Sensitive Data Storage Using Split Keys and Attribute Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems are vulnerable to external threats, risking the compromise of sensitive information and exposing organizations to legal and reputational risks due to the lack of secure storage methods that protect sensitive data even if the server or virtual environment is accessed by unauthorized actors.
Innovation Solution
The system employs a secure computing environment that generates hash values based on combinations of anonymized user identifiers, user attributes, and a secret key generated by a remote computing device, ensuring that sensitive data remains secure as long as the external actor does not access both the system and the secret key generator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sensitive information is stored directly on the server, then data accessibility and operational efficiency are improved, but security against external threats deteriorates
Solution Approach 1:
The system segments sensitive information into multiple components: hash values stored in data repositories and secret keys stored separately in secure key storage. This segmentation ensures that even if one component is compromised, the complete sensitive information remains protected. The hash values are generated by combining anonymized user identifiers, user attributes, and secret keys, creating a distributed security architecture.
Solution Approach 2:
The system introduces hash values as an intermediary between the original sensitive data and the stored representations. Instead of storing plaintext sensitive information, the system stores hash values that can verify data integrity without revealing the original information. This intermediary layer provides mathematical proof of data authenticity while maintaining security.
2Speed
If hash values are generated using a secret key stored locally with the data, then data verification speed is improved, but security against data breaches deteriorates
Solution Approach 1:
The system separates the secret key storage from the data repository, creating distinct security zones. Secret keys are stored in a secure key storage system with restricted access, while hash values are stored in data repositories for efficient verification. This segmentation maintains verification speed by keeping hash values accessible while protecting the secret keys from compromise.
Solution Approach 2:
The system performs preliminary hash value generation using secret keys before data storage or transmission. Hash values are pre-computed and stored alongside or separate from the data they protect. This preliminary action enables rapid verification without requiring real-time secret key access, balancing speed and security.
Data Source
AI summary
A system including: one or more processors; a memory storing instructions that, when executed by the one or more processors are configured to cause the system to: receive a plurality of user names and a plurality of anonymized user identifiers; receive a plurality of user attributes associated with one or more users of the plurality of users; receive a first plurality of hash values that uniquely identify an association between each user attribute and one or more users; receive a first request for a listing of user names associated with a first user attribute; receive a first secret key; generate a second plurality of hash values; determine a first subset of the first plurality of hash values that match the second plurality of hash values; generate a first graphical user interface including the listing of user names; and transmit the first graphical user interface to the first user device.