Using cryptography and application gateway to eliminate malicious data access and data exfiltration

A method implemented at a gateway for data protection comprising:

• identifying confidential data elements in a message payload received at the gateway;
• applying a collection of encryption policies stored on the gateway to each identified confidential data element in the message payload;
• receiving a collection of group keys related to group affiliations of users from a key store and storing the group keys in a secure storage device;
• encrypting each identified confidential data element in the message payload based on the encryption policies and the group keys;
• and
• storing the encrypted identified confidential data elements in a remotely located data storage device accessible through the gateway.

A method implanted at a gateway for decrypting protected data comprising:

• receiving a request from a user device at the gateway for confidential data from a data storage device in communication with the gateway;
• authenticating a user accessing the user device based on a login authentication of the user;
• identifying a group affiliation based on the login authentication of the user;
• retrieving a collection of group keys based on the group affiliation;
• retrieving the confidential data including encrypted confidential data elements from the data storage device;
• decrypting the encrypted confidential data elements based on the group keys;
• and
• delivering the confidential data including the decrypted confidential data elements to the user device.