Secure processing environment for protecting sensitive information
A processor-implemented method for a secure processing environment for protecting sensitive information is provided. The processor-implemented method may include receiving encrypted data and routing the encrypted data to the secure processing environment. Then the encrypted data may be decrypted and fields containing sensitive information may be found. The method may also include obfuscating the sensitive information and returning, by the secure processing environment, the decrypted data and obfuscated data.
1. A computer system for protecting sensitive information for a receiving application on a host server computer, the host server computer including a host memory, the computer system comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more tangible storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising:
program instructions to receive at the host server computer encrypted data and to route the encrypted data to a secure processing environment prior to the encrypted data entering the host memory, the encrypted data including specified sensitive information, the specified sensitive information including one or more fields of sensitive data, and each of said fields being identified by a tag;
program instructions to decrypt the encrypted data in the secure processing environment;
program instructions to identify in the secure processing environment the one or more fields within the decrypted data containing the specified sensitive information for the receiving application on the host server computer, including program instructions to search the decrypted information for the one or more tags identifying the one or more fields of sensitive data;
program instructions to obfuscate in the secure processing environment the identified decrypted sensitive information prior to entry of the identified decrypted sensitive information into the host memory, and in a way that is usable by the receiving application on the host server computer while protecting the identified decrypted sensitive information from other software on the host server computer, including program instructions for, each time one of the tags is identified, obfuscating the field of sensitive data identified by the each tag; and
program instructions to return the decrypted data from the secure processing environment with the identified decrypted sensitive information obfuscated to make the obfuscated sensitive information accessible to the receiving application on the host server computer, and wherein the sensitive information never appears in the host memory as the decrypted sensitive information.
2. The computer system of claim 1 , wherein the secure processing environment includes a policy for identifying the sensitive information.
3. The computer system of claim 2 , wherein the policy includes a specification of de-obfuscation of obfuscated information.
4. The computer system of claim 2 , wherein the policy may be provisioned into the secure processing environment when the computer system is initialized or dynamically based on an application program which executes on the computer system.
5. The computer system of claim 2 , wherein the policy uses at least one of meta data and a field definition document to identify the sensitive information.
6. The computer system of claim 1 , wherein the program instructions to identify a field within the decrypted data containing sensitive information comprise program instructions to identify the field by at least one of a tag and an offset into a received data stream.
7. The computer system of claim 6 , wherein a parallel scan logic is used to identify the tag from the decrypted data that identifies sensitive information.
8. A computer program product for protecting sensitive information for a receiving application on a host server computer, the host server computer including a host memory, the computer program product comprising:
one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more tangible storage devices, the program instructions comprising:
program instructions to receive at the host server computer encrypted data and to route the encrypted data to a secure processing environment prior to the encrypted data entering the host memory, the encrypted data including specified sensitive information, the specified sensitive information including one or more fields of sensitive data, and each of said fields being identified by a tag;
program instructions for the host server computer to route the encrypted data to a secure processing environment;
program instructions to decrypt the encrypted data in the secure processing environment;
program instructions to identify in the secure processing environment the one or more fields within the decrypted data containing the specified sensitive information for the receiving application on the host server computer, including program instructions to search the decrypted information for the one or more tags identifying the one or more fields of sensitive data;
program instructions to obfuscate in the secure processing environment the identified decrypted sensitive information prior to entry of the identified decrypted sensitive information into the host memory, and in a way that is usable by the receiving application on the host server computer while protecting the sensitive information from other software on the host server computer, including program instructions for, each time one of the tags is identified, obfuscating the field of sensitive data identified by the each tag; and
program instructions to return the decrypted data from the secure processing environment with the identified decrypted sensitive information obfuscated to make the obfuscated sensitive information accessible to the receiving application of the host server computer, and wherein the sensitive information never appears in the host memory as the decrypted sensitive information.
9. The computer program product of claim 8 , wherein the secure processing environment includes a policy for identifying the sensitive information.
10. The computer program product of claim 9 , wherein the policy includes a specification of de-obfuscation of obfuscated information.
11. The computer program product of claim 8 , wherein the program instructions to identify a field within the decrypted data containing sensitive information comprise program instructions to identify the field by at least one of a tag and an offset into a received data stream.
12. The computer system according to claim 2 , wherein:
the one or more processors include a plurality of tag registers to find the sensitive fields in the decrypted data; and
the program instructions to identify a field within the decrypted data containing sensitive information includes program instructions to compare values from the decrypted data with the tag registers to determine if said values match one of the tag registers.
13. The computer system according to claim 1 , wherein:
the program instructions to identify a field within the decrypted data containing the specified sensitive information includes program instructions to identify the field in the decrypted data containing the specified sensitive information after the encrypted data is decrypted in the secure processing environment; and
the program instructions to obfuscate the identified decrypted sensitive information include program instructions to obfuscate the identified decrypted sensitive information after the field within the decrypted data containing the specified sensitive information is identified.