Web Encryption Accelerator for PCI-DSS Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The strict interpretation of PCI-DSS requirements for encrypting sensitive data in enterprise computing environments, particularly with the use of Enterprise Service Bus (ESB) systems, poses challenges as modern operating systems with virtual memory implementations may inadvertently persist unencrypted data to disk, making compliance difficult.
Innovation Solution
A Secure Web Encryption Accelerator (XWEA) is designed to encrypt data from the web browser before it reaches the back-end system, using a tokenization system to generate and store encrypted tokens in the database, allowing only tokens to be persisted, thus ensuring compliance with PCI-DSS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is persisted to database in ESB for inter-process communication, then communication efficiency is improved, but PCI-DSS compliance deteriorates due to potential unencrypted data persistence
Solution Approach 1:
The system performs encryption before data is persisted to the database. The XWEA encrypts sensitive data at the web application layer before it enters the ESB and reaches the database, ensuring that even if data is persisted, it remains encrypted and compliant with PCI-DSS requirements.
Solution Approach 2:
The XWEA acts as an intermediary component between the web application and the ESB/database. It intercepts data flows, performs encryption operations, and returns encrypted data to the original system, thereby mediating between communication needs and security requirements without disrupting the ESB's inter-process communication functionality.
2Reliability
If encryption is implemented at web application layer, then PCI-DSS compliance is improved, but application resource burden increases
Solution Approach 1:
The XWEA is designed as a self-service encryption system that manages its own encryption keys, cryptographic operations, and data persistence independently. It provides encryption services to multiple applications without requiring each application to implement its own encryption logic, thereby reducing the resource burden on individual applications while maintaining compliance.
3Productivity
If centralized encryption system is deployed, then cryptography operation efficiency is improved, but system complexity increases
Solution Approach 1:
The XWEA is designed as a universal encryption system that can serve multiple different applications and data types through a single centralized platform. It implements a standardized encryption interface and tokenization mechanism that works across various ESB configurations and database systems, reducing overall system complexity despite the centralized architecture by providing a unified solution rather than multiple specialized components.
Data Source
AI summary
Embodiments of the invention provide a system for encrypting web session data which may include a session management module adapted to receive data from a web application module and provide a token that represents the data in encrypted form to the web application, wherein the web application is adapted to use the token to represent the data. The system may also include a tokenizer module communicably coupled to the session management module, wherein the tokenizer module is adapted to receive the data and generate the token. Further, the system may include a database communicably coupled to the session management module, wherein the database is adapted to receive the token and the data, associate the token with the data, and store the token and the data.