Application Data In Use Security Risk Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current industry solutions for protecting 'Data in Use' are inadequate as they defer security measures to 'Data at Rest' solutions, leading to compliance violations, legal disputes, and ease of cryptanalysis due to inconsistent key management and repetitive encryption overheads.
Innovation Solution
Implementing code-level protections that allow the application to directly manage sensitive data through real-time encryption and decryption during arithmetic operations, minimizing repetitive encryption and decryption by optimizing code structure and using data masking, with the ability to reset encryption keys post-breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time encryption and decryption is implemented during arithmetic operations, then data security is improved, but computational overhead increases
Solution Approach 1:
The patent applies partial encryption by encrypting only sensitive data portions rather than entire data structures, and selectively encrypting/decrypting only when necessary based on data flow analysis. This reduces the frequency and scope of encryption operations while maintaining security for critical data points.
Solution Approach 2:
The patent segments data into sensitive and non-sensitive portions, applying encryption only to sensitive segments. It also divides the protection mechanism into multiple layers including data masking, selective encryption, and contextual protection based on operational state.
2Reliability
If repetitive encryption and decryption operations are performed, then data protection is improved, but execution time increases
Solution Approach 1:
The patent performs preliminary analysis of data flow patterns to identify when encryption/decryption operations are actually necessary. It pre-computes protection strategies based on static analysis, avoiding redundant encryption operations in code paths where data remains encrypted or is not accessed.
Solution Approach 2:
The patent maintains data in encrypted state continuously where possible, using encryption persistence across function calls and data transformations. It avoids unnecessary decryption-encryption cycles by maintaining encryption state throughout the data lifecycle unless computation requires plaintext.
3Productivity
If data is kept in plaintext for arithmetic operations, then computational speed is improved, but security exposure increases
Solution Approach 1:
The patent introduces encrypted data structures and intermediate representations that allow computational operations to be performed on encrypted data where possible, or minimizes the duration and scope of plaintext exposure through controlled decryption zones and immediate re-encryption.
Solution Approach 2:
The patent applies different protection qualities to different data regions and operational contexts. Sensitive data receives full encryption protection, while non-sensitive data uses lighter protection mechanisms. The level of protection is locally optimized based on data classification and operational context.
4Ease of operation
If encryption keys are managed centrally, then key distribution is simplified, but compliance with data ownership regulations deteriorates
Solution Approach 1:
The patent segments key management authority by implementing hierarchical key structures where data owners retain control of their encryption keys while centralized systems manage distribution and rotation policies. Different key levels serve different security and compliance requirements.
Solution Approach 2:
The patent establishes key management policies and data ownership assignments in advance through preliminary configuration and metadata tagging. Encryption keys are bound to specific data owners and purposes before data processing begins, ensuring compliance is built into the system architecture rather than added later.
Data Source
AI summary
This invention presents Application software driven Data in Use security risk reduction, by selectively protecting Application sensitive data, resetting Keys post breach, and minimizing Ciphertext exposure. Both sensitive data detection and protection are disclosed. Sensitive data detection includes direct lexical scan and indirect intermediate variables value capture. Protection includes Non-Invasive and Invasive Mitigation. Non-Invasive Mitigation discloses code Front & Tail Trimming, Secure Wipe, and code line gap determined encryption (after last use) & decryption (before next use). Invasive Mitigation discloses a total code redesign using dependency graphs, a local code lines swap, and a global code lines collapse. Single machine job shop scheduling results are upheld with I/O library serialization, within Application development environment. Shuffle (unshuffled) algorithm(s) for data masking (unmasking) are disclosed. Ciphertext exposure volume computation method is shown to determine optimum data protection (using either encryption, or masking).