Dynamic Data Tokenization for Jurisdictional Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems fail to effectively handle dynamically changing access controls, leading to security vulnerabilities and loss of data relationships due to insufficient mechanisms for handling changes in access permissions, particularly for sensitive and non-sensitive data combinations.
Innovation Solution
A data management system that enables secure handling of sensitive and non-sensitive data by encoding sensitive data into tokens, allowing immediate access and manipulation upon changes in access controls, using cryptographic keys for decoding and encoding data fields based on jurisdictional regulations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-existing data management systems transmit the whole dataset upon access control changes, then data access is restored, but transmission time and network bandwidth are significantly increased
Solution Approach 1:
The patent extracts only the necessary portions of data (specific columns or fields) from the complete dataset rather than transmitting the entire dataset. This is achieved through selective data transmission mechanisms that identify and send only the data elements affected by access control changes, thereby reducing transmission time and network bandwidth requirements while maintaining access control enforcement reliability
Solution Approach 2:
The patent segments the dataset into manageable portions (columns, fields, or data elements) that can be independently transmitted. This segmentation allows the system to send only the specific data portions that require access control updates rather than the complete dataset, resolving the contradiction between reliable access control and transmission efficiency
2Loss of time
If pre-existing systems transmit restricted data portions, then transmission time is reduced, but relationship data between rows and sensitive columns is lost
Solution Approach 1:
The patent introduces an intermediary mechanism (such as a data catalog, metadata structure, or relationship map) that preserves the relationships between data rows and sensitive columns. This intermediary maintains the structural context of the data, allowing selective transmission of data portions while retaining information about how the transmitted data relates to the complete dataset, including relationships with sensitive columns that may not be transmitted
Solution Approach 2:
The patent creates and transmits copies of relationship metadata or data catalogs that describe the structure and relationships of the complete dataset. These copies preserve the connections between rows and columns without requiring transmission of the actual sensitive data, thereby maintaining data relationship information while reducing transmission time and bandwidth requirements
3Adaptability or versatility
If data is stored outside jurisdictional boundaries, then data utility and accessibility are improved, but compliance with data sovereignty regulations becomes difficult
Solution Approach 1:
The patent applies local quality by implementing jurisdiction-specific access control policies that tailor data protection measures to the specific regulatory requirements of different jurisdictions. This allows data to be stored flexibly in various locations while maintaining compliance with local data sovereignty regulations through customized access controls and encryption schemes appropriate to each jurisdiction's legal framework
Data Source
AI summary
A network system to allow global usage of data while allowing regional jurisdictions control over sensitive data. Different jurisdictions may declare different types of data as sensitive data that is not to be discoverable by another party. The system may receive data that includes encoded data at a first device from a second device (e.g., associated with a remote datacenter). The system may store the data at the first device. In response to receiving a request from a third entity, the system may request a cryptographic key for decoding one or more data fields of the encoded data. Based on decoding the associated field data, the system may transmit a response to the data request that includes the decoded data.