Object-Level Encryption System with Unique Session Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database encryption methods are ineffective in protecting data from unauthorized access, as they often require robust key management and can be breached, leading to security threats from insiders and external intruders, with existing solutions lacking rigorous authentication and object-level protection.
Innovation Solution
Implementing object-level encryption (OLE) where each data object in separate cells or groups of cells is encrypted with unique cryptographic session keys and initialization vectors, using a security server to manage and authenticate access, providing an object-level firewall that protects data even if the database firewall is breached.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all database cells are encrypted to provide comprehensive security, then security protection is improved, but resource consumption and system complexity increase
Solution Approach 1:
The patent implements selective encryption where only specific sensitive cells within database rows are encrypted based on their security requirements, while other non-sensitive cells remain unencrypted. This allows the system to provide security protection where needed without unnecessarily encrypting entire rows, thereby reducing resource consumption and system complexity while maintaining appropriate security levels for different data elements.
2Loss of energy
If selective cell encryption is implemented to reduce resource usage, then resource efficiency is improved, but security coverage is reduced
Solution Approach 1:
The system evaluates each cell's sensitivity and applies encryption selectively only to cells that require protection, leaving non-sensitive cells unencrypted. This approach optimizes resource efficiency by avoiding unnecessary encryption of entire rows while ensuring that sensitive data elements maintain adequate security coverage through targeted encryption.
3Reliability
If object-level encryption with unique keys per cell is implemented, then security against intruders is improved, but key management complexity increases
Solution Approach 1:
The patent segments the database into individual cells with unique encryption keys, allowing each cell to be encrypted independently with its own key. This segmentation approach enhances security against intruders by isolating encryption vulnerabilities to individual cells rather than affecting entire rows, while the key management system handles the complexity of managing multiple keys through systematic organization and access control mechanisms.
4Reliability
If rigorous authentication protocols are implemented, then access control security is improved, but system operation complexity increases
Solution Approach 1:
The system performs authentication and authorization checks before granting access to encrypted cells, establishing security credentials in advance. This preliminary action ensures rigorous authentication security is maintained while reducing operational complexity during data access, as the authentication framework is already in place and does not require complex real-time verification processes during normal operations.
Data Source
AI summary
Parties are enabled to exchange data without knowing the other party's encryption key. Cells in one party's database each form an object which is encrypted at the object level. Authentications and authorizations are incorporated into each object. An encryption management engine produces different keys for each objects. A security server database stores a key registered by one party. The in a later request by the party is compared to its registered key. A protocol and key management method allow identification and access to an appropriate key using only publicly available information. A set of data is added with a secured session key. A selected set of data is used to create a cryptographically secure Header-Tx with a secured session key and an Access Control List with an embedded security policy. Data is sent to a receiver only when authorized by the customer authentication security server.