SYSTEM AND METHOD FOR CRYPTOGRAPHIC DATA MANAGEMENT
The embodiments of this invention relate to methods for managing encrypted data. An embodiment of this method includes sending data from a first application to a server, encrypting the data sent from the first application to the server to produce encrypted data, storing the encrypted data at the server; and sending a token to the first application, wherein the token references the encrypted data.
1 . A method for managing data, comprising:
sending data from a first application to a server;
encrypting the data to produce encrypted data;
storing the encrypted data in a first database that is in communication with the server; and
storing a token, wherein the token references the encrypted data.
2 . The method of claim 1 , wherein the token is at least one of an application-defined token or a server-defined token.
3 . The method of claim 1 , wherein the token comprises at least a portion of the data in unencrypted form.
4 . The method of claim 1 , further comprising sharing the token with a second application.
5 . The method of claim 1 , further comprising storing the token in a second database communicably coupled to the first application.
6 . The method of claim 1 , wherein storing the encrypted data comprises storing the encrypted data in a database that is in communication with the server, and further comprising partitioning the encrypted data stored in the database.
7 . The method of claim 1 , further comprising rotating the encrypted data, wherein rotating the encrypted data comprises:
decrypting the encrypted data with the first encryption key to produce decrypted data;
encrypting the decrypted data with the second encryption key to produce re-encrypted data; and
replacing the encrypted data with the re-encrypted data.
8 . The method of claim 1 , further comprising sending the token from the first application to the server;
retrieving the encrypted data referenced by the token;
decrypting the encrypted data to produce decrypted data; and
sending the decrypted data to the first application.
9 . A computer program product embodied on a computer-usable medium, the medium having stored thereon a sequence of instructions which, when executed by a processor, causes the processor to execute a method for rotating data, the method comprising:
sending data from a first application to a server;
encrypting the data to produce encrypted data;
storing the encrypted data in a database that is in communication with the server; and
storing a token in a database that is in communication with the first application.
10 . The computer program of claim 9 , wherein the token is at least one of an application-defined token or a server-defined token.
11 . The method of claim 9 , wherein the token comprises at least a portion of the data in unencrypted form.
12 . The computer program product of claim 9 , further comprising sharing the token with a second application.
13 . The computer program product of claim 9 , wherein storing the encrypted data comprises storing the encrypted data in a database that is in communication with the server, and further comprising partitioning the encrypted data stored in the database.
14 . The computer program product of claim 9 , further comprising rotating encrypted data, wherein rotating the encrypted data comprises:
decrypting the encrypted data with the first encryption key to produce decrypted data;
encrypting the decrypted data with the second encryption key to produce re-encrypted data; and
replacing the encrypted data with the re-encrypted data.
15 . A system for managing data, comprising:
one or more application interfaces configured to receive data from one or more applications;
a cryptography module configured to encrypt the data received from the one or more applications to produce encrypted data; and
a database configured to store the encrypted data.
16 . The system of claim 15 , further comprising a token module configured to generate a token referencing the encrypted data.
17 . The system of claim 16 , wherein the token comprises at least a portion of the data in unencrypted form
18 . The system of claim 15 , further comprising a rotation module configured to rotate encrypted data.
19 . The system of claim 15 , wherein the database comprises a plurality of partitions.
20 . A method for managing data, comprising:
sending means for sending data from a first application to a server;
encrypting means for encrypting the data to produce encrypted data;
a first storing means for storing the encrypted data in a database that is in communication with the server; and
a second storing means for storing a token in a database that is in communication with the first application.
21 . The method of claim 20 , further comprising sharing means for sharing the token with a second application.
22 . The method of claim 20 , further comprising a second storing means for storing the token that is communicably coupled to the first application.
23 . The method of claim 20 , wherein the token comprises at least a portion of the data in unencrypted form.
24 . The method of claim 20 , further comprising rotating means for rotating data in response to rotating an encryption key, wherein rotating the encryption key comprises replacing a first encryption key with a second encryption key.
25 . The method of claim 20 , wherein the token comprises at least one of an application-defined token or a server-defined token.