Encrypted Data Management Using Hierarchical Path Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems lack sufficient security as they co-locate encryption keys with encrypted data, making them vulnerable to attacks, and current methods for operating on encrypted data are either insecure or inefficient.
Innovation Solution
A secure encrypted data management system that generates and encrypts hierarchical path identifiers to preserve data hierarchy, allowing encrypted data operations without decrypting the data, thus keeping encryption keys separate from the server and enhancing security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If encryption keys are co-located with encrypted data on the server, then data operations can be performed efficiently, but security is compromised as attackers can steal keys and decrypt data
Solution Approach 1:
The system segments the encryption key management by creating separate key hierarchies for different data partitions. Each partition has its own encryption keys that are stored separately from the data, allowing efficient data operations while maintaining security through distributed key storage across multiple secure locations
Solution Approach 2:
The patent introduces encryption key wrappers as an intermediary mechanism. These wrappers encrypt the actual encryption keys and store them in locations separate from the data. The wrappers act as mediators that enable secure key retrieval without exposing the keys directly to the data storage system or attackers
2Reliability
If encryption keys are stored separately from encrypted data, then security is improved, but data operations become slower and less efficient
Solution Approach 1:
The system performs preliminary actions by pre-establishing key hierarchies and wrapping keys before data operations occur. Encryption keys are pre-wrapped and stored in optimized locations, and key hierarchies are pre-configured to enable fast key retrieval during data operations, reducing the performance overhead of separate key storage
Solution Approach 2:
The patent implements dynamic key management where the system can adaptively select which encryption keys to use based on the specific data partition being accessed. This dynamic approach allows the system to maintain security through separate key storage while optimizing performance by only retrieving and using the necessary keys for current operations
3Reliability
If traditional encryption methods are used with separate key storage, then security is enhanced, but the system becomes too slow for practical use
Solution Approach 1:
The system changes the parameters of key management by implementing hierarchical key structures with multiple levels (master keys, data encryption keys, and wrapped keys). This hierarchical parameter structure allows the system to use stronger encryption algorithms for security while using optimized, faster encryption methods for actual data operations, achieving both security and speed
Data Source
AI summary
A method for performing an encrypted data operation may include generating an encrypted hierarchical path identifier corresponding to a hierarchical data space for at least one plaintext data operation that preserves the hierarchy of the hierarchical data space. The at least one plaintext data operation may correspond to at least one subdivision of the hierarchical data space. The method may further include encrypting the at least one plaintext data operation, and sending a request to perform an encrypted data operation to a server. The request may include the encrypted data operation and the encrypted hierarchical path identifier.