Using cryptography and application gateway to eliminate malicious data access and data exfiltration

1. A system for data protection comprising:

a gateway, the gateway including;

a communication interface configured to receive and send encrypted and non-encrypted data;

a secure storage device configured to store a plurality of pre-configured encryption policies;

a processing circuit coupled to the secure storage device and the communication interface, the processing circuit configured to:

identify confidential data elements in a message payload received at the gateway through the communication interface;

apply the encryption policies to each identified confidential data element in the message payload;

receive a collection of group keys from a key store and store the group keys in the secure storage device;

encrypt each identified confidential data element in the message payload based on the encryption policies and the group keys; and

store the encrypted identified confidential data elements in a remotely located data storage device accessible through the communication interface, wherein the processing circuit is configured to encrypt a first confidential data element using a first group key and a second data element using a second group key.

2. The system of claim 1 , wherein the confidential data elements are encrypted at a moment of ingestion at the data storage device.

3. The system of claim 2 , wherein the confidential data elements remain encrypted at the data storage device.

4. The system of claim 1 , wherein the message payload received at the gateway originates from a user data provider.

5. The system of claim 1 , wherein the message payload received at the gateway originates from a system data provider.

6. The system of claim 1 , wherein the remotely located data storage device is an information system data store.

7. The system of claim 1 , wherein the confidential data elements include personal information, financial information or business information.

8. A method implemented at a gateway for data protection comprising:

identifying confidential data elements in a message payload received at the gateway;

applying a collection of encryption policies stored on the gateway to each identified confidential data element in the message payload;

receiving a collection of group keys related to group affiliations of users from a key store and storing the group keys in a secure storage device;

encrypting each identified confidential data element in the message payload based on the encryption policies and the group keys; and

storing the encrypted identified confidential data elements in a remotely located data storage device accessible through the gateway, wherein encrypting each identified confidential data element includes encrypting a first confidential data element using a first group key and a second data element using a second group key.

9. The method of claim 8 , wherein the confidential data elements are encrypted at a moment of ingestion at the data storage device.

10. The method of claim 9 , wherein the confidential data elements remain encrypted at the data storage device.

11. The method of claim 8 , wherein the message payload received at the gateway originates from a user data provider.

12. The method of claim 8 , wherein the message payload received at the gateway originates from a system data provider.

13. The method of claim 8 , wherein the confidential data elements include personal information, financial information or business information.

14. A method implemented at a gateway for decrypting protected data comprising:

receiving a request from a user device at the gateway for confidential data from a data storage device in communication with the gateway;

authenticating a user accessing the user device based on a login authentication of the user;

identifying a group affiliation based on the login authentication of the user;

retrieving a collection of group keys based on the group affiliation;

retrieving the confidential data including encrypted confidential data elements from the data storage device;

decrypting the encrypted confidential data elements based on the group keys; and

delivering the confidential data including the decrypted confidential data elements to the user device, wherein decrypting the encrypted confidential data elements includes decrypting a first confidential data element using a first group key and a second data element using a second group key.

15. The method of claim 14 , wherein the request is received at the gateway is over a secure Transport Layer Security (TLS) session.

16. The method of claim 14 , wherein the login authentication includes a X.509 certificate.

17. The method of claim 14 , wherein the confidential data elements are not saved as decrypted confidential elements on the data storage device.