Transparent Client Arbitrating Mutable and Immutable Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional databases lack adequate security measures to protect against internal threats and tampering, as they often rely on mutable audit logs that can be easily modified, and existing blockchain-based systems are not suited for low-latency access to large data sets due to performance penalties and scalability issues.
Innovation Solution
A system that employs a transparent client application to arbitrate data storage between mutable and immutable data repositories, using a tamper-evident, immutable data structure like Docuchain, which utilizes Merkle Trees and cryptographic hash pointers to securely store and retrieve data, and fragments data across multiple blockchain-backed storage structures to prevent tampering and ensure data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional mutable databases are used for data storage, then data access speed and system simplicity are improved, but security against internal threats and tampering is worsened
Solution Approach 1:
The patent segments data into two categories: high-security data stored in immutable data lakes with cryptographic hashing, and low-security data stored in traditional mutable databases. This segmentation allows critical data to be protected while maintaining fast access for non-critical operations, resolving the contradiction between security and speed.
Solution Approach 2:
The patent introduces an intermediary layer consisting of a transparent client application and database driver that sits between the application and the database. This intermediary automatically classifies data, routes it to appropriate storage locations, and manages the complexity of dual-storage architecture, allowing traditional databases to maintain their speed优势 while gaining security capabilities.
2Reliability
If blockchain-based immutable storage is used for all data, then security and tamper-evidence are improved, but data access performance and scalability are worsened
Solution Approach 1:
The patent segments data storage based on security requirements, storing only high-security data in immutable blockchain-backed data lakes while keeping low-security data in traditional mutable databases. This selective segmentation maintains tamper-evidence for critical data without imposing blockchain performance penalties on all data operations.
Solution Approach 2:
The patent applies immutable storage partially - only to the extent necessary for high-security data requirements. By using immutable storage selectively rather than universally, the system achieves tamper-evidence where needed while avoiding the performance overhead of blockchain for all data access operations.
3Device complexity
If data is stored in a single database, then system complexity is reduced, but security classification and protection of different data types is worsened
Solution Approach 1:
The transparent client application and database driver automatically perform data classification and routing without requiring application code changes or manual intervention. The system self-services the complexity of managing multiple storage locations, making the dual-database architecture as simple to use as a single database while achieving proper security classification.
Solution Approach 2:
The patent creates a universal interface layer that works with both immutable and mutable databases through the same API. This multi-functional database driver handles both storage types transparently, allowing the system to manage multiple database types with a single unified interface, thus not increasing operational complexity for users.
Data Source
AI summary
Provided is a process including: receiving a first write request from an application requesting to write data to a first remote database via a network; classifying the second value as higher-security; and in response to classifying the second value as higher-security, redirecting the second value from a destination specified by the application in the received first write request, wherein an attacker with full access to the first database does not have access to the second value classified as higher security, and wherein code of the application is not modified to interface with two databases in place of the first remote database.