METHOD AND SYSTEM FOR ENCRYPTING AND DECRYPTING DATA IN RESPONSE TO A USER REQUEST

Abstract

METHOD AND SYSTEM FOR ENCRYPTING AND DECRYPTING DATA IN RESPONSE TO A USER REQUEST One aspect of the invention relates to a method 100 for encrypting and decrypting data in response to a user request, the method 100 comprising the steps of: Selecting 104, via a traffic load balancer, a second domain name system from at least the second domain name system attached to a first geographical area in which a first active hardware security module is installed and a third domain name system attached to a second geographical area in which a second hardware security module is installed, encryption and decryption data from the first hardware security module being replicated in the second hardware security module; Transmitting 110 the user request to the first hardware security module. Figure to be published with the abstract: Figure 2

Description

Title of the invention: METHOD AND SYSTEM FOR ENCRYPTING AND DECRYPTING DATA IN RESPONSE TO A USER REQUEST TECHNICAL FIELD OF THE INVENTION

[0001] The present invention relates to a method and a system for encrypting and decrypting, via a hardware security module, data in response to a user request. The invention finds a particularly interesting application in the field of data encryption and decryption. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0002] Various hardware security module technologies, also called HSM (Hardware Security Module), are known. A hardware security module is, for example, formed by a PCI (Peripheral Component Interconnect) card. Its role is to reliably store secrets, in the long term, for cryptographic use and to physically protect access to these secrets and their use over time. A hardware security module may also be capable of generating this secret. Generally, secrets are private keys used in cryptography.

[0003] This type of hardware security module provides high data security and is generally compliant with the FIPS ("Federal Information Protection Standards") 140 standard (e.g., 140-2), which establishes security requirements.

[0004] Such a hardware security module must sometimes undergo maintenance operations that may represent 0.1% of its usage time. These maintenance operations more specifically result in a shutdown of around 40 minutes per month. Thus, during this maintenance time, users are not able to access the data encryption and decryption services usually provided by this hardware security module. Summary of the invention

[0005] The invention provides a solution to the problem mentioned above, by proposing a method and a system allowing, in response to a user request, to encrypt and decrypt data at any time.

[0006] In this context, the invention thus relates, in its broadest sense, to a method for encrypting and decrypting data in response to a user request, the method comprising the steps of: • From a user query, resolve, via a first domain name system, a first canonical name; • Forward, via the first domain name system, the first canonical name and the user request to a traffic load balancer; • Resolve, via the traffic load balancer, a second canonical name; • Select, via the traffic load balancer, a second system of domain names from at least the second domain name system attached to a first geographic area in which a first active hardware security module is installed and a third domain name system attached to a second geographic area in which a second hardware security module is installed, encryption and decryption data from the first hardware security module being replicated in the second hardware security module; • Forward, via the traffic load balancer, the second canonical name and the user query to the second selected domain name system; • Resolve, via the second domain name system, a first IP address of the first hardware security module; • Transmit, via the second domain name system, the first IP address and the user request to a first load balancing system located in the first geographic area; • Select, via the first load balancing system, a first active reverse proxy server from among at least two reverse proxy servers located in the first geographic area; • Forward, via the first load balancing system, the first IP address and user request to the first selected reverse proxy server; • Forward the user request to the first hardware security module via the first reverse proxy server.

[0007] When executing this method, a second domain name system attached to a first geographic area in which a first active hardware security module is installed is selected. In other words, since the first hardware security module is active, a selection is made by the traffic load balancer in order to assure the user that his request will be processed by a first hardware security module which is not under maintenance.

[0008] In addition to the characteristics which have just been mentioned in the preceding paragraph, the method according to this aspect of the invention may have one or more complementary characteristics among the following, considered individually or according to all technically possible combinations.

[0009] According to a non-limiting aspect of the invention, the user request is formed by a address of a data resource.

[0010] According to a non-limiting aspect of the invention, when the operation of the first reverse proxy server located in the first geographical area is interrupted, the method comprises the steps of: • Select, via the first load balancing system, a second active reverse proxy server from among the at least two reverse proxy servers located in the first geographic area; • Forward, via the first load balancing system, the first IP address and the user request to the second selected reverse proxy server; • Forward the user request to the first hardware security module via the second reverse proxy server.

[0011] According to a non-limiting aspect of the invention, when the operation of the first hardware security module is interrupted, the method comprises the steps of: • Selecting, via the traffic load balancer, the third domain name system from among the at least second domain name system attached to the first geographical area and third domain name system attached to the second geographical area in which the second active hardware security module is installed; • Forward, via the traffic load balancer, the second canonical name and the user query to the third selected domain name system; • Resolve, via the third domain name system, a second IP address of the second hardware security module; • Transmit, via the third domain name system, the second IP address and the user request to a second load balancing system located in the second geographical area; • Select, via the second load balancing system, a first active reverse proxy server from among at least two reverse proxy servers located in the second geographic area; • Forward, via the second load balancing system, the second IP address and the user request to the first selected reverse proxy server; • Forward the user request to the second hardware security module via the first reverse proxy server.

[0012] According to a non-limiting aspect of the invention, when the operation of the first reverse proxy server located in the second geographical area is interrupted, the method comprises the steps of: • Select, via the second load balancing system, a second active reverse proxy server from among the at least two reverse proxy servers located in the second geographic area; • Forward, via the second load balancing system, the second IP address and the user request to the second selected reverse proxy server; • Forward the user request to the second hardware security module via the second reverse proxy server.

[0013] Another aspect of the invention relates to a computer program product downloadable from a communications network and / or recorded on a computer-readable medium and / or executable by a processor, said computer program product being remarkable in that it comprises program code instructions for implementing the method according to any one of the aforementioned aspects of the invention, when the program is executed on a computer.

[0014] A different aspect of the invention relates to a system for encrypting and decrypting data in response to a user request, the system comprising: • A first domain name system configured to, from a user query, resolve a first canonical name; • A traffic load balancer configured to: • Receive, from the first domain name system, the first canonical name and the user query; • Resolve a second canonical name; • Selecting a second domain name system from at least the second domain name system attached to a first geographic area in which a first active hardware security module is installed and a third domain name system attached to a second geographic area in which a second hardware security module is installed, encryption and decryption data from the first hardware security module being replicated in the second hardware security module; • The second and third domain name systems configured to receive, from the traffic load balancer, the second canonical name and the user request; • The second domain name system being further configured to resolve a first IP address of the first hardware security module; • The third domain name system being further configured to resolve a second IP address of the second hardware security module; • A first load distribution system installed in the first geographical area configured to: • Receive, from the second domain name system, the first IP address and the user request; • Select a first active reverse proxy server from at least two reverse proxy servers located in the first geographic area; • The at least two reverse proxy servers located in the first geographic area, each of the reverse proxy servers being configured to receive, from the first load balancing system, the first IP address and the user request; • The first hardware security module configured to receive, from at least two reverse proxy servers located in the first geographic area, the user request, • A second load distribution system installed in the second geographic area configured to: • Receive, from the third domain name system, the second IP address and the user request; • Select a first active reverse proxy server from at least two reverse proxy servers located in the second geographic area; • The at least two reverse proxy servers located in the second geographic area, each of the reverse proxy servers being configured to receive, from the second load balancing system, the second IP address and the user request; and • The second hardware security module configured to receive the user request from at least two reverse proxy servers located in the second geographic area.

[0015] According to a non-limiting aspect of the invention, • The traffic load balancer is configured to select the third domain name system when the second domain name system attached to the first geographic area in which the first hardware security module is located is selected and the operation of the first hardware security module is interrupted, and • The traffic load balancer is configured to select the second domain name system when the third domain name system attached to the second geographic area in which the second hardware security module is located is selected and the func Operation of the second hardware security module is interrupted.

[0016] According to a non-limiting aspect of the invention, the system comprises, in at least one of the first or second geographical zones, three reverse proxy servers.

[0017] According to a non-limiting aspect of the invention, within at least one of the first or second geographical zones, the reverse proxy servers are spaced from each other by a distance of between 20 km and 80 km.

[0018] The invention and its various applications will be better understood upon reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0019] The figures are presented for information purposes only and in no way limit the invention.

[0020] [Fig. 1] illustrates a system for encrypting and decrypting data in response to a user request according to a non-limiting aspect of the invention.

[0021] [Fig.2] illustrates the steps of a method according to a non-limiting aspect of the invention, said method being implemented within the system to encrypt and decrypt data as illustrated in [Fig.l]. DETAILED DESCRIPTION

[0022] [Fig.l] shows a non-limiting exemplary embodiment of a system 1 for encrypting and decrypting data in response to a user request according to the invention.

[0023] The system 1 comprises a first domain name system 2 configured to, from a user query generated via a web interface 3, resolve a first canonical name.

[0024] This first domain name system 2 is, for example, a domain name system of the DNS type (for Domain Name System in English). The first canonical name is, for its part, of the CNAME type (for Canonical Name in English).

[0025] The system 1 further comprises a traffic load balancer 4 configured to: - Receive, from the first domain name system 2, the first canonical name and the user request, - Resolve a second canonical name, - Select a second domain name system 5 from among at least the second domain name system 5 attached to a first geographical zone ZI in which a first active hardware security module 6 is installed and a third domain name system 5' attached to a second geographical zone Z2 in which a second hardware security module 6' is installed.

[0026] Traffic load balancer 4 is better known by the English terminology of Traffic Manager.

[0027] Each of the second and third domain name systems 5, 5' may also be formed by a domain name system of the DNS type (for Domain Name System in English). The second canonical name is also of the CNAME type (for Canonical Name in English).

[0028] According to a non-limiting exemplary embodiment, the first geographical zone ZI is formed by a Western Europe zone and the second geographical zone Z2 is formed by an Eastern Europe zone.

[0029] Furthermore, each of the first and second hardware security modules 6, 6' is commonly referred to by the acronym HSM (for Hardware Security Module in English).

[0030] It should be noted that encryption and decryption data of the first hardware security module 6 are replicated in the second hardware security module 6'.

[0031] Furthermore, the second domain name system 5, the first hardware security module 6, the third domain name system 5' and the second hardware security module 6' belong to the system 1 according to the invention.

[0032] The second domain name system 5 is notably configured to: • Receive, from traffic load balancer 4, the second canonical name and the user request; • Resolve a first IP address (for Internet Protocol in English) of the first hardware security module 6.

[0033] The third 5' domain name system is configured to: • Receive, from traffic load balancer 4, the second canonical name and the user request; • Resolve a second IP address of the second 6' hardware security module.

[0034] The system 1 also comprises a first load distribution system 7 installed in the first geographical zone ZI and a second load distribution system 7' installed in the second geographical zone Z2.

[0035] Each of the first and second load distribution systems 7, 7' is more commonly referred to by the English terminology of Load Balancer.

[0036] The first load distribution system 7 is configured to: • Receive, from the second domain name system 5, the first IP address and the user request; • Select a first active reverse proxy server 8 from three reverse proxy servers 8, 8', 8” located in the first geographical area ZI.

[0037] System 1 comprises the first reverse proxy server 8, the second reverse proxy server 8' and the third reverse proxy server 8”.

[0038] Each of the reverse proxy servers is more commonly referred to by the ter- English reverse proxy minology.

[0039] Each of the first, second and third reverse proxy servers 8, 8', 8” is configured to receive, from the first load balancing system 7, the first IP address and the user request.

[0040] The second load distribution system 7' is, for its part, configured to: • Receive, from the third 5' domain name system, the second IP address and the user request; • Select a first active reverse proxy server 9 from three reverse proxy servers 9, 9', 9” located in the second geographical zone Z2.

[0041] System 1 comprises the first reverse proxy server 9, the second reverse proxy server 9' and the third reverse proxy server 9”.

[0042] Each of the first, second and third reverse proxy servers 9, 9', 9” is configured to receive, from the second load balancing system 7', the second IP address and the user request.

[0043] It should further be noted that: • The first hardware security module 6 is configured to receive, from the first reverse proxy server 8, the second reverse proxy server 8' and the third reverse proxy server 8”, the user request, and • The second hardware security module 6' is configured to receive, from the first reverse proxy server 9, the second reverse proxy server 9' and the third reverse proxy server 9”, the user request.

[0044] It should also be noted that the traffic load balancer 4 is configured to select the third domain name system 5' when the second domain name system 5 attached to the first geographical zone ZI in which the first hardware security module 6 is installed is selected and the operation of the first hardware security module 6 is interrupted.

[0045] Conversely, the traffic load balancer 4 is configured to select the second domain name system 5 when the third domain name system 5' attached to the second geographical zone Z2 in which the second hardware security module 6' is installed is selected and the operation of the second hardware security module 6' is interrupted.

[0046] According to a particular implementation, • Within the first geographical zone Zl, the first, second and third reverse proxy servers 8, 8', 8” are spaced from each other by a distance of between 20km and 80km, for example of the order of 50km; and • Within the second geographical zone Z2, the first, second and third reverse proxy servers 9, 9', 9” are spaced from each other by a distance of between 20km and 80km, for example of the order of 50km.

[0047] This system 1 is constructed and arranged to execute the steps of the method 100 for encrypting and decrypting data in response to a user request as schematically illustrated in [Fig.2].

[0048] The method 100 comprises a step of, from a user request, resolving 101, via the first domain name system 2, a first canonical name.

[0049] According to a non-limiting implementation, the user request is formed by an address of a data resource provided by the user via the web interface 3. This address of a data resource is usually designated by the acronym URL (for Uniform Resource Locator in English).

[0050] Then, it comprises a step of transmitting 102, via the first domain name system 2, the first canonical name and the user request to the traffic load balancer 4.

[0051] This traffic load balancer 4 then resolves 103 a second canonical name and selects 104 the second domain name system 5 from among the second domain name system 5 attached to the first geographical zone ZI in which the first active hardware security module 6 is installed and the third domain name system 5' attached to the second geographical zone Z2 in which the second hardware security module 6' is installed.

[0052] The selection of the second domain name system 5 with respect to the third domain name system 5' can be carried out according to whether the first hardware security module 6 is active and the second hardware security module 6' is inactive. Indeed, if the second hardware security module 6' is inactive, the services which the user wishes to access will not be accessible. If the first and second hardware security modules 6, 6' are active, the selection can be carried out according to the current traffic loads in the first and second geographical zones Z1, Z2.

[0053] The method 100 also comprises a step of transmitting 105, via the traffic load balancer 4, the second canonical name and the user request to the second selected domain name system 5.

[0054] Once the second canonical name and the user request are received by the second domain name system 5, the method 100 comprises a step of resolving 106, via the second domain name system 5, a first IP address of the first hardware security module 6.

[0055] This first IP address and the user request are then transmitted 107, via the second domain name system 5, to the first load distribution system 7 located in the first geographical zone Zl.

[0056] The first load balancing system 7 then selects 108 the first active reverse proxy server 8 from among the three reverse proxy servers 8, 8', 8” located in the first geographical area Zl, then transmits 109 the first IP address and the user request to the first selected reverse proxy server 8.

[0057] When the first reverse proxy server 8 receives the first IP address and the user request, it transmits 110 the user request to the first hardware security module 6.

[0058] The first hardware security module 6 can then encrypt or decrypt data in response to the user request.

[0059] According to a non-limiting implementation, when the operation of the first reverse proxy server 8 located in the first geographical zone Z1 is interrupted, the method 100 comprises the steps of: - Select 111, via the first load balancing system 7, a second active reverse proxy server 8' from among the first, second and third reverse proxy servers 8, 8', 8” located in the first geographical area Zl; - Transmit 112, via the first load balancing system 7, the first IP address and the user request to the second selected reverse proxy server 8'; - Transmit 113, via the second reverse proxy server 8', the user request to the first hardware security module 6.

[0060] According to a non-limiting implementation, when the operation of the first hardware security module 6 is interrupted, the method 100 comprises the steps of: - Selecting 114, via the traffic load balancer 4, the third domain name system 5'; - Forward 115, via traffic load balancer 4, the second canonical name and user request to the third selected domain name system 5'; - Resolve 116, via the third domain name system 5', a second IP address of the second hardware security module 6'; - Transmit 117, via the third domain name system 5', the second IP address and the user request to the second load balancing system 7'; - Select 118, via the second load balancing system 7', a first active reverse proxy server 9 among the first, second and third reverse proxy servers 9, 9', 9” located in the second geographical zone Z2; - Transmit 119, via the second load balancing system 7', the second IP address and the user request to the first selected reverse proxy server 9; - Transmit 120, via the first reverse proxy server 9, the user request to the second hardware security module 6'.

[0061] According to a non-limiting implementation, when the operation of the first reverse proxy server 9 located in the second geographical zone Z2 is interrupted, the method 100 comprises the steps of: - Select 121, via the second load balancing system 7', a second active reverse proxy server 9' from among the first, second and third reverse proxy servers 9, 9', 9” located in the second geographical zone Z2; - Transmit 122, via the second load balancing system 7', the second IP address and the user request to the second selected reverse proxy server 9'; - Transmit 123, via the second reverse proxy server 9', the user request to the second hardware security module 6'.

[0062] The various aspects of the invention mentioned above have numerous advantages. Among these, we can cite: • Redirect a user's request to an active hardware security module; • Allow the user to use the services offered by the hardware security modules when one of the hardware security modules is no longer functioning, this characteristic being possible because the data from the first hardware security module 6 is copied into the second hardware security module 6'; and • Allow the user to use the services offered by the hardware security modules while one of the reverse proxy servers located in a geographical area is no longer functioning.

Claims

Claims

1. A method (100) for encrypting and decrypting data in response to a user request, said method (100) comprising the steps of: - From a user query, resolve (101), via a first domain name system (2), a first canonical name; - Transmitting (102), via said first domain name system (2), said first canonical name and said user request to a traffic load balancer (4); - Resolving (103), via said traffic load balancer (4), a second canonical name; - Selecting (104), via said traffic load balancer (4), a second domain name system (5) from at least said second domain name system (5) attached to a first geographical area (Zl) in which a first active hardware security module (6) is installed and a third domain name system (5') attached to a second geographical area (Z2) in which a second hardware security module (6') is installed, encryption and decryption data of said first hardware security module (6) being replicated in said second hardware security module (6'); - Transmitting (105), via said traffic load balancer (4), said second canonical name and said user request to said second selected domain name system (5); - Resolving (106), via said second domain name system (5), a first IP address of said first hardware security module (6); - Transmitting (107), via said second domain name system (5), said first IP address and said user request to a first load distribution system (7) located in said first geographical area (Zl); - Selecting (108), via said first load distribution system (7), a first active reverse proxy server (8) from among at least two reverse proxy servers (8, 8') located in said first geographical area (Zl); - Transmit (109), via said first distribution system of load (7), said first IP address and said user request to said first selected reverse proxy server (8); Transmitting (110), via said first reverse proxy server (8), said user request to said first hardware security module (6).

2. Method (100) according to the preceding claim, characterized in that the user request is formed by an address of a data resource.

3. Method (100) according to any one of the preceding claims, characterized in that when the operation of the first reverse proxy server (8) located in the first geographical area (Zl) is interrupted, the method (100) comprises the steps of: - Selecting (111), via the first load distribution system (7), a second active reverse proxy server (8') from among the at least two reverse proxy servers (8, 8') located in said first geographical area (Zl); - Transmitting (112), via said first load distribution system (7), the first IP address and the user request to said selected second reverse proxy server (8'); - Transmitting (113), via said second reverse proxy server (8'), said user request to the first hardware security module (6).

4. Method (100) according to any one of the preceding claims, characterized in that when the operation of the first hardware security module (6) is interrupted, the method (100) comprises the steps of: - Selecting (114), via the traffic load balancer (4), the third domain name system (5') from among the at least second domain name system (5) attached to the first geographical area (Zl) and third domain name system (5') attached to the second geographical area (Z2) in which the second active hardware security module (6') is installed; - Transmitting (115), via said traffic load balancer (4), the second canonical name and the user request to said third selected domain name system (5'); - Resolving (116), via said third domain name system (5'), a second IP address of the second hardware security module (6'); - Transmitting (117), via said third domain name system (5'), said second IP address and said user request to a second load balancing system (7') located in said second geographic area (Z2); - Selecting (118), via said second load distribution system (7'), a first active reverse proxy server (9) from among at least two reverse proxy servers (9, 9') located in said second geographical area (Z2); - Transmitting (119), via said second load balancing system (7'), said second IP address and said user request to said first selected reverse proxy server (9); - Transmit (120), via said second reverse proxy server (9), said user request to said second hardware security module (6').

5. Method (100) according to the preceding claim, characterized in that when the operation of the first reverse proxy server (9) located in the second geographical zone (Z2) is interrupted, the method (100) comprises the steps of: - Select (121), via the second load balancing system (7'), a second active reverse proxy server (9') from among the at least two reverse proxy servers (9, 9') located in said second geographical area (Z2); - Transmitting (122), via said second load balancing system (7'), the second IP address and the user request to said second selected reverse proxy server (9'); - Transmit (123), via said second reverse proxy server (9'), said user request to the second hardware security module (6').

6. Computer program product downloadable from a communication network and / or recorded on a computer-readable medium and / or executable by a processor, characterized in that it comprises program code instructions for implementing the method (100) according to any one of the preceding claims, when the program is executed on a computer.

7. System (1) for encrypting and decrypting data in response to a user query, said system (1) comprising: - A first domain name system (2) configured to, from a user query, resolve a first canonical name; - A traffic load balancer (4) configured to: • Receive, from said first domain name system (2), said first canonical name and said user query; • Resolve a second canonical name;• Selecting a second domain name system (5, 5') from at least said second domain name system (5) attached to a first geographical area (Zl) in which a first active hardware security module (6) is installed and a third domain name system (5') attached to a second geographical area (Z2) in which a second hardware security module (6') is installed, encryption and decryption data of said first hardware security module (6) being replicated in said second hardware security module (6'); - Said second and third domain name systems (5, 5') configured to receive, from said traffic load balancer (4), said second canonical name and said user request; - Said second domain name system (5) being further configured to resolve a first IP address of said first hardware security module (6);- Said third domain name system (5') being further configured to resolve a second IP address of said; second hardware security module (6'); A first load distribution system (7) installed in said first geographical zone (Zl) configured to: • Receive, from said second domain name system (5), said first IP address and said user request; • Select a first active reverse proxy server (8) from at least two reverse proxy servers (8, 8”) located in said first geographic area (Zl); Said at least two reverse proxy servers (8, 8”) located in said first geographical area (Zl), each of said reverse proxy servers (8, 8”) being configured to receive, from said first load balancing system (7), said first IP address and said user request; Said first hardware security module (6) configured to receive, from said at least two reverse proxy servers (8, 8”) located in said first geographical area (Zl), said user request, A second load balancing system (7') located in said second geographical area (Z2) configured to: • Receive, from said third domain name system (5'), said second IP address and said user request; • Select a first active reverse proxy server (9,) from at least two reverse proxy servers (9, 9') located in said second geographic area (Z2); Said at least two reverse proxy servers (9, 9') located in said second geographical zone (Z2), each of said reverse proxy servers (9, 9') being configured to receive, from said second load balancing system (7'), said second IP address and said user request; and Said second hardware security module (6') configured to receive, from said at least two reverse proxy servers (9, 9') installed in said second geographic area (Z2), said user request.

8. System (1) according to the preceding claim, characterized in that: - The traffic load balancer (4) is configured to select the third domain name system (5') when the second domain name system (5) attached to the first geographical area (Zl) in which the first hardware security module (6) is installed is selected and the operation of said first hardware security module (6) is interrupted; and - The traffic load balancer (4) is configured to select the second domain name system (5) when the third domain name system (5') attached to the second geographical area (Z2) in which the second hardware security module (6') is installed is selected and the operation of the second hardware security module (6') is interrupted.

9. System (1) according to any one of claims 7 or 8, characterized in that it comprises, in at least one of the first or second geographical zones (Zl, Z2), three reverse proxy servers (8, 8', 8”, 9, 9', 9”).

10. System (1) according to any one of claims 7 to 9, characterized in that within at least one of the first or second geographical zones (Zl, Z2), the reverse proxy servers (8, 8', 8”, 9, 9', 9”) are spaced from each other by a distance of between 20 km and 80 km.

Images