

Data security in database systems is commonly based on the CIA triad:

• Confidentiality ensures that sensitive data is accessible only to authorized users and systems.
• Integrity ensures that data remains accurate, consistent, and protected from unauthorized modification.
• Availability ensures that authorized users can access the data and systems when needed.

Databases are frequently exposed to threats such as unauthorized access, data leakage, insider misuse, insecure application logic, weak access control, and injection attacks. These risks make technical safeguards essential, especially when databases store sensitive or regulated information.

Tokenization

Tokenization replaces sensitive data with a non-sensitive substitute called a token. The token has no meaningful value if exposed, while the original sensitive data is stored in a protected system or vault.

For example, instead of storing a real card number or personal identifier in an application database, the system stores a token that references the original value through a controlled process.

Tokenization is useful because it can:

• Reduce the amount of sensitive data stored in primary systems.
• Minimize exposure during a breach.
• Reduce compliance scope in certain regulated environments.
• Protect high-risk data such as payment information or personally identifiable information.

However, tokenization also introduces challenges. Organizations must manage the token vault securely, integrate tokenization workflows with existing systems, and handle performance considerations caused by additional lookup or API calls.

Encryption

Encryption transforms readable data, or plaintext, into unreadable ciphertext using a cryptographic algorithm and key. It is one of the most widely adopted methods for protecting data confidentiality.

Encryption can protect:

• Data at rest, such as information stored in databases, disks, or backups.
• Data in transit, such as information moving through networks or APIs.

Common approaches include symmetric encryption and asymmetric encryption.

Symmetric encryption uses the same key for encryption and decryption. It is commonly used because it is efficient for large volumes of data.

Asymmetric encryption uses a public key and private key pair. It is often used for secure key exchange, digital signatures, and identity-related cryptographic processes.

The main challenge with encryption is not only the algorithm itself, but key management. If encryption keys are poorly stored, shared, rotated, or monitored, encrypted data may still be exposed. This makes operational processes and access control just as important as the cryptographic method.

Data Masking

Data masking creates a realistic but fictitious version of sensitive data. It is commonly used in non-production environments such as development, testing, training, and analytics.

The goal is to allow teams to work with data that looks structurally valid without exposing real sensitive information.

There are two common forms:

• Static data masking, which creates a permanently masked copy of a dataset.
• Dynamic data masking, which masks data in real time based on access rules or user roles.

Masking is especially useful in software development workflows because developers and testers often need realistic data to validate application behavior. However, the masked data must preserve format, structure, and referential integrity. Poor masking can break validation rules or produce unrealistic test scenarios.

Operational Comparison

Method

This research used a qualitative exploratory approach. The goal was not to measure adoption statistically, but to understand how IT professionals apply tokenization, encryption, and masking in real database environments.

The study used semi-structured interviews with IT professionals who were involved in database management, security operations, infrastructure, backend development, or regulatory compliance.

The interview topics included:

• How tokenization is used in the organization.
• What types of data are tokenized.
• What encryption standards are applied.
• How encryption keys are managed.
• Where data masking is implemented.
• How data protection practices align with UUPDP or other legal standards.
• What practical challenges appear during implementation.

This approach allowed the research to capture technical practices, organizational constraints, and real-world implementation trade-offs.

Findings

Tokenization Is Applied Selectively

The findings show that tokenization is primarily used for highly sensitive data, especially payment-related data and personally identifiable information.

Tokenization helps reduce the amount of sensitive data stored directly in application systems. This reduces the impact of a breach because the exposed token does not reveal the original value.

At the same time, tokenization requires additional architecture. A secure token vault, integration layer, and access control model must be designed carefully. In legacy systems, this can become complex because existing applications may not be built to separate sensitive values from business workflows.

Encryption Acts as the Foundational Layer

Encryption was the most widely adopted method among the three techniques. It is commonly used to protect data at rest and data in transit.

This confirms encryption's role as a foundational control in database security. However, implementation maturity varies. Some organizations use automated key management systems, while others still depend on more manual processes.

The research highlights that encryption strength depends heavily on key management. A strong algorithm can still fail operationally if keys are stored insecurely, shared too broadly, or rotated inconsistently.

Masking Supports Safer Development and Testing

Data masking is commonly used in development and testing environments. This allows teams to test applications using realistic datasets without exposing actual sensitive information.

Masking is important because non-production environments are often less controlled than production systems. Developers, testers, vendors, or support teams may need access to data-like structures, but they do not always need real customer data.

The challenge is maintaining realism. If masked data does not follow the same format, relationships, or validation rules as production data, testing can become unreliable.

Discussion

The study supports the view that no single method is sufficient on its own.

Encryption protects confidentiality broadly, but authorized users or applications may still access plaintext after decryption. Tokenization minimizes exposure for selected high-risk fields, but it requires additional architecture and operational discipline. Masking protects non-production workflows, but it does not directly protect live production data.

Together, the three techniques can support a layered security model:

• Encryption protects stored and transmitted data.
• Tokenization reduces exposure of highly sensitive values.
• Masking reduces the risk of sensitive data leakage in non-production environments.

This layered approach aligns with the concept of defense in depth. It also supports privacy compliance because it demonstrates that organizations are applying appropriate technical controls based on data sensitivity and usage context.

Practical Implications

For organizations planning to strengthen database security, the research suggests several practical considerations:

• Classify data before selecting protection methods.
• Use encryption as a baseline control for sensitive databases and communication channels.
• Apply tokenization to high-risk values that do not need to remain directly readable in primary systems.
• Use masking for development, testing, training, and analytics environments.
• Treat key management and vault management as critical security processes.
• Ensure that compliance requirements are mapped to technical and operational controls.
• Consider performance and integration impacts early in the design phase.

Database security should not be treated only as a tool implementation. It requires governance, architecture, operations, access control, monitoring, and continuous improvement.

Conclusion

This study examined the practical use of tokenization, encryption, and data masking as a combined strategy for database security and privacy compliance.

The findings show that a layered approach is more effective than relying on a single technique. Encryption provides broad confidentiality, tokenization protects highly sensitive values by reducing exposure, and masking enables safer use of data in non-production environments.

The study also highlights that regulatory compliance is an important driver of security initiatives, but implementation maturity can vary across organizations. Technical controls must be supported by strong operational processes, skilled teams, and clear governance.

Overall, combining tokenization, encryption, and masking provides a practical path toward stronger data protection, improved compliance readiness, and more resilient database security.

Academic Note

This article is adapted from an academic paper written during my undergraduate study in Information Systems. The research was conducted as part of my academic work on database security, privacy compliance, and practical data protection strategies.