SECURING CUSTOMER SENSITIVE INFORMATION ON PRIVATE CLOUD PLATFORMS

A method for securing customer sensitive information on private cloud platforms includes receiving, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The method includes sending the encrypted local key to the off-premises computing system for decryption, and receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system. The decrypted local key is decrypted from the received encrypted local key. The method includes decrypting a secret key assigned to the user, encrypting the sensitive information using the decrypted secret key, and storing the encrypted sensitive information.

FIELD

The subject matter disclosed herein relates to data security and more particularly relates to securing customer sensitive information on private cloud platforms.

BACKGROUND

Data security is a constant problem for various entities, especially for data centers which are often the target of hackers. While security systems are available to protect sensitive information at a datacenter, hackers still manage to access the data.

BRIEF SUMMARY

A method for securing customer sensitive information on private cloud platforms is disclosed. An apparatus and computer program product also perform the functions of the method. The method includes receiving, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The method includes sending the encrypted local key to the off-premises computing system for decryption, and receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system. The decrypted local key is decrypted from the received encrypted local key. The method includes decrypting a secret key assigned to the user, encrypting the sensitive information using the decrypted secret key, and storing the encrypted sensitive information.

An apparatus for securing customer sensitive information on private cloud platforms is disclosed includes a processor and a memory that stores code executable by the processor to receive, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The code is executable by the processor to send the encrypted local key to the off-premises computing system for decryption, to receive the decrypted local key in response to sending the encrypted local key to the off-premises computing system, where the decrypted local key is decrypted from the received encrypted local key, to decrypt a secret key assigned to the user, to encrypt the sensitive information using the decrypted secret key, and to store the encrypted sensitive information.

A program product for securing customer sensitive information on private cloud platforms includes a computer readable storage medium and program code. The program code is configured to be executable by a processor to perform operations comprising receiving, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The program code is further configured to be executable by the processor to perform operations comprising sending the encrypted local key to the off-premises computing system for decryption, receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system, where the decrypted local key is decrypted from the received encrypted local key, decrypting a secret key assigned to the user, encrypting the sensitive information using the decrypted secret key, and storing the encrypted sensitive information.

DETAILED DESCRIPTION

Many of the functional units described in this specification have been labeled as modules, in order to more particularly emphasize their implementation independence. For example, a module may be implemented as a hardware circuit comprising custom very large scale integrated (“VLSI”) circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A module may also be implemented in programmable hardware devices such as a field programmable gate array (“FPGA”), programmable array logic, programmable logic devices or the like.

Any combination of one or more computer readable medium may be utilized. The computer readable medium may be a computer readable storage medium. The computer readable storage medium may be a storage device storing the code. The storage device may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, holographic, micromechanical, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

The embodiments may transmit data between electronic devices. The embodiments may further convert the data from a first format to a second format, including converting the data from a non-standard format to a standard format and/or converting the data from the standard format to a non-standard format. The embodiments may modify, update, and/or process the data. The embodiments may store the received, converted, modified, updated, and/or processed data. The embodiments may provide remote access to the data including the updated data. The embodiments may make the data and/or updated data available in real time. The embodiments may generate and transmit a message based on the data and/or updated data in real time.

A method for securing customer sensitive information on private cloud platforms is disclosed. An apparatus and computer program product also perform the functions of the method. The method includes receiving, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The method includes sending the encrypted local key to the off-premises computing system for decryption, and receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system. The decrypted local key is decrypted from the received encrypted local key. The method includes decrypting a secret key assigned to the user, encrypting the sensitive information using the decrypted secret key, and storing the encrypted sensitive information.

In some embodiments, the method includes retrieving the encrypted sensitive information in response to a request to use the sensitive information, sending the encrypted local key to the off-premises computing system for decryption, receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system, decrypting the secret key assigned to the user, decrypting the sensitive information using the decrypted secret key, and providing the decrypted sensitive information for use. In other embodiments, the method includes erasing the decrypted local key and the decrypted secret key after use in encryption or decryption and using or encrypting the sensitive information. In other embodiments, the off-premises computing system includes a software as a service (“SaaS”) running on a cloud computing system and a SaaS management layer of the SaaS encrypts and decrypts the local key using the master key.

In some embodiments, the method includes generating the local key at the on-premises computing system, where the local key is specific to the on-premises computing system, sending the local key to the off-premises computing system, receiving an encrypted version of the local key, and storing the encrypted local key on-premises. In other embodiments, the method includes generating the secret key at the on-premises computing system, where the secret key is specific to the user, encrypting the secret key using the local key, and storing the encrypted secret key on-premises. In other embodiments, the master key is generated at the off-premises computing system with use specific to the on-premises computing system.

In some embodiments, the on-premises computing system is a cloud computing system providing computing services to the user where the user is a client. In other embodiments, the on-premises computing system executes workloads in a virtual machine of controlled by the user. In other embodiments, the sensitive information is received from the off-premises computing system. In other embodiments, the sensitive information includes a password, an account number, a social security number, a credit card number, and/or personal information of the user.

An apparatus for securing customer sensitive information on private cloud platforms is disclosed includes a processor and a memory that stores code executable by the processor to receive, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The code is executable by the processor to send the encrypted local key to the off-premises computing system for decryption, to receive the decrypted local key in response to sending the encrypted local key to the off-premises computing system, where the decrypted local key is decrypted from the received encrypted local key, to decrypt a secret key assigned to the user, to encrypt the sensitive information using the decrypted secret key, and to store the encrypted sensitive information.

In some embodiments, the code is further executable by the processor to retrieve the encrypted sensitive information in response to a request to use the sensitive information, send the encrypted local key to the off-premises computing system for decryption, receive the decrypted local key in response to sending the encrypted local key to the off-premises computing system, decrypt the secret key assigned to the user, decrypt the sensitive information using the decrypted secret key, and provide the decrypted sensitive information for use. In other embodiments, the code is further executable by the processor to erase the decrypted local key and the decrypted secret key after use in encryption or decryption and using or encrypting the sensitive information.

In other some embodiments, the code is further executable by the processor to generate the local key at the on-premises computing system, where the local key is specific to the on-premises computing system, to send the local key to the off-premises computing system, to receive an encrypted version of the local key, and to store the encrypted local key on-premises. In other embodiments, the code is further executable by the processor to generate the secret key at the on-premises computing system, where the secret key is specific to the user, to encrypt the secret key using the local key, and to store the encrypted secret key on-premises. In other embodiments, the off-premises computing system includes a SaaS running on a cloud computing system and a SaaS management layer of the SaaS encrypts and decrypts the local key using the master key.

A program product for securing customer sensitive information on private cloud platforms includes a computer readable storage medium and program code. The program code is configured to be executable by a processor to perform operations comprising receiving, at an on-premises computing system, sensitive information of a user. A local key of the on-premises computing system was previously encrypted by a master key stored at an off-premises computing system. The program code is further configured to be executable by the processor to perform operations comprising sending the encrypted local key to the off-premises computing system for decryption, receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system, where the decrypted local key is decrypted from the received encrypted local key, decrypting a secret key assigned to the user, encrypting the sensitive information using the decrypted secret key, and storing the encrypted sensitive information.

In some embodiments, the program code is further executable by the processor to perform operations comprising retrieving the encrypted sensitive information in response to a request to use the sensitive information, sending the encrypted local key to the off-premises computing system for decryption, receiving the decrypted local key in response to sending the encrypted local key to the off-premises computing system, decrypting the secret key assigned to the user, decrypting the sensitive information using the decrypted secret key, providing the decrypted sensitive information for use, and erasing the decrypted local key and the decrypted secret key after use in encryption or decryption. In other embodiments, the program code is further executable by the processor to perform operations comprising erasing the decrypted local key and the decrypted secret key after use in encryption or decryption and using or encrypting the sensitive information.

FIG.1is a schematic block diagram illustrating one embodiment of a system for securing customer sensitive information on private cloud platforms. The system100includes an on-premises computing system102and an off-premises computing system104connected by a computer network106, and multiple clients108a-108n(collectively or generically “108”) connected to the on-premises computing system102over another computer network110, which are described below.

The on-premises computing system102includes an encryption apparatus (not shown) on one or more computing devices. The encryption apparatus protects customer sensitive information (or “sensitive information”) by encrypting the sensitive information using a secret key and storing the encrypted sensitive information on-premises. The secret key is encrypted using a local key, which is encrypted using a master key kept at the off-premises computing system104. By having the encryption keys spread over multiple locations and having an encrypted version of the secret key and local key on the on-premises computing system102, hackers will have a very difficult time accessing the sensitive information. The encryption apparatus is described further below.

The on-premises computing system102, as used herein, includes computing devices controlled by a particular entity while the off-premises computing system104is not controlled by the entity. On-premises includes a location that may include one or more buildings, facilities, etc. with interconnected computing devices. In some embodiments, a portion of the on-premises computing system102is located remotely but is controlled by the entity. The off-premises computing system104, in some embodiments, is a public system providing services to multiple entities where the entity controlling the on-premises computing system102uses software services of the off-premises computing system104.

In some examples, the on-premises computing system102is a private cloud that services workloads from the clients108. The private cloud includes computing resources to enable clients to submit workloads for processing by the private cloud. In some embodiments, the private cloud includes rack mounted servers, power supplies, storage devices, routers, switches, and the like. Often, a private cloud or other on-premises computing system102has a need to access an off-premises computing system104. For example, an off-premises computing system104may have desirable resources that the owner of the on-premises computing system102might not want to duplicate.

One example of an off-premises computing system104that provides services accessed by the on-premises computing system102is a storage solution that has capabilities for mass storage that the owner of the on-premises computing system102desires to use. An example of such a system is the Amazon Web Services (“AWS”) Simple Storage Service (“S3”), which is an object storage service that provides scalability, data availability, performance, etc. In other embodiments, the off-premises computing system104provides specialized data processing solution, such as customer billing, video processing, or the like. The off-premises computing system104includes at least one computing device capable of communicating with the on-premises computing system102, generating a master key, decrypting a local key, transmitting the local key, etc. One of skill in the art will recognize other off-premises computing systems104that are connected to an on-premises computing system102.

While the depicted solution shows an on-premises computing system102as a data center, the on-premises computing system102may also take other forms. For example, the on-premises computing system102may be an edge computing system located at a store or at a processing hub for a retailer and the clients108include customer computing devices that interact with a website of the retailer. The customers may then input customer sensitive information, such as a password for the customer's account, credit card information, a social security number, or other customer data that needs to be protected from hackers and at least some of the employees of the retailer. The embodiments described herein are applicable to any on-premises computing system102that connects to an off-premises computing system104providing services to the on-premises computing system102where sensitive information is present and should be protected in a very secure way.

In some embodiments, the on-premises computing system102includes a computing device, such as a server, a workstation, a desktop computer, a mainframe computer, a rack-mounted server, etc. capable of encrypting and decrypting keys and data and capable of storing and accessing encrypted sensitive information. The on-premises computing system102also has an ability to connect to the off-premises computing system104for some type of computer service. The off-premises computing system104, in some embodiments provides a software as a service (“SaaS”). The SaaS, in some embodiments, includes a SaaS management layer that handles encryption, decryption, creation of a master key, etc. and the on-premises computing system102communicates with the SaaS management layer of the off-premises computing system104to send an encrypted local key, to receive a decrypted local key after decryption, etc.

The clients108, in some embodiments, are servers that submit workloads to the on-premises computing system102. In some embodiments, the on-premises computing system102creates one or more virtual machines for a client108and the workloads execute on a virtual machine. In other embodiments, the clients108are other computing devices in a data center that submit workloads to the on-premises computing system102for execution. The customers submitting workloads from time to time upload sensitive information regarding the workloads, an access account, or the like. In other embodiments, the clients108are laptop computers, smartphones, tablets, desktop computers, etc. that are used by customers to create a customer account, purchase goods, shop for products, etc. The customers submit some sensitive information, such as a credit card number, a birth date, a social security number, a password, etc. and the submitted sensitive information is protected through encryption with the encryption apparatus. One of skill in the art will recognize other forms of the system100that has an on-premises computing system102connected to an off-premises computing system104that receives sensitive information for protection through encryption by the encryption apparatus.

The computer networks106,110, in some embodiments include overlapping elements. For example, both computer networks106,110may include the Internet, part of a local area network (“LAN”), etc. The computer networks106,110may be wired, wireless or a combination of both. The computer networks106,110may include a LAN, a wide area network (“WAN”), a fiber optic network, a proprietary network, the Internet, a wireless connection, and/or the like. The wireless connection may be a mobile telephone network. The wireless connection may also employ a Wi-Fi network based on any one of the Institute of Electrical and Electronics Engineers (“IEEE”) 802.11 standards. Alternatively, the wireless connection may be a BLUETOOTH® connection. In addition, the wireless connection may employ a Radio Frequency Identification (“RFID”) communication including RFID standards established by the International Organization for Standardization (“ISO”), the International Electrotechnical Commission (“IEC”), the American Society for Testing and Materials® (“ASTM”®), the DASH7™ Alliance, and EPCGlobal™.

Alternatively, the wireless connection may employ a ZigBee® connection based on the IEEE 802 standard. In one embodiment, the wireless connection employs a Z-Wave® connection as designed by Sigma Designs®. Alternatively, the wireless connection may employ an ANT® and/or ANT-F® connection as defined by Dynastream® Innovations Inc. of Cochrane, Canada. The wireless connection may be an infrared connection including connections conforming at least to the Infrared Physical Layer Specification (“IrPHY”) as defined by the Infrared Data Association® (“IrDA” ®). Alternatively, the wireless connection may be a cellular telephone network communication. All standards and/or connection types include the latest version and revision of the standard and/or connection type as of the filing date of this application.

FIG.2is a schematic block diagram illustrating one embodiment 200 of a hardware/software domain and a crypto keys domain for securing customer sensitive information on private cloud platforms. The hardware/software domain includes an encryption apparatus202in on-premises hardware204and on-premises data storage206. The encryption apparatus202is substantially similar to the encryption apparatus described with regard to the system100ofFIG.1. The on-premises hardware204and the on-premises data storage206are part of the on-premises computing system102. The on-premises hardware204is a computing device capable of storing and accessing sensitive information, encrypting and decrypting keys and sensitive information, sending an encrypted local key, receiving a decrypted local key, and other encryption management tasks. The embodiment 200 includes the off-premises computing system104with a SaaS management layer208.

A user210enters (1) sensitive information, in some embodiments, at the SaaS management layer208, which then sends (2) the sensitive information to the on-premises hardware204. The user210, in other embodiments, sends the sensitive information using a client108, a management node, or the like to the SaaS management layer208. Alternatively, the on-premises hardware204receives (1) the sensitive information directly, for example, from a client108. The encryption apparatus202receives (2) the sensitive information and sends (3) an encrypted local key to the SaaS management layer208. The SaaS management layer decrypts (4) the local key using the master key and sends (5) the decrypted local key to the on-premises hardware204.

The encryption apparatus202receives (5) the decrypted local key and decrypts (6) an encrypted secret key using the decrypted local key. The encryption apparatus202encrypts (7) the sensitive information using the decrypted secret key and stores (8) the encrypted sensitive information on the on-premises data storage206. After the operations (1)-(8) described above, the encryption apparatus202erases the decrypted local key, the decrypted secret key and the unencrypted sensitive information. In some embodiments, the encryption apparatus202stores the unencrypted sensitive information, the decrypted local key, the decrypted secret key, and any other sensitive data in volatile memory of the on-premises hardware204so that the unencrypted information, the decrypted local key, the decrypted secret key, etc. can be erased without leaving a copy on the on-premises computing system102. Likewise, in some embodiments the SaaS management layer208stores the decrypted local key in volatile memory and erases the decrypted local key after the decrypted local key is transmitted to the on-premises hardware204.

The crypto keys domain is intended to show that the master key is used to encrypt and decrypt the local key, the decrypted local key is used to encrypt and decrypt the secret key, the decrypted secret key is used to encrypt and decrypt the sensitive information. The master key, the local key, and the secret key are cryptography keys. Typically, the master key, the local key, and the secret key are each generated using information specific to the purpose of the key. For example, the local key may be generated using an identifier specific to a particular computer located in the on-premises computing system102. A particular secret key is specific to a customer and may be generated using a customer identifier or other information specific to the customer.

The master key, in some embodiments, is specific to the on-premises computing system102and may be generated using some information specific to a computer, a router, an internet protocol (“IP”) address, etc. of the on-premises computing system102. Thus, the SaaS management layer208may include multiple master keys for different on-premises computing systems and the encryption apparatus202may include numerous secret keys, each correlating to a specific customer. In some embodiments, the master key, the local key, and the secret key are private keys and a public key may be publicly available. One of skill in the art will recognize other formats and generation methods for the master key, the local key, and the secret key.

In some embodiments, the sensitive information is used to access customer information on the off-premises computing system104. If a hacker breaks into the off-premises computing system104, the information located there is either non-sensitive and therefore not a problem if seen or copied by the hacker, or is protected by the sensitive information located elsewhere. The hacker might be able to access the master key, but without context or a mapping to the on-premises computing system102, the master key would be useless to the hacker. If another hacker gets into the on-premises computing system102, the sensitive information, the secret key, and the local key are all encrypted and the hacker would then have no knowledge of how to get the master key on the SaaS management layer208. Making a link between the local key on the on-premises computing system102and the master key on the SaaS management layer208would be very difficult for a hacker. Thus, the embodiments described herein provide a more robust encryption system than other current encryption systems.

While the process displayed in the embodiment 200 ofFIG.2depicts encryption of received sensitive information, a similar process may be used to service a request to access the sensitive information. Other related processes, such as generating a master key, local key and/or secret key are discussed below with regard to the apparatus400ofFIG.4.

FIG.3is a schematic block diagram illustrating one embodiment of an apparatus300for securing customer sensitive information on private cloud platforms. The apparatus300includes an embodiment of the encryption apparatus202that includes a sensitive info receiver module302, a local key sender module304, a local key receiver module306, a key decryption module308, a sensitive info encryption module310, and a sensitive info storage module312, which are described below. In some embodiments, the encryption apparatus202is implemented with program code stored on a computer readable storage device on the on-premises computing system102. The computer readable storage device is non-transitory and is non-volatile. The program code is executable on a processor of the on-premises hardware204. In other embodiments, the encryption apparatus202is implemented with a programmable hardware device, such as an FPGA. In other embodiments, all or a portion of the encryption apparatus202is implemented with hardware circuits.

The apparatus300includes a sensitive info receiver module302configured to receive, at the on-premises computing system102, sensitive information of a user210. A local key of the on-premises computing system102was previously encrypted by a master key stored at the off-premises computing system104. In some embodiments, the sensitive info receiver module302receives the sensitive information from the off-premises computing system104, such as from a SaaS management layer208. In other embodiments, the sensitive info receiver module302receives the sensitive information from a client108, from an input device connected to the on-premises hardware204, or other source known to those of skill in the art.

The local key is an encryption key that is used for data at the on-premises computing system102. The local key is used exclusively for data on the on-premises computing system102and not for other computing systems. In some embodiments, the local key is used to encrypt and decrypt secret keys associated with various customers, virtual machines, etc. The master key is stored at the off-premises computing system104and in some embodiments is specific to the on-premises computing system102.

The apparatus300includes a local key sender module304configured to send the encrypted local key to the off-premises computing system104for decryption. For example, the local key sender module304retrieves a copy of the encrypted local key from a storage device (e.g. on-premises data storage206) within the on-premises computing system102. The off-premises computing system104decrypts the encrypted local key, for example, in a SaaS management layer208of the off-premises computing system104, and sends the decrypted local key to the on-premises computing system102. Typically, the local key sender module304sends the encrypted local key in response to some need for encrypting or decrypting sensitive information.

The apparatus300includes a local key receiver module306configured to receive the decrypted local key in response to the local key sender module304sending the encrypted local key to the off-premises computing system104. The decrypted local key is decrypted from the received encrypted local key at the off-premises computing system104. For example, when the on-premises computing system102receives the decrypted local key, the decrypted local key is routed to the local key receiver module306or the local key receiver module304is aware of receipt of the decrypted local key and retrieves the decrypted local key from a buffer, register, etc.

The apparatus300includes a key decryption module308configured to decrypt a secret key assigned to the user210that sent the sensitive information. The user210may be associated with a customer. For example, the customer may be sending workloads to the on-premises computing system102for processing and data from the workloads may be stored on the off-premises computing system104so the sensitive information may be used to access an account of the customer on the off-premises computing system104.

The apparatus300includes a sensitive info encryption module310configured to encrypt the sensitive information using the decrypted secret key and a sensitive info storage module312configured to store the encrypted sensitive information. The decrypted secret key is specific to the user210. In some examples, the sensitive info storage module312stores the encrypted sensitive information in the on-premises data storage206. The sensitive info storage module312stores the encrypted sensitive information on-premises, for example, to avoid having sensitive information on a public cloud of the off-premises computing system104.

FIG.4is a schematic block diagram illustrating another embodiment of an apparatus400for securing customer sensitive information on private cloud platforms. The apparatus400includes another embodiment of the encryption apparatus202that includes a sensitive info receiver module302, a local key sender module304, a local key receiver module306, a key decryption module308, a sensitive info encryption module310, and a sensitive info storage module312, which are substantially similar to those described above in relation to the apparatus300ofFIG.3. The encryption apparatus202includes one or more of a sensitive info retriever module402, a sensitive info use module404, an erasure module406, a local key creation module408, and a secret key creation module410, which are described below. The encryption apparatus202may be implemented the same way as the encryption apparatus202ofFIG.3.

The apparatus400, in some embodiments, includes a sensitive info retriever module402configured to retrieve the encrypted sensitive information in response to a request to use the sensitive information. For example, the sensitive information may be a password and the user210may want to use the password to access an account, data, etc. In some embodiments, the request from the user210comes directly from a user210. In other embodiments, the request comes from a client108of the user210as part of a process to service the workloads. In other embodiments, the request is part of an online sales process and the sensitive information is a credit card number. One of skill in the art will recognize other requests to access the sensitive information.

In response to the sensitive info retriever module402retrieving the encrypted sensitive information or in response to the request, the local key sender module304sends the encrypted local key to the off-premises computing system104for decryption, the local key receiver module306receives the decrypted local key in response to the local key sender module304sending the encrypted local key to the off-premises computing system104, the key decryption module308decrypts the secret key assigned to the user210, and the sensitive info encryption module310decrypts the sensitive information using the decrypted secret key.

The apparatus400, in the embodiment, includes a sensitive info use module404configured to provide the decrypted sensitive information for use by the user210. In some embodiments, the sensitive info use module404provides the sensitive information to an application that uses the sensitive information. For example, the sensitive info use module404may provide the unencrypted sensitive information in the form of a password to an application being accessed by the user210. In other embodiments, the sensitive info use module404provides the decrypted sensitive information to the user210. One of skill in the art will recognize other ways that the sensitive info use module404is able to provide the decrypted sensitive information for use.

The apparatus400includes an erasure module406configured to erase the decrypted local key and the decrypted secret key after use in encryption or decryption and using or encrypting the sensitive information. In some embodiments, the erasure module406erases the decrypted local key and the decrypted secret key after use in encryption or decryption and using or encrypting the sensitive information from every location where stored on the on-premises computing system102. In some embodiments, to facilitate easy erasure the decrypted local key, the decrypted secret key and the unencrypted sensitive information are stored in volatile memory and the erasure module406erases the decrypted keys and the unencrypted sensitive information from volatile memory.

For example, where the sensitive information is initially received by the sensitive info receiver module302and the modules304-312of the apparatus300ofFIG.3may store the decrypted local key, the decrypted secret key and the unencrypted sensitive information are stored in volatile memory, the erasure module406erases the decrypted local key, the decrypted secret key and the unencrypted sensitive information from the volatile memory. Similarly, when a request to use the sensitive information received, the modules402,404,304-310may again store the decrypted local key, the decrypted secret key and the unencrypted sensitive information are stored in volatile memory and the erasure module406may then erase the decrypted local key, the decrypted secret key and the decrypted sensitive information from volatile memory.

The apparatus400, in some embodiments, includes a local key creation module408configured to generate the local key at the on-premises computing system102, where the local key is specific to the on-premises computing system102. The local key creation module408is also configured to send the local key to the off-premises computing system104, receive an encrypted version of the local key and store the encrypted local key on-premises. For example, the local key creation module408may store the encrypted local key in the on-premises data storage206. In some embodiments, the local key is mapped to a particular master key at the off-premises computing system104. The off-premises computing system104generates a master key, in some embodiments, specifically for use in decrypting the encrypted local key.

In some embodiments, the apparatus400includes a secret key creation module410configured to generate the secret key at the on-premises computing system102, where the secret key is specific to the user210, to encrypt the secret key using the local key, and to store the encrypted secret key on-premises, for example, in the on-premises data storage206. For example, the secret key creation module410may generate a secret key for each user210or customer. In some embodiments, the secret key creation module410generates multiple secret keys for a user210or customer.

FIG.5is a schematic flow chart diagram illustrating one embodiment of a method500for encrypting and storing customer sensitive information. The method500begins and receives502, at an on-premises computing system102, sensitive information of a user210. A local key of the on-premises computing system102was previously encrypted by a master key stored at an off-premises computing system104. The method500receives502the sensitive information, in various embodiments, from a user210the off-premises computing system104, from the user210, from a client108, etc. The method500sends504the encrypted local key to the off-premises computing system104for decryption and receives506the decrypted local key in response to sending the encrypted local key to the off-premises computing system104. The decrypted local key is decrypted from the received encrypted local key. The method500decrypts508, using the decrypted local key, a secret key assigned to the user210, and encrypts510the sensitive information using the decrypted secret key. The method500stores512the encrypted sensitive information and erases514the decrypted local key, the decrypted secret key and the unencrypted sensitive information, and the method500ends. In various embodiments, all or a portion of the method500is implemented with the sensitive info receiver module302, the local key sender module304, the local key receiver module306, the key decryption module308, the sensitive info encryption module310, the sensitive info storage module312and/or the erasure module406.

FIG.6is a schematic flow chart diagram illustrating one embodiment of a method600for retrieving and using customer sensitive information. The method600begins and receives602a request to use the sensitive information. For example, the method600may receive the request from the user210or a customer associated with the sensitive information. The method600receives602the request to use the sensitive information, in various embodiments, from a user210via the off-premises computing system104, from the user210, from a client108, etc. The method600retrieves604the encrypted sensitive information. A local key of the on-premises computing system102was previously encrypted by a master key stored at an off-premises computing system104.

The method600sends606the encrypted local key to the off-premises computing system104for decryption and receives608the decrypted local key in response to sending the encrypted local key to the off-premises computing system104. The decrypted local key is decrypted from the received encrypted local key. The method600decrypts610, using the decrypted local key, a secret key assigned to the user210and decrypts612the sensitive information using the decrypted secret key. The method600provides614the decrypted sensitive information for use and erases616the decrypted local key, the decrypted secret key and erases616, after use, the decrypted sensitive information, and the method600ends. In some embodiments, the method600retrieves the unencrypted sensitive information after decrypting610the secret key. In various embodiments, all or a portion of the method600is implemented with the sensitive info retriever module402, the local key sender module304, the local key receiver module306, the key decryption module308, the sensitive info encryption module310, the sensitive info use module404, and/or the erasure module406.