Systems and methods for decryption as a service

• US 9,461,973 B2
• Filed: 03/19/2015
• Issued: 10/04/2016
• Est. Priority Date: 03/19/2014
• Status: Active Grant

• Current Assignee: Bluefin Payment Systems LLC
• Original Assignee: Bluefin Payment Systems LLC
• Inventors: Barnett, Timothy William, Kasatkin, Alexander I., Miyata, Christopher Hozumi, Ruehle, Daniel
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US14/663,238
• Publication Number:
  US 20150271150A1
• Time in Patent Office: 565 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/2379 Updates performed during online database operations; commit processing
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/223 based on the use of peer-to-peer networks
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16H 70/00 ICT specially adapted for the handling or processing of medical references
• CPC Class Codes: G16H 70/60 relating to pathologies
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 : wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/123 : received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3226 : using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 : involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Systems and methods for decryption of payloads are disclosed herein. In various embodiments, systems and methods herein are configured for decrypting thousands of transactions per second. Further, in particular embodiments, the systems and methods herein are scalable, such that many thousands of transactions can be processed per second upon replicating particular architectural components.

Claims

1. A system for decryption of payloads, the system comprising:

a frontend server operatively connected to a first, second, and third read-only database, the frontend server configured for;

a) receiving a plurality of payloads from one or more third parties, wherein each of the payloads includes at least one encrypted element;

b) retrieving authentication data from the first, second and third read-only databases;

c) comparing the authentication data with each of the plurality of payloads to determine whether one or more of the payloads of the plurality of payloads has been compromised;

d) upon determining that one or more of the payloads of the plurality of payloads has not been compromised, transmitting the one or more payloads of the plurality of payloads to a hardware security module for decryption of the at least one encrypted element;

the first, second, and third read-only databases operatively connected to the frontend server and configured for storing read-only authentication data for use in determining whether payloads have been compromised;

a master read-only database operatively connected to the first, second, and third read-only databases and a read/write backend database, the master read-only database configured for receiving the authentication data from the read/write backend database and refreshing the authentication data at each of the first, second, and third read-only databases; and

the hardware security module operatively connected to the frontend server, the hardware security module configured for decrypting the one or more payloads of the plurality of encrypted payloads based on an encryption key and transmitting the decrypted one or more payloads to the one or more third parties.

2. The system of claim 1, wherein each payload includes an identifier associated with a source of the payload.

3. The system of claim 2, wherein retrieving the authentication data from the first, second and third read-only databases comprises retrieving the authentication data from the first, second and third read-only databases for each of the received plurality of payloads by each identifier associated with each of the plurality of payloads.

4. The system of claim 3, wherein the identifier is a serial number or firmware identifier associated with a particular point of interaction device.

5. The system of claim 3, wherein the identifier is an identifier associated with a mobile payments system.

6. The system of claim 3, wherein the identifier is an identifier associated with an electronic health records system.

7. The system of claim 1, wherein:

the hardware security module is a first hardware security module; and

the system further comprises a second hardware security module operatively connected to the frontend server, the second hardware security module configured for decrypting the one or more payloads of the plurality of encrypted payloads based on an encryption key for the one or more payloads and transmitting the decrypted one or more payloads to the one or more third parties.

8. The system of claim 7, wherein the system is configured to process up to about 1600 transactions per second.

9. The system of claim 7, wherein the system is configured to process twice as many transactions by doubling the number of read-only databases and hardware security modules.

10. The system of claim 9, wherein the system is configured to process up to about 3200 transactions per second.

11. A computer-implemented method for decryption of payloads, the method comprising:

providing a frontend server operatively connected to a first, second, and third read-only database, the frontend server configured for;

a) receiving a plurality of payloads from one or more third parties, wherein each of the payloads includes at least one encrypted element;

b) retrieving authentication data from at least one of the first, second, and third read-only databases;

c) comparing the authentication data with each of the plurality of payloads to determine whether one or more of the payloads of the plurality of payloads has been compromised;

d) upon determining that one or more of the payloads of the plurality of payloads has not been compromised, transmitting the one or more payloads of the plurality of payloads to a hardware security module for decryption of the at least one encrypted element;

providing the first, second, and third read-only databases operatively connected to the frontend server and configured for storing read-only authentication data for use in determining whether payloads have been compromised;

providing a master read-only database operatively connected to the first, second, and third read-only databases and a read/write backend database, the master read-only database configured for receiving the authentication data from the read/write backend database and refreshing the authentication data at each of the first, second, and third read-only databases; and

providing the hardware security module operatively connected to the frontend server, the hardware security module configured for decrypting the one or more payloads of the plurality of encrypted payloads based on an encryption key and transmitting the decrypted one or more payloads to the one or more third parties.

12. The computer-implemented method of claim 11, wherein each payload includes an identifier associated with a source of the payload.

13. The computer-implemented method of claim 12, wherein retrieving the authentication data from at least one of the first, second, and third read-only databases comprises retrieving the authentication data from at least one of the first, second, and third read-only databases for each of the received plurality of payloads by each identifier associated with each of the plurality of payloads.

14. The computer-implemented method of claim 13, wherein the identifier is a serial number or firmware identifier associated with a particular point of interaction device.

15. The computer-implemented method of claim 13, wherein the identifier is an identifier associated with a mobile payments system.

16. The computer-implemented method of claim 13, wherein the identifier is an identifier associated with an electronic health records system.

17. The computer-implemented method of claim 11, wherein:

the hardware security module is a first hardware security module; and

the computer-implemented method further comprises providing a second hardware security module operatively connected to the frontend server, the second hardware security module configured for decrypting the one or more payloads of the plurality of encrypted payloads based on an encryption key for the one or more payloads and transmitting the decrypted one or more payloads to the one or more third parties.

18. The computer-implemented method of claim 17, wherein the computer-implemented method enables processing of up to about 1600 transactions per second.

19. The computer-implemented method of claim 17, wherein the computer-implemented method enables processing twice as many transactions by providing twice as many read-only databases and hardware security modules.

20. The computer-implemented method of claim 19, wherein the computer-implemented method enables processing of up to about 3200 transactions per second.

21. A scalable system for fast decryption of payloads, the system comprising:

at least one hardware security module operatively connected to one or more frontend servers and configured for decrypting encrypted elements of payloads;

the one or more frontend servers configured to receive and authenticate payloads based at least in part upon retrieving authentication data from a particular read-only database of at least three read-only databases;

the at least three read-only databases operatively connected to the one or more frontend servers, wherein the at least three read-only databases comprise the authentication data for authenticating payloads;

a read-only master database operatively connected to the at least three read-only databases, the read-only master database configured to receive the authentication data from the backend read/write database and refresh the authentication data stored at the at least three read-only databases; and

a backend read/write database for logging decryptions and authentications, the backend read/write database operatively connected to the at least one hardware security module and the read-only master database.

22. The system of claim 21, wherein the system comprises a particular number of one or more frontend servers and a specific number of one or more read-only databases based on a ratio of read-only databases and frontend servers to a number of hardware security modules.

23. The system of claim 22, wherein the system comprises three read-only databases for every two hardware security modules.

24. The system of claim 21, wherein:

the at least one hardware security module is configured to decrypt encrypted elements of payloads at a particular number of payloads per second; and

the system comprises a number of read-only databases such that the read-only databases can authenticate the particular number of payloads per second.

25. The system of claim 24, wherein the system comprises two hardware security modules and is configured to decrypt up to 3200 payloads per second.

26. The system of claim 24, wherein the system comprises four hardware security modules and is configured to decrypt up to 6400 payloads per second.

27. The system of claim 26, wherein the system comprises six read-only databases and is configured to authenticate up to 6400 payloads per second.

28. The system of claim 21 wherein the at least one hardware security module is configured to decrypt encrypted data in a 3DES format.

29. The system of claim 21, wherein the at least one hardware security module is configured to decrypt encrypted data in a DUKPT format.

30. The system of claim 21, wherein the at least one hardware security module is configured to decrypted encrypted data in a BPS format.

31. The system of claim 21, wherein the at least one hardware security module is configured to decrypted encrypted data in a base64 encoded format.

32. The system of claim 21, wherein the at least one hardware security module is configured to decrypted encrypted data in a hexadecimal encoded format.

33. The system of claim 21, wherein the at least one hardware security module is configured to decrypted encrypted data in an encrypted value name format.

34. The system of claim 21, wherein the at least one hardware security module is configured to decrypted encrypted data in any of the following formats:

3DES, DUKPT, BPS, base64, hexadecimal encoded, or encrypted value name.

35. A system for fast decryption of one or more payloads, the system comprising:

a message queuing protocol operatively connected to a first read-only database and a read/write database, the message queuing protocol configured for;

receiving event notifications from the first read-only database, wherein the event notifications each comprise one or more notifications regarding the authentication of one or more received payloads;

queuing the event notifications received from the first read-only database; and

transmitting the event notifications to the read/write database upon determining that the read/write database is configured to accept event notifications;

second and third read-only databases operatively connected to the frontend server and configured for storing authentication data for use in determining whether a payload has been compromised; and

a master read-only database operatively connected to the first, second, and third read-only databases and the read/write database, the master read-only database configured for receiving the authentication data from the read/write database and refreshing the authentication data at each of the first, second, and third read-only databases.

36. The system of claim 35, wherein the system further comprises a frontend server operatively connected to at least one slave read-only database, the frontend server configured for receiving the one or more received payloads and authenticating each of the one or more received payloads by comparing data included in the one or more received payloads with data included in the at least one slave read-only database.

37. The system of claim 36, wherein the system further comprises a hardware security module, wherein the hardware security module is operatively connected to the frontend server and is for decrypting encrypted portions of the one or more received payloads.

38. The system of claim 37, wherein the hardware security module is operatively connected to the frontend server via a hardware security module server.

39. The system of claim 35, wherein the message queuing protocol is further configured for storing the event notifications upon determining the read/write database is not configured to accept event notifications.

40. The system of claim 39, wherein upon determining the read/write database is configured to accept event notifications, transmitting the stored event notifications to the read/write database.

41. The system of claim 35, wherein the read/write database is a P2PE manager.