Perpetual Data Column Rekeying for Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current data management systems face challenges in providing adequate data security, as they often rely on single-time encryption, which can be vulnerable to breaking by resourceful fraudsters, and manual re-encryption processes are infrequent and inefficient, allowing unauthorized access to sensitive data.

Innovation Solution

Implementing a data management system that automatically and continuously re-encrypts data in periodic manners, with varying re-encryption frequencies and strengths based on data sensitivity, ensuring that even if a fraudster gains access, they cannot break encryption before re-encryption occurs, thereby limiting exploitable data access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data is encrypted a single time in traditional data management systems, then initial security is provided, but the encryption can be broken by fraudsters given enough time

Engineering Contradiction:

Improvedata securityVSAvoidtime for fraudsters to break encryption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements periodic re-encryption of data at scheduled intervals. The system automatically re-encrypts data columns with new encryption keys according to defined periodicity (e.g., daily, weekly, monthly), preventing fraudsters from having indefinite time to break encryption. This periodic action continuously refreshes the security posture of the encrypted data.

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

The system performs re-encryption actions in advance before fraudsters can successfully break the current encryption. By scheduling re-encryption operations ahead of time and executing them automatically, the system proactively eliminates potential security vulnerabilities before they can be exploited.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If manual re-encryption is performed occasionally in traditional systems, then some security refresh occurs, but the process is infrequent and ad-hoc allowing years to pass between re-encryption events

Engineering Contradiction:

Improvedata securityVSAvoidre-encryption frequency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system automatically manages its own re-encryption operations without requiring manual intervention. The automated re-encryption service monitors encryption keys, schedules re-encryption tasks, executes the re-encryption process, and manages key rotation autonomously, ensuring consistent and frequent security updates.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system implements monitoring and feedback mechanisms to track the security state of encrypted data. Based on feedback about encryption age, key strength, and security threats, the system dynamically adjusts re-encryption schedules and triggers re-encryption operations when security thresholds are approached.

Inventive Principle:

Principle #23Feedback

3Device complexity

If the entire database is encrypted with a single encryption key, then simplified key management is achieved, but breaking this single encryption scheme gives fraudsters access to the entire database

Engineering Contradiction:

Improveencryption key managementVSAvoidimpact of encryption breaking

Core Design Contradiction:

Device complexityVSObject-affected harmful factors

Solution Approach 1:

The patent divides the database into multiple data columns, each encrypted with a separate encryption key. This segmentation means that if one encryption key is compromised, fraudsters only gain access to that specific column's data, not the entire database. The system manages multiple keys independently, distributing the security risk across multiple encrypted segments.

Inventive Principle:

Principle #1Segmentation

4Reliability

If various portions of the database are encrypted with different encryption keys, then localized security is improved, but the system still suffers from the drawback that breaking encryption on one portion allows exploitation of that portion

Engineering Contradiction:

Improvelocalized data securityVSAvoidexploitability of compromised data

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system implements periodic re-encryption for each data column with separate encryption keys. By continuously rotating keys and re-encrypting data columns at scheduled intervals, the system limits the time window during which any compromised portion can be exploited, even if fraudsters manage to break one column's encryption.

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

The system dynamically changes encryption parameters including key strength, encryption algorithms, and re-encryption periodicity based on the sensitivity of each data column. Highly sensitive columns receive stronger encryption and more frequent re-encryption, while less sensitive columns use appropriate security levels, optimizing both security and performance.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11393046B1System and method for perpetual rekeying of various data columns with a frequency and encryption strength based on the sensitivity of the data columns

Publication Date: 2022.07.19 INTUIT INC

AI summary

A data management system stores data related to a plurality of users. The data management system initially stores the data in an encrypted format. The data management system automatically periodically re-encrypts the data in accordance with a re-encryption policy. The re-encryption policy includes re-encryption periodicity data defining a periodicity for automatically re-encrypting the data.