System and method for secure database management

A method includes encrypting a request received from a user device to generate an encrypted request. Encrypted data items are searched based on the encrypted request to identify desired encrypted data items. In response to determining that two or more encrypted data items of the desired encrypted data items have a same interaction identification, the two or more encrypted data items are locked and masked, and the masked two or more encrypted data items are removed. Algebraic operations are determined based on the encrypted request. An encrypted response is determined by performing the algebraic operations on the desired encrypted data items. The encrypted response is decrypted to obtain a decrypted response. An error is determined due to the algebraic operations performed on the desired encrypted data items. In response to determining that the error is less than an error threshold, the decrypted response is sent to the user device.

TECHNICAL FIELD

The present disclosure relates generally to database management, and more specifically to a system and method for secure database management.

BACKGROUND

The growing amount of sensitive data stored in databases poses a serious security risk. Current database management systems do not provide adequate protection for sensitive data, which can result in data breaches and sensitive information loss.

SUMMARY

The system described in the present disclosure provides several practical applications and technical advantages that overcome the current technical problems with database management.

In general, a system for secure database management comprises a database management system operably coupled to a user device of a user and a data storage system via a network. The database management system receives a request from the user device of the user, generates a secret key and a public key, and encrypts the request using the public key to generate an encrypted request. The database management system searches a plurality of encrypted data items stored in the data storage system based on the encrypted request to identify a plurality of desired encrypted data items. In response to determining that two or more encrypted data items of the plurality of desired data items have a same interaction identification, the database management system locks and masks the two or more encrypted data items of the plurality of desired data items. The database management system removes the masked two or more encrypted data items from the plurality of desired encrypted data items. In response to determining that all encrypted data items having a same interaction identification are not identified, identifying, locking, masking, and removing operations are repeated one or more times until all encrypted data items having a same interaction identification are identified.

In response to determining that the two or more encrypted data items of the plurality of desired data items do not have the same interaction identification or in response to determining that all encrypted data items having a same interaction identification are identified, the database management system retrieves the plurality of desired encrypted data items from the data storage system The database management system determines one or more algebraic operations based on the encrypted request and determines an encrypted response based on the encrypted request and the plurality of desired encrypted data items by performing the one or more algebraic operations on the plurality of desired encrypted data items. The database management system decrypts the encrypted response using the secret key to obtain a decrypted response and determines an error due to the one or more algebraic operations performed on the plurality of desired encrypted data items.

In response to determining that the error is less than an error threshold, the database management system sends the decrypted response to the user device of the user. In response to determining that the error is not less than the error threshold, the database management system performs an error correction process on the decrypted response to obtain a corrected decrypted response. The error correction process may be repeated one or more times until the error becomes less than the error threshold. The database management system sends the corrected decrypted response to the user device of the user.

The system for secure database management allows for various advantages. By encrypting the request and performing the one or more algebraic operations on the plurality of desired encrypted data items to obtain the encrypted response, an unauthorized or malicious user is prevented from accessing interactions between the user device and the data storage system. In certain embodiments, the unauthorized or malicious user may alter data items stored in the data storage system, such that two or more data items may have a same interaction identification. By locking and masking the two or more data items and excluding the masked two or more data items from the plurality of desired encrypted data items, the encrypted response is not contaminated by the altered data items. Accordingly, the databased management system allows for improving security of interactions between the user device and the data storage system, which in turn allows for improving security of network communications between various computing systems.

Accordingly, the following disclosure is particularly integrated into practical applications of: (1) improving security of interactions between the user device and the data storage system; and (2) improving security of network communications between computing systems.

In one embodiment, a database management system communicatively coupled to a data storage system and a user device of a user includes a memory configured to store an error threshold and a processor communicatively coupled to the memory. The processor is configured to receive a request from the user device, encrypt the request to generate an encrypted request, and search a plurality of encrypted data items stored in the data storage system based on the encrypted request to identify a plurality of desired encrypted data items. In response to determining that two or more encrypted data items of the plurality of desired encrypted data items have a same interaction identification, the processor is further configured to lock the two or more encrypted data items, mask the two or more encrypted data items, and remove the masked two or more encrypted data items from the plurality of desired encrypted data items. The processor is further configured to retrieve the plurality of desired encrypted data items from the data storage system, determine one or more algebraic operations based on the encrypted request, determine an encrypted response based on the encrypted request and the plurality of desired encrypted data items by performing the one or more algebraic operations on the plurality of desired encrypted data items, decrypt the encrypted response to obtain a decrypted response, and determine an error for the decrypted response due to the one or more algebraic operations performed on the plurality of desired encrypted data items. In response to determining that the error is less than the error threshold, the processor is further configured to send the decrypted response to the user device.

DETAILED DESCRIPTION

As described above, previous technologies fail to provide effective systems and methods for database management. Embodiments of the present disclosure and their advantages may be understood by referring toFIGS.1,2A and2B.FIGS.1,2A and2Bare used to describe a system and method for secure database management.

System Overview

FIG.1illustrates an embodiment of a system100for secure database management. In certain embodiments, the system100comprises a database management system110operably coupled to a user device106of a user104and a data storage system142via a network102. Network102enables the communication between the components of the system100. In other embodiments, the system100may not have all the components listed and/or may have other elements instead of, or in addition to, those listed above. For example, the database management system110may be integrated into the data storage system142.

In general, the database management system110receives a request108from the user device106of the user104, generates a secret key122and a public key124, and encrypts the request108using the public key124to generate an encrypted request128. The database management system110searches a plurality of encrypted data items156-1through156-mstored in the data storage system142based on the encrypted request128to identify a plurality of desired encrypted data items158.

In response to determining that two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158have a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1), the database management system110locks and masks the two or more encrypted data items of the plurality of desired encrypted data items158. The database management system110removes the masked two or more encrypted data items from the plurality of desired encrypted data items158. In response to determining that all encrypted data items having a same interaction identification are not identified, identifying, locking, masking and removing operations are repeated one or more times until all encrypted data items having a same interaction identification are identified. In response to determining that the two or more encrypted data items of the plurality of desired encrypted data items158do not have the same interaction identification or in response to determining that all encrypted data items having a same interaction identification are identified, the database management system110retrieves the plurality of desired encrypted data items158from the data storage system142.

The database management system110determines one or more algebraic operations126based on the encrypted request128and determines an encrypted response130based on the encrypted request128and the plurality of desired encrypted data items158by performing the one or more algebraic operations126on the plurality of desired encrypted data items158. The database management system110decrypts the encrypted response130using the secret key122to obtain a decrypted response132and determines an error134due to the one or more algebraic operations126performed on the plurality of desired encrypted data items158.

In response to determining that the error134is less than an error threshold136, the database management system110sends the decrypted response132to the user device106of the user104. In response to determining that the error134is not less than the error threshold136, the database management system110performs an error correction process on the decrypted response132to obtain a corrected decrypted response138. The error correction process may be repeated one or more times until the error134becomes less than the error threshold136. The database management system110sends the corrected decrypted response138to the user device106of the user104.

By encrypting the request108and performing the one or more algebraic operations126on the plurality of desired encrypted data items158to obtain the encrypted response130, an unauthorized or malicious user is prevented from accessing interactions between the user device106and the data storage system142. In certain embodiments, the unauthorized or malicious user may alter data items stored in the data storage system142, such that two or more data items may have a same interaction identification. By locking and masking the two or more data items and excluding the masked two or more data items from the plurality of desired encrypted data items158, the encrypted response130is not contaminated by the altered data items. Accordingly, the database management system110allows for improving security of interactions between the user device106and the data storage system142.

System Components

Network

Network102may be any suitable type of wireless and/or wired network. The network102may or may not be connected to the Internet or public network. The network102may include all or a portion of an Intranet, a peer-to-peer network, a switched telephone network, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a personal area network (PAN), a wireless PAN (WPAN), an overlay network, a software-defined network (SDN), a virtual private network (VPN), a mobile telephone network (e.g., cellular networks, such as 4G or 5G), a plain old telephone (POT) network, a wireless data network (e.g., WiFi, WiGig, WiMax, etc.), a long-term evolution (LTE) network, a universal mobile telecommunications system (UMTS) network, a peer-to-peer (P2P) network, a Bluetooth network, a near field communication (NFC) network, and/or any other suitable network. The network102may be configured to support any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

User Device

The user device106is generally any device that is configured to process data and interact with the user104. Examples of the user device106include, but are not limited to, a personal computer, a desktop computer, a workstation, a server, a laptop, a tablet computer, a mobile phone (such as a smartphone), a virtual reality headset, etc. The user device106may include a user interface, such as a display, a microphone, keypad, or other appropriate terminal equipment usable by a respective user. The user device106may include a hardware processor, memory, and/or circuitry (not explicitly shown) configured to perform any of the functions or actions of the user device described herein. For example, software applications designed using software code may be stored in respective memories and executed by respective processors to perform the functions of the user device106. The user device106is configured to communicate with other components of the system100via the network102.

In operation, the user device106of the user104is configured send one or more requests108to the database management system110and receive one or more corrected responses from the database management system110.

Database Management System

The database management system110is generally any device that is configured to process data and communicate with other components of the system100via the network102. The database management system110may comprise a processor112in signal communication with a memory116and a network interface114.

Processor112comprises one or more processors operably coupled to the memory116. Processor112is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). Processor112may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, processor112may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The one or more processors are configured to implement various software instructions to perform the operations described herein. For example, the one or more processors are configured to execute software instructions118, one or more encryption/decryption algorithms120, one or more error correction algorithms140, and perform one or more functions described herein.

Network interface114is configured to enable wired and/or wireless communications (e.g., via network102). Network interface114is configured to communicate data between the database management system110and other components of the system100. For example, the network interface114may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. The processor112is configured to send and receive data using the network interface114. Network interface114may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

The memory116comprises a non-transitory computer-readable medium such as one or more disks, tape drives, or solid-state drives, and may be used as an over-flow data storage device, to store programs when such programs are selected for execution, and to store instructions and data that are read during program execution. Memory116may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory116may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. The memory116may store any of the information described inFIGS.1,2A and2Balong with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein. The memory116is operable to store software instructions118, the one or more encryption/decryption algorithms120, the one or more error correction algorithms140, and/or any other data and instructions. The software instructions118and the one or more encryption/decryption algorithms120may comprise any suitable set of software instructions, logic, rules, or code operable to be executed by the processor112. The one or more encryption/decryption algorithms120may comprise suitable homomorphic encryption algorithms.

In operation, the processor112of the database management system110receives a request108from the user device106of the user104. The processor112of the database management system110generates a secret key122and a public key124. In certain embodiments, the key generation process comprises executing one or more encryption/decryption algorithms120by the processor112of the database management system110. The one or more encryption/decryption algorithms120may comprise suitable homomorphic encryption algorithms. The processor112of the database management system110encrypts the request108using the public key124to generate an encrypted request128. In certain embodiments, the encryption process comprises executing one or more encryption/decryption algorithms120by the processor112of the database management system110.

The processor112of the database management system110searches a plurality of encrypted data items156-1through156-mstored in the data storage system142based on the encrypted request128to identify a plurality of desired encrypted data items158. In certain embodiments, the plurality of desired encrypted data items158may comprise one or more of the plurality of encrypted data items156-1through156-m. In response to determining that two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158have a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1), the processor112of the database management system110locks the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158. In certain embodiments, the locking process comprises preventing updates to the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1). The processor112of the database management system110masks the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158. The processor112of the database management system110removes the masked two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) from the plurality of desired encrypted data items158.

In response to determining that all encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) having a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) are not identified, identifying, locking, masking and removing operations are repeated one or more times until all encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) having a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) are identified.

In response to determining that the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158do not have the same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) or in response to determining that all encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) having a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) are identified, the processor112of the database management system110retrieves the plurality of desired encrypted data items158from the data storage system142.

The processor112of the database management system110determines one or more algebraic operations126based on the encrypted request128. In certain embodiments, the one or more algebraic operations126comprise addition or multiplication. The processor112of the database management system110determines an encrypted response130based on the encrypted request128and the plurality of desired encrypted data items158by performing the one or more algebraic operations126on the plurality of desired encrypted data items158. The processor112of the database management system110decrypts the encrypted response130using the secret key122to obtain a decrypted response132. In certain embodiments, the decryption process comprises executing the one or more encryption/decryption algorithms120by the processor112of the database management system110. The processor112of the database management system110determines an error134due to the one or more algebraic operations126performed on the plurality of desired encrypted data items158.

In response to determining that the error134is less than an error threshold136, the processor112of the database management system110sends the decrypted response132to the user device106of the user104. In response to determining that the error134is not less than the error threshold136, the processor112of the database management system110performs an error correction process on the decrypted response132to obtain a corrected decrypted response138. In certain embodiments, the error correction process comprises executing one or more error correction algorithms140by the processor112of the database management system110. The error correction process may be repeated one or more times until the error134becomes less than the error threshold136. The processor112of the database management system110sends the corrected decrypted response138to the user device106of the user104.

By encrypting the request108and performing the one or more algebraic operations126on the plurality of desired encrypted data items158to obtain the encrypted response130, an unauthorized or malicious user is prevented from accessing interactions between the user device106and the data storage system142. In certain embodiments, the unauthorized or malicious user may alter the encrypted data items156-1through156-mstored in the data storage system142, such that two or more encrypted data items may have a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1). By locking and masking the two or more encrypted data items and excluding the masked two or more data items from the plurality of desired encrypted data items158, the encrypted response130is not contaminated by the altered encrypted data items. Accordingly, the database management system110allows for improving security of interactions between the user device106and the data storage system142.

Data Storage System

The data storage system142is generally any device that is configured to process data and communicate with other components of the system100via the network102. The data storage system142may comprise a processor144in signal communication with a memory148and a network interface146.

Processor144comprises one or more processors operably coupled to the memory148. Processor144is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). Processor144may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, processor144may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The one or more processors are configured to implement various software instructions to perform the operations described herein. For example, the one or more processors are configured to execute software instructions150and perform one or more functions described herein.

Network interface146is configured to enable wired and/or wireless communications (e.g., via network102). Network interface146is configured to communicate data between the data storage system142and other components of the system100. For example, the network interface146may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. The processor144is configured to send and receive data using the network interface146. Network interface146may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Memory148comprises a non-transitory computer-readable medium such as one or more disks, tape drives, or solid-state drives, and may be used as an over-flow data storage device, to store programs when such programs are selected for execution, and to store instructions and data that are read during program execution. Memory148may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory148may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. The memory148may store any of the information described inFIGS.1,2A and2Balong with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein. The memory148is operable to store software instructions150and/or any other data and instructions. The software instructions150may comprise any suitable set of software instructions, logic, rules, or code operable to be executed by the processor144.

The memory148is further operable to store a database152. The database152may comprise encrypted data items156-1through156-malong with respective interaction identifications154-1through154-m. The interaction identifications154-1through154-mmay comprise one or more alphanumeric characters. In certain embodiments, the interaction identifications154-1through154-mcomprise financial transaction identifications. In such embodiments, each of the encrypted data items156-1through156-mmay comprise a customer name, an account number, a credit limit, a transaction amount, a total revolving balance, a credit card category, or the like.

Example Method for Secure Database Management

FIGS.2A and2Billustrate an example flowchart of a method200for secure database management. Modifications, additions, or omissions may be made to method200. Method200may include more, fewer, or other operations. For example, operations may be performed in parallel or in any suitable order. For example, one or more operations of method200may be implemented, at least in part, in the form of the software instructions (e.g., instructions118, one or more encryption/decryption algorithms120, and/or one or more error correction algorithms140ofFIG.1), stored on non-transitory, tangible, computer-readable medium (e.g., memories116and/or148ofFIG.1) that when executed by one or more processors (e.g., processors112and/or144ofFIG.1) may cause the one or more processors to perform operations202-234.

Method200starts with operation202, where a processor112of a database management system110receives a request108from a user device106of a user104.

At operation204, the processor112of the database management system110generates a secret key122and a public key124. In certain embodiments, the key generation process comprises executing one or more encryption/decryption algorithms120by the processor112of the database management system110. The one or more encryption/decryption algorithms120may comprise suitable homomorphic encryption algorithms.

At operation206, the processor112of the database management system110encrypts the request108using the public key124to generate an encrypted request128. In certain embodiments, the encryption process comprises executing one or more encryption/decryption algorithms120by the processor112of the database management system110.

At operation208, the processor112of the database management system110searches a plurality of encrypted data items156-1through156-mstored in a data storage system142based on the encrypted request128to identify a plurality of desired encrypted data items158. In certain embodiments, the plurality of desired encrypted data items158may comprise one or more of the plurality of encrypted data items156-1through156-m.

At operation210, the processor112of the database management system110determines if two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158have a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1).

In response to determining at operation210that the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158have the same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1), method200continues to operation212. At operation212, the processor112of the database management system110locks the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158. In certain embodiments, the locking process comprises preventing updates to the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1).

At operation214, the processor112of the database management system110masks the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158.

At operation216, the processor112of the database management system110removes the masked two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) from the plurality of desired encrypted data items158.

At operation218, the processor112of the database management system110determines if all encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) having a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) are identified.

In response to determining at operation218that all encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) having a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) are not identified, method200goes back to operation210. In certain embodiments, operations210through218are repeated one or more times until all encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mof FIG.1) having a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) are identified.

In response to determining at operation210that the two or more encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) of the plurality of desired encrypted data items158do not have the same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) or in response to determining at operation218that all encrypted data items (e.g., respective ones of the plurality of encrypted data items156-1through156-mofFIG.1) having a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1) are identified, method200continues to operation220.

At operation220, the processor112of the database management system110retrieves the plurality of desired encrypted data items158from the data storage system142.

At operation222, the processor112of the database management system110determines one or more algebraic operations126based on the encrypted request128. In certain embodiments, the one or more algebraic operations126comprise addition or multiplication.

At operation224, the processor112of the database management system110determines an encrypted response130based on the encrypted request128and the plurality of desired encrypted data items158by performing the one or more algebraic operations126on the plurality of desired encrypted data items158.

At operation226, the processor112of the database management system110decrypts the encrypted response130using the secret key122to obtain a decrypted response132. In certain embodiments, the decryption process comprises executing the one or more encryption/decryption algorithms120by the processor112of the database management system110.

At operation228, the processor112of the database management system110determines an error134due to the one or more algebraic operations126performed on the plurality of desired encrypted data items158.

At operation230, the processor112of the database management system110determines if the error134less than an error threshold136.

In response to determining at operation230that the error134is not less than the error threshold136, method200continues to operation232. At operation232, the processor112of the database management system110performs an error correction process on a current decrypted response (e.g., decrypted response132) to obtain a corrected decrypted response138. In certain embodiments, the error correction process comprises executing one or more error correction algorithms140by the processor112of the database management system110. After performing operation232, method200goes back to operation228. In certain embodiments, operations228though232are preformed one or more times until the error134becomes less than the error threshold136.

In response to determining at operation230that the error134is less than the error threshold136, method200continues to operation234. At operation234, the processor112of the database management system110sends the current decrypted response (e.g., decrypted response132or corrected decrypted response138ofFIG.1) to the user device106of the user104. After performing operation234, method200ends.

By encrypting the request108and performing the one or more algebraic operations126on the plurality of desired encrypted data items158to obtain the encrypted response130, an unauthorized or malicious user is prevented from accessing interactions between the user device106and the data storage system142. In certain embodiments, the unauthorized or malicious user may alter the encrypted data items156-1through156-mstored in the data storage system142, such that two or more encrypted data items may have a same interaction identification (e.g., respective one of the plurality of interaction identifications154-1through154-mofFIG.1). By locking and masking the two or more encrypted data items and excluding the masked two or more data items from the plurality of desired encrypted data items158, the encrypted response130is not contaminated by the altered encrypted data items. Accordingly, method200allows for improving security of interactions between the user device106and the data storage system142.