Gateway Tokenization for Secure Multi-Domain Cloud Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection techniques expose sensitive data to misuse and security threats when transmitted or stored outside a trusted domain, particularly in cloud computing environments where entities cannot be fully trusted.
Innovation Solution
Implementing a gateway device that performs tokenization, encryption, and other data protection techniques to secure sensitive data, using token tables and initialization vectors, while maintaining data confidentiality and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is provided to entities outside trusted domain for processing, then data operations can be performed, but data security and confidentiality are compromised
Solution Approach 1:
The patent introduces a gateway device as an intermediary component positioned between the trusted domain and untrusted cloud entities. This gateway performs tokenization of sensitive data before transmission, enabling external entities to process tokenized data while the original sensitive data remains protected within the trusted domain. The gateway acts as a mediator that facilitates data processing outside the trusted domain without compromising security.
Solution Approach 2:
The patent transforms data from its original sensitive format into tokenized form, changing the parameter representation of the data. Tokenization converts sensitive data values into tokens that can be processed by external cloud entities while maintaining a mapping relationship that allows reconstruction of the original data. This parameter transformation enables processing outside the trusted domain while preserving security.
2Object-affected harmful factors
If data is encrypted to protect confidentiality, then data security is improved, but data processing capability is reduced
Solution Approach 1:
The patent creates a copy of the data in tokenized form that can be processed by external entities, while the original encrypted/sensitive data remains protected. The tokenized copy maintains the structural and functional characteristics needed for processing while being semantically different from the original data, allowing processing without exposing the actual sensitive information.
Solution Approach 2:
The patent segments the data processing function into two parts: tokenization performed by the gateway device within the trusted domain, and processing of tokenized data performed by external cloud entities. This segmentation allows the sensitive data to remain encrypted/tokenized during transmission and storage, while still enabling necessary processing operations through the tokenized representations.
3Object-affected harmful factors
If tokenization is applied to protect data, then data confidentiality is maintained, but data integrity and processing accuracy may be affected
Solution Approach 1:
The patent implements feedback mechanisms where the gateway device receives tokenized data back from external entities, verifies processing results, and ensures accurate reconstruction of original data. The feedback loop includes validation of token-to-original-data mappings and verification that processing operations were performed correctly on the tokenized representations, maintaining integrity while preserving confidentiality.
Solution Approach 2:
The patent performs preliminary tokenization actions at the gateway device before data is transmitted to external entities. This preliminary action establishes the secure tokenized form that will be processed externally, and includes pre-establishment of mapping relationships and validation rules that ensure processing accuracy and data integrity will be maintained throughout the external processing operation.
Data Source
AI summary
A gateway device for implementing data security is described herein. The gateway device is coupled between a client device and a server device, and is configured to receive encoded data and a set of operations from the server device in response to a request for cloud services from the client device. The gateway device is configured to decode the encoded data, and to provide the decoded data and the set of operations to the client device. The client device is configured to perform the set of operations on the decoded data, and to incorporate the operation results into an application or interface corresponding to the requested cloud service. The gateway device is configured to encode the operation result data, and to provide the encoded operation result data to the server device for storage.