Application-Layer Data Protection Without Code Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection methods require application code changes, are complex, and lack persistent protection for data at rest, in transit, and in use, especially against modern cyber-attacks, and are costly and invasive.
Innovation Solution
A method and system for application-level data protection that intercepts and secures data without requiring code changes, using local parameters to enforce data protection policies, enabling persistent encryption and decryption based on predefined policies, and integrating with existing systems through APIs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If field level encryption, tokenization, masking are applied at the application layer, then data protection effectiveness is improved, but implementation complexity and cost increase significantly
Solution Approach 1:
The patent introduces an intermediary component (encryption module, tokenization module, or masking module) that operates between the application layer and data storage layer. This intermediary handles data protection operations transparently without requiring application code changes, thus maintaining high data protection effectiveness while reducing implementation complexity by centralizing the protection logic in a dedicated module rather than embedding it throughout the application codebase
2Reliability
If field level encryption is applied at the application layer, then data protection effectiveness is improved, but implementation time and development effort increase
Solution Approach 1:
The patent implements preliminary action by pre-configuring data protection policies, encryption algorithms, and tokenization rules in the intermediary module before actual data processing begins. The system establishes the protection framework in advance, defining which data fields require protection and what protection methods to apply, thereby enabling rapid deployment without requiring time-consuming application code modifications and testing for each protected field
3Ease of manufacture
If encryption is applied at database level, then implementation simplicity is improved, but data protection persistence deteriorates
Solution Approach 1:
The patent ensures continuity of useful action by maintaining data protection throughout the entire data lifecycle - from storage in the database, through transit in memory, to processing in application layers. The intermediary module continuously encrypts data at rest in the database, encrypts data in transit between components, and can perform tokenization or masking during active use, thereby achieving persistent protection across all states without sacrificing implementation simplicity
4Ease of operation
If full decryption is performed before data reading, then data accessibility is improved, but system performance deteriorates
Solution Approach 1:
The patent applies local quality by selectively decrypting only the specific data fields that are currently needed for processing, rather than decrypting the entire database. The intermediary module identifies which protected fields are required by the application query, decrypts only those specific fields in memory, and leaves other protected fields encrypted. This selective approach maintains data accessibility for required fields while preserving system performance by avoiding the overhead of full database decryption
Data Source
AI summary
System and computer implemented method for enabling application level data protection while not requiring application code changes, thereby keeping data persistently protected while at rest, in transit, and when in use in certain cases. A computer implemented method for securing data comprises pre-defining a plurality of data protection policies for securing application level data stored in a plurality of software modules, deploying a first local parameter and a second local parameter in the application layer of a first software module and second software module respectively, configuring the first local parameter to selectively intercept and encrypt the application level data before the application level data leaves the application layer of the first software module and configuring a second local parameter to access the plurality of data protection policies and to selectively intercept and decrypt the encrypted application level data received by the second software module from the first software module.