Split-Blob Encryption for Controlled Sensitive Data Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The frequent transfer and handling of sensitive data among multiple entities increases the risk of exposure, particularly in contexts like healthcare and finance, where strict regulations and liabilities apply.
Innovation Solution
A method involving a split blob design where sensitive data is encrypted with a unique key, which is then encrypted using a public-private key pair, allowing only authorized entities to decrypt and re-encrypt the key, minimizing the number of entities with access to unencrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If sensitive data is transferred frequently among multiple entities for processing and analysis, then data usability and processing capability are improved, but the risk of data exposure increases
Solution Approach 1:
The patent segments sensitive data into multiple encrypted portions distributed across different entities. Each entity holds only a fragment of the complete data, making it useless without the other fragments. This segmentation allows data to be widely distributed for processing while preventing any single entity from accessing the complete sensitive information, thus resolving the contradiction between data usability and exposure risk.
Solution Approach 2:
The patent introduces encrypted data fragments as intermediaries between the original data owner and processing entities. These encrypted fragments act as mediators that enable processing operations without exposing the actual sensitive data. The intermediary mechanism allows multiple entities to participate in data processing while maintaining security, as none of the intermediaries can be decoded without the original encryption key.
2Productivity
If multiple entities are involved in handling sensitive data, then processing capability and analytical depth are improved, but the complexity of security management increases
Solution Approach 1:
The patent implements a universal encryption scheme that can be applied across multiple entities and processing stages. The same encryption algorithm and key management approach work consistently whether data is processed by one entity or many, simplifying security management despite increased processing capability. This multi-functional approach allows the system to handle various processing scenarios without requiring different security protocols for each entity.
Solution Approach 2:
The patent changes the encryption parameters dynamically based on the processing requirements of different entities. By adjusting encryption keys, fragment distribution patterns, and access permissions according to specific processing needs, the system maintains simplified security management while accommodating diverse processing capabilities. This parameter flexibility allows the same framework to serve multiple entities with different processing requirements without increasing overall complexity.
3Reliability
If data is encrypted with multiple layers and keys, then security against exposure is improved, but the computational overhead and processing time increase
Solution Approach 1:
The patent performs preliminary encryption and data segmentation before distribution to multiple entities. By preparing the encrypted fragments in advance and organizing them for efficient distribution, the system reduces the computational overhead during actual processing operations. This preliminary action ensures high security reliability through multi-layer encryption while minimizing processing time delays, as the encryption work is completed beforehand rather than during critical processing stages.
Solution Approach 2:
The patent applies encryption selectively to only the portions of data that require protection, rather than uniformly encrypting all data. By identifying and encrypting only the sensitive fragments that need security protection, the system achieves high security reliability for critical data while reducing overall processing time. This partial action approach avoids the time penalty of encrypting entire datasets when only specific portions require protection.
Data Source
AI summary
A method may include receiving, by a first computing system and from a second computing system, an encrypted first key encrypted with a first public-private key pair. The encrypted first key may include a hash of at least a portion of sensitive data. The method May include decrypting, by the first computing system, the encrypted first key using a private key of the first public-private key pair to access a first key. The method may include validating, by the first computing system, the first key. The method may include re-encrypting, by the first computing system, the first key using a symmetric key to generate a re-encrypted key. The method may include transmitting, by the first computing system, the re-encrypted key to the second computing system such that the sensitive data may be decrypted.