Differential Client-Side Encryption for Secure Data Processing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

There is a need for a method and apparatus that allows sensitive information to be conveyed through a system without the requestor having access to the contents, thereby avoiding obligations to protect the information.

Innovation Solution

A method involving a processor that allocates public keys to entities, stores corresponding private keys and decryption algorithms, and decrypts encrypted data received over a network, allowing the decrypted data to be processed by a separate computing device without the processor having access to the unencrypted data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the requestor processes sensitive information directly, then processing capability is improved, but security risk and compliance obligation increase

Engineering Contradiction:

Improveprocessing capabilityVSAvoidsecurity risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system segments the sensitive information processing into two distinct parts: encryption/decryption operations performed by the requestor's computing device, and processing operations performed by a separate processing engine. This segmentation allows the requestor to process information without actually accessing the sensitive data, as the data remains encrypted during transmission and is only decrypted by the processing engine temporarily.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The processing engine acts as an intermediary between the requestor and the sensitive information. The requestor submits encrypted data to the processing engine, which temporarily decrypts it for processing, then re-encrypts it before returning to the requestor. This intermediary mechanism enables processing capability while eliminating the requestor's direct access to sensitive data, thereby reducing security risks and compliance obligations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If the requestor stores sensitive information, then data availability is improved, but security obligation increases

Engineering Contradiction:

Improvedata availabilityVSAvoidsecurity obligation

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The system extracts the sensitive information from the requestor's computing device environment entirely. The requestor only stores and transmits encrypted data, while the actual sensitive information is temporarily held only in the processing engine's secure environment during processing operations. This extraction eliminates the requestor's security obligations regarding storage of sensitive data while maintaining data availability through encrypted storage.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS20250106192A1Differential client-side encryption of information originating from a client

Publication Date: 2025.03.27 PAYPAL INC

AI summary

A method may include allocating a number of public keys, where each respective public key is allocated to a respective entity of a number of entities; storing a number of private keys, where each respective private corresponds to a respective public key; storing one or more decryption algorithms, where each respective decryption algorithm is configured to decrypt data previously encrypted using at least one encryption algorithm of the encryption algorithms. Each respective encryption algorithm may be configured to encrypt data using at least one public key. Each respective decryption algorithm may be configured to decrypt data using at least one private key. The method may include receiving encrypted data, where the encrypted data is encrypted using a first public key and a first encryption algorithm, and the encrypted data is provided over a network.