UI Field Mapping Gateway for Server-Side Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection methods, such as transport layer encryption, fail to protect sensitive data from servers since the server has access to the encryption key, requiring retrofitting of client devices and are infeasible for end-users to modify.
Innovation Solution
Implementing a gateway device that intermediates between client and server, using tokenization, encryption, and data masking to protect sensitive data, with the gateway controlling encryption keys and operating within the client's trust domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If transport layer encryption is used to protect sensitive data, then data protection from unauthorized entities is improved, but the server still has access to the encryption key and can access the data
Solution Approach 1:
The patent introduces a gateway device as an intermediary between the client and server. The gateway performs tokenization on sensitive data before it reaches the server, mapping original data values to tokenized representations. This intermediary layer ensures the server never receives or processes the actual sensitive data, only tokenized versions, thereby eliminating server access to plaintext data while maintaining system functionality.
Solution Approach 2:
The patent transforms the data parameter from its original sensitive form to a tokenized form through the gateway's tokenization process. By changing the parameter representation (from plaintext to tokens), the system maintains data usability for processing while eliminating the security vulnerability of server access to sensitive information.
2Reliability
If client devices are retrofitted or re-programmed to protect data from the server, then data protection is improved, but the complexity and cost of modifying thousands or millions of client devices increases
Solution Approach 1:
Instead of modifying client devices, the patent places an intermediary gateway in the network architecture between the client and server. This gateway handles all tokenization operations centrally, eliminating the need to retrofit or re-program individual client devices. The solution shifts the complexity from numerous distributed client modifications to a single centralized gateway implementation.
Solution Approach 2:
The gateway device serves multiple functions: it acts as a proxy for client-server communication, performs tokenization on sensitive data, manages token mappings, and maintains security policies. This multi-functional intermediary protects data across all client devices uniformly without requiring individual device modifications.
3Ease of operation
If the client is a User Interface extension of the server, then ease of use is improved, but the ability to modify the client for security purposes is lost
Solution Approach 1:
The gateway serves as an intermediary that enables security functionality without requiring modifications to the client's User Interface or behavior. The client continues to operate as a standard UI extension of the server, while the gateway transparently intercepts and tokenizes data in the background, preserving both usability and security.
Data Source
AI summary
A gateway device for implementing data security is described herein. The gateway device is coupled between a client device and a server device, and generates a mapping between portions of data received from a client device and interface fields or data elements of the client device. Upon receiving subsequent data from the client device, the gateway device can access the generated mapping to identify portions of the subsequent data corresponding to particular interface fields or data elements of the client device using the mapping, and can encode the identified portions of the subsequent data, for instance based on data protection techniques defined by a security policy. The encoded data can then be outputted by the gateway device to the server device.