Secure Processing Environment for Sensitive Data Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In client-server computing environments, sensitive information such as credit card numbers is exposed in cleartext on servers, leading to security risks due to visibility to operating systems, web servers, and malware, even during transmission and storage, as it is decrypted and available in memory dumps.
Innovation Solution
A processor-implemented method creates a secure processing environment that receives encrypted data, decrypts it, and obfuscates sensitive information within a secure vault, ensuring it remains encrypted and protected from other software, using hardware and parallel processing to minimize exposure and maintain confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive information is decrypted on the server for processing, then the data becomes accessible and usable by applications, but the information is exposed in cleartext to operating systems, web servers, and malware
Solution Approach 1:
The patent segments the processing environment into a secure processing environment (SPE) and a non-secure environment. The SPE is a isolated hardware enclave that decrypts and processes sensitive data internally, preventing cleartext exposure to the broader system. This segmentation allows the data to be usable within the SPE while remaining protected from external threats.
Solution Approach 2:
The secure processing environment acts as an intermediary between encrypted data storage and application processing. It receives encrypted data, decrypts it within the protected enclave, processes the sensitive information, and returns results without exposing cleartext to intermediate systems. This intermediary approach enables data usability while maintaining security isolation.
2Productivity
If sensitive data is stored in memory on the server, then it is readily accessible for processing, but it becomes visible in memory dumps and to debugging tools
Solution Approach 1:
The patent extracts sensitive data processing from the general server memory environment into a dedicated secure processing environment. By taking out the decryption and processing operations into this isolated enclave, the system maintains processing efficiency while preventing sensitive data from being written to or exposed through standard memory dumps and debugging interfaces.
Solution Approach 2:
The secure processing environment implements local quality by creating a specialized processing zone with different security characteristics than the rest of the system. Within this local environment, data can be in cleartext for efficient processing, but the enclave's boundaries prevent this cleartext from being accessible to external memory access mechanisms.
3Reliability
If encryption is applied during transmission, then data is protected in transit, but the data must be decrypted on the server creating security vulnerabilities
Solution Approach 1:
The patent implements a nested structure where the secure processing environment is embedded within the server infrastructure. The transmission encryption layer operates externally, and upon reaching the server, the data is passed to the nested SPE for decryption and processing. This nesting allows the system to maintain standard transmission security protocols while adding a layered secure processing component without requiring complete system redesign.
Data Source
AI summary
A processor-implemented method for a secure processing environment for protecting sensitive information is provided. The processor-implemented method may include receiving encrypted data and routing the encrypted data to the secure processing environment. Then the encrypted data may be decrypted and fields containing sensitive information may be found. The method may also include obfuscating the sensitive information and returning, by the secure processing environment, the decrypted data and obfuscated data.