Adaptive Risk Decisioning for Secure Query Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face delays and security challenges when handling sensitive data from multiple sources with different security levels, as they require additional time and computing resources for encryption and decryption, and may expose data to unauthorized access during transmission and processing.
Innovation Solution
A method and system for query processing with adaptive risk decisioning, where a client analyzes queries to determine the appropriate servers and generates subqueries based on security profiles, allowing for unencrypted or encrypted execution on servers, using homomorphic encryption and Trusted Execution Environment (TEE) for secure data processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption techniques are applied to sensitive data during transmission and processing, then data security is improved, but processing time increases due to additional computational overhead
Solution Approach 1:
The patent segments the data processing workflow into distinct phases: query generation at client side, encrypted query transmission, server-side processing of encrypted data, and result decryption. This segmentation allows encryption to be applied only where necessary (during transmission and storage) while maintaining efficient plaintext processing at endpoints, thus balancing security with processing speed.
Solution Approach 2:
The patent implements preliminary encryption of sensitive data before transmission to the server. By encrypting data in advance at the client side using established cryptographic protocols, the system ensures security is already in place before the time-sensitive processing phase begins, reducing the need for repeated encryption/decryption cycles during processing.
2Reliability
If encryption and decryption operations are performed on queries and data, then unauthorized access is prevented, but additional computing resources and time are required
Solution Approach 1:
The patent extracts the computationally intensive encryption and decryption operations from the main query processing pipeline. Encryption is performed once during data ingestion and query formulation, while the core processing operations work with already-encrypted data or plaintext at the edges, minimizing the frequency of cryptographic operations during throughput-critical phases.
Solution Approach 2:
The system creates and processes copies of encrypted data and queries without requiring repeated encryption/decryption cycles. Once data is encrypted, multiple processing passes can be performed on the encrypted copy, and results can be decrypted once at the end, significantly reducing the total computational overhead compared to encrypting/decrypting at every processing stage.
3Adaptability or versatility
If data from multiple data sources with different security levels is accessed, then comprehensive query results are obtained, but security management complexity increases
Solution Approach 1:
The patent applies local quality by assigning different security profiles and encryption requirements to different data sources and data elements based on their specific security needs. Rather than applying a uniform security policy across all data sources, the system tailors encryption strength, access controls, and security protocols to match the actual sensitivity and security requirements of each individual data source, simplifying overall security management.
4Productivity
If plaintext queries are sent to servers, then processing efficiency is improved, but data exposure to unauthorized access increases during transmission
Solution Approach 1:
The patent introduces encryption as an intermediary layer between the client and server communication. Queries are encrypted in transit, serving as a protective intermediary that prevents unauthorized access during transmission while allowing the server to process the encrypted data efficiently. This intermediary encryption layer decouples the need for secure transmission from the need for efficient processing.
Data Source
AI summary
Provided are methods and systems for query processing with adaptive risk decisioning. An example method includes receiving a query by a client in communication with plurality of servers. The method further includes analyzing, by the client, the query to select at least one server being configured to provide data of a data source, the data being associated with a portion of the query. The method includes acquiring, by the client, a security profile of the data source. The method includes generating, by the client and based on the query, at least one subquery for the server. The method includes sending, by the client, the subquery to the server. The server processes, based on the security profile, the subquery over the data, to obtain a result of the subquery. The method includes generating, by the client and based on the result of the subquery, a result for the query.