Security-Relevant Data Fragmentation Across Non-Volatile Memories
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing security-relevant information, such as biometric data, are vulnerable to unauthorized access and compromise data protection, especially when stored on user devices, making them susceptible to presentation attacks and failing to meet data protection requirements.
Innovation Solution
The method involves splitting a data set containing security-relevant information into two fragments, storing them in different non-volatile memories, ensuring each fragment alone is insufficient for reconstructing the complete information, and using cryptographic techniques like AES 256-CBC and SHA algorithms to encrypt and distribute the fragments with misaligned lengths, along with unique headers for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the complete data set containing security-relevant information is stored in a single location for easy access, then the ease of operation is improved, but the security and data protection are compromised
Solution Approach 1:
The data set is divided into multiple fragments (first data set fragment and second data set fragment), each stored in separate non-volatile memories. No single fragment contains the complete security-relevant information, so compromising one storage location does not expose the entire data set. This segmentation resolves the contradiction by maintaining security while enabling operational access through fragment recombination when needed.
2Reliability
If the data set is stored on user's mobile device for user control, then the data protection compliance is improved, but the security against unauthorized access deteriorates
Solution Approach 1:
The complete data set is split into multiple fragments stored in different non-volatile memories (which can include mobile devices). Each fragment alone is insufficient to reconstruct the original data, providing security against unauthorized access even if one device is compromised. This enables data protection compliance while mitigating vulnerability to unauthorized access.
Solution Approach 2:
The system uses cryptographic techniques (AES 256-CBC encryption, SHA algorithms) to create a composite security structure where encrypted fragments are distributed across multiple storage locations. The combination of cryptographic protection and distributed storage creates a composite defense mechanism that maintains data protection compliance while resisting unauthorized access.
3Reliability
If the data set is split into multiple fragments and stored separately, then the security is improved, but the device complexity increases
Solution Approach 1:
The data set is divided into fragments that are stored in separate non-volatile memories. While this segmentation improves security by preventing single-point compromise, it inherently increases device complexity as multiple storage locations and fragment management mechanisms are required. The patent accepts this complexity trade-off to achieve the security improvement.
Solution Approach 2:
The patent introduces intermediary components including cryptographic processing units, fragment distribution mechanisms, and recombination logic. These intermediaries manage the complexity of handling fragmented data by providing standardized interfaces for encryption, distribution, and recombination, thereby organizing the increased complexity in a structured manner.
4Reliability
If cryptographic encryption is applied to the data set, then the security is improved, but the processing time and energy consumption increase
Solution Approach 1:
The data set is encrypted using AES 256-CBC and divided into fragments before being stored in non-volatile memories. This preliminary cryptographic action ensures that the data is protected from the moment of storage, and the encryption/decryption operations are performed only when data needs to be accessed or reconstructed, rather than continuously. This approach improves security while managing energy consumption by limiting cryptographic operations to necessary moments.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
The present invention relates to a computer-implemented method for managing a data record containing safety-relevant information, comprising the steps of: splitting the data record into a first data record fragment containing a first part of the safety-relevant information and into a second data record fragment containing a second part of the safety-relevant information, storing the first data record fragment in a first non-volatile memory and storing the second data record fragment in a second non-volatile memory, wherein the first data record fragment and the second data record fragment together represent the complete safety-relevant information, and wherein at least the first data record fragment containing the first part of the safety-relevant information or the second data record fragment containing the second part of the safety-relevant information is configured such thatthat it does not allow any conclusions to be drawn about the other part of the security-relevant information.