US 20080082837 A1
A system for secure data storage and transmission is provided. The system comprises a first security module for protecting data in a first data at rest system and a second security moducle for protecting data in a second data at rest system. At least one encryption parameter for the second data at rest system differs from at least one encryption parameter for the first data at rest system so that a datum is reencrypted when the datum is transferred from the first data at rest system to the second data at rest system.
1. A system for secure data storage and transmission comprising:
a first security module for protecting data in a first data at rest system, at least a subset of data stored in the first data at rest system being encrypted, the first security module associated with a first key domain defining encryption parameters for the first data at rest system; and
a second security module for protecting data in a second data at rest system, at least a subset of data stored in the second data at rest system being encrypted, the second security module associated with a second key domain defining encryption parameters for the second data at rest system, at least one encryption parameter for the second data at rest system differing from at least one encryption parameter for the first data at rest system so that a datum is reencrypted when the datum is transferred from the first data at rest system to the second data at rest system.
2. The system of
3. The system of
4. The system of
5. The system of
a security management module, wherein the security management module promulgates a security policy.
6. The system of
7. The system of
8. The system of
9. A selective data access system comprising:
a first data field encrypted with a first encryption key; and
a second data field encrypted with a second encryption key, wherein a first user has access to the first encryption key and a second user has access to a second encryption key.
10. The system of
11. The system of
12. The system of
13. A method of data transfer comprising:
storing data and encryption status information for the data in a first data at rest system;
examining the encryption status information when transferring the data from the first data at rest system to a second data at rest system; and
reencrypting the data if the first data at rest system and the second data at rest system are associated with different key domains.
14. The method of
15. The method of
16. A method for providing partial access to data comprising:
generating a report for a third party, wherein the report includes obfuscated sensitive information;
allowing the third party to examine the report; and
providing access to unobfuscated sensitive information if the third party identifies information of interest.
17. The method of
18. The method of
19. The method of
20. A method as recited in
21. A method of secure data transport comprising:
encrypting a datum;
storing the datum in a first data at rest system; and
transferring the datum to a second data at rest system, wherein the datum remains encrypted during transfer and storage.
22. The method of
23. The method of
24. The method of
This application claims priority to U.S. Provisional Patent Application 60/848,251, filed Sep. 29, 2006, the contents of which are incorporated in its entirety.
The subject disclosure relates to methods and systems for protecting sensitive electronic information, and more particularly to improved methods and systems for protecting credit card information as such information is processed, stored, and travels across a distributed computing network.
As the world of telecommunications, computer networking, and electronics continues to expand, the world as we know provides unprecedented access to information. Sitting in the glow of a computer screen, an individual can instantaneously access information on the opposite side of the planet by the Internet and other means. As companies continue to integrate such capabilities into more and more facets of their business, new and difficult challenges arise. In general, those with access to information are trustworthy and would never consider accessing and/or using information improperly. However, in the area of electronic commerce, credit card fraud and identity theft have become commonplace.
Such problems have spurred advances in the technology of securing data. Examples of such advances are the commonly-used secure sockets layer (SSL) and S-HTTP security mechanisms. Whereas SSL utilizes handshake-based key distribution with complex public key cryptography techniques, S-HTTP is designed to send individual messages securely. In either case, intermediaries in the process are not able to do more than simply move the incoming file to a subsequent destination, even though the intermediary is an integral part of the ongoing client-server relationship. Hence, the very nature of the security mechanisms presents limitations in that in order for an intermediary to have access, the access criteria must be duplicated in a complex and difficult to maintain manner.
Despite these advances, sensitive information is still commonly stolen and illicitly used. One area of weakness is the time when data is in transit and, particularly, in transit within a single entity or enterprise such as on an internal network. Similarly, as data passes between organizations, the data can be exposed by weak security measures and other infiltrations such as access data stolen from authorized personnel.
It should be appreciated that the present invention can be implemented and utilized in numerous ways, including without limitation as a process, an apparatus, a system, a device, a method for applications now known and later developed or a computer readable medium. These and other unique features of the system disclosed herein will become more readily apparent from the following description and the accompanying drawings.
One embodiment of the invention is directed to a system for secure data storage and transmission comprising a first security module for protecting data in a first data at rest system and a second security module for protecting data in a second data at rest system. At least a subset of data stored in the first data at rest system is encrypted. The first security module is associated with a first key domain defining encryption parameters for the first data at rest system. At least a subset of data stored in the second data at rest system is encrypted. The second security module is associated with a second key domain defining encryption parameters for the second data at rest system. At least one encryption parameter for the second data at rest system differs from at least one encryption parameter for the first data at rest system so that a datum is reencrypted when the datum is transferred from the first data at rest system to the second data at rest system.
This embodiment may have several features. For example, encryption parameters mau comprise encryption keys or encryption algorithms. The first security module may encrypt data stored on the first data at rest system. The second security module may encrypt data stored on the second data at rest system.
The system may also include a security management module which promulgates a security policy. The security management module may be communicatively coupled with the first security module and the second security module. The security management module may store an audit log. In some embodiments, encryption parameters in the first key domain may be altered independently of encryption parameters in the second key domain.
Another embodiment of the invention is directed to a selective data access system comprising a first data field encrypted with a first encryption key and a second data field encrypted with a second encryption key. A first user has access to the first encryption key and a second user has access to a second encryption key.
This embodiment may have several features. In some embodiments, a third user has access to both the first and the second encryption keys. The first data field and the second data field may reside in the same database. The first data field and the second data field may reside in the same table.
Another embodiment of the invention is directed to a method of data transfer comprising storing data and encryption status information for the data in a first data at rest system, examining the encryption status information when transferring the data from the first data at rest system to a second data at rest system, and reencrypting the data if the first data at rest system and the second data at rest system are associated with different key domains. In some embodiments, the key domains define encryption parameters. In other embodiments, encryption parameters comprise encryption keys or encryption algorithms.
Another embodiment of the invention is directed to a method for providing partial access to data comprising generating a report for a third party, the report containing obfuscated sensitive information, allowing the third party to examine the report, and providing access to unobfuscated sensitive information if the third party identifies information of interest.
This embodiment of the invention can have various features. For example, the obfuscated sensitive information may be pronouncable. The method may include generating a report comprises obtaining obfuscated data from a substitution cipher. The obfuscated sensitive data may be of the same data category as the unobfuscated sensitive data. The report may include obfuscated sensitive data selected from the group consisting of names, social security numbers, indications of treatment, telephone numbers and combinations thereof.
Another embodiment of the invention is directed to a method of secure data transport comprising encrypting a datum, storing the datum in a first data at rest system, and transferring the datum to a second data at rest system. The datum remains encrypted during transfer and storage.
This embodiment of the invention can have various features. The first data at rest system can be associated with a first domain and the second data at rest system can be associated with a second domain. The datum may be encrypted in accordance with the second domain before transfer. The datum may be encrypted in accordance with the second domain after transfer.
The presently disclosed embodiments will be further explained with reference to the attached drawings, wherein like structures are referred to by like numerals throughout the several views. The drawings shown are not necessarily to scale, with emphasis instead generally being placed upon illustrating the principles of the presently disclosed embodiments.
While the above-identified drawings set forth presently disclosed embodiments, other embodiments are also contemplated, as noted in the discussion. This disclosure presents illustrative embodiments by way of representation and not limitation. Numerous other modifications and embodiments can be devised by those skilled in the art which fall within the scope and spirit of the principles of the presently disclosed embodiments.
The present invention overcomes many of the prior art problems associated with transferring sensitive data in a distributed computing network. The advantages, and other features of the system disclosed herein, will become more readily apparent to those having ordinary skill in the art from the following detailed description of certain preferred embodiments taken in conjunction with the drawings which set forth representative embodiments of the present invention and wherein like reference numerals identify similar structural elements. All relative descriptions herein such as upstream, downstream, left, right, up, and down are with reference to the Figures, and not meant in a limiting sense.
For clarity, certain terms are defined generally as follows. A processor generally is logic circuitry that responds to and processes instructions that drive a computer and can include, without limitation, a central processing unit, an arithmetic logic unit, an application specific integrated circuit, a task engine, and/or any combinations, arrangements, or multiples thereof.
Software or code generally refers to computer instructions which, when executed on one or more digital data processing devices, cause interactions with operating parameters, sequence data/parameters, database entries, network connection parameters/data, variables, constants, software libraries, and/or any other elements needed for the proper execution of the instructions, within an execution environment in memory of the digital data processing device(s).
A module is a functional aspect, which may include software and/or hardware. Typically, a module encompasses the necessary components to accomplish a task. It is envisioned that the same hardware could implement a plurality of modules and portions of such hardware being available as needed to accomplish the task. Those of ordinary skill will recognize that the software and various processes discussed herein are merely exemplary of the functionality performed by the disclosed technology and thus such processes and/or their equivalents may be implemented in commercial embodiments in various combinations without materially affecting the operation of the disclosed technology.
A network can be a series of network nodes (each node being a digital data processing device, for example) that can be interconnected by network devices and communication lines (e.g., public carrier lines, private lines, satellite lines, etc.) that enable the network nodes to communicate. The transfer of data (e.g., messages) between network nodes can be facilitated by network devices such as routers, switches, multiplexers, bridges, gateways, etc. that can manipulate and/or route data from an originating node to a destination node regardless of any dissimilarities in the network topology (e.g., bus, star, token ring, etc.), spatial distance (local, metropolitan, wide area network, etc.), transmission technology (e.g., TCP/IP, Systems Network Architecture, etc.), data type (e.g., data, voice, video, multimedia, etc.), nature of connection (e.g., switched, non-switched, dial-up, dedicated, virtual, etc.), and/or physical link (e.g., optical fiber, coaxial cable, twisted pair, wireless, etc.) between the originating and destination network nodes.
In view of the challenges discussed herein, a need exists for a system and method that effectively provides protection of sensitive consumer data while allowing access to intermediaries in the e-commerce process.
Still further, organizations need to allow downstream systems to utilize encrypted data. Typically, extract, transform, and load (ETL) tools cannot utilize encrypted data because the data type is not understood and/or the length control is not maintained. Thus, there is a need to preserve and control the data length and type while maintaining high level of security such as in the Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES) systems.
In one embodiment, the subject technology balances security and operational needs by employing systems, methods, apparatus and data structures where:
1. A credit card number (and other sensitive fields) are partially encrypted (e.g., using Data Type Preserving encryption or related methods) at the first point of capture (in the commerce chain);
2. The sensitive fields stay partially encrypted (with an optional re-encryption of some fields or parts of the fields content) throughout the commerce chain, enabling most applications to process without any field level decryption; and/or
3. Selected data (at file level and database file level) at rest on disk and backups is additionally and fully (double) encrypted.
This embodiment results in high transparency and low overhead.
It is an object of the subject technology to control the data length and type.
Preferably, data length control (DLC) reduces the need for changes to database and file structures in applications by preserving the length and/or the datatype of the encrypted field. Datatype preservation simply means that each ciphertext field is as valid as the plaintext field it replaces. In one aspect, the method defines an appropriate alphabet of valid characters and performing all operations within the constraints of the defined alphabet. Each different datatype requires a judicious choice of alphabet. An alphabet consisting of numeric digits (“0123456789”) could be used to encrypt most number data, such as social security numbers (e.g. 123-45-6789). (The dashes, not included the chosen alphabet, are copied unchanged to the corresponding positions in the ciphertext output.) Other alphabets, such as all printable ASCII characters, all characters shared by ASCII and EBCDIC, or all hexadecimal digits can be used to encode a variety of common datatypes.
As a result of DLC, the following advantages are realized:
DLC reduces the need for changes to database structures and applications by preserving the datatype of the encrypted field; and
Each ciphertext field is as valid as the plaintext field it replaces.
It is a further object of the subject technology to provide secure sharing of enterprise information. In business use-cases the invention described minimizes the cost of securing enterprise information and allows for the secure sharing of data within the enterprise and with appropriate individuals outside of the enterprise.
DTP and DLC can be implemented with different methods, including AES Counter Mode, where numeric in/out can be “compressed” to also include meta data within the original length of an alpha-numeric field. It is a further object of the subject technology to monitor user behavior. In business use-cases, the benefits are usage control for enterprise data and validation of usage behavior for critical applications and data.
The flow charts herein illustrate the structure or the logic of the present technology, possibly as embodied in computer program software for execution on a computer, digital processor or microprocessor. Those skilled in the art will appreciate that the flow charts illustrate the structures of the computer program code elements, including logic circuits on an integrated circuit, that function according to the present technology. As such, the present invention is practiced in its essential embodiment(s) by a machine component that renders the program code elements in a form that instructs a digital processing apparatus (e.g., computer) to perform a sequence of function step(s) corresponding to those shown in the flow charts.
Referring now to the
The environment 100 is a client/server network, which can support electronic commerce (e-commerce). The environment 100 includes a plurality of servers which communicate with a distributed computer network via communication channels, whether wired or wireless, as is well known to those of ordinary skill in the pertinent art. In the preferred embodiment, the distributed computer network is the Internet. The servers may be provided by various entities within the environment 100. For simplicity, the servers are not drawn but rather the illustrative components thereof are shown as would be known to those of ordinary skill in the pertinent art. The servers may host multiple Web sites and house multiple databases 110, 112 as necessary for e-commerce and the proper utilization of the subject technology.
A server is any of a number of servers known to those skilled in the art that are intended to be operably connected to a network so as to operably link to a plurality of clients 102, 104, 106, 108 via the distributed computer network. As illustration, the server typically includes a central processing unit including one or more microprocessors such as those manufactured by Intel or AMD, random access memory (RAM), mechanisms and structures for performing I/O operations, a storage medium such as a magnetic hard disk drive(s), and an operating system for execution on the central processing unit. The hard disk drive of the server may be used for storing data, client applications and the like utilized by client applications. The hard disk drive(s) of the server also are typically provided for purposes of booting and storing the operating system, other applications or systems that are to be executed on the server, paging and swapping between the hard disk and the RAM.
The distributed computer network may include any number of network systems well known to those skilled in the art. For example, distributed computer network may be a combination of local area networks (LAN), wide area networks (WAN), or, other network technologies as is well known. For the Internet, the preferred method of accessing information is the World Wide Web because navigation is intuitive and does not require technical knowledge.
The plurality of computers or clients 102, 104, 106, 108 can be similarly configured as the servers or simple systems such as desktop computers, laptop computers, personal digital assistants, cellular telephones and the like. The clients 102, 104, 106, 108 allow users to conduct e-commerce and administrators to access information on the servers. For simplicity, only four clients 102, 104, 106, 108 are shown. The clients 102, 104, 106, 108 have displays and an input device(s) as would be appreciated by those of ordinary skill in the pertinent art. The display may be any of a number of devices known to those skilled in the art for displaying images responsive to outputs signals from the computers 102, 104, 106, 108. Such devices include but are not limited to cathode ray tubes (CRT), liquid crystal displays (LCDs), plasma screens and the like. Although a simplified diagram is illustrated in
The client 102 provides consumer access to the environment 100 whereas clients 104, 106, 108 are associated with vendors and/or an entity that provides the goods and/or services sought by the consumer. It will be recognized by those of ordinary skill in the art that the hardware of the clients 102, 104, 106, 108 would often be interchangeable. A plurality of consumers typically can share the same client 102 and cookie technology can be utilized to facilitate access to the environment 100. Of course, a plurality of users can utilize the environment 100 simultaneously.
Similarly to the servers, the clients 102, 104, 106, 108 typically include a central processing unit including one or more micro-processors, mechanisms and structures for performing I/O operations (not shown), a storage medium such as a magnetic hard disk drive(s), a device for reading from and/or writing to removable computer readable media and operating system software for execution on the central processing unit. In one embodiment, the application programs or software reside on the hard disk drive of a client for performing the functions in accordance with the subject technology. In another embodiment, the hard disk drive simply has a browser for accessing a software application hosted on a server within the distributed computing network.
Still referring to
The client 102 allows a user to browse a Web site hosted by an entity such as a retailer. To make a transaction, the consumer places one or more desired items in an electronic shopping cart and proceeds to check out. At checkout, the consumer is prompted to provide payment information such as credit card information. The credit card company employs a server to store a point of service (POS) database 110 related to all the transactions. In alternative embodiments, a user may utilize an application on the client 102 other than a Web site to make a transaction. Such an application includes software downloaded from the Internet, installed from a diskette, CD, DVD or other persistent storage device, or pre-installed on the client 102.
The records of the POS database 110 must eventually be attended to in terms of payment and passed along to the retailer for storage in a mainframe database 112 stored in a server of the retailer. More particularly, the records are extracted and transferred such as by electronic mail as denoted graphically in area 114. In area 116, a file containing the records is uploaded to the mainframe database 112 while area 118 illustrates that data is loaded into the mainframe database 112 for storage and subsequent access as well. Working in the opposite direction, an extract, transform, and load (ETL) application 120 performs a process in data warehousing that involves extracting data from outside sources, transforming it to fit business needs, and ultimately and loading it into the data warehouse. ETL is the way data gets loaded into the warehouse.
Data may be transferred between the POS database 110 and the mainframe database 112 through a variety of methods. As discussed above, records may be extracted and emailed to the mainframe 112. Alternatively, data may be transferred through technologies including but not limited to Data Transformation Services, SQL Server™ Transfer Manager and Bulk Copy Program, and SQL Server™ Integration Services, all available as part of Microsoft® SQL Server™, available from Microsoft Corp. of Redmond, Wash.; and Data Integrator™, available from Pervasive Software, Inc. of Austin, Tex.
Referring now to
DTP (Data Type Preservation) and AES Counter Mode encryption are examples of encryption modes and transformation processes that can be used for data confidentiality in the provided examples. Data Type Preservation is described detail in U.S. patent application Ser. No. 09/721,942, filed Nov. 27, 2000, the contents of which are hereby incorporated by reference herein.
A complex data flow diagram, representing some of the possible data flows in an enterprise, is shown in
Referring now to
Referring now to
Referring now to
Referring now to
Referring now to
Again, to oversee the distribution of the key, each file 714 a, 716 a is stored in database 714, 716, respectively, and monitored by an application 740 as well as a DTP module 742 to coordinate compliance. The activity is stored in an audit log database 734. As a result, a central key management solution with a distributed encryption solution is coordinating the use of different encryption keys and encryption formats in a data flow between databases and files.
Referring now to
Referring now to
Referring now in particular to
Referring now in particular to
The above description is not intended to deprecate masking techniques. Indeed, masking may be a useful component of a data export/import format. Using the above example, if the middle eight digits of a credit card number encrypted, the data export/import format may specify that application 1406 display the number with masking to prevent confusion as to the actual number. This aspect of the invention is depicted in
Referring now to
Any of the formats discussed including formats for data in transit, data at rest, data import, and data export may be vary based on the user and/or the user's role. Using data export formats for an example, certain individuals and/or roles may be allowed to view clear text credit card data, while other individuals may only view cipher text credit card data.
It will be appreciated by those of ordinary skill in the pertinent art that the functions of several elements may, in alternative embodiments, be carried out by fewer elements, or a single element. Similarly, in some embodiments, any functional element may perform fewer, or different, operations than those described with respect to the illustrated embodiment. Also, functional elements (e.g., modules, databases, interfaces, computers, servers and the like) shown as distinct for purposes of illustration may be incorporated within other functional elements in a particular implementation.
While the invention has been described with respect to preferred embodiments, those skilled in the art will readily appreciate that various changes and/or modifications can be made to the invention without departing from the spirit or scope of the invention.