Secure Data Engine Ingress Egress via Segmented Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In enterprise environments with mixed public cloud, private cloud, and on-premise IT setups, data movement using ETL or ELT techniques poses security risks due to the exposure of sensitive data in clear formats across site boundaries, compromising security and privacy.
Innovation Solution
A data engine system that stores data in a protected format and maintains a secured database replica in clear format, using a data security system to convert data between formats for secure ingress and egress, ensuring that sensitive data remains encrypted and only accessible within the secure appliance, optimizing queries while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in protected format in secured database, then data security and privacy are improved, but query processing efficiency and ease of operation deteriorate due to inability to optimize queries on encrypted data
Solution Approach 1:
The database is segmented into two separate storage locations: a secured database storing data in protected format for security, and a secured database replica storing data in clear format for efficient querying. This segmentation allows each component to optimize for its specific function without compromising the other.
Solution Approach 2:
A secured database replica is created as a copy of the original secured database, but with the distinction that the replica stores data in clear format while the original stores data in protected format. This copy enables query optimization without exposing sensitive data in the primary database.
2Adaptability or versatility
If data is moved between environments using ETL techniques, then data transformation and compatibility are improved, but security risks increase due to exposure of sensitive data in clear formats across site boundaries
Solution Approach 1:
The secured database replica acts as an intermediary between the secured database and external systems. It receives data in protected format, converts it to clear format for processing, and returns results encrypted back to the secured database, thereby mediating data movement while maintaining security.
Solution Approach 2:
Data is converted to clear format in the secured database replica before processing, and then converted back to protected format before being stored in the secured database. This preliminary action of encryption/decryption ensures data remains secure throughout the ETL process without exposing sensitive information in clear formats across boundaries.
3Productivity
If data is stored in clear format for optimized queries, then query processing efficiency is improved, but data security and privacy deteriorate due to exposure of sensitive information
Solution Approach 1:
The system segments data storage into two separate locations with different security characteristics: the secured database stores data in protected format for security, while the secured database replica stores data in clear format for efficient querying. This segmentation allows each component to optimize for its specific function without compromising the other.
Data Source
AI summary
Aspects include receiving a query at a data engine. The data engine includes data in a protected format stored in a secured database and a copy of the data in a clear format stored in a secured database replica. The query is received from a requestor. The query is processed at the secured database replica to generate a query response in the clear format. The query response is converted into the protected format. The converted query response in the protected format is provided to the requestor.