Centralized Encryption Service for Distributed Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for storing sensitive data are insecure, as hackers can access and decrypt the data, leading to potential fraudulent use, and laws require stricter data protection measures.
Innovation Solution
Implementing a central encryption service that generates and manages replacement values for sensitive data, which are stored instead of actual values, ensuring only the central service has access to the encrypted data, thus protecting the data integrity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sensitive data is stored in common database facilities, then data accessibility and operational efficiency are improved, but data security and protection against unauthorized access deteriorate
Solution Approach 1:
The patent extracts the actual sensitive data from the common database facility and stores it separately in secure storage. Only encrypted replacement values remain in the database, while the master encryption keys are held exclusively by the encryption service. This separation allows the database to maintain high accessibility while the sensitive data enjoys enhanced security protection.
Solution Approach 2:
The encryption service acts as an intermediary between the database and any entities needing access to sensitive data. Instead of direct access to plaintext data, users receive encrypted replacement values from the database and must go through the encryption service to decrypt them. This intermediary layer adds a security checkpoint without significantly impacting operational efficiency.
2Reliability
If encryption is applied to sensitive data in databases, then data security is improved, but the complexity of key management and decryption processes increases
Solution Approach 1:
The encryption service automatically manages the encryption and decryption processes without requiring manual key management from database administrators or users. The service maintains the master encryption keys and handles all decryption operations automatically when replacement values are provided, eliminating the burden of key management complexity from the system operators.
Solution Approach 2:
The encryption service provides multiple functions including key generation, data encryption, replacement value creation, and decryption operations through a single unified service interface. This multi-functional approach consolidates what would otherwise be separate complex key management systems into one manageable service, reducing overall system complexity.
3Reliability
If centralized encryption service is implemented, then data protection against breaches is improved, but system architecture complexity and operational overhead increase
Solution Approach 1:
The system segments the data protection function into a separate centralized encryption service, distinct from the database operations. This segmentation allows the database to remain simple and focused on data storage and retrieval, while the encryption service handles all security-related operations. The clear separation of concerns reduces overall system complexity despite adding a new component.
Solution Approach 2:
The encryption service performs preliminary encryption of sensitive data before it is stored in the database, and prepares decryption capabilities in advance. By setting up the encryption infrastructure beforehand and automating the decryption process, the system minimizes operational overhead during normal database operations, making the added complexity less burdensome.
Data Source
AI summary
An approach is provided for securely storing sensitive data values. A primary facility is provided that directly or indirectly receives requests from a requestor to store an actual data value. The primary facility obtains a replacement value associated with the actual value and encrypts the actual value, and the replacement value is transmitted to the requestor. The replacement and encrypted values are stored in a master copy database at the primary facility, and copies thereof are stored in distributed secondary databases. When the requestor needs an actual data value, the requestor transmits the replacement value either to the primary facility for retrieval of data from the master database, or to the secondary facility for retrieval from the respective secondary database. The chosen facility retrieves the encrypted value from its respective database using the replacement value, decrypts the encrypted value, and transmits the actual value back to the requestor.