Data Privacy Compliance Through HYOK Encryption and Key Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data privacy compliance systems, particularly in cloud environments, fail to provide scalable and secure methods for organizations to comply with privacy laws like GDPR, especially in ensuring the right to be forgotten by effectively deleting personal data from all copies, including backups and secondary storage.
Innovation Solution
Implementing a 'Hold Your Own Key' (HYOK) encryption scheme where users retain control over encryption keys, ensuring data is encrypted before storage and can be made inaccessible by revoking keys, thus enabling compliance with GDPR regulations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional PKI models are used for securing devices and messages, then data can be encrypted and transmitted, but the system fails to be scalable and secure in terms of privacy, and cannot provide easy compliance with privacy laws
Solution Approach 1:
The patent segments the encryption key management by introducing a dedicated key management service that separates key generation, storage, and rotation operations from the main application logic. This allows the system to maintain security while improving scalability and compliance capabilities through modular architecture.
Solution Approach 2:
The patent introduces a key management service as an intermediary between the application and the encryption/decryption operations. This mediator handles key generation, distribution, rotation, and revocation, simplifying the overall system while enhancing security and privacy compliance.
2Reliability
If organizations store multiple copies of data including backups, then data redundancy and disaster recovery are improved, but the ability to erase or delete data from all copies becomes complex and resource-intensive
Solution Approach 1:
The patent applies preliminary action by encrypting data with unique keys before storage and maintaining a centralized registry of all data copies and their associated keys. When data needs to be erased, the system pre-identifies all locations and revokes the key, making the deletion process simple and efficient across all copies including backups.
Solution Approach 2:
The patent implements a feedback mechanism where the key management service maintains awareness of all data copies through registration and tracking. When a key is revoked, the system provides feedback to all stored copies, enabling coordinated deletion across primary and secondary storage locations without complex manual intervention.
3Adaptability or versatility
If data is stored encrypted with user-controlled keys, then user privacy control and GDPR compliance are improved, but key management complexity and security requirements increase
Solution Approach 1:
The patent implements self-service by enabling users to directly control their own encryption keys through the key management service. Users can generate, store, rotate, and revoke their own keys without requiring organization intervention, thereby enhancing privacy control while the automated system handles the complexity of key management operations.
Data Source
AI summary
A method or system of providing data privacy compliance at a server with respect to a right to be forgotten can include one or more processors configured for receiving key information, data, and an expiration date in response to a request to create a key by a data subject to a key management service, sending a request to and receiving a key from the key management system, encrypting the data at the server with the key to provide encrypted data, storing the encrypted data in a storage, receiving a request to access the data, attempting to retrieve the key by the server, and denying access to the data in response to the request after a request from the data subject to revoke the key. In some embodiments, the key information received by the server is Hold Your Own Key and the encryption of data is Hold Your Own Encryption.