Field-Level Encryption State Management for Dynamic Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption systems face inefficiencies due to the computational burden of encrypting all data, difficulty in identifying fields that require encryption, and varying encryption requirements over time and context, particularly in large-scale datastores like relational databases.
Innovation Solution
A data encryption scheme that uses a data model to store target encryption states for each data field, enabling dynamic encryption and decryption based on individual field requirements, and employs a system to periodically or on-demand adjust encryption states in response to events like key rotation, new columns, column removal, and new rows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all data is encrypted to ensure data security, then security is improved, but computational burden increases significantly
Solution Approach 1:
The patent segments data into individual fields and applies encryption selectively to only those fields that require protection based on encryption policies, rather than encrypting all data uniformly. This allows the system to maintain security for sensitive fields while avoiding the computational overhead of encrypting non-sensitive data.
Solution Approach 2:
The patent implements local quality by applying different encryption states to different data fields based on their specific sensitivity and policy requirements. Each field can have its own encryption state (encrypted or unencrypted) determined by evaluating encryption policies against the field's characteristics, allowing optimized resource allocation.
2Productivity
If encryption is applied to specific fields based on policy requirements, then computational efficiency is improved, but difficulty in identifying and managing encryption requirements increases
Solution Approach 1:
The patent creates a universal encryption policy management system that handles multiple encryption policies, fields, and scenarios through a single unified framework. The encryption policy evaluator can assess any data field against any encryption policy, and the system automatically determines the appropriate encryption state, reducing management complexity despite the variety of requirements.
Solution Approach 2:
The system implements self-service by automatically evaluating encryption policies against data fields and determining encryption states without manual intervention. The encryption policy evaluator autonomously assesses whether each field should be encrypted based on the policies and requirements, eliminating the need for manual tracking and management of encryption states.
3Adaptability or versatility
If encryption states are adjusted dynamically based on changing policies, then adaptability is improved, but system complexity increases
Solution Approach 1:
The patent implements dynamics by making encryption states changeable and adaptable based on updated encryption policies and varying data requirements. The system can dynamically re-evaluate fields when policies change and automatically adjust encryption states accordingly, allowing the system to adapt to new security requirements without manual reconfiguration.
Solution Approach 2:
The system uses feedback mechanisms where the encryption policy evaluator continuously monitors policy changes and data field states, and automatically triggers re-evaluation and state adjustment when necessary. This feedback loop ensures the system remains adaptive to changing requirements while maintaining automated control, reducing the perceived complexity through self-regulation.
Data Source
AI summary
A system may access a data model comprising a plurality of field names and, for each field name from among the plurality of field names, a target encryption state that indicates whether data identified by the field name is to be encrypted. The system may receive an encryption trigger. The system may, responsive to the encryption trigger, for each encryption event from among one or more encryption events: identify a target encryption state for the data based on the data model, and execute an encryption process on the data based on the target encryption state. The encryption process may cause the data to be in the target encryption state.