A healthcare analytics company must share a BigQuery dataset containing patient identifiers with an external research partner. The security team requires that direct identifiers (like medical record numbers) be replaced with tokens so records can still be joined across tables using the same identifier, and the original values must be recoverable later by an authorized internal team for audit purposes. The tokenization must be resistant to unauthorized reversal even if the transformed dataset is exposed. Which Sensitive Data Protection de-identification technique should they use?