Tiered Database Access Using Cached Authentication and Keyed Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely enrolling and authenticating users for tiered data access, particularly in financial transactions, while ensuring scalability and preventing identity theft.
Innovation Solution
A system utilizing an enrollment processor connected to a network via a firewall, with a bastion host and load balancer, generates encryption keys for computing devices, stores tiered data in databases and in-memory caches, and performs decryption based on user access requests, using in-memory caches and decryption keys for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all key data is exchanged during user enrollment for secure access to tiered data, then authentication security is improved, but the complexity of the enrollment process increases
Solution Approach 1:
The patent segments user data into three distinct tiers: Tier 1 data (collected during enrollment), Tier 2 data (collected from external sources), and Tier 3 data (sensitive data requiring highest security). Each tier has its own encryption key and access controls. This segmentation allows the system to maintain high security for sensitive data while simplifying the enrollment process by not requiring all data to be exchanged upfront.
Solution Approach 2:
The system performs preliminary actions by collecting and encrypting Tier 1 data during enrollment, and pre-collecting Tier 2 data from external sources before the user actually needs access. This allows the enrollment process to be completed with less immediate data exchange, while security is maintained through pre-established encryption keys and cached authentication data.
2Reliability
If a secure system gathers data from multiple sources with authentication and verification, then identity theft prevention is improved, but scalability of the service deteriorates
Solution Approach 1:
The patent creates cached copies of Tier 2 authentication data from external sources and stores them locally in the system. Instead of repeatedly querying external sources for every authentication attempt, the system uses these cached copies for verification. This copying mechanism maintains security by preserving authentication capabilities while dramatically improving scalability and reducing dependency on external systems.
Solution Approach 2:
The system implements local quality by storing encrypted Tier 1 data locally in a database and cached Tier 2 data locally in memory. This local storage allows rapid authentication operations without requiring continuous external verification, thereby improving scalability while maintaining security through localized encryption key management and data verification.
3Reliability
If encrypted data is stored in a database for secure access, then data security is improved, but access speed deteriorates
Solution Approach 1:
The patent segments data storage into two locations with different security and performance characteristics: Tier 1 encrypted data is stored in a database for high security, while Tier 2 cached data is stored in memory for fast access. During authentication, the system first checks the cached data in memory for immediate verification, then accesses the encrypted database only when necessary. This segmentation resolves the contradiction by providing both secure storage and rapid access paths.
Solution Approach 2:
The system performs preliminary actions by pre-caching authentication data from Tier 2 sources into memory before actual authentication is needed. This preliminary caching allows the system to perform rapid authentication operations using the cached data, while the encrypted database serves as a secure backup. The preliminary action of caching eliminates the need for slow database access during time-critical authentication operations.
Data Source
AI summary
Implementations are disclosed herein to provide tiered access to databases. In some implementations, a method includes an enrollment processor, generating, at the enrollment processor, an encryption key specific to a computing device associated with the tiered data; providing the encryption key to the computing device; receiving, at the enrollment processor, the tiered data that includes at least first tier data and second tier data, storing the tiered data, receiving, at the enrollment processor, an access request from a second computing device associated with a user, determining, using the in-memory cache, whether there is a match between the data elements and the stored second tier data, based on determination that there is the match, performing a decryption of a portion of the first tier data using the encryption key, and storing the decrypted portion of the first tier data in a third database connected to the enrollment processor.