Encrypted URL References for Multi-Tenant Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network resource identification methods, such as URLs, are vulnerable to man-in-the-middle attacks and replay attacks, particularly in multi-tenant database systems, where sensitive information can be extracted or altered, compromising user data security.
Innovation Solution
Implementing client-side encryption of URLs using public and private keys, where the client device encrypts the URL before transmission and the server decrypts it, along with techniques like URL rotation and limited-use references to enhance security against malicious attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If URLs are transmitted in plain text for easy access and compatibility, then ease of operation is improved, but security against man-in-the-middle attacks deteriorates
Solution Approach 1:
The patent introduces an intermediary encryption mechanism that mediates between the client and server. URLs are encrypted using public key cryptography before transmission, and decrypted by the server using private keys. This intermediary encryption layer protects URLs from man-in-the-middle attacks while maintaining transparent access for authorized parties.
Solution Approach 2:
The patent changes the state of URLs from plain text to encrypted text. By applying cryptographic transformation to the URL parameter, the system maintains the functional ability to access resources while eliminating the security vulnerability of plain text transmission. The encryption/decryption process allows the URL to be restored to its functional state at the destination.
2Object-affected harmful factors
If URLs are encrypted to protect sensitive information, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the client automatically encrypts URLs using the server's public key, and the server automatically decrypts using its private key. This eliminates the need for manual cryptographic key management and reduces operational complexity. The system serves itself by automating the encryption/decryption workflow.
Solution Approach 2:
The patent uses public key cryptography as an intermediary mechanism that simplifies the overall system. Rather than requiring complex symmetric key management between multiple parties, the public key acts as a universal intermediary that any client can use to encrypt, and only the intended server can decrypt. This reduces the complexity of key distribution and management.
3Object-affected harmful factors
If URL rotation is implemented to prevent replay attacks, then security is improved, but loss of time increases
Solution Approach 1:
The patent implements preliminary action by generating time-limited URLs in advance with embedded expiration timestamps. URLs are created with a predefined validity period, and the system proactively invalidates them after expiration. This prevents replay attacks by ensuring that intercepted URLs become useless after their predetermined lifetime, eliminating the need for real-time validation during each request.
Data Source
AI summary
Techniques are disclosed relating to protecting sensitive data in references to network resources. In some embodiments, a host system receives a request for a stored resource, where a first portion of the request is encrypted by a client device using a particular encryption technique and a second portion of the request is not encrypted using the particular encryption technique and where the first portion of the request includes a reference to the resource. In some embodiments, the host decrypts the reference to the resource and provides the resource to the requesting device based on the decrypted reference.