PII Encryption Key Generation for Virtual World Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for three-dimensional virtual worlds lack effective security measures to protect personally identifiable information (PII) from unauthorized access, especially when the database storing this information is compromised.
Innovation Solution
The implementation of dynamically generated encryption keys using resource-intensive password-based key derivation functions like scrypt, combined with randomized storage locations for different data fields across accounts, prevents unauthorized access and brute-force attacks by ensuring that even if data is decrypted, linking multiple data fields to a single account is challenging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If personally identifiable information is stored in a database for virtual world operations, then user functionality and service delivery are enabled, but the system becomes vulnerable to unauthorized access and database compromise
Solution Approach 1:
The patent segments PII storage by creating separate encrypted data fields for different types of information (e.g., financial data, health information, personal identifiers) and stores them in randomized locations within the database, preventing unauthorized access to complete user profiles even if the database is compromised
Solution Approach 2:
The patent introduces encryption keys as an intermediary layer between the stored PII and unauthorized access attempts. These keys are dynamically generated and stored separately from the encrypted data fields, creating a security barrier that prevents direct access to sensitive information
2Ease of operation
If encryption keys are stored with encrypted data for decryption purposes, then data accessibility is maintained, but security is compromised if the database is stolen
Solution Approach 1:
The patent separates encryption keys from encrypted data fields, storing keys in a secure key management system rather than alongside the encrypted data. This segmentation ensures that even if the database is stolen, the encryption keys remain protected and cannot be used to decrypt the segmented data fields
Solution Approach 2:
The patent introduces a key management system as an intermediary that controls access to encryption keys. This intermediary layer manages key generation, storage, and retrieval operations, ensuring that keys are only accessible through authorized processes while maintaining data accessibility for legitimate operations
3Productivity
If data fields are stored in fixed locations for efficient retrieval, then search performance is improved, but linked attacks become more effective
Solution Approach 1:
The patent implements dynamic storage locations for encrypted data fields by randomizing their positions in the database and maintaining an index mapping system. This dynamic approach prevents attackers from easily linking data fields to specific users or records, as the physical location of data fields changes and cannot be reliably predicted or correlated
Solution Approach 2:
The patent creates index copies that map logical data identifiers to physical storage locations without exposing the actual data or location patterns. These index structures enable efficient retrieval while hiding the true organization of encrypted data fields, preventing attackers from inferring relationships between data fields through location analysis
4Reliability
If conventional encryption methods are used for PII protection, then basic security is provided, but resource-intensive parallel attacks can still compromise the system
Solution Approach 1:
The patent changes the cryptographic parameters by implementing segmented encryption where different encryption keys and algorithms are applied to different data fields. This parameter diversification increases the computational complexity of parallel attacks, as attackers would need to compromise multiple different encryption schemes simultaneously rather than breaking a single encryption method
Data Source
AI summary
A method implemented in a computing system hosting a three-dimensional virtual reality world. The computer system stores a set of searchable records, each having: a searchable hash of at least a portion of personally identifiable information; and an encrypted identity, decryptable using an encryption key generated based at least in part on the searchable hash and a global key. In response to a search request identifying at least a portion of personally identifiable information as a search criterion, the computer system generates a hash of the search criterion, and finds a matching searchable record that has a searchable hash equal to the hash computed from the search criterion. An encryption key is computed based on the global key and the matched searchable record to decrypt an encrypted identity of a user having at least the portion of personally identifiable information that is the search criterion in the search request.