Edge Encryption with Metadata for Secure Data Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-as-a-service models, encrypting sensitive data for storage in remote networks can limit the ability of external service providers to perform operations on that data, as standard APIs cannot interpret encrypted values, leading to disabled functions.
Innovation Solution
Implementing edge encryption with metadata, where sensitive data is encrypted and accompanied by metadata indicating its properties, allowing the service provider to perform operations without decrypting the data, using a system that includes a processor and memory to receive, encrypt data, generate metadata, and transmit a payload with both encrypted and metadata to the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive data is encrypted for transmission and storage by remote servers, then data security is improved, but the ability of service providers to perform operations on the data deteriorates
Solution Approach 1:
The data is segmented into two distinct parts: encrypted sensitive data and unencrypted metadata. The encryption system processes only specific portions of the data while leaving other portions (metadata) in plaintext. This segmentation allows the service provider to perform operations on the metadata without compromising the security of the encrypted data, thus resolving the contradiction between data security and operational capability.
Solution Approach 2:
Metadata acts as an intermediary between the encrypted data and the service provider's operations. The metadata contains descriptive information about the encrypted data (such as data type, format, relationships) that enables the service provider to perform operations without accessing or decrypting the actual sensitive data. This intermediary mechanism maintains both security and operational versatility.
2Ease of operation
If standard APIs are used to access encrypted data, then ease of operation is maintained, but the functionality of the APIs deteriorates due to inability to interpret encrypted values
Solution Approach 1:
Instead of requiring APIs to directly process encrypted data, the system creates a copy of the essential data characteristics in the form of metadata. This metadata copy contains all the information needed for API operations (data type, format, relationships) without containing the actual sensitive values. Standard APIs can then operate on this metadata copy as if they were operating on the original data, maintaining ease of operation while preserving security.
3Reliability
If all data is encrypted to ensure security, then data protection is improved, but the complexity of the system increases due to handling encrypted data throughout the pipeline
Solution Approach 1:
The encryption is applied locally and selectively to only the sensitive portions of the data, rather than encrypting the entire dataset. The system identifies specific data fields that require encryption and applies encryption only to those portions, leaving metadata and non-sensitive data in plaintext. This local quality approach maintains strong data protection for sensitive information while significantly reducing the complexity of handling encrypted data throughout the system pipeline.
Data Source
AI summary
Systems and methods are disclosed for encrypting portions of data for storage and processing in a remote network. For example, methods may include receiving a message that includes data for forwarding to a server device; encrypting a portion of the data to determine an encrypted portion; determining metadata based on the portion of the data, wherein the metadata indicates one or more properties of the portion of the data and enables one or more operations to be performed by the server device that depend on the one or more properties; determining a payload including the data with both the encrypted portion and the metadata substituted for the portion of the data; and transmitting the payload to the server device.