Method and system for handling sensitive data in a content delivery network

• US 8,799,674 B1
• Filed: 12/06/2010
• Issued: 08/05/2014
• Est. Priority Date: 12/04/2009
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Leighton, F. Thomson
• Primary Examiner(s): Thiaw, Catherine
• Assistant Examiner(s): ZAIDI, SYED A
• Application Number:
  US12/960,840
• Time in Patent Office: 1,338 Days
• Field of Search: 713/189, 713/171, 726/6
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G06Q 30/0635 Processing of requisition or of purchase orders
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/67 : Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/69 : Identity-dependent

Abstract

Using cryptographic techniques, sensitive data is protected against disclosure in the event of a compromise of a content delivery network (CDN) edge infrastructure. These techniques obviate storage and/or transfer of such sensitive data, even with respect to payment transactions that are being authorized or otherwise enabled from CDN edge servers.

Claims

1. Apparatus, comprising:

a hardware processor;

computer memory holding computer program instructions that when executed by the hardware processor perform a set of operations under the control of configuration data that includes one or more keys, each key in the configuration data being a public key of a cryptographic key pair associated with one of a set of issuing entities, the public key having an associated secret key that is available at a computing entity distinct and remote from the apparatus, the set of operations comprising;

receiving a message body that includes sensitive data, the message body being a component of a message directed to a third party domain;

determining an identity of an issuing entity associated with the sensitive data;

parsing the message body to extract at least a portion of the sensitive data;

applying to the portion of the sensitive data extracted the public key of the issuing entity whose identity was determined to generate a value V;

discarding the portion of the sensitive data extracted;

determining whether the value V is associated with an identifier W associated with a third party domain;

in response to determining that the value V is associated with an identifier W associated with the third party domain, retrieving a token T that associates (V,W) and forwarding the message including the token onward to the third party domain;

in response to determining that the value V is not associated with an identifier W associated with the third party domain, generating a new token that associates (V,W) and forwarding the message including the new token onward to the third party domain;

receiving a response from the third party domain that includes the token or the new token previously forwarded with the message;

in response to receiving the response from the third party domain, retrieving the value V and issuing a new request to the computing entity at which the secret key is available, the new request including the value V; and

receiving a response from the computing entity indicating that a transaction associated with the sensitive data is authorized to proceed, the computing entity having applied the secret key to the value V to identify the sensitive data.

2. The apparatus as described in claim 1 wherein the sensitive data is PCI data.

3. The apparatus as described in claim 2 wherein the PCI data is a credit card number.

4. The apparatus as described in claim 1 wherein the operation of retrieving the value V and issuing a new request includes using the token or new token received from the third party domain together with the value W to retrieve the value V.

5. The apparatus as described in claim 1 wherein the response from the third party domain is a payment request.

6. The apparatus as described in claim 1 wherein the operation of applying to the sensitive data the public key of the issuing entity includes padding the sensitive data with given data before applying the public key.

7. The apparatus as described in claim 6 wherein the given data is data associated with a content delivery network with which the apparatus is associated.

8. The apparatus as described in claim 6 wherein the given data is obfuscation data to prevent a rainbow attack against a data store in which tokens are maintained.

9. The apparatus as described in claim 1 wherein the portion of the sensitive data extracted is all of the sensitive data in the message body.

10. The apparatus as described in claim 1 wherein the portion of the sensitive data extracted is configurable.

11. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, are operable to:

receive a message body that includes sensitive data, the message body being a component of a message directed to a third party domain;

determine an identity of an issuing entity associated with the sensitive data;

parsing the message body to extract at least a portion of the sensitive data;

apply to the portion of the sensitive data extracted a public key of the issuing entity whose identity was determined to generate a value V, the public key having an associated secret key that is available at a remote computing entity;

discard the portion of the sensitive data extracted;

determine whether the value V is associated with an identifier W associated with a third party domain;

in response to a determination that the value V is associated with an identifier W associated with the third party domain, retrieve a token T that associates (V,W) and forward the message including the token onward to the third party domain;

in response to a determination that the value V is not associated with an identifier W associated with the third party domain, generate a new token that associates (V,W) and forward the message including the new token onward to the third party domain;

receive a response from the third party domain that includes the token or the new token previously forwarded with the message;

in response to receiving the response from the third party domain, retrieve the value V and issue a new request to the remote computing entity at which the secret key is available, the new request including the value V; and

receive a response from the remote computing entity indicating that a transaction associated with the sensitive data is authorized to proceed, the computing entity having applied the secret key to the value V to identify the sensitive data.