Composite Decryption Key Retrieval for Sensitive Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage and retrieval methods for sensitive information are vulnerable to breaches, leading to privacy risks, regulatory non-compliance, and misuse, with inadequate cybersecurity measures.
Innovation Solution
Sensitive data is collected and encrypted directly at the user device using dynamic encryption keys generated from login sessions, stored separately from decryption information, and retrieved with user permission and composite decryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive data is stored centrally in a company's database, then data retrieval is efficient and convenient, but security vulnerabilities increase and breach risks escalate
Solution Approach 1:
The patent segments the data storage architecture by separating encrypted sensitive data from decryption keys. Encrypted data is stored in a first database while decryption keys are stored in a second, separate location. This segmentation ensures that even if one storage system is compromised, the other remains secure, thereby improving data security without requiring overly complex distributed storage systems.
Solution Approach 2:
The patent introduces encryption as an intermediary layer between the stored data and the decryption keys. The encrypted data acts as a mediator that cannot be accessed without the corresponding decryption key, creating a security buffer that protects sensitive information while maintaining a relatively simple storage architecture.
2Object-affected harmful factors
If encryption is applied to sensitive data, then privacy protection and security are enhanced, but data access and retrieval become more complex
Solution Approach 1:
The patent applies preliminary action by encrypting data before storage and pre-establishing the separation between encrypted data and decryption keys. This preliminary encryption step protects privacy from the outset, while the systematic approach to key management (storing keys separately in a controlled manner) minimizes the operational complexity of data access.
Solution Approach 2:
The patent implements a controlled feedback mechanism where decryption keys are only released to authorized systems after proper authentication and authorization. This feedback loop ensures that encryption-protected data can be accessed efficiently by legitimate users while maintaining security, balancing privacy protection with ease of authorized operation.
3Reliability
If dynamic encryption keys are used for each login session, then security against breaches is improved, but key management complexity increases
Solution Approach 1:
The patent applies dynamics by using dynamic encryption keys that change with each login session or authentication event. This dynamic key generation approach significantly improves breach resistance because compromised keys become obsolete after each session. The system manages this complexity through automated key rotation and session-based key derivation, making the dynamic key management relatively straightforward.
4Reliability
If data is stored in encrypted form, then security is enhanced, but data usability and processing capability are reduced
Solution Approach 1:
The patent extracts the decryption capability from the stored data by separating encrypted data from decryption keys. This extraction maintains data protection while enabling efficient processing: once authorized, the decryption key is temporarily retrieved to decrypt data for processing, then the key is discarded or secured again. This approach balances protection with productivity by minimizing the time encrypted data needs to remain in an unusable state.
Data Source
AI summary
A method includes receiving a request from a data requester device by a server system to retrieve sensitive data associated with a customer. Decryption of the sensitive data can require a composite decryption key specific for the encrypted sensitive data. The method can include retrieving the encrypted sensitive data, a login session identifier associated with the encrypted sensitive data, at least one attribute associated with the data requester, and a decryption algorithm. The login session identifier, the at least one attribute associated with the data requester, and the decryption algorithm are required for generating the composite decryption key for decrypting the encrypted sensitive data. The method includes generating the composite decryption key and decrypting the encrypted sensitive data by the server system based on the composite decryption key. The method can include providing the decrypted sensitive data to the data requester device to be revealed.