High performance data encryption server and method for transparently encrypting/decrypting data

• US 8,386,768 B2
• Filed: 02/08/2007
• Issued: 02/26/2013
• Est. Priority Date: 02/08/2006
• Status: Active Grant

• Current Assignee: Thales DIS CPL USA, Inc. (Thales SA)
• Original Assignee: SafeNet Incorporated (Thales SA)
• Inventors: Nair, Sushil, Zolotusky, Anatol, Charpentier, Claude, Metzger, Brian
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US11/704,705
• Publication Number:
  US 20080034199A1
• Time in Patent Office: 2,210 Days
• Field of Search: 713/153, 713/165
• US Class Current: 713/153
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services

Abstract

High-performance data encryption/decryption server and method for transparently encrypting/decrypting data. System and method for encryption and/or decryption cryptographic services that have applicability small and large databases and especially to encryption and/or decryption of bulk data. Method for transparently applying a cryptographic operation to application-specific data. Encryption server for transparent encryption and decryption of application specific data. Method for transparently encrypting application specific data. Computer program stored on a computer readable media for modifying the operation of a computer process implementing a method for transparently encrypting application specific data. System and appliance for transparently encrypting application specific data. System for transparently applying a cryptographic operation to application-specific data.

Claims

1. A method for transparently applying a cryptographic operation to application-specific data, the method comprising:

providing an application program interface (API) coupled between a cryptographic server and a data store of an information processing device, the information processing device running at least one of an operating system (OS) and a native database management system (DBMS) that natively contains at least one hook corresponding to a pre-defined OS or native DBMS data flow event or location and operable to invoke third party-provided computer program code when data flow of the OS or DBMS reaches the pre-defined data flow event or location;

providing the third-party computer program code; and

responsive to a request from an application related to an input/output (I/O) operation on a storage mechanism that causes data flow of the OS or DBMS to reach the pre-defined data flow event or location, initiating via the API, by the computer program code invoked by the hook, cryptographic processing of an application-specific data item corresponding to the I/O operation request by a cryptographic appliance (CA) coupled to the cryptographic server.

2. The method of claim 1, wherein the cryptographic processing includes at least one of an encryption operation and a decryption operation.

3. The method of claim 1, wherein the API is provided in a server computer.

4. The method of claim 3, wherein the server computer comprises the cryptographic appliance.

5. The method of claim 4, wherein the cryptographic operation comprises a combination of encryption and decryption operations on a data item.

6. The method of claim 4, wherein the cryptographic operation comprises at least one of an encryption operation and a decryption operation.

7. The method of claim 3, wherein the server computer comprises the cryptographic server.

8. The method of claim 7, wherein the cryptographic server performs at least one of an encryption operation and a decryption operation.

9. The method of claim 7, wherein the cryptographic server is adapted to perform both encryption operations and decryption operations.

10. The method of claim 1, wherein the hooks are exit routines.

11. The method of claim 1, wherein at least one of the hooks corresponds to a type of the data store.

12. The method of claim 1, wherein the cryptographic operation comprises an encryption operation when writing to the data store and a decryption operation when reading from the data store.

13. The method of claim 1, wherein the API supports at least one of:

(i) cryptographic appliance authentication requests, (ii) encryption and/or decryption requests, and (iii) cryptographic key management requests.

14. The method of claim 1, wherein the API supports encryption and/or decryption requests for providing encryption and/or decryption services.

15. The method of claim 1, wherein the API supports requests for security operations.

16. The method of claim 15, wherein the security operations include at least one of encryption/decryption, encryption key management, and user authentication.

17. The method of claim 1, wherein the hooks comprise at least one of operating system exit routines and operating system read triggers.

18. An encryption server for use in transparent encryption and decryption of application specific data, the server comprising an information processing device having:

(a) a first interface for coupling with a cryptographic appliance; and

(b) an application programming interlace (API) configured to be called by computer program code invoked for execution by at least one hook natively provided by one of an operating system (OS) and a native database management system (DBMS), the hook corresponding to a pre-defined OS or native DBMS data flow event or location and operable to invoke the computer program code when, responsive to a request from an application related to an input/output (I/O) operation on a storage mechanism, data now of the OS or DBMS reaches the pre-defined data now event or location, the API used by the computer program code to initiate cryptographic processing of an application-specific data item corresponding to the I/O operation request by the cryptographic appliance;

wherein the server acts as a cryptographic requests broker between the API and the cryptographic appliance.

19. The encryption server of claim 18, wherein the server acts as broker between the API and a security appliance for performing security operations.

20. The encryption server of claim 18, wherein the application programming interface (API) includes at least one of:

(i) a user authentication program module;

(ii) a data encryption and decryption program module; and

(iii) a cryptographic key management program module.

21. The encryption server of claim 20, wherein the cryptographic appliance is adapted to provide at least one of (i) fast encryption and/or decryption, (ii) user identification and authorization, and (iii) cryptographic key management.

22. A method for transparently encrypting application specific data, the method comprising:

providing computer program code which, in operation, is invoked by at least one-hook provided natively by and specific to a particular type of operating system (OS) or native database management system (DBMS), the hook corresponding to a pre-defined OS or native DBMS data flow event or location and operable to invoke the provided computer program code; and

responsive to a request from an application related to an input/output (I/O) operation on a storage mechanism that causes data flow of the OS or DBMS to reach the pre-defined data flow event or location, using the hook to invoke execution of the computer program code to initiate, via an application program interface (API) in cooperation with a cryptographic server, cryptographic processing of data corresponding to the I/O operation request.

23. A non-transitory computer readable storage medium storing computer readable instructions which, when read by a computer, cause the computer to perform a method for transparently encrypting application specific data, the method comprising:

providing an application program interface (API) coupled between a cryptographic server and a data store of an information processing device, the information processing device running at least one of an operating system (OS) and a native database management system (DBMS) that natively contains at least one hook corresponding to a pre-defined OS or native DBMS data flow event or location and operable to invoke third party-provided computer program code when data flow of the OS or DBMS reaches the pre-defined data flow event or location;

providing the third-party computer program code; and

responsive to a request from an application related to an input/output (I/O) operation on a storage mechanism that causes data flow of the OS or DMBS to reach the pre-defined data flow event or location, initiating via the API, by the computer program code invoked by the hook, cryptographic processing of an application-specific data item corresponding to the I/O operation request by a cryptographic appliance (CA) coupled to the cryptographic server.

24. A system for transparently encrypting application specific data, the system comprising:

an information processing device having;

an operating system (OS) natively providing at least one exit routine corresponding to a pre-defined OS data flow event or location, the exit routine associated with at least one of a native data access method, a native database management system, and a memory resident data store, the exit routine responsive to a request from an application related to an input/output (I/O) operation on a storage mechanism that causes data flow of the OS to reach the pre-defined data flow event or location; and

an application program interface (API) adapted to send a cryptographic service request based on the at least one exit routine;

an encryption server (ES) initiating a cryptographic service responsive to the cryptographic service request; and

a cryptographic appliance (CA) performing the initiated cryptographic service.