Sensitive Data Access via Segmented Storage and Token Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring secure and compliant storage and access of sensitive data across different geographical locations, particularly due to stringent regulations requiring data to be stored in specific countries, poses challenges in managing access and storage protocols.
Innovation Solution
A system that uses a processor to determine access and storage policies based on data location context, employing tokens to securely store and retrieve sensitive data, with separate storage and application server systems to prevent unauthorized access, ensuring that both systems must be compromised to obtain the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sensitive data is stored in a centralized location for easy access, then access efficiency is improved, but security and compliance with regional storage regulations deteriorate
Solution Approach 1:
The patent divides the data storage system into two separate segments: a data storage system that holds sensitive data and an application server system that holds application logic and tokens. This segmentation ensures that even if one system is compromised, the other remains secure, thereby maintaining both access efficiency and security/compliance with regional regulations.
2Reliability
If access controls are made more restrictive to enhance security, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent introduces tokens as an intermediary mechanism between the application server system and the data storage system. These tokens enable authorized access to sensitive data without requiring direct authentication at the storage level, thus maintaining strict security controls while simplifying the access process for authorized users.
3Reliability
If data is stored in multiple geographical locations for compliance, then compliance with regional regulations is improved, but system complexity increases
Solution Approach 1:
The patent extracts the complexity of managing multiple geographical storage locations by separating the data storage function from the application logic. The data storage system can be distributed across multiple locations for compliance, while the application server system manages access uniformly through tokens, reducing overall system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for accessing data includes an interface and a processor. The interface is to receive a request to access data and requestor information. The processor is to determine whether the data comprises sensitive data configured to have an assigned access policy and an assigned storage policy; and in the event that the data comprises sensitive data configured to have the assigned access policy and the assigned storage policy, determine whether access is allowed based at least in part on the requestor information; and in the event that access is allowed, retrieve the data based on information provided by a token and provide the data.