Polymorphic Encryption Data Vault Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security systems face challenges in balancing access and security, as encryption makes data unusable for applications, and fully homomorphic encryption is complex and resource-intensive, limiting its development in secure data vaults.
Innovation Solution
Implementing a secure data vault with polymorphic encryption that isolates sensitive data, using different encryption forms tailored to user needs, allowing operations on fully encrypted data without decryption, and storing it redundantly in local and cloud copies, with granular access control and role-based policies to minimize data exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted to enhance security, then security is improved, but data becomes unusable for applications
Solution Approach 1:
The patent segments data into multiple partitions, each encrypted with different encryption schemes tailored to specific operations. This allows different portions of data to be accessed and operated on in different encryption states, enabling both security and usability.
Solution Approach 2:
Different encryption schemes are applied to different data partitions based on their specific operational requirements. Each partition has customized encryption properties that enable its specific operations while maintaining security, rather than applying a uniform encryption approach to all data.
2Reliability
If fully homomorphic encryption is used to perform operations on encrypted data, then data security is maintained, but processing resources and complexity increase significantly
Solution Approach 1:
The system divides data into multiple partitions, each with its own encryption scheme optimized for specific operations. This segmentation avoids the need for complex fully homomorphic encryption across all data, reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent employs multiple different encryption schemes with varying parameters and properties tailored to different operational needs. By changing encryption parameters rather than using a single complex scheme, the system achieves security with reduced complexity.
3Ease of operation
If data is decrypted for use, then data usability is improved, but attack vectors increase
Solution Approach 1:
The system performs necessary operations on data while it remains encrypted, before any decryption occurs. This preliminary action on encrypted data eliminates the need to decrypt data for routine operations, thereby reducing attack vectors while maintaining usability.
Solution Approach 2:
The patent introduces an intermediary layer of encryption schemes and operational protocols that enable data processing without full decryption. This intermediary mechanism allows usable operations on encrypted data, reducing exposure to attacks.
4Adaptability or versatility
If multiple parties are given decryption rights to access data, then data accessibility is improved, but security risk increases
Solution Approach 1:
The patent segments data into multiple partitions with different encryption schemes, allowing different parties to access only the partitions they need for their specific purposes. This segmentation enables broad accessibility while limiting each party's exposure and reducing overall security risk.
Solution Approach 2:
Different encryption schemes are applied to different data partitions based on access requirements. This allows tailored access control where each party can access data in the appropriate encryption state for their needs, improving accessibility while maintaining security through localized encryption properties.
Data Source
AI summary
Polymorphic encryption is described in a way to restrict access and enhance security of a secure data access system. In one example, a data vault has a first copy of a value being encrypted according to a first encryption scheme to enable a first operation on the first copy when the first copy is encrypted without decrypting the first copy and a second copy being encrypted according to a second encryption scheme. A governance layer has at least a first policy configured to enable the first operation, the governance layer configured to permit the first operation for an authenticated user. An interface layer has roles supporting a selected policy, the interface layer further comprising a user interface to receive user credentials, to link the credentials to a role and to send an authentication of the user and the role to the governance layer.