Controlled Data Migration With Key-Wrapped Transfer Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in securely migrating encrypted user data, particularly personally identifiable information (PII), from an existing PCI compliant Controlled Data Environment (EPCI-CDE) to a new PCI compliant Controlled Data Environment (NPCI-CDE) while maintaining compliance with PCI standards, especially when dealing with numerous instances of user data and the need for subset filtering during transfer.
Innovation Solution
A system and process involving the generation of security keys, encryption contexts, and secure file transfers are employed to migrate user data. This includes generating first and second security keys, encrypting private keys, and using a key management system to manage encryption keys across environments, ensuring compliance through secure file transfers and decryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If all user data is transferred from EPCI-CDE to NPCI-CDE, then data completeness is improved, but transfer security and compliance complexity worsen
Solution Approach 1:
The patent extracts only the necessary subset of user data from the EPCI-CDE based on filtering criteria rather than transferring all data. The system identifies and extracts specific records that meet defined conditions, reducing the volume of data requiring secure transfer while maintaining compliance with PCI standards by only moving relevant information to the NPCI-CDE.
2Reliability
If encryption is applied during data transfer, then data security is improved, but processing time worsens
Solution Approach 1:
The system performs preliminary encryption of data before transfer using established PCI-compliant encryption standards. By pre-encrypting data in the EPCI-CDE before initiation of transfer, the system ensures security requirements are met while allowing the actual transfer process to proceed more efficiently without real-time encryption overhead.
3Productivity
If subset filtering is implemented during migration, then transfer efficiency is improved, but system complexity worsens
Solution Approach 1:
The patent implements partial action by applying filtering criteria to identify only the necessary subset of user data for transfer. The system evaluates records against defined conditions and processes only those meeting the criteria, avoiding unnecessary processing of irrelevant data while maintaining a manageable filtering mechanism that balances efficiency gains with acceptable system complexity.
Data Source
AI summary
Devices, systems and processes are for described for migrating controlled data from an existing controlled data environment (CDE) to a new CDE. A process includes generating first security keys that include a first public key (1PUK) and a first private key (1PRK), generating an encryption context (EC), generating, based on the EC, second security keys that include an encrypted and an unencrypted 2nd Key (u2SEK); encrypting, using the u2SEK, the 1PRK to generate an encrypted 1PRK; generating a migration request which transfers controlled data from an existing data store to a new data store (NDS); communicating, by the new CDE, the migration request and the 1PUK to the existing CDE; receiving the transfer file from the existing CDE; decrypting the transfer file; and storing the transfer file in the NDS. The existing CDE utilizes the 1PUK to encrypt the controlled data and output encrypted controlled data in a transfer file.