Framework-Level Sensitive Data Encryption in Microservices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing networking systems with distributed microservice frameworks face challenges in securely handling sensitive data, such as configuration data, as it flows through the system, particularly in ensuring encryption without relying on application-level encryption.
Innovation Solution
The implementation of a process that automatically creates and incorporates an encrypted version of sensitive data within a model associated with a microservice system, allowing for secure communication and storage of sensitive information across the distributed microservice framework.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application-level field duplication and encoding/decoding are used to encrypt sensitive data, then the application can control encryption, but the data still flows through subsystems in unencrypted form and can be inspected or logged
Solution Approach 1:
The patent applies preliminary action by encrypting sensitive data at the point of entry into the framework, before the data flows through any subsystems. The framework automatically encrypts the data using encryption keys stored in secure elements, ensuring data is encrypted before it can be inspected or logged by intermediate subsystems.
Solution Approach 2:
The patent introduces an intermediary encryption layer at the framework level that sits between the application and the microservice subsystems. This intermediary automatically handles encryption and decryption without requiring application-level encoding/decoding logic, thereby reducing application complexity while maintaining security.
2Reliability
If the entire database is encrypted to protect sensitive data, then database security is improved, but the entire database must be encrypted even if only some data is sensitive
Solution Approach 1:
The patent applies local quality by implementing selective encryption at the framework level, where only specific sensitive fields and data elements are encrypted based on their sensitivity classification, rather than encrypting the entire database. This allows non-sensitive data to remain accessible without decryption overhead.
Solution Approach 2:
The patent segments the database into sensitive and non-sensitive portions, applying encryption only to the sensitive segments identified through schema analysis and sensitivity labels. This segmentation allows the system to maintain high productivity for non-sensitive operations while ensuring security for sensitive data.
3Reliability
If sensitive data is omitted or redacted from reporting, then data security is improved, but the true value cannot be determined even by privileged users for provisioning or debugging
Solution Approach 1:
The patent implements dynamic data masking that adapts based on user privileges and context. Privileged users can dynamically access decrypted sensitive data for provisioning and debugging purposes, while standard users see encrypted or redacted data. This dynamic approach maintains security while preserving necessary accessibility.
Solution Approach 2:
The system provides feedback mechanisms that allow privileged users to request decryption of sensitive data when needed for provisioning or debugging. The framework tracks and controls these decryption requests, providing audit trails while enabling authorized access to the true data values when necessary.
4Reliability
If framework-level automatic encryption is implemented, then data security is improved without application-level encryption, but the framework must automatically encrypt data which increases framework complexity
Solution Approach 1:
The patent implements self-service encryption where the framework automatically identifies sensitive data fields through schema analysis and sensitivity labels, then autonomously applies encryption without requiring explicit configuration or intervention. The system manages its own encryption keys and processes, reducing the need for complex external encryption management.
Solution Approach 2:
The patent creates a universal encryption framework that handles multiple encryption scenarios (data at rest, data in transit, selective field encryption) through a single integrated mechanism. This multi-functional approach reduces overall framework complexity compared to implementing separate encryption solutions for each scenario.
Data Source
AI summary
Systems and methods for protecting sensitive data in a system include receiving, by one or more processors, a data model comprising one or more data fields; identifying, within the data model, at least one field designated as sensitive data; automatically creating an encrypted form of the sensitive data at a framework level without requiring an application-level encryption process; and incorporating the encrypted form of the sensitive data into the data model in place of the unencrypted data.