Indexable Database Encryption for Secure Cloud Data Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security solutions fail to effectively protect personally identifiable information (PII) stored in the cloud, as encryption keys can be compromised by insider threats, leading to potential data leaks and compliance issues, especially when data is retrieved and decrypted.
Innovation Solution
The system builds indexable databases with sensitive information secured at rest using encryption keys generated on-premises, rotating keys regularly, and hashing sensitive data for secure storage and retrieval, ensuring only the customer possesses the decryption key, which remains on-premises, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted and stored in the cloud, then data security is improved, but the ability to retrieve and search the data is worsened
Solution Approach 1:
The patent divides the data into two separate components: encrypted data for security and searchable hashes for retrieval. The hash of the encrypted data is stored separately and can be searched without decrypting the actual data, allowing secure storage while maintaining search capability through the hash indices.
Solution Approach 2:
The patent introduces a hash function as an intermediary between the encrypted data and the search query. The hash acts as a mediator that allows the system to search for data using the hash value without accessing the encrypted content, thus maintaining security while enabling retrieval operations.
2Reliability
If all data is encrypted to protect sensitive information, then data protection is improved, but system complexity and performance are worsened
Solution Approach 1:
The patent applies encryption selectively rather than universally. Only data fields marked as sensitive or containing personally identifiable information (PII) are encrypted, while other data remains unencrypted. This allows the system to maintain strong protection for critical data without the overhead of encrypting all data, reducing overall system complexity.
3Ease of operation
If encryption keys are stored in the cloud for easy access, then data accessibility is improved, but security against insider threats is worsened
Solution Approach 1:
The patent extracts the encryption key management function from the cloud environment and places it on the customer's premises. The customer's system generates and stores the encryption keys locally, while only the encrypted data and its hashes are uploaded to the cloud. This separation ensures that even cloud administrators cannot access or compromise the encryption keys, eliminating the insider threat risk.
Data Source
AI summary
The technology disclosed teaches protecting sensitive data in the cloud via indexable databases. The method includes identifying sensitive fields of metadata for encryption and for hashing. The method also includes hashing at least partial values in the indexable sensitive fields to non-reversible hash values, concatenating the non-reversible hash values with the metadata for the network events, and encrypting the sensitive fields of metadata. Also included is sending the metadata for the network events, with the non-reversible hash values and the encrypted sensitive fields, to a remote database server that does not have a decryption key for the encrypted sensitive fields and that indexes the non-reversible hash values for indexed retrieval against the indexable sensitive fields. The disclosed technology also teaches retrieving sensitive information that is secured at rest: receiving a sensitive field query, hashing the query, querying and receiving network event metadata responsive to the query, and decrypting the metadata.