Protected Data Set for Untrusted Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data containing proprietary and confidential elements becomes unusable for processing in untrusted environments due to strong encryption methods, which introduces vulnerabilities and negates the benefits of using public infrastructures like public clouds.
Innovation Solution
A method that separates data records into confidential and non-confidential attributes, calculates encrypted and authentication values using strong encryption algorithms like AES/CBC or AES/GCM, and exports a protected data set to untrusted environments, allowing for secure processing without decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strong encryption methods are used to protect confidential data in untrusted environments, then data security is improved, but data usability for processing deteriorates
Solution Approach 1:
The patent segments confidential data into two distinct components: encrypted values (for security) and authentication values (for processing). This segmentation allows each component to serve its specific function independently, resolving the contradiction between security and usability.
Solution Approach 2:
The patent introduces authentication values as an intermediary element that enables processing operations without requiring decryption. These authentication values act as a mediator between the encrypted data and processing requirements, allowing secure yet usable data handling.
2Ease of operation
If data is decrypted before processing in untrusted environments, then data usability is improved, but data security deteriorates
Solution Approach 1:
The patent extracts the authentication functionality from the encrypted data itself, creating separate authentication values that can be used for processing. This extraction allows processing operations to proceed on the extracted authentication values without exposing the actual confidential data, maintaining security while improving usability.
3Ease of operation
If lower strength encryption methods are used to enable processing, then data usability is improved, but data security deteriorates
Solution Approach 1:
The patent segments the encryption functionality into two parts: strong encryption for protecting confidential data (producing encrypted values) and separate authentication mechanisms (producing authentication values). This segmentation allows strong encryption to be maintained while enabling processing through the authentication values.
4Reliability
If processing is performed on encrypted data, then data security is maintained, but processing speed deteriorates
Solution Approach 1:
The patent introduces authentication values as intermediary structures that enable efficient processing operations. These authentication values are designed to support common processing operations (such as equality comparisons and aggregations) without requiring decryption, thereby maintaining security while improving processing speed.
Solution Approach 2:
The patent creates authentication values that are copies or representations of the encrypted data, optimized for processing purposes. These authentication value copies allow standard analytical tools to process data efficiently without accessing or decrypting the actual confidential information.
Data Source
AI summary
Systems and methods for manipulation of private information in untrusted environments are disclosed. In one embodiment, in a trusted computing environment comprising at least one computer processor, for a plurality of data records, a method for manipulation of private information in untrusted environments may include: (1) separating each data record into a confidential data attribute and a non-confidential data attribute; (3) calculating an encrypted value for the confidential data attribute using an encryption key; (4) calculating an authentication value for the confidential data attribute using a hash value key; (5) associating the encrypted value and the authentication value in a protected data set; and (6) associating the non-confidential data record with the associated encrypted value and the authentication value; and (7) exporting the protected data set to an untrusted computing environment.