Data Protection System with Fragmented Decryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data theft is a significant concern for organizations when employees leave or are fired, as it often goes undetected until it's too late, resulting in costly losses, and existing technologies lack effective methods to prevent unauthorized access to sensitive data in multi-tenant database environments.
Innovation Solution
Implementing a data protection system that sets a download threshold, encrypts data exceeding this threshold, and manages a decryption key by deconstructing it into 'N' fragments, where 'N' equals '2K−1', allowing reconstruction with 'K' fragments, thereby securing data against unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted and decryption keys are fragmented to prevent unauthorized access, then data security is improved, but system complexity increases
Solution Approach 1:
The decryption key is divided into multiple key fragments that are distributed to different key holders. This segmentation ensures that no single key holder can access the complete decryption key alone, thereby enhancing data security while managing the complexity through structured distribution of key fragments to authorized personnel.
2Ease of operation
If decryption keys are distributed to multiple key holders, then access control is improved, but coordination difficulty increases
Solution Approach 1:
The system pre-distributes key fragments to multiple key holders before any data access is needed. This preliminary distribution establishes access control in advance, allowing authorized personnel to have their key fragments securely stored and ready. When data access is required, the pre-established key fragment distribution enables straightforward reconstruction of the decryption key without requiring complex real-time coordination.
3Reliability
If key fragments are required for data access, then unauthorized access prevention is improved, but access time increases
Solution Approach 1:
Key fragments are distributed to authorized key holders in advance, before any data access is needed. This preliminary action ensures that when legitimate access is required, the key fragments are already available and can be quickly combined to reconstruct the decryption key, minimizing access time while maintaining strong unauthorized access prevention.
4Reliability
If data download threshold is set, then data theft prevention is improved, but productivity decreases
Solution Approach 1:
The system applies preliminary anti-action by encrypting data that exceeds the download threshold before it can be exfiltrated. This preventive encryption measure blocks potential data theft while allowing legitimate large data downloads to proceed through the established key fragment reconstruction process, thus preventing data theft without completely blocking productive data access.
Data Source
AI summary
Some embodiments of the present invention include an apparatus for securing data and include a processor, and one or more stored sequences of instructions which, when executed by the processor, cause the processor to set a data download threshold, encrypt data to be downloaded by a user based on detecting size of the data violating the download threshold such that the user receives encrypted downloaded data, and manage a decryption key used to decrypt the encrypted downloaded data. The decryption key may be deconstructed into “N” key fragments and may be reconstructed using “K” key fragments where “N” is equal to “2K−1”.