Systems and method for providing a data security service
Systems, methods, and computer-readable media for providing standards compliant encryption, storage, and retrieval of data are disclosed. In an embodiment, data is received at a first data center from a first device in connection with a service request and encrypted to produce encrypted data. The encrypted data may be transmitted from the first data center to the first device, and then may subsequently be received at a second data center. The second data center may store the encrypted data in a database accessible to the second data center. Because all data provided to the system is encrypted by the first data center prior to being stored and/or provided to the second data center, the database and the second data center may be out of the scope of compliance monitoring, auditing, and reporting for one or more data security standards.
1. A method for securely transmitting sensitive data in a computer network, the method comprising:
receiving information from a graphic user interface (GUI) of an electronic user device, wherein the information may include sensitive data;
determining, by the electronic user device, if the received information contains sensitive data, and if the received information contains sensitive data, transmitting, by the electronic user device, the sensitive data to a first data center;
encrypting, by the first data center, the sensitive data to produce encrypted data without storing the sensitive data at rest;
transmitting, by the first data center, the encrypted data to the electronic user device;
transmitting, by the electronic user device, the encrypted data to a second data center;
storing the encrypted data in a database accessible to the second data center;
transmitting, by the electronic user device or an end-point device, a first request to the first data center to retrieve the encrypted data;
transmitting, by the first data center, through a proxy to the second data center, a second request to retrieve the encrypted data from the database;
retrieving, by the second data center, the encrypted data from the database in response to the second request;
transmitting, by the second data center, the encrypted data to the first data center; and
transmitting, by the first data center, the sensitive data to the electronic user device or to the end-point device without encrypting the sensitive data.
2. The method of claim 1 , wherein the encrypting of the sensitive data utilizes tokenization and the encrypted data is a token.
3. The method of claim 1 , wherein the transmitting the sensitive data to the first data center uses HTTPS.
4. The method of claim 1 , wherein the end-point device processes the sensitive data to complete a transaction provided by a backend service.
5. The method of claim 4 , wherein the backend service processes a credit card payment.
6. The method of claim 4 , wherein the processing by the end-point device generates additional data that is to be stored in the database.
7. The method of claim 1 , wherein the second request identifies a destination IP address for the encrypted data retrieved from the database.