Edge encryption

Patent metadata

Field	Value
Publication number	US-12184764-B2
Application number	US-202017082950-A
Country	US
Kind code	B2
Filing date	Oct 28, 2020
Priority date	May 30, 2017
Publication date	Dec 31, 2024
Grant date	Dec 31, 2024

Abstract

A system and method for encrypting portions of data for storage in a remote network have been provided. The system comprises a memory with instructions executable by a processor to receive data for forwarding to a server device, wherein the received data comprises an indication of one or more portions of the received data to be encrypted; identify a portion comprising the one or more portions of the received data based at least in part on the indication; encrypt the identified portion of the data; generate a payload that comprises the encrypted portion and one or more unencrypted portions of the received data; and transmit, to the server device, the payload.

First claim

What is claimed is:

1. A method comprising:
receiving, via a gateway device operated by a private network, an incident report message that includes user data comprising sensitive information for forwarding to a server device operated by an external service provider network, which is different from the private network, wherein the sensitive information identifies a user of the private network associated with the incident report message;
comparing, by the gateway device operated by the private network, the sensitive information with a pattern to identify the sensitive information that matches the pattern;
encrypting, by the gateway device operated by the private network, the identified sensitive information to generate encrypted sensitive information with an encryption key such that an unencrypted version of the sensitive information is not available to the server device;
determining metadata associated with the sensitive information to enable the server device to perform one or more functions without decrypting the encrypted sensitive information; and
transmitting, to the server device, a payload including the metadata and the incident report message with the encrypted sensitive information substituted for the identified sensitive information without transmitting the encryption key to the server device.

2. The method of claim 1 , wherein the pattern is a regular expression matching an expected format for the sensitive information, and the identified sensitive information comprises a string.

3. The method of claim 1 , wherein the pattern comprises a format indicative of a credit card number.

4. The method of claim 1 , wherein the pattern comprises a format indicative of a social security number.

5. The method of claim 1 , wherein the pattern comprises a format indicative of an IP address.

6. The method of claim 1 , wherein receiving the incident report message comprises receiving probe data from a discovery probe prior to comparing the sensitive information with the pattern, wherein the discovery probe is configured to acquire the probe data to be stored in a configuration item of a configuration management database, and wherein the probe data comprises the user data.

7. The method of claim 1 , comprising receiving a specification of the pattern using a graphical user interface prior to comparing the sensitive information with the pattern.

8. The method of claim 1 , comprising:
receiving a request to display the sensitive information; and
transmitting, via the server device, in response to receiving the request, the sensitive information be displayed.

9. A system operable to encrypt portions of data for storage in a remote network, the system comprising:
memory storing instructions; and
one or more processors configured to execute the instructions to cause the one or more processors to:
receive, via a gateway device operated by a private network, an incident report message that includes user data comprising sensitive information for forwarding to a server device operated by an external service provider network, which is different from the private network, wherein the sensitive information identifies a user of the private network associated with the incident report message;
compare, by the gateway device operated by the private network, the sensitive information with a pattern to identify the sensitive information that matches the pattern;
encrypt, by the gateway device operated by the private network, the sensitive information to generate encrypted sensitive information with an encryption key such that an unencrypted version of the sensitive information is not available to the server device;
determine metadata associated with the sensitive information to enable the server device to perform one or more functions without decrypting the encrypted sensitive information; and
transmit, to the server device, a payload including the metadata and the user data with the encrypted sensitive information substituted for the identified sensitive information without transmitting the encryption key to the server device.

10. The system of claim 9 , wherein the pattern is a regular expression matching an expected format for the sensitive information, and the identified sensitive information comprises a string.

11. The system of claim 9 , wherein the pattern comprises a format indicative of an IP address, a credit card number, a host name, an operating system version, an operating system patch level, a uniform resource locator, a class, a name, a social security number, a binary large object, or any combination thereof.

12. The system of claim 9 , wherein the gateway device is at an edge of an environment through which communications with another environment pass through the gateway device, wherein the gateway device is configured to output the user data based on a request received at a platform instance in the other environment associated with the server device.

13. The system of claim 9 , wherein the instructions are configured to cause the one or more processors to invoke a discovery probe against a target device to obtain the user data from a result of the discovery probe, wherein receiving the incident report message comprises receiving the user data from the discovery probe, and wherein the user data comprises information about computing resources communicatively coupled to a computing device associated with the one or more processors.

14. The system of claim 9 , wherein the pattern comprises a format indicative of a credential.

15. The system of claim 9 , wherein the payload comprises multiple portions with the encrypted sensitive information substituted for the identified sensitive information.

16. A tangible, non-transitory, and machine-readable medium comprising instructions that, when executed by a processor, cause the processor to perform operations comprising:
invoking a discovery probe against a target device to obtain user data comprising sensitive information from a result of the discovery probe;
receiving, via a gateway device operated by a private network, the user data corresponding to an incident report message, wherein the user data comprises the sensitive information from the discovery probe for forwarding to a server device operated by an external service provider network, which is different from the private network, and wherein the sensitive information identifies a user of the private network associated with the incident report message;
comparing, by the gateway device operated by the private network, the sensitive information with a pattern to identify the sensitive information that matches the pattern;
encrypting, by the gateway device operated by the private network, the identified sensitive information of the user data to generate encrypted sensitive information with an encryption key such that an unencrypted version of the sensitive information is not available to the server device;
determining metadata associated with the sensitive information to enable the server device to perform one or more functions without decrypting the encrypted sensitive information; and
transmitting, to the server device, a payload including the metadata and the user data with the encrypted sensitive information substituted for the identified sensitive information of the user data without transmitting the encryption key to the server device.

17. The tangible, non-transitory, and machine-readable medium of claim 15 , wherein the operations comprise receiving a specification of the pattern via a graphical user interface.

18. The tangible, non-transitory, and m

Assignees

• Servicenow Inc

Inventors

• Rohel Pierre Francois
• Shah Siddharth
• Wexler Martin

Classifications

• H04W12/088

  using filters or firewalls · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L2209/76

  Proxy, i.e. using intermediary entity to perform cryptographic operations · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title