PII Key Management with Segmented Encryption and Key Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems provide little control to users over their personally identifiable information (PII), which is vulnerable to breaches and unauthorized access, and often sold to third parties without user consent, leading to potential misuse.
Innovation Solution
A system where users store PII on personal devices, requiring consent for access, uses a set of keys to encrypt different portions of PII, and generates new keys periodically to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users store PII on personal devices with consent-based access control, then user control and security are improved, but system complexity increases
Solution Approach 1:
The system segments PII into multiple portions and encrypts each with a different key from a set of keys. This segmentation approach allows the system to maintain security while managing complexity through organized key management rather than monolithic security structures.
Solution Approach 2:
The system generates new keys periodically and revokes old keys. This periodic key rotation creates time-limited security windows, improving reliability by ensuring that even if a key is compromised, its usefulness is limited. The structured periodic approach manages complexity through automated routines rather than ad-hoc security measures.
2Ease of operation
If a single key is used to encrypt all PII, then ease of operation is improved, but security deteriorates because compromise of one key exposes all data
Solution Approach 1:
Instead of using a single key for all PII, the system divides PII into multiple portions and assigns different keys to each portion. This segmentation improves security by ensuring that compromise of one key does not expose all data, while the systematic approach to key assignment maintains operational ease.
Solution Approach 2:
Different portions of PII are encrypted with different keys based on their specific security requirements and access patterns. This local quality approach allows tailored security for different data elements while maintaining overall system ease of operation through consistent key management procedures.
3Reliability
If keys are generated periodically and old keys are revoked, then security is improved through time-limited access, but device complexity increases
Solution Approach 1:
The system implements periodic key generation and revocation to create time-limited security windows. This periodic action improves reliability by ensuring keys have limited usefulness even if compromised. The complexity is managed through structured periodic routines rather than complex real-time key management systems.
Solution Approach 2:
Old keys are revoked and discarded after their periodic lifecycle expires, while new keys are generated for continued security. This discarding and recovering approach simplifies key management by automatically retiring compromised or expired keys, reducing the burden of managing large numbers of active keys while maintaining security.
Data Source
AI summary
A system protects personally identifiable information (PII) by implementing an unconventional key management scheme. In this scheme, the system uses a set of keys rather than an individual key for encrypting PII. Different portions of the PII are encrypted using different keys from the set of keys. In this manner, even if a malicious user were to access a key, that key would not give the malicious user the ability to decrypt all of the PII. Additionally, the system generates a new set of keys periodically (e.g., once a month). The system also deletes sets of keys that are too old (e.g., six months old). As a result, even if a malicious user were to access a key, the usefulness of that key would be time limited.