Application Gateway Encryption for Insider Threat Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current systems face challenges in protecting data from insider threats and exfiltration, as administrative users can bypass access controls and malicious insiders can access sensitive information, while data remains vulnerable during intra-system communication.

Innovation Solution

Implementing a comprehensive data protection mechanism using a combination of symmetric and asymmetric cryptography through an Application Gateway, which identifies and encrypts confidential data elements based on pre-configured policies and Group Keys, ensuring secure storage and access control.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If complete disk encryption is used to protect data at rest, then data security against external threats is improved, but data accessibility for authorized users and protection against insider threats deteriorates

Engineering Contradiction:

Improvedata securityVSAvoiddata accessibility

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent segments data into different sensitivity levels (public, internal, confidential, restricted) and applies different encryption strategies to each segment. This allows authorized users to access appropriate data without requiring decryption of all data, while maintaining security against both external and insider threats.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements selective encryption where only specific sensitive data elements are encrypted based on their classification, rather than encrypting entire disks or databases. This local approach maintains accessibility for non-sensitive data while providing targeted protection for sensitive information.

Inventive Principle:

Principle #3Local quality

2Ease of operation

If system administrators use high-level privileges to access and manage database data, then system functionality is improved, but vulnerability to insider threats deteriorates

Engineering Contradiction:

Improvesystem functionalityVSAvoidinsider threat vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary encryption layer between administrators and sensitive data. Even administrators with high-level privileges cannot directly access plaintext sensitive data; they must go through the encryption/decryption process which enforces access policies and prevents unauthorized access to restricted information.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent applies preliminary encryption to sensitive data before it is stored in the database, preventing insider threats from accessing sensitive information even if they have administrative privileges. The encryption is applied in advance, before any potential malicious access attempt.

Inventive Principle:

Principle #9Preliminary anti-action

3Productivity

If data is transmitted over non-encrypted sockets for intra-system communication, then communication efficiency is improved, but data vulnerability to network interception deteriorates

Engineering Contradiction:

Improvecommunication efficiencyVSAvoidnetwork interception vulnerability

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent applies encryption selectively to sensitive data elements within the data stream during intra-system communication, rather than encrypting entire communication channels. This maintains communication efficiency for non-sensitive data while providing targeted protection for sensitive information transmitted over the network.

Inventive Principle:

Principle #3Local quality

4Reliability

If Row Level Security is implemented to restrict data access, then data protection against unauthorized access is improved, but ease of circumvention by administrators deteriorates

Engineering Contradiction:

Improvedata protectionVSAvoidaccess control complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces the mechanical access control system (Row Level Security permissions) with a cryptographic system. Instead of relying on permission checks that can be bypassed, the system uses encryption keys that mathematically enforce access control, making it impossible to circumvent without the proper cryptographic credentials.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10609001B2Using cryptography and application gateway to eliminate malicious data access and data exfiltration

Publication Date: 2020.03.31 SYNERGY BUSINESS INNOVATION & SOLUTION INC

AI summary

A system and method that prevents data access and data exfiltration is disclosed. The system includes a communication interface configured to receive and send encrypted and non-encrypted data, a secure storage device that resides on a gateway the storage device stores a plurality of pre-configured encryption policies and a processing circuit coupled to the storage device and the communication interface. The processing circuit configured to identify confidential data elements in a message payload received at the gateway through the communication interface, apply the encryption policies to each identified confidential data element in the message payload, receive a collection of Group Keys from a key store, encrypt each identified confidential data element in the message payload based on the encryption policies and the Group Keys and store the encrypted identified confidential data elements in a remotely located data storage device accessible through the communication interface.