Public Cloud Tokenization Service for Confidential Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting confidential data in public cloud databases face challenges such as difficulty in querying and processing encrypted data, complex encryption key management, application integration overhead, and performance degradation due to frequent encryption/decryption operations.
Innovation Solution
The use of encryption and tokenization to protect confidential data, where data is tokenized, encrypted, and stored in separate memories, allowing for secure data retrieval and processing without decrypting the data within the public cloud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to protect data stored in the public cloud, then data security is improved, but data query and processing capability deteriorates
Solution Approach 1:
The patent segments the data protection mechanism into two independent parts: tokenization for data identification and encryption for data protection. The tokenized data is stored in the cloud database while encryption keys are managed separately through a secure key management service. This segmentation allows the system to query and process tokenized data efficiently while maintaining encryption security through separate key management, resolving the contradiction between data security and query capability.
Solution Approach 2:
The patent introduces a token as an intermediary between the original data and its encrypted form. The token serves as a placeholder that can be queried and processed in the cloud database without revealing the actual data content. When data access is needed, the token is used to retrieve the encrypted data, which is then decrypted using secure key management. This intermediary approach enables efficient cloud querying while maintaining encryption security.
2Reliability
If traditional encryption is used for data protection, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent implements self-service key management by integrating with a secure key management service that automatically handles key generation, storage, rotation, and access control. The system automatically retrieves encryption keys when needed through standardized APIs, eliminating the need for manual key management. This self-service approach maintains strong encryption security while significantly reducing key management complexity and operational overhead.
3Reliability
If encryption operations are performed frequently, then data protection is improved, but application performance deteriorates
Solution Approach 1:
The patent performs tokenization of data before it is stored in the cloud database, creating a mapping between tokens and encrypted data. This preliminary action allows the system to store and query tokenized data without performing encryption/decryption operations during normal application execution. When data access is required, the pre-tokenized data can be quickly retrieved and decrypted only when needed, significantly reducing performance overhead while maintaining continuous data protection.
Data Source
AI summary
A method for using encryption and tokenization to protect confidential data that is stored in a public cloud database is provided. The method includes: receiving a first data set; tokenizing the first data set; obtaining a first token for at least one attribute of the first data set; encrypting an original value of the attribute and the first data set; storing each of the original value of the at least one attribute, the encrypted value of the at least one attribute, and the first token in a first memory; storing each of the first token and the encrypted first data set in a second memory; and storing the tokenized first data set in a third memory that is hosted on a public cloud server.