Cryptographic proxy service
View Patent ↗A cryptographic proxy service may be provided. Upon determining that data associated with a network destination comprises at least some sensitive data, a cryptographic service may provide a security certificate associated with the network destination. The plurality of data may be encrypted according to the security certificate associated with the network destination and provided to the cryptographic service for re-encryption and transmission to the network destination.
1. A method comprising:
determining whether data associated with a network destination comprises sensitive data, wherein determining whether the data comprises sensitive data comprises applying a plurality of content evaluation rules to the data, wherein the applied content evaluation rules include keywords, expressions for types of data, and destination domain comparison; and
in response to determining that the data comprises sensitive data:
receiving, from an intermediate network destination, a security certificate associated with the network destination, wherein the certificate is generated at the intermediate network destination to impersonate the network destination;
encrypting the data according to the security certificate associated with the network destination; and
forwarding the encrypted data to the intermediate network destination.
2. The method of claim 1 , wherein the data comprises personally identifiable information.
3. The method of claim 1 , wherein the plurality of data comprises metadata identifying the data as sensitive data.
4. The method of claim 1 , wherein the intermediate network destination is associated with an enterprise associated with a source of the data.
5. The method of claim 4 , wherein the network destination is associated with a second enterprise.
6. The method of claim 1 , wherein the network destination comprises a cloud storage service.
7. The method of claim 1 , wherein the network destination comprises a social media service.
8. A non-transitory computer readable medium comprising program code that, when executed, performs a method comprising:
determining whether a plurality of data associated with a network destination comprises at least some sensitive data by applying content evaluation rules including keywords, expressions for types of data, and destination domain comparison; and
in response to determining that a plurality of data associated with a network destination comprises at least some sensitive data:
notifying a cryptographic service that the plurality of data comprises at least some sensitive data,
receiving a security certificate associated with the network destination from the cryptographic service, wherein the cryptographic service is not affiliated with the network destination but generates the certificate associated with the network destination,
encrypting the plurality of data according to the security certificate associated with the network destination, and
providing the encrypted plurality of data to the cryptographic service.
9. The non-transitory computer readable medium of claim 8 , wherein the cryptographic service comprises a second network destination.
10. The non-transitory computer readable medium of claim 8 , wherein the program code is executed on a client device operable to execute a second program code comprising the cryptographic service.
11. The non-transitory computer readable medium of claim 8 , further comprising retaining the security certificate for encryption of a second plurality of data associated with the network destination.
12. The non-transitory computer readable medium of claim 11 , wherein the second plurality of data is not associated with the plurality of data.
13. The non-transitory computer readable medium of claim 8 , further comprising receiving a second security certificate for a second plurality of data associated with the network destination.
14. A system comprising:
a memory store; and
a processor coupled to the memory store, wherein the processor is configured to execute stages comprising:
determining whether data associated with a network destination comprises sensitive data, wherein determining whether the data comprises sensitive data comprises applying a plurality of content evaluation rules to the data, wherein the applied content evaluation rules include keywords, expressions for types of data, and destination domain comparison; and
in response to determining that the data comprises sensitive data:
receiving, from an intermediate network destination, a security certificate associated with the network destination, wherein the certificate is generated at the intermediate network destination to impersonate the network destination;
encrypting the data according to the security certificate associated with the network destination; and
forwarding the encrypted data to the intermediate network destination.
15. The system of claim 14 , wherein the data comprises personally identifiable information.
16. The system of claim 14 , wherein the plurality of data comprises metadata identifying the data as sensitive data.
17. The system of claim 14 , wherein the intermediate network destination is associated with an enterprise associated with a source of the data.
18. The system of claim 17 , wherein the network destination is associated with a second enterprise.
19. The system of claim 14 , wherein the network destination comprises a cloud storage service.