SYSTEM AND METHOD FOR CRYPTOGRAPHIC DATA MANAGEMENT

• US 20080077803A1
• Filed: 09/21/2007
• Published: 03/27/2008
• Est. Priority Date: 09/22/2006
• Status: Abandoned Application

• Current Assignee: Paymetric Incorporated (Fidelity National Information Services Incorporated)
• Original Assignee: Paymetric Incorporated (Fidelity National Information Services Incorporated)
• Inventors: Leach, Nathan, Mytchak, David, Perez, Alex, Kostyanovskaya, Tatyana, Bushman, Eric, Moyle, Joe
• Application Number:
  US11/859,218
• Publication Number:
  US 20080077803A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

The embodiments of this invention relate to methods for managing encrypted data. An embodiment of this method includes sending data from a first application to a server, encrypting the data sent from the first application to the server to produce encrypted data, storing the encrypted data at the server; and sending a token to the first application, wherein the token references the encrypted data.

Claims

1. A method for managing data, comprising:

sending data from a first application to a server;

encrypting the data to produce encrypted data;

storing the encrypted data in a first database that is in communication with the server; and

storing a token, wherein the token references the encrypted data.

2. The method of claim 1, wherein the token is at least one of an application-defined token or a server-defined token.

3. The method of claim 1, wherein the token comprises at least a portion of the data in unencrypted form.

4. The method of claim 1, further comprising sharing the token with a second application.

5. The method of claim 1, further comprising storing the token in a second database communicably coupled to the first application.

6. The method of claim 1, wherein storing the encrypted data comprises storing the encrypted data in a database that is in communication with the server, and further comprising partitioning the encrypted data stored in the database.

7. The method of claim 1, further comprising rotating the encrypted data, wherein rotating the encrypted data comprises:

decrypting the encrypted data with the first encryption key to produce decrypted data;

encrypting the decrypted data with the second encryption key to produce re-encrypted data; and

replacing the encrypted data with the re-encrypted data.

8. The method of claim 1, further comprising sending the token from the first application to the server;

retrieving the encrypted data referenced by the token;

decrypting the encrypted data to produce decrypted data; and

sending the decrypted data to the first application.

9. A computer program product embodied on a computer-usable medium, the medium having stored thereon a sequence of instructions which, when executed by a processor, causes the processor to execute a method for rotating data, the method comprising:

sending data from a first application to a server;

encrypting the data to produce encrypted data;

storing the encrypted data in a database that is in communication with the server; and

storing a token in a database that is in communication with the first application.

10. The computer program of claim 9, wherein the token is at least one of an application-defined token or a server-defined token.

11. The method of claim 9, wherein the token comprises at least a portion of the data in unencrypted form.

12. The computer program product of claim 9, further comprising sharing the token with a second application.

13. The computer program product of claim 9, wherein storing the encrypted data comprises storing the encrypted data in a database that is in communication with the server, and further comprising partitioning the encrypted data stored in the database.

14. The computer program product of claim 9, further comprising rotating encrypted data, wherein rotating the encrypted data comprises:

decrypting the encrypted data with the first encryption key to produce decrypted data;

encrypting the decrypted data with the second encryption key to produce re-encrypted data; and

replacing the encrypted data with the re-encrypted data.

15. A system for managing data, comprising:

one or more application interfaces configured to receive data from one or more applications;

a cryptography module configured to encrypt the data received from the one or more applications to produce encrypted data; and

a database configured to store the encrypted data.

16. The system of claim 15, further comprising a token module configured to generate a token referencing the encrypted data.

17. The system of claim 16, wherein the token comprises at least a portion of the data in unencrypted form

18. The system of claim 15, further comprising a rotation module configured to rotate encrypted data.

19. The system of claim 15, wherein the database comprises a plurality of partitions.

20. A method for managing data, comprising:

sending means for sending data from a first application to a server;

encrypting means for encrypting the data to produce encrypted data;

a first storing means for storing the encrypted data in a database that is in communication with the server; and

a second storing means for storing a token in a database that is in communication with the first application.

21. The method of claim 20, further comprising sharing means for sharing the token with a second application.

22. The method of claim 20, further comprising a second storing means for storing the token that is communicably coupled to the first application.

23. The method of claim 20, wherein the token comprises at least a portion of the data in unencrypted form.

24. The method of claim 20, further comprising rotating means for rotating data in response to rotating an encryption key, wherein rotating the encryption key comprises replacing a first encryption key with a second encryption key.

25. The method of claim 20, wherein the token comprises at least one of an application-defined token or a server-defined token.