SECURE APPLICATION ACCESS SYSTEM

• US 20150039887A1
• Filed: 12/09/2013
• Published: 02/05/2015
• Est. Priority Date: 08/01/2013
• Status: Active Grant

• Current Assignee: Bitglass, Inc. (Forcepoint LLC)
• Original Assignee: Bitglass, Inc. (Forcepoint LLC)
• Inventors: Kahol, Anurag, Bhattacharjya, Anoop Kumar, Kausik, Balas Natarajan
• Granted Patent: US 9,552,492 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A proxy server creates an index of keywords, receives an encrypted record, decrypts the received encrypted record as decrypted data and, when a keyword in the index is encountered in the decrypted data, associates in the index an encrypted record location identifier with the encountered keyword. The proxy server receives a search query and uses the keyword index to retrieve encrypted records from the server. The encrypted records are decrypted and sent as search results in response to the search query.

Claims

1. A method, comprising:

requesting, by a first device, an encrypted record from a second device;

receiving, by the first device, an encrypted record from a second device;

decrypting, by the first device, the received encrypted record as decrypted data;

creating, by the first device, an index of keywords;

searching the decrypted data, when a keyword in the index is encountered in the decrypted data, associating an encrypted record location identifier in the index with the encountered keyword.

2. The method as recited in claim 1, wherein the encrypted location identifier is a pointer to an encrypted data record.

3. The method as recited in claim 1, further comprising:

wherein the encrypted location identifier is a unique identifier string; and

inserting the unique identifier string in the encrypted record corresponding to a location where the keyword was encountered;

sending the encrypted record to the second device to replace the requested encrypted record on the second device.

4. The method as recited in claim 1, further comprising:

encrypting the decrypted data as a new encrypted record using a new encryption key;

sending the new encrypted record to the second device to replace the requested encrypted record on the second device.

5. The method as recited in claim 1, wherein the second device is a server.

6. The method as recited in claim 1, wherein the first device is a proxy server.

7. The method as recited in claim 1, wherein an index is created for a particular cloud application program.

8. The method as recited in claim 1, wherein an index is created for a particular user.

9. The method as recited in claim 1, further comprising:

receiving, by the first device, a search query, the search query comprising one or more keywords;

matching the one or more keywords with one or more keywords in the index;

in response to a match of a keyword in the index, issuing a search query to the second device, the search query including an encrypted location identifier associated with the matched keyword.

10. The method as recited in claim 9, further comprising:

receiving, by the first device, a search result set from the second device, the search result set including at least one encrypted record;

decrypting the at least one encrypted record;

including the decrypted at least one encrypted record in a second search result set;

sending the second search result set to a third device.

11. An apparatus, comprising:

a subsystem at a first device, implemented at least partially in hardware, that requests an encrypted record from a second device;

a subsystem at a first device, implemented at least partially in hardware, that receives an encrypted record from a second device;

a subsystem at a first device, implemented at least partially in hardware, that decrypts the received encrypted record as decrypted data;

a subsystem at a first device, implemented at least partially in hardware, that creates an index of keywords;

a subsystem at a first device, implemented at least partially in hardware, that searches the decrypted data, when a keyword in the index is encountered in the decrypted data, associates an encrypted record location identifier in the index with the encountered keyword.

12. The apparatus as recited in claim 11, wherein the encrypted location identifier is a pointer to an encrypted data record.

13. The apparatus as recited in claim 11, further comprising:

wherein the encrypted location identifier is a unique identifier string; and

a subsystem at a first device, implemented at least partially in hardware, that inserts the unique identifier string in the encrypted record corresponding to a location where the keyword was encountered;

a subsystem at a first device, implemented at least partially in hardware, that sends the encrypted record to the second device to replace the requested encrypted record on the second device.

14. The apparatus as recited in claim 11, further comprising:

a subsystem at a first device, implemented at least partially in hardware, that encrypts the decrypted data as a new encrypted record using a new encryption key;

a subsystem at a first device, implemented at least partially in hardware, that sends the new encrypted record to the second device to replace the requested encrypted record on the second device.

15. The apparatus as recited in claim 11, wherein the second device is a server.

16. The apparatus as recited in claim 11, wherein the first device is a proxy server.

17. The apparatus as recited in claim 11, wherein an index is created for a particular cloud application program.

18. The apparatus as recited in claim 11, wherein an index is created for a particular user.

19. The apparatus as recited in claim 11, further comprising:

a subsystem at a first device, implemented at least partially in hardware, that receives a search query, the search query comprising one or more keywords;

a subsystem at a first device, implemented at least partially in hardware, that matches the one or more keywords with one or more keywords in the index;

a subsystem at a first device, implemented at least partially in hardware, that, in response to a match of a keyword in the index, issues a search query to the second device, the search query including an encrypted location identifier associated with the matched keyword.

20. The apparatus as recited in claim 19, further comprising:

a subsystem at a first device, implemented at least partially in hardware, that receives, by the first device, a search result set from the second device, the search result set including at least one encrypted record;

a subsystem at a first device, implemented at least partially in hardware, that decrypts the at least one encrypted record;

a subsystem at a first device, implemented at least partially in hardware, that includes the decrypted at least one encrypted record in a second search result set;

a subsystem at a first device, implemented at least partially in hardware, that sends the second search result set to a third device.

21. A non-transitory computer readable medium, storing software instructions, which when executed by one or more processors cause performance of:

requesting, by a first device, an encrypted record from a second device;

receiving, by the first device, an encrypted record from a second device;

decrypting, by the first device, the received encrypted record as decrypted data;

creating, by the first device, an index of keywords;

searching the decrypted data, when a keyword in the index is encountered in the decrypted data, associating an encrypted record location identifier in the index with the encountered keyword.

22. The non-transitory computer readable medium as recited in claim 21, wherein the encrypted location identifier is a pointer to an encrypted data record.

23. The non-transitory computer readable medium as recited in claim 21, further comprising:

wherein the encrypted location identifier is a unique identifier string; and

inserting the unique identifier string in the encrypted record corresponding to a location where the keyword was encountered;

sending the encrypted record to the second device to replace the requested encrypted record on the second device.

24. The non-transitory computer readable medium as recited in claim 21, further comprising:

encrypting the decrypted data as a new encrypted record using a new encryption key;

sending the new encrypted record to the second device to replace the requested encrypted record on the second device.

25. The non-transitory computer readable medium as recited in claim 21, wherein the second device is a server.

26. The non-transitory computer readable medium as recited in claim 21, wherein the first device is a proxy server.

27. The non-transitory computer readable medium as recited in claim 21, wherein an index is created for a particular cloud application program.

28. The non-transitory computer readable medium as recited in claim 21, wherein an index is created for a particular user.

29. The non-transitory computer readable medium as recited in claim 21, further comprising:

receiving, by the first device, a search query, the search query comprising one or more keywords;

matching the one or more keywords with one or more keywords in the index;

in response to a match of a keyword in the index, issuing a search query to the second device, the search query including an encrypted location identifier associated with the matched keyword.

30. The non-transitory computer readable medium as recited in claim 29, further comprising:

receiving, by the first device, a search result set from the second device, the search result set including at least one encrypted record;

decrypting the at least one encrypted record;

including the decrypted at least one encrypted record in a second search result set;

sending the second search result set to a third device.