Deterministic Cryptography Deidentification Granular Data Destruction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data de-identification methods using lookup tables are limited to item-level granularity, leading to scalability issues in cloud environments, and cryptographic key destruction results in entire dataset loss, requiring inefficient separate keys for each data item.

Innovation Solution

Implementing deterministic cryptography with authenticated encryption and name-token pair groupings to enable granular data destruction and re-identification, allowing for precise control over data protection and retrieval.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If lookup tables are used for de-identification, then data item uniqueness is maintained, but memory consumption increases to Big O of (n) and scalability is limited

Engineering Contradiction:

Improvedata item uniquenessVSAvoidmemory consumption

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent segments the monolithic lookup table into multiple smaller partitioned tables, where each partition stores a subset of the name-token mappings. This segmentation reduces the memory footprint of any single table while collectively maintaining all necessary mappings for data item uniqueness across the distributed system.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a new dimension of distribution by storing partitioned lookup tables across multiple cloud storage locations or nodes rather than in a single centralized table. This dimensional shift from centralized to distributed storage enables linear scalability while maintaining data item uniqueness through coordinated access to the partitioned structure.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

2Reliability

If cryptographic keys are destroyed for data destruction, then data security is improved, but entire datasets are lost requiring separate keys for each item

Engineering Contradiction:

Improvedata securityVSAvoidkey management overhead

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the cryptographic key management system by associating different encryption keys with different partitions of the dataset. Each partition can be independently encrypted and decrypted using its specific key, enabling granular control over data destruction and retrieval without requiring separate keys for every individual data item.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by allowing different security properties (encryption keys) to be applied to different partitions of the data based on local requirements. This enables selective destruction of specific data partitions by destroying only the corresponding local encryption key, while other partitions remain accessible with their own keys.

Inventive Principle:

Principle #3Local quality

3Adaptability or versatility

If deterministic encryption is used for granular destruction, then data differentiation is achieved, but re-identification capability must be maintained

Engineering Contradiction:

Improvegranular data destructionVSAvoidre-identification capability

Core Design Contradiction:

Adaptability or versatilityVSLoss of information

Solution Approach 1:

The patent extracts and preserves the reversible identification mappings in separate, securely stored lookup tables that maintain the relationship between encrypted data and original identifiers. These extracted mappings enable re-identification of specific data items by looking up the corresponding token in the partitioned tables, while the actual data remains encrypted and protected.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces lookup tables as intermediary structures that mediate between the encrypted data and the original identifiers. These intermediary tables store the mapping relationships without exposing the actual sensitive data, enabling controlled re-identification through token lookup while maintaining the security and granular destruction capabilities of deterministic encryption.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11757626B1Deterministic cryptography deidentification with granular data destruction

Publication Date: 2023.09.12 CYBER ARK SOFTWARE LTD

AI summary

Disclosed embodiments relate to systems and methods for deterministic cryptography deidentification enabling granular destruction. Techniques include preparing a table of name-token pair groupings with unique tokens, storing data deidentified in association with the deidentification process in a centralized repository, identifying a token from the table of name-token pair groupings, and enabling reidentifying of a specific data item of the deidentified data based on the token provided from the table.