User-Defined Secure Database Schemas for Cross-Organization Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure data exchange between organizations lack flexibility and structure while compromising access controls, and existing cryptographic systems risk trust exploitation by third parties.
Innovation Solution
A secure database system that uses user-defined schemas and encryption keys, ensuring data and schema are encrypted, preventing access to unauthorized parties, including the database manager, by sharing encryption keys only among participating organizations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a third-party organization provides cryptographic functionality, then users can easily secure their communications, but the third party may exploit trust to obtain unencrypted communications
Solution Approach 1:
The patent extracts the cryptographic key management functionality from the cloud service provider's control sphere. Clients generate and retain their own encryption keys locally, while only encrypted data is stored in the cloud. This separation ensures that the cloud service provider cannot access unencrypted communications, eliminating the trust vulnerability while maintaining ease of secure communication setup.
Solution Approach 2:
The patent introduces an intermediary cryptographic architecture where client-side key management acts as a mediator between the user and the cloud service provider. The cloud service provider becomes a mere storage intermediary that handles only encrypted data, unable to decrypt or access the actual communication content, thus resolving the trust issue while preserving operational simplicity.
2Manufacturing precision
If a formal schema is used in databases, then control over data structure is improved, but flexibility is reduced
Solution Approach 1:
The patent implements dynamic schema evolution capabilities that allow data structures to adapt and change over time without requiring complete schema redefinitions. The system supports adding, modifying, and removing fields and data types dynamically, enabling both structured data control and flexibility to accommodate changing requirements.
Solution Approach 2:
The patent employs preliminary schema definition with forward-compatible design patterns. Schemas are defined in advance with extensible structures that anticipate future data requirements, allowing the system to maintain structural control while being prepared for flexible adaptations when new data types or fields are needed.
3Adaptability or versatility
If spreadsheets are used for data exchange, then flexibility is improved, but data structure control is reduced
Solution Approach 1:
The patent merges the flexibility of spreadsheet-like interfaces with the structural control of formal databases. The system combines dynamic field addition capabilities with schema validation rules, creating a hybrid approach that accepts flexible user input while maintaining enforced data structure integrity through defined data types, constraints, and validation protocols.
4Ease of operation
If encryption keys are shared among users, then data accessibility is improved, but risk of key exposure to unauthorized parties increases
Solution Approach 1:
The patent segments the encryption key architecture into multiple independent key components that are distributed among different users and systems. No single party possesses the complete decryption capability, and keys are segmented by function (encryption keys, decryption keys, key wrap keys) and by scope (user-specific, organization-specific, data-set-specific), reducing the impact of any single key exposure.
Solution Approach 2:
The patent implements local quality in key management by assigning different encryption keys to different data sets, users, and access contexts. Each user or data collection has its own dedicated key pair, ensuring that key exposure in one area does not compromise other data. This localized key management maintains accessibility for authorized users while minimizing the scope of potential key exposure risks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are described for providing secure communications among users from different organizations. An example method includes: providing a communication service to (i) a first group of users from a first organization having a first computing environment and (ii) a second group of users from a second organization having a second computing environment; creating a data storage schema in the first computing environment; encrypting the data storage schema using an encryption key in the first computing environment; sending the encrypted data storage schema from the first computing environment to a cloud storage infrastructure; receiving the encrypted data storage schema from the cloud storage infrastructure in the second computing environment; decrypting the data storage schema using the encryption key in the second computing environment; and using the data storage schema to share data between the first group of users and the second group of users.