Vaultless Tokenization for Field-Level Document Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods for sensitive data in electronic documents rely on data storages to maintain associations between tokens and original values, leading to excessive resource consumption, latency, and security vulnerabilities, while lacking flexibility in access control.
Innovation Solution
Implement a hybrid encryption approach using public and private encryption keys to generate tokens directly in electronic documents, eliminating the need for data storage and enabling granular access control without relying on vaults.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vault-based tokenization is used to control access to sensitive data, then access control capability is improved, but computing resource consumption and latency increase
Solution Approach 1:
The patent extracts the token storage function from the centralized vault and places it directly in the electronic document. Each sensitive value is replaced with a token that embeds its own decryption capability, eliminating the need to store tokens externally in a vault. This extraction resolves the contradiction by removing the latency-inducing vault lookup while preserving access control through embedded token metadata.
Solution Approach 2:
The tokens are designed to be self-sufficient, containing all necessary information for decryption within the document itself. The token structure includes encrypted data, decryption algorithms, and access control metadata that enable the document to service its own decryption needs without external vault intervention, thereby eliminating latency while maintaining security.
2Reliability
If data storage is used to maintain token associations, then access control is enabled, but device complexity and resource consumption increase
Solution Approach 1:
The patent merges the token storage, token management, and decryption functionality into the electronic document itself. The token structure combines encrypted data, decryption algorithms, and access control metadata in a single self-contained unit, eliminating the need for separate vault infrastructure and reducing system complexity while maintaining access control capabilities.
Solution Approach 2:
The token structure serves multiple functions simultaneously: it acts as encrypted data storage, contains decryption instructions, embeds access control policies, and provides data type information. This multi-functionality eliminates the need for separate systems for each function, reducing overall system complexity while enabling comprehensive access control.
3Ease of operation
If shared secrets are communicated between devices for decryption, then data accessibility is improved, but security vulnerability increases
Solution Approach 1:
The patent segments the decryption capability into individual tokens distributed within the document, rather than using a single shared secret. Each token contains its own encrypted data and decryption algorithm, allowing selective access to specific values without exposing a master key. This segmentation enables data accessibility while eliminating the security vulnerability of shared secrets.
Solution Approach 2:
The token structure employs asymmetric encryption where the encryption key is publicly available in the document but the decryption key remains private and embedded within the token structure. This asymmetry allows anyone to encrypt data using the public key while only authorized recipients with the private key can decrypt, improving accessibility while maintaining security against unauthorized access.
Data Source
AI summary
Presented herein are systems and methods of controlling access to values in electronic documents. A first service may receive an electronic document comprising a corresponding plurality of values associated with a corresponding plurality of fields to be provided to at least one of a plurality of client devices. The first service may identify, from the electronic document, a field of the plurality of fields associated with a corresponding value of the plurality of values is to be encrypted. The first service may select, from a plurality of first encryption keys, a first encryption key based on a field type of the field. The first service may generate a token using the value and the first encryption key for the field. The first service may send to a client device of the plurality of client devices, the electronic document comprising the token replacing the value associated with the corresponding field.