A payment processing company needs to store customer credit card information for recurring billing purposes while minimizing the risk of exposing sensitive cardholder data. The security team wants to replace the actual credit card numbers with randomly generated values that can be mapped back to the original data only through a secure lookup service. Which cryptographic solution should be implemented?