METHOD AND SYSTEM FOR ENCRYPTING AND DECRYPTING DATA IN RESPONSE TO A USER REQUEST

Abstract

METHOD AND SYSTEM FOR ENCRYPTING AND DECODING DATA IN RESPONSE TO A USER REQUEST. One aspect of the invention relates to a method 100 for encrypting and decrypting data in response to a user request, the method 100 comprising the steps of: Selecting 104, via a traffic load balancer, a second domain name system from among at least the second domain name system attached to a first geographical area in which a first active hardware security module is implemented and a third domain name system attached to a second geographical area in which a second hardware security module is implemented, encryption and decryption data from the first hardware security module being replicated in the second hardware security module; Transmitting 110 the user request to the first hardware security module. Figure to be published with the abstract: Figure 2

Description

Title of the invention: METHOD AND SYSTEM FOR ENCRYPTING AND DECRYPTING DATA IN RESPONSE TO A USER REQUEST TECHNICAL FIELD OF THE INVENTION

[0001] The present invention relates to a method and system for encrypting and decrypting data in response to a user request, using a hardware security module. The invention has a particularly interesting application in the field of data encryption and decryption. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0002] Various hardware security module (HSM) technologies are known. A hardware security module is, for example, a PCI (Peripheral Component Interconnect) card. Its role is to reliably store secrets long-term for cryptographic use and to physically protect access to and use of these secrets over time. A hardware security module may also be capable of generating the secret. Generally, secrets are private keys used in cryptography.

[0003] This type of hardware security module ensures high data security and is generally compliant with FIPS ("Federal Information Protection Standards") 140 (for example 140-2), which establishes security requirements.

[0004] Such a hardware security module must sometimes undergo maintenance operations that can represent 0.1% of its usage time. More specifically, these maintenance operations result in downtime of approximately 40 minutes per month. During this maintenance time, users are unable to access the data encryption and decryption services normally provided by this hardware security module. Summary of the invention

[0005] The invention offers a solution to the problem mentioned above, by proposing a method and a system allowing, in response to a user request, the encryption and decryption of data at any time.

[0006] In this context, the invention thus relates, in its broadest sense, to a method for encrypting and decrypting data in response to a user request, the method comprising the steps of: • From a user request, resolve, via a first domain name system, a first canonical name; • Transmit, via the first domain name system, the first canonical name and the user request to a traffic load balancer; • Resolve, via the traffic load balancer, a second canonical name; • Select, via the traffic load balancer, a second system of domain names from at least the second domain name system attached to a first geographical area in which a first active hardware security module is implemented and a third domain name system attached to a second geographical area in which a second hardware security module is implemented, encryption and decryption data from the first hardware security module being replicated in the second hardware security module; • Transmit, via the traffic load balancer, the second canonical name and the user request to the second selected domain name system; • Resolve, via the second domain name system, a first IP address of the first hardware security module; • Transmit, via the second domain name system, the first IP address and the user request to a first load balancing system located in the first geographical area; • Select, via the first load balancing system, a first active reverse proxy server from among at least two reverse proxy servers located in the first geographical area; • Transmit, via the first load balancing system, the first IP address and the user request to the first selected reverse proxy server; • Transmit, via the first reverse proxy server, the user request to the first hardware security module.

[0007] During the execution of this process, a second domain name system attached to a first geographical area in which a first active hardware security module is implemented is selected. In other words, since the first hardware security module is active, a selection is made by the traffic load balancer to ensure that the user's request will be processed by a first hardware security module that is not undergoing maintenance.

[0008] In addition to the characteristics just mentioned in the preceding paragraph, the process according to this aspect of the invention may have one or more complementary characteristics from among the following, considered individually or according to all technically possible combinations.

[0009] According to a non-limiting aspect of the invention, the user request is formed by a address of a data resource.

[0010] According to a non-limiting aspect of the invention, when the operation of the first reverse proxy server located in the first geographical area is interrupted, the method comprises the following steps: • Select, via the first load balancing system, a second active reverse proxy server from among the at least two reverse proxy servers located in the first geographical area; • Transmit, via the first load balancing system, the first IP address and the user request to the second selected reverse proxy server; • Transmit, via the second reverse proxy server, the user request to the first hardware security module.

[0011] According to a non-limiting aspect of the invention, when the operation of the first hardware security module is interrupted, the method comprises the steps of: • Selecting, via the traffic load balancer, the third domain name system from among the at least second domain name system attached to the first geographical area and third domain name system attached to the second geographical area in which the second active hardware security module is located; • Transmit, via the traffic load balancer, the second canonical name and the user request to the third selected domain name system; • Resolve, via the third domain name system, a second IP address of the second hardware security module; • Transmit, via the third domain name system, the second IP address and the user request to a second load balancing system located in the second geographical area; • Select, via the second load balancing system, a first active reverse proxy server from among at least two reverse proxy servers located in the second geographical area; • Transmit, via the second load balancing system, the second IP address and the user request to the first selected reverse proxy server; • Transmit, via the first reverse proxy server, the user request to the second hardware security module.

[0012] According to a non-limiting aspect of the invention, when the operation of the first reverse proxy server located in the second geographical area is interrupted, the method comprises the following steps: • Select, via the second load balancing system, a second active reverse proxy server from among the at least two reverse proxy servers located in the second geographical area; • Transmit, via the second load balancing system, the second IP address and the user request to the second selected reverse proxy server; • Transmit, via the second reverse proxy server, the user request to the second hardware security module.

[0013] Another aspect of the invention relates to a computer program product downloadable from a communication network and / or recorded on a computer-readable medium and / or executable by a processor, said computer program product being notable in that it includes program code instructions for implementing the method according to any one of the aforementioned aspects of the invention, when the program is executed on a computer.

[0014] A different aspect of the invention relates to a system for encrypting and decrypting data in response to a user request, the system comprising: • A first domain name system configured to resolve a first canonical name from a user query; • A traffic load balancer configured for: • Receive, from the first domain name system, the first canonical name and the user query; • Resolve a second canonical name; • Select a second domain name system from at least the second domain name system attached to a first geographical area in which a first active hardware security module is implemented and a third domain name system attached to a second geographical area in which a second hardware security module is implemented, with encryption and decryption data from the first hardware security module being replicated in the second hardware security module; • The second and third domain name systems configured to receive, from the traffic load balancer, the second canonical name and the user request; • The second domain name system is further configured to resolve a first IP address of the first hardware security module; • The third domain name system is further configured to resolve a second IP address of the second hardware security module; • A first load balancing system implemented in the first geographical area configured to: • Receive, from the second domain name system, the first IP address and the user request; • Select a first active reverse proxy server from at least two reverse proxy servers located in the first geographic area; • At least two reverse proxy servers located in the first geographic area, each of the reverse proxy servers being configured to receive, from the first load balancing system, the first IP address and the user request; • The first hardware security module configured to receive the user request from at least two reverse proxy servers located in the first geographic area, • A second load balancing system implemented in the second geographic area, configured to: • Receive, from the third domain name system, the second IP address and the user request; • Select a first active reverse proxy server from at least two reverse proxy servers located in the second geographic area; • At least two reverse proxy servers located in the second geographic area, each reverse proxy server configured to receive the second IP address and user request from the second load balancer; and • The second hardware security module configured to receive the user request from at least two reverse proxy servers located in the second geographic area.

[0015] According to a non-limiting aspect of the invention, • The traffic load balancer is configured to select the third domain name system when the second domain name system attached to the first geographic zone in which the first hardware security module is deployed is selected and the operation of the first hardware security module is interrupted, and • The traffic load balancer is configured to select the second domain name system when the third domain name system attached to the second geographic zone in which the second hardware security module is located is selected and the function The operation of the second hardware security module is interrupted.

[0016] According to a non-limiting aspect of the invention, the system comprises, in at least one of the first or second geographical areas, three reverse proxy servers.

[0017] According to a non-limiting aspect of the invention, within at least one of the first or second geographical areas, the reverse proxy servers are spaced from each other by a distance of between 20 km and 80 km.

[0018] The invention and its various applications will be better understood upon reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0019] The figures are presented for illustrative purposes only and are in no way limiting of the invention.

[0020] [Fig. 1] illustrates a system for encrypting and decrypting data in response to a user request according to a non-limiting aspect of the invention.

[0021] [Fig.2] illustrates the steps of a process according to a non-limiting aspect of the invention, said process being implemented within the system to encrypt and decrypt data as illustrated in [Fig.1]. DETAILED DESCRIPTION

[0022] Fig. 1 shows a non-limiting example of a system 1 for encrypting and decrypting data in response to a user request according to the invention.

[0023] System 1 includes a first domain name system 2 configured to resolve a first canonical name from a user request generated via a web interface 3.

[0024] This first domain name system 2 is, for example, a DNS (Domain Name System) type domain name system. The first canonical name, on the other hand, is of the CNAME (Canonical Name) type.

[0025] The system 1 further includes a traffic load balancer 4 configured to: - Receive, from the first domain name system 2, the first canonical name and the user request, - Resolve a second canonical name, - Select a second domain name system 5 from among at least the second domain name system 5 attached to a first geographical zone Z1 in which a first active hardware security module 6 is implemented and a third domain name system 5' attached to a second geographical zone Z2 in which a second hardware security module 6' is implemented.

[0026] Traffic load balancer 4 is better known by the English term Traffic Manager.

[0027] Each of the second and third domain name systems 5, 5' can It can also be formed by a DNS (Domain Name System) type domain name system. The second canonical name is also of the CNAME (Canonical Name) type.

[0028] According to a non-limiting example of embodiment, the first geographical area ZI is formed by a Western Europe area and the second geographical area Z2 is formed by an Eastern Europe area.

[0029] In addition, each of the first and second hardware security modules 6, 6' is commonly referred to by the acronym HSM (for Hardware Security Module in English).

[0030] It should be noted that encryption and decryption data from the first hardware security module 6 are replicated in the second hardware security module 6'.

[0031] In addition, the second domain name system 5, the first hardware security module 6, the third domain name system 5' and the second hardware security module 6' belong to system 1 according to the invention.

[0032] The second domain name system 5 is specifically configured to: • Receive, from traffic load balancer 4, the second canonical name and the user request; • Resolve a first IP address (for Internet Protocol in English) of the first hardware security module 6.

[0033] The third domain name system 5' is, for its part, configured to: • Receive, from traffic load balancer 4, the second canonical name and the user request; • Resolve a second IP address of the second hardware security module 6'.

[0034] System 1 also includes a first load distribution system 7 located in the first geographical area ZI and a second load distribution system 7' located in the second geographical area Z2.

[0035] Each of the first and second load distribution systems 7, 7' is more commonly referred to by the English terminology of Load Balancer.

[0036] The first load distribution system 7 is configured to: • Receive, from the second domain name system 5, the first IP address and the user request; • Select a first active reverse proxy server 8 from among three reverse proxy servers 8, 8', 8” located in the first geographical area ZI.

[0037] System 1 comprises the first reverse proxy server 8, the second reverse proxy server 8' and the third reverse proxy server 8”.

[0038] Each of the reverse proxy servers is more commonly referred to as the ter- English minology of reverse proxy.

[0039] Each of the first, second and third reverse proxy servers 8, 8', 8" is configured to receive, from the first load balancing system 7, the first IP address and the user request.

[0040] The second load distribution system 7' is, for its part, configured to: • Receive, from the third domain name system 5', the second IP address and the user request; • Select a first active reverse proxy server 9 from among three reverse proxy servers 9, 9', 9" located in the second geographic area Z2.

[0041] System 1 comprises the first reverse proxy server 9, the second reverse proxy server 9' and the third reverse proxy server 9”.

[0042] Each of the first, second and third reverse proxy servers 9, 9', 9" is configured to receive, from the second load balancing system 7', the second IP address and the user request.

[0043] It should also be noted that: • The first hardware security module 6 is configured to receive, from the first reverse proxy server 8, the second reverse proxy server 8' and the third reverse proxy server 8”, the user request, and • The second hardware security module 6' is configured to receive, from the first reverse proxy server 9, the second reverse proxy server 9' and the third reverse proxy server 9”, the user request.

[0044] It should also be noted that the traffic load balancer 4 is configured to select the third domain name system 5' when the second domain name system 5 attached to the first geographical area ZI in which the first hardware security module 6 is located is selected and the operation of the first hardware security module 6 is interrupted.

[0045] Conversely, the traffic load balancer 4 is configured to select the second domain name system 5 when the third domain name system 5' attached to the second geographical zone Z2 in which the second hardware security module 6' is located is selected and the operation of the second hardware security module 6' is interrupted.

[0046] According to a particular implementation, • Within the first geographical zone Zl, the first, second, and third reverse proxy servers 8, 8', 8" are spaced between each other at a distance of between 20km and 80km, for example on the order of 50km; and • Within the second geographical area Z2, the first, second and third reverse proxy servers 9, 9', 9" are spaced from each other by a distance of between 20km and 80km, for example on the order of 50km.

[0047] This system 1 is constructed and arranged to perform the steps of the process 100 for encrypting and decrypting data in response to a user request as schematically illustrated in [Fig.2].

[0048] The process 100 includes a step of, from a user request, resolving 101, via the first domain name system 2, a first canonical name.

[0049] According to a non-limiting implementation, the user request is formed by an address of a data resource entered by the user via the web interface 3. This address of a data resource is usually designated by the acronym URL (for Uniform Resource Locator in English).

[0050] Then, it includes a step of transmitting 102, via the first domain name system 2, the first canonical name and the user request to the traffic load balancer 4.

[0051] This traffic load balancer 4 then resolves 103 a second canonical name and selects 104 the second domain name system 5 from among the second domain name system 5 attached to the first geographical area Z1 in which the first active hardware security module 6 is located and the third domain name system 5' attached to the second geographical area Z2 in which the second hardware security module 6' is located.

[0052] The selection of the second domain name system 5 over the third domain name system 5' can be made depending on whether the first hardware security module 6 is active and the second hardware security module 6' is inactive. Indeed, if the second hardware security module 6' is inactive, the services the user wishes to access will not be available. If both the first and second hardware security modules 6 and 6' are active, the selection can be made based on the current traffic loads in the first and second geographic zones Z1 and Z2.

[0053] The method 100 also includes a step of transmitting 105, via the traffic load balancer 4, the second canonical name and the user request to the second selected domain name system 5.

[0054] Once the second canonical name and user request are received by the second domain name system 5, the process 100 includes a step of resolving 106, via the second domain name system 5, a first IP address of the first hardware security module 6.

[0055] This first IP address and the user request are then transmitted 107, via the second domain name system 5, to the first load balancing system 7 located in the first geographical area Zl.

[0056] The first load balancing system 7 then selects 108 the first active reverse proxy server 8 from among the three reverse proxy servers 8, 8', 8" located in the first geographical area Zl, then transmits 109 the first IP address and the user request to the first selected reverse proxy server 8.

[0057] When the first reverse proxy server 8 receives the first IP address and user request, it forwards 110 the user request to the first hardware security module 6.

[0058] The first hardware security module 6 can then encrypt or decrypt data in response to the user request.

[0059] According to a non-limiting implementation, when the operation of the first reverse proxy server 8 located in the first geographical area Z1 is interrupted, the process 100 comprises the steps of: - Select 111, via the first load balancing system 7, a second active reverse proxy server 8' from among the first, second and third reverse proxy servers 8, 8', 8” located in the first geographical area Zl; - Transmit 112, via the first load balancing system 7, the first IP address and the user request to the second selected reverse proxy server 8'; - Transmit 113, via the second reverse proxy server 8', the user request to the first hardware security module 6.

[0060] According to a non-limiting implementation, when the operation of the first hardware security module 6 is interrupted, the method 100 includes the steps of: - Selecting 114, via the traffic load balancer 4, the third domain name system 5'; - Transmit 115, via the traffic load balancer 4, the second canonical name and the user request to the third selected domain name system 5'; - Resolve 116, via the third domain name system 5', a second IP address of the second hardware security module 6'; - Transmit 117, via the third domain name system 5', the second IP address and the user request to the second load balancing system 7'; - Select 118, via the second load balancing system 7', a first active reverse proxy server 9 from among the first, second and third reverse proxy servers 9, 9', 9" located in the second geographical area Z2; - Transmit 119, via the second load balancing system 7', the second IP address and the user request to the first selected reverse proxy server 9; - Transmit 120, via the first reverse proxy server 9, the user request to the second hardware security module 6'.

[0061] According to a non-limiting implementation, when the operation of the first reverse proxy server 9 located in the second geographical area Z2 is interrupted, the process 100 comprises the steps of: - Select 121, via the second load balancing system 7', a second active reverse proxy server 9' from among the first, second and third reverse proxy servers 9, 9', 9" located in the second geographical area Z2; - Transmit 122, via the second load balancing system 7', the second IP address and the user request to the second selected reverse proxy server 9'; - Transmit 123, via the second reverse proxy server 9', the user request to the second hardware security module 6'.

[0062] The various aspects of the aforementioned invention offer numerous advantages. Among these, we can mention: • Redirect a user's request to an active hardware security module; • To allow the user to use the services offered by the hardware security modules even when one of the hardware security modules is no longer functioning, this feature being possible because the data from the first hardware security module 6 is copied into the second hardware security module 6'; and • Allow the user to use the services offered by the hardware security modules even when one of the reverse proxy servers located in a geographical area is no longer functioning.

Claims

Demands

1. A method (100) for encrypting and decrypting data in response to a user request, said method (100) comprising the steps of: - From a user request, resolve (101), via a first domain name system (2), a first canonical name; - Transmit (102), via said first domain name system (2), said first canonical name and said user request to a traffic load balancer (4); - Resolve (103), via said traffic load balancer (4), a second canonical name; - Select (104), via said traffic load balancer (4), a second domain name system (5) from among at least said second domain name system (5) attached to a first geographical zone (Z1) in which is implemented a first active hardware security module (6) and a third domain name system (5') attached to a second geographical zone (Z2) in which is implemented a second hardware security module (6'), encryption and decryption data of said first hardware security module (6) being replicated in said second hardware security module (6'); - Transmit (105), via said traffic load balancer (4), said second canonical name and said user request to said second selected domain name system (5); - Resolve (106), via said second domain name system (5), a first IP address of said first hardware security module (6); - Transmit (107), via said second domain name system (5), said first IP address and said user request to a first load balancing system (7) located in said first geographical area (Zl); - Select (108), via said first load balancing system (7), a first active reverse proxy server (8) from among at least two reverse proxy servers (8, 8') located in said first geographical area (Zl); - Transmit (109), via said first distribution system charge (7), said first IP address and said user request to said first reverse proxy server (8) selected; Transmit (110), via said first reverse proxy server (8), said user request to said first hardware security module (6).

2. Method (100) according to the preceding claim, characterized in that the user request is formed by an address of a data resource.

3. A method (100) according to any one of the preceding claims, characterized in that when the operation of the first reverse proxy server (8) located in the first geographical area (Zl) is interrupted, the method (100) comprises the steps of: - Selecting (111), via the first load balancing system (7), a second active reverse proxy server (8') from among the at least two reverse proxy servers (8, 8') located in said first geographical area (Zl); - Transmitting (112), via said first load balancing system (7), the first IP address and the user request to said selected second reverse proxy server (8'); - Transmitting (113), via said second reverse proxy server (8'), said user request to the first hardware security module (6).

4. Method (100) according to any one of the preceding claims, characterized in that when the operation of the first hardware security module (6) is interrupted, the method (100) comprises the steps of: - Selecting (114), via the traffic load balancer (4), the third domain name system (5') from among the at least second domain name system (5) attached to the first geographical zone (Z1) and third domain name system (5') attached to the second geographical zone (Z2) in which the second active hardware security module (6') is located; - Transmit (115), via said traffic load balancer (4), the second canonical name and the user request to said third selected domain name system (5'); - Resolve (116), via said third domain name system (5'), a second IP address of the second hardware security module (6'); - Transmit (117), via said third domain name system (5'), said second IP address and said user request to a second load balancing system (7') located in said second geographical area (Z2); - Select (118), via said second load balancing system (7'), a first active reverse proxy server (9) from among at least two reverse proxy servers (9, 9') located in said second geographical area (Z2); - Transmit (119), via said second load balancing system (7'), said second IP address and said user request to said first selected reverse proxy server (9); - Transmit (120), via said second reverse proxy server (9), said user request to said second hardware security module (6').

5. A method (100) according to the preceding claim, characterized in that when the operation of the first reverse proxy server (9) located in the second geographical area (Z2) is interrupted, the method (100) comprises the steps of: - Select (121), via the second load balancing system (7'), a second active reverse proxy server (9') from among the at least two reverse proxy servers (9, 9') located in said second geographical area (Z2); - Transmit (122), via said second load balancing system (7'), the second IP address and the user request to said second selected reverse proxy server (9'); - Transmit (123), via said second reverse proxy server (9'), said user request to the second hardware security module (6').

6. Product computer program downloadable from a communication network and / or recorded on a computer-readable medium and / or executable by a processor, characterized in that it includes program code instructions for implementing the method (100) according to any one of the preceding claims, when the program is executed on a computer.

7. System (1) for encrypting and decrypting data in response to a user request, said system (1) comprising: - A first domain name system (2) configured to resolve a first canonical name from a user request; - A traffic load balancer (4) configured to: • Receive, from said first domain name system (2), said first canonical name and said user request; • Resolve a second canonical name;• Select a second domain name system (5, 5') from at least said second domain name system (5) attached to a first geographic zone (Z1) in which a first active hardware security module (6) is deployed and a third domain name system (5') attached to a second geographic zone (Z2) in which a second hardware security module (6') is deployed, encryption and decryption data from said first hardware security module (6) being replicated in said second hardware security module (6'); - Said second and third domain name systems (5, 5') configured to receive, from said traffic load balancer (4), said second canonical name and said user request; - Said second domain name system (5) being further configured to resolve a first IP address from said first hardware security module (6);- Said third domain name system (5') being further configured to resolve a second IP address of said; second hardware security module (6'); A first load balancing system (7) implemented in said first geographical zone (Zl) configured for: • To receive, from said second domain name system (5), said first IP address and said user request; • Select a first active reverse proxy server (8) from at least two reverse proxy servers (8, 8”) located in said first geographical area (Zl); Said at least two reverse proxy servers (8, 8”) located in said first geographical area (Zl), each of said reverse proxy servers (8, 8”) being configured to receive, from said first load balancing system (7), said first IP address and said user request; The said first hardware security module (6) configured to receive, from said at least two reverse proxy servers (8, 8”) located in said first geographical zone (Z1), said user request, A second load balancing system (7') located in said second geographical zone (Z2) configured to: • Receive, from said third domain name system (5'), said second IP address and said user request; • Select a first active reverse proxy server (9,) from at least two reverse proxy servers (9, 9') located in said second geographical zone (Z2); Said at least two reverse proxy servers (9, 9') located in said second geographic zone (Z2), each of said reverse proxy servers (9, 9') being configured to receive, from said second load balancing system (7'), said second IP address and said user request; and Said second hardware security module (6') configured to receive, from said at least two reverse proxy servers (9, 9') located in said second geographical area (Z2), said user request.

8. System (1) according to the preceding claim, characterized in that: - The traffic load balancer (4) is configured to select the third domain name system (5') when the second domain name system (5) attached to the first geographical zone (Z1) in which the first hardware security module (6) is located is selected and the operation of said first hardware security module (6) is interrupted; and - The traffic load balancer (4) is configured to select the second domain name system (5) when the third domain name system (5') attached to the second geographical zone (Z2) in which the second hardware security module (6') is located is selected and the operation of the second hardware security module (6') is interrupted.

9. System (1) according to any one of claims 7 or 8, characterized in that it comprises, in at least one of the first or second geographical areas (Z1, Z2), three reverse proxy servers (8, 8', 8”, 9, 9', 9”).

10. System (1) according to any one of claims 7 to 9, characterized in that within at least one of the first or second geographical zones (Z1, Z2), the reverse proxy servers (8, 8', 8”, 9, 9', 9”) are spaced from each other by a distance of between 20 km and 80 km.

Images