Cross-Table Encryption for Sensitive Data Association Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for a simple and effective method to protect personal data from theft in commercial databases without compromising its availability to authorized users, given the increasing incidence of identity theft and regulatory requirements such as the California Security Breach Information Act.
Innovation Solution
The method involves encrypting sensitive data associations by storing data values in separate tables using different encryption keys and salt values, ensuring that sensitive information like SSN and salary are not exposed together, while allowing authorized access by decrypting the data using appropriate keys and salt values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted and stored in separate tables with different encryption keys, then data security is improved, but data access complexity increases
Solution Approach 1:
The patent divides the database into multiple separate tables, each containing different data fields (e.g., personal information table, financial information table). Each table is encrypted with a different encryption key, so that even if one table is compromised, other sensitive data remains protected. This segmentation approach directly resolves the contradiction by improving security through structural division while managing access complexity through organized key management.
Solution Approach 2:
The patent applies different encryption keys to different tables or data fields based on their sensitivity level. Critical data fields use stronger encryption or different keys compared to less sensitive fields. This local differentiation improves overall security without uniformly increasing complexity across the entire system, allowing authorized users to access less sensitive data more easily while maintaining strong protection for critical information.
2Reliability
If salt values are used to encrypt data associations, then unauthorized correlation prevention is improved, but processing time increases
Solution Approach 1:
The patent pre-generates salt values and stores them in the database alongside the encrypted data. During data encryption, the system retrieves the pre-stored salt value rather than generating a new one each time, which significantly reduces processing time. The salt values are generated in advance and can be cached, allowing the system to maintain strong correlation protection while minimizing the time penalty during normal operations.
3Reliability
If multiple encryption keys are used for different data fields, then data protection is improved, but key management complexity increases
Solution Approach 1:
The patent introduces a key management service or intermediary component that handles the storage, retrieval, and rotation of encryption keys. This intermediary abstracts the complexity of managing multiple keys from the application logic, providing a unified interface for key access. The service can implement key versioning, access control policies, and automatic key rotation, thereby improving data protection through multiple keys while containing management complexity within a dedicated component.
Data Source
AI summary
Sensitive data associations for related data values are protected. A set of related data values is received. The set of related data values include at least a first data value and a second data value. The first data value is associated with a first data field and the second data value is associated to a second data field. First encrypted data is created by encrypting the first data value using a first encryption key and a second encrypted data is created by encrypting the second data value using a second encryption key. The first data value is stored in a first data table, the second data value is stored in a second data table, the first encrypted data is stored in the second table, and the second encrypted data is stored in the first table.