Systems and methods for decryption as a service via a hardware security module
Systems and methods for decryption of payloads are disclosed herein. In various embodiments, systems and methods herein are configured for decrypting thousands of transactions per second. Further, in particular embodiments, the systems and methods herein are scalable, such that many thousands of transactions can be processed per second upon replicating particular architectural components.
1. A system for decryption of one or more payloads, the system comprising:
a hardware security module implemented by at least one processor for decrypting encrypted elements of received payloads, the hardware security module operatively connected to at least one decryption server;
the at least one decryption server, wherein the at least one decryption server is configured to
transmit the particular payload to the hardware security module for decryption of at least one encrypted element;
at least one read-only database, the at least one read-only database configured to store authentication data for decrypting encrypted elements of the received payloads;
a frontend server operatively connected to the at least one read-only database, the frontend server configured to: 1) retrieve authentication data associated with a particular received payload; and 2) compare the authentication data to the particular received payload to authenticate the particular received payload before the particular received payload is transmitted to the hardware security module; and
a master read-only database operatively connected to the at least one read-only database, the master read-only database configured for refreshing the authentication data stored at the at least one read-only database.
2. The system of claim 1 , further comprising: at least one decryption server operatively connected to the hardware security module, wherein the at least one decryption server is configured to:
receive the particular received payload, the particular received payload comprising at least one encrypted element;
transmit the particular received payload to the hardware security module for decryption of the at least one encrypted element;
upon receiving the particular received payload from the hardware security module, parse the particular received payload to determine whether the at least one encrypted element has been decrypted by the hardware security module;
upon determining that the at least one encrypted element has not been decrypted by the hardware security module, transmit an error message to a read/write database operatively coupled to the frontend server.
3. The system of claim 1 , wherein the system further comprises a read/write database operatively connected to the master database, the read/write database configured for transmitting updated authentication data to the master database.
4. A computer-implemented method for decryption of one or more payloads, the method comprising:
providing a hardware security module implemented by at least one processor for decrypting encrypted elements of received payloads, the hardware security module operatively connected to at least one decryption server;
providing at least one read-only database, the at least one read-only database configured to store authentication data for decrypting encrypted elements of the received payloads;
providing a frontend server operatively connected to the at least one read-only database, the frontend server configured to: 1) retrieve authentication data associated with a particular received payload; and 2) compare the authentication data to the particular received payload to authenticate the particular received payload before the particular received payload is transmitted to the hardware security module; and
providing a master read-only database operatively connected to the at least one read-only database, the master read-only database configured for refreshing the authentication data stored at the at least one read-only database
providing the at least one decryption server;
transmitting the particular payload to the hardware security module for decryption of at least one encrypted element.
5. The computer-implemented method of claim 4 , wherein the computer-implemented method further comprises the step of providing a read/write database operatively connected to the master database, the read/write database configured for transmitting updated authentication data to the master database.
6. The system of claim 2 , wherein the at least one decryption server is further configured to, upon determining that the at least one encrypted element has been decrypted by the hardware security module, transmitting the particular received payload to a third-party partner.
7. The system of claim 1 , wherein the hardware security module is operatively connected to the frontend server via the at least one decryption server.
8. The system of claim 1 , wherein the at least one read-only database is a slave read only database.
9. The system of claim 6 , wherein the at least one encrypted element comprises an identifier associated with a source of the particular received payload.
10. The system of claim 9 , wherein the source of the particular received payload is any of the following: a particular point of interaction device, a mobile payments system, or an electronic health records system.
11. The system of claim 10 , wherein the at least one encrypted element is in any of the following formats: 3DES, DUKPT, BPS, base64, hexadecimal encoded, or encrypted value name.
12. The system of claim 3 , wherein the read/write database is a P2PE manager.
13. The computer-implemented method of claim 4 , further comprising:
providing the at least one decryption server operatively connected to the hardware security module;
receiving the particular received payload, the particular received payload comprising at least one encrypted element;
retrieving authentication data associated with the particular received payload;
comparing the particular received payload authentication data to the particular received payload to authenticate the particular received payload;
transmitting the particular received payload to the hardware security module for decryption of the at least one encrypted element;
upon receiving the particular received payload from the hardware security module, parsing the particular received payload to determine whether the at least one encrypted element has been decrypted by the hardware security module; and
upon determining that the at least one encrypted element has not been decrypted by the hardware security module, transmitting an error message to a read/write database operatively coupled to the frontend server.
14. The computer-implemented method of claim 4 , wherein the hardware security module is operatively connected to the frontend server via the at least one decryption server.
15. The computer-implemented method of claim 4 , wherein the at least one read-only database is a slave read only database.
16. The computer-implemented method of claim 13 , wherein the computer-implemented method further comprises the step of, upon determining that the at least one encrypted element has been decrypted by the hardware security module, transmitting the particular received payload to a third-party partner.
17. The computer-implemented method of claim 5 , wherein the read/write database is a P2PE manager.
18. The computer-implemented method of claim 16 , wherein the at least one encrypted element comprises an identifier associated with a source of the particular received payload.
19. The computer-implemented method of claim 18 , wherein the source of the particular received payload is any of the following: a particular point of interaction device, a mobile payments system, or an electronic health records system.
20. The computer-implemented method of claim 19 , wherein the at least one encrypted element is in any of the following formats: 3DES, DUKPT, BPS, base64, hexadecimal encoded, or encrypted value name.