Secure processing environment for protecting sensitive information

A computer system for protecting sensitive information, the computer system comprising:

• a host server computer including a host memory, and a secure processing environment separate from the host memory, for receiving encrypted data from a client computer for a receiving application on the host server computer, and for routing the encrypted data to the secure processing environment;
• a crypto application specific integrated circuit (ASIC) in the secure processing environment for decrypting the encrypted data to obtain decrypted data in cleartext form;
• a field programmable gate array (FPGA) in the secure processing environment, for identifying a field in the cleartext form of the decrypted data containing sensitive information;
• wherein:
• the crypto ASIC in the secure processing environment obfuscates the field within the cleartext form of the decrypted data containing the sensitive information;
• and
• the decrypted data is transmitted from the secure processing environment to the host memory of the host server computer with the sensitive information obfuscated, and stored the obfuscated, decrypted sensitive information in the host memory of the host server computer for the receiving application on the host server computer, wherein the sensitive information never appears in the host memory in the cleartext form.

A computer program product for protecting sensitive information in a host server computer, the host server computer including a host memory, a secure processing environment separate from the host memory, the computer program product comprising:

• one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more tangible storage devices, the program instructions comprising:
• program instructions for receiving, at the host server computer, encrypted data from a client computer for a receiving application on the host server computer, and for routing the encrypted data to the secure processing environment;
• program instructions for using a crypto application specific integrated circuit (ASIC) in the secure processing environment for decrypting the encrypted data to obtain decrypted data in cleartext form;
• program instructions for using a field programmable gate array (FPGA) in the secure processing environment, for identifying a field in the cleartext form of the decrypted data containing sensitive information;
• program instructions for using the crypto ASIC in the secure processing environment for obfuscating the field within the cleartext form of the decrypted data containing the sensitive information;
• and
• program instructions for transmitting the decrypted data from the secure processing environment to the host memory of the host server computer with the sensitive information obfuscated, and for storing the obfuscated, decrypted sensitive information in the host memory of the host server computer for the receiving application on the host server computer, wherein the sensitive information never appears in the host memory in the cleartext form.