Field-Level Data Protection Using Asymmetric Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data security approaches in cloud-based systems fail to effectively prevent unauthorized access to specific sections or fields of data, particularly in scenarios where sensitive information, such as HIPAA-regulated medical data, needs to be protected from users who are not authorized to view or modify it.
Innovation Solution
Implementing field-level data protection using asymmetric cryptography, where session-specific keys are generated by a client application and shared with a cloud platform during user authentication, allowing the platform to selectively encrypt and decrypt data fields based on user authorization, using client and server public/private key pairs to ensure only authorized users can access and edit confidential data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional symmetric encryption is used to protect data in cloud databases, then data can be encrypted at rest, but unauthorized users can still access decrypted data when it is retrieved and processed by the application layer
Solution Approach 1:
The patent segments data into individual fields or columns within database records, applying different encryption keys to different segments. This allows field-level encryption where each sensitive field can be protected with its own key, enabling fine-grained access control without encrypting entire records. The segmentation principle resolves the contradiction by maintaining confidentiality at the field level while avoiding the complexity of encrypting and managing entire records separately.
Solution Approach 2:
The patent implements local quality by applying different encryption properties to different parts of the data structure. Specifically, it uses asymmetric encryption (public-key cryptography) for fields requiring high security while using symmetric encryption for less sensitive data. This localized approach to encryption quality allows the system to provide strong protection where needed while maintaining efficiency and reducing overall system complexity.
2Reliability
If field-level encryption is implemented to protect specific data fields, then unauthorized access to sensitive fields is prevented, but the complexity of key management and encryption operations increases significantly
Solution Approach 1:
The patent introduces an intermediary component in the form of a database trigger or stored procedure that automatically handles encryption and decryption operations. This intermediary layer manages the complexity of field-level encryption by intercepting data access requests, applying the appropriate encryption keys automatically, and returning decrypted data to applications only when authorized. This resolves the contradiction by hiding key management complexity from applications while maintaining strong field-level access control.
Solution Approach 2:
The patent implements self-service through automated encryption key management where the system automatically generates, stores, and manages encryption keys without requiring manual intervention. Database triggers automatically apply encryption to newly inserted data and decryption to retrieved data, eliminating the need for applications to manually manage cryptographic operations. This reduces operational complexity while maintaining security.
3Reliability
If all data fields are encrypted to ensure maximum security, then data confidentiality is maintained, but legitimate users cannot access or edit the data they are authorized to view
Solution Approach 1:
The patent applies local quality by encrypting only specific fields or columns that contain sensitive data rather than encrypting entire records or all fields. This selective encryption approach maintains strong protection for confidential information while leaving non-sensitive fields accessible, thereby resolving the contradiction between data protection and ease of operation. Users can freely access and edit non-encrypted fields while sensitive fields remain protected but accessible to authorized users through automated decryption.
4Reliability
If asymmetric cryptography is used for field-level encryption, then selective data protection is achieved, but the computational overhead and processing time increase
Solution Approach 1:
The patent merges asymmetric and symmetric encryption approaches in a hybrid cryptographic system. Asymmetric encryption (public-key cryptography) is used for key exchange and establishing secure communication channels, while symmetric encryption is used for actual data field encryption. This combination resolves the contradiction by using asymmetric cryptography only where its unique properties (selective access control) are needed, while relying on faster symmetric encryption for bulk data protection, thereby maintaining selective encryption capabilities while improving processing speed.
Data Source
AI summary
Systems, apparatuses, and methods for providing data security for data that is stored in a cloud-level platform. In one embodiment, each session is associated with specific session “keys” for use in encrypting and decrypting data. The session specific keys are generated by a client application and the client public key of a public/private key pair is provided to the cloud platform as part of a user authentication process. If the user is properly authenticated, then the platform creates its own set of keys and sends the server public key of a public/private key pair to the client. When the client requests a data record or document, the platform can determine if the user is authorized to have access to the entire data record or document or only to certain fields or portions of the record or document. Based on that determination, the platform may selectively encrypt certain fields or portions of the record or document with the client public key.