Encryption Filter for Selective Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for encrypted communication between a client and a server, particularly in REST-based systems, face challenges such as data exposure during transmission, complex key management, and the need for server-side decryption, which compromises security and efficiency.
Innovation Solution
A method that dynamically encrypts and decrypts query and response elements based on a predetermined configuration, using encryption filters to manage key data and maintain encryption transparency, allowing for selective encryption and decryption without server involvement, and utilizing different encryption methods for varying query and response elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If point to point encryption is used to protect communication path, then security during transmission is improved, but data is exposed on the server and requires complex key management
Solution Approach 1:
The patent introduces an encryption filter as an intermediary component between the client and server. This filter handles all encryption and decryption operations, allowing the server to process encrypted data without requiring decryption capabilities. The filter manages key storage and retrieval, eliminating the need for complex key management on the server side while maintaining secure communication.
Solution Approach 2:
The system segments the encryption functionality from the server by introducing a separate encryption filter component. This segmentation allows the server to focus on data processing while the dedicated filter handles cryptographic operations, simplifying the overall key management architecture and reducing the server's security burden.
2Reliability
If XML encryption or JSON web encryption is used to encrypt data in messages, then data security is improved, but the structure of data is modified and services may classify encrypted messages as invalid
Solution Approach 1:
The encryption filter applies encryption selectively to specific data elements within messages based on predefined policies. Rather than encrypting entire messages or documents, only sensitive fields are encrypted while maintaining the overall message structure. This localized approach ensures data security for sensitive information while preserving compatibility with services that expect standard message formats.
Solution Approach 2:
The encryption filter acts as an intermediary that transparently encrypts sensitive data elements before messages reach the server and decrypts them afterward. This intermediary approach maintains the original message structure and format, allowing standard services to process messages without detecting encryption, while still providing security for sensitive information.
3Adaptability or versatility
If encryption filters are used to transparently encrypt data, then compatibility with unencrypted data processing is improved, but computational overhead increases
Solution Approach 1:
The encryption filter applies encryption only to necessary sensitive data elements rather than encrypting entire messages or all data fields. This partial encryption approach reduces computational overhead compared to full message encryption while still providing security for critical information. The filter uses predefined policies to identify only the minimal required elements for encryption.
Solution Approach 2:
The system allows dynamic adjustment of encryption parameters and policies to optimize the balance between security and computational overhead. By modifying encryption parameters such as which fields are encrypted, the strength of encryption, and the frequency of key rotation, the system can adapt to different performance requirements while maintaining transparency to applications.
Data Source
AI summary
The invention relates to a method and an apparatus for encrypted communication between a client and a server, wherein the communication comprises request messages, each with request elements, and response messages, each with response elements. Request elements and response elements can comprise data. It is an object of the invention to hamper or prevent unauthorized access to the data during communication and also during storage and processing on the server. In this case, it is assumed that the communication channel and also the server itself are not trustworthy and neither client nor server provide measures or are adaptable in order to counter said risks of unauthorized access, for example by means of cryptographic methods. The invention achieves this object by virtue of a first request message being received from a client, being broken down into request elements, and at least one request element being encrypted on the basis of a predetermined configuration, encrypted request elements being combined with unencrypted request elements to form a second response message, and being finally transmitted to the server; a first response message is then received from the server, broken down into response elements, and at least one request element is encrypted on the basis of a predetermined configuration, the encrypted request element is combined with unencrypted request elements to form a second request message, and is finally transmitted to the server; a first response message is received from the server, broken down into response elements, response elements that need to be decrypted are determined and decrypted, decrypted response elements are combined with unaltered, unencrypted response elements to form a second response message, and are finally transmitted to the client. The invention also presents an apparatus for encrypting communication between the client and the server, wherein the apparatus is arranged between the client and the server and wherein the apparatus is set up to perform the steps of said method for encrypted communication between the client and the server.