Database Server Format-Preserving Encryption for Sensitive Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems lack effective methods to protect personally identifiable information and sensitive data while maintaining data format integrity and operational efficiency, leading to security risks and compliance challenges with privacy regulations.
Innovation Solution
Implementing a database server system that employs format-preserving encryption (FPE) to encrypt and decrypt data in real-time, allowing operations to be performed on encrypted data without format changes, and generating synthetic data for testing directly on production systems, while managing encryption keys and user access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If classical encryption is applied to protect data, then data security is improved, but storage space increases and table redesign is required
Solution Approach 1:
The patent applies format-preserving encryption which changes the encryption parameters to maintain the original data format and length, eliminating the need for additional storage space while preserving data security
Solution Approach 2:
The encryption process creates a cryptographic copy of the data that matches the original format exactly, allowing the encrypted data to replace the plaintext data without requiring additional storage capacity
2Reliability
If classical encryption is applied to protect data, then data security is improved, but table redesign is required
Solution Approach 1:
Format-preserving encryption modifies the encryption parameters to ensure the ciphertext maintains the same format, length, and data type as the plaintext, eliminating the need for table schema changes or structural redesign
3Reliability
If data is encrypted before storage, then data security is improved, but operations require decryption increasing processing time
Solution Approach 1:
The format-preserving encryption enables the encrypted data to serve multiple purposes directly without requiring decryption, allowing applications to perform operations on encrypted data itself, thus eliminating the time-consuming decryption step while maintaining security
4Reliability
If data is returned in encrypted form, then data security is improved, but applications cannot verify format or perform operations
Solution Approach 1:
The format-preserving encryption maintains all original data parameters including format, length, and data type characteristics, allowing applications to verify format correctness and perform operations on encrypted data without decryption while still ensuring security
Data Source
AI summary
A database server system is provided for computer-implemented communication of electronic data between a computer-readable storage medium for storing such data and a computer-implemented application for performing at least one operation to the data. The data are structured in a first table of rows and columns defining a plurality of data cells. The database server system is configured to receive a read request from the application to return data of the data cells, and perform a format-preserving encryption or decryption operation to the data in the at least one of the data cells prior to returning the data to the application, and/or to receive a create or an update request from the application, wherein the create or update request causes a write operation to at least one of the data cells in the storage medium. A format-preserving encryption or decryption operation is performed prior to carrying out the write operation.