Secure Sensitive Data Storage via Segmented Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for storing and retrieving sensitive information in a distributed environment where multiple applications need to access the same data face security challenges, as databases can be hacked or stolen, and existing split-storage solutions are not fully satisfactory.
Innovation Solution
A method and system that generate extracted and complementary data from sensitive information, encode it, and use a unique index ID for storage across multiple application systems and a server system, ensuring that neither data can be reconstructed from individual database thefts and allowing secure sharing and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sensitive information is stored in a database for use by multiple applications, then information availability and user convenience are improved, but security risks increase due to potential database theft or hacking
Solution Approach 1:
The patent divides sensitive information into two separate components: extracted data stored in the application system's database and complementary data stored in a secure server system database. This segmentation ensures that no single database contains the complete sensitive information, preventing reconstruction even if one database is compromised. The extracted data and complementary data are designed to be useless independently but reconstruct the original information when combined through a secure process.
2Object-affected harmful factors
If sensitive information is split into two parts and stored in separate databases, then security is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary secure server system that manages the complementary data and coordinates the reconstruction process. The server system receives requests from application systems, retrieves the necessary complementary data, and facilitates the secure combination process. This intermediary layer simplifies the overall system architecture by centralizing security management while allowing application systems to maintain their operational simplicity.
Solution Approach 2:
The patent extracts the most sensitive component (complementary data) from the application system's database and stores it in a separate, highly secure server system. This extraction removes the critical security vulnerability from the application layer while maintaining the ability to reconstruct information when needed. The application system retains only the less sensitive extracted data, which is insufficient for unauthorized reconstruction.
3Productivity
If extracted data and complementary data are stored in the same database, then retrieval simplicity is improved, but security is compromised as both components become vulnerable to simultaneous theft
Solution Approach 1:
The patent segments the storage locations of extracted data and complementary data into two separate databases: one in the application system and another in the secure server system. This physical and logical separation ensures that even if one database is compromised, the other remains protected, preventing simultaneous theft of both components. The segmentation maintains retrieval efficiency through established communication protocols and indexing mechanisms.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of storing and retrieving a utilization data ((CC#) or applicative data for instance) associated to a sensitive information (CC#) which requires to be secured in an environment comprising a plurality of application systems (ASii=1..n) that can use said information (CC#), characterized in that storing said information (CC#) comprises the following steps: • at a given application system (ASj) of said plurality of application systems (A8i¡=1..n): receiving said information (CC#) (21), generating from said information (CC#) an extracted data (C(CC#)) and a complementary data (A(CC#)), generating an encoded information (H(CC#)) from said information (CC#), sending the extracted data (C(CC#)) and the encoded information (H(CC#)) to a server system (SS) (22), • at the server system (SS): generating an index (ID) and assigning this index (ID) to the encoded information (H(CC#)) and the extracted data (C(CC#)), storing the encoded information (H(CC#)), the extracted data (C(CC#)), and the index (ID) in a database (DBss) associated to the server system (SS) (23, 24), forwarding the index (ID) to the given application system (ASj) of the plurality of application systems (A8ii=1..n) (25), • at said given application system (ASj): assigning the index (ID) to an application stored data (A(CC#), applicative data) related to the information (CC#), storing the index (ID) along with said application stored data (A(CC#), applicative data) in a database (DBASj) associated to said given application server (ASj) (26).