Encrypted Data Management System Bulk Access Ticketing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for managing access requests related to encrypted data in software applications are inefficient, leading to excessive computing resource utilization and delays due to the need for multiple requests to data owning users for each encryption key.
Innovation Solution
A method that groups encryption keys by data owning users and generates a single data access ticket for each applicable user, allowing a unified request for access to all relevant keys, reducing the need for multiple requests and improving auditability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access requests are sent to data owning users for each individual encrypted data item, then access control security is maintained, but computing resource utilization increases and processing time is excessive
Solution Approach 1:
The patent combines multiple individual access requests for different encrypted data items belonging to the same data owning user into a single bulk access request. The system identifies all encrypted data items associated with a data owning user and consolidates access requests into one unified request, reducing the number of communication rounds and processing overhead while maintaining security through centralized approval.
Solution Approach 2:
The system performs preliminary identification and grouping of encrypted data items before generating access requests. By pre-processing the data store to map encrypted data items to their owning users and consolidating request lists in advance, the system prepares the access request structure beforehand, eliminating the need for repeated individual request processing and reducing overall latency.
2Reliability
If multiple individual access requests are sent to data owning users, then precise access control is achieved, but the number of requests and computing resource utilization increase
Solution Approach 1:
Multiple granular access requests are merged into a single consolidated request that encompasses all encrypted data items for a given data owning user. This merging reduces the total number of requests processed through the system, decreasing computational overhead and resource consumption while preserving access control precision through centralized authorization logic that evaluates all items together.
Solution Approach 2:
The access request system is designed to handle both individual and bulk access requests through a universal processing mechanism. The single consolidated request structure can represent multiple encrypted data items simultaneously, allowing the system to maintain precise access control policies while reducing request volume. The universal request format accommodates varying numbers of data items without requiring separate processing paths.
3Loss of information
If individual access requests are processed for each encrypted data item, then detailed access logging is achieved, but processing time and user burden increase
Solution Approach 1:
The system performs preliminary consolidation of access requests by grouping encrypted data items and their associated logging requirements before submission to data owning users. This pre-grouping maintains detailed access logging information for each individual item while processing them as a unified batch, reducing the time users spend reviewing and approving requests without sacrificing audit trail completeness.
Solution Approach 2:
Detailed access logging information for multiple encrypted data items is merged into a single comprehensive access request record. The consolidated request preserves granular logging details for each item while presenting a unified approval interface to data owning users, thereby maintaining information integrity for auditing purposes while significantly reducing processing time and user interaction cycles.
Data Source
AI summary
Aspects of the present disclosure provide techniques for encrypted data management. Embodiments include determining an encrypted data item in a data store that is related to a request from a data consuming user. Embodiments include determining a data owning user and an encryption key that correspond to the encrypted data item based on a key identifier associated with the encrypted data item. Embodiments include determining one or more additional encrypted data items and one or more additional encryption keys that correspond to the data owning user based on key identifiers associated with the one or more additional encrypted data items. Embodiments include generating a single data access ticket comprising information about the data consuming user, the data owning user, the encryption key, and the one or more additional encryption keys.