Field-Level Data Encryption in Public Cloud Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data protection methods, such as encrypting entire databases, are inadequate for securing sensitive information in use within cloud computing systems, as they fail to protect data from breaches, user errors, or stolen access credentials when data is transmitted over public or shared networks.
Innovation Solution
Implementing a system that uses field-level encryption and tokenization, where sensitive data is identified and encrypted using hardware security modules (HSMs) to generate random tokens or ciphertext, and appending encryption key information, ensuring secure data transmission and storage while allowing compatibility with existing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If entire databases are encrypted at rest, then data confidentiality is improved, but data usability and access speed deteriorate
Solution Approach 1:
The patent segments data into two categories: confidential data (requiring encryption) and non-confidential data (accessible without encryption). This segmentation allows selective encryption of only the sensitive portions of the database, maintaining fast access speeds for non-sensitive data while protecting confidential information.
Solution Approach 2:
The patent applies different security qualities to different parts of the data structure. Specifically, only confidential fields within records are encrypted, while non-confidential fields remain accessible in plaintext. This local application of encryption maintains overall system performance while protecting specific sensitive elements.
2Reliability
If field-level encryption is implemented, then data security in transit is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary component (security module or gateway) that handles encryption and decryption operations. This intermediary sits between the application and the database, managing the complexity of field-level encryption transparently and allowing existing applications to work with encrypted data without modification.
Solution Approach 2:
The patent creates encrypted copies of confidential data fields while maintaining the original data structure and relationships. This copying approach allows the system to work with both encrypted and unencrypted versions of data, simplifying integration with existing systems that expect standard data formats.
3Adaptability or versatility
If data is transmitted over public networks, then cloud computing accessibility is improved, but risk of data breach increases
Solution Approach 1:
The patent applies preliminary protective measures by encrypting confidential data before it leaves the organization's premises. This pre-encryption creates a security layer that protects data even if intercepted during transmission over public networks, effectively countering the potential harm of data breaches in advance.
Solution Approach 2:
The patent changes the security parameter of data from unencrypted to encrypted state during the transmission process. This parameter change occurs automatically through the use of encryption modules that transform confidential data into protected form before network transmission, maintaining cloud accessibility while reducing breach risk.
Data Source
AI summary
Computer implemented systems and methods are provided for securing data. In some embodiments, a system for securing data may comprise one or more processors configured to receive a request for data over a network. The one or more processors may be configured to identify one or more confidential portions of data within the requested data. The one or more processors may be further configured to transmit the confidential portions of data to a hardware device configured to secure the confidential portions of data, and receive the secured data from the hardware device.