Self-consistent structures for secure transmission and temporary storage of sensitive data
Implementations provide self-consistent, temporary, secure storage of information. An example system includes short-term memory storing a plurality of key records and a cache storing a plurality of data records. The key records and data records are locatable using participant identifiers. Each key record includes a nonce and each data record includes an encrypted portion. The key records are deleted periodically. The system also includes memory storing instructions that cause the system to receive query parameters that include first participant identifiers and to obtain a first nonce. The first nonce is associated with the first participant identifiers in the short-term memory. The instructions also cause the system to obtain data records associated with the first participant identifiers in the cache, to build an encryption key using the nonce and the first participant identifiers, and to decrypt the encrypted portion of the obtained data records using the encryption key.
1. A client system including a non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one processor, cause the client system to:
monitor data input by a user entering data into a data entry interface;
determine, via the monitoring, that the user has provided, via the data entry interface, data that uniquely identifies the user and a subject entity;
send, responsive to the determining, the data that uniquely identifies the user and the data that uniquely identifies the subject entity to a server;
receive, from the server, an indication that data records for the subject entity have been pre-fetched, wherein the server stores the pre-fetched data records for the subject entity in an encrypted portion of a data record, the encrypted portion being encrypted with an encryption key built from a nonce, the data that uniquely identifies the user and the data that uniquely identifies the subject entity; and
responsive to receiving the indication, make available a control in the data entry interface, the control sending a report request to the server in response to selection of the control by the user, wherein the report request provides the data uniquely identifying the user and the subject entity and the server provides at least one of the pre-fetched data records in response to the report request.
2. The client system of claim 1 , wherein the data that uniquely identifies the user includes at least one national registration number and the data that uniquely identifies the subject entity includes a birthdate and a name.
3. The client system of claim 1 , wherein determining that the user has provided the data that uniquely identifies the user and the subject entity occurs before the user has finished completing data entry in the data entry interface.
4. The client system of claim 3 , wherein the data entry interface is an electronic prescription drug interface.
5. The client system of claim 1 , wherein at least one pre-fetched record of the pre-fetched data records is fetched from a distributed data source.
6. The client system of claim 5 , wherein the at least one pre-fetched record is fetched via a secure connection using an HTTPS protocol.
7. The client system of claim 1 , the instructions further causing the client system to:
receive meta-information from the user; and
responsive to selection of the control by the user, provide the meta-information with the data uniquely identifying the user and the subject entity,
wherein the meta-information is used to select the pre-fetched data records provided in response to the report request.
8. The client system of claim 1 , wherein building the encryption key includes combining components of the encryption key in an order determined based on a value of the data uniquely identifying the user or the data uniquely identifying the subject entity.
9. The client system of claim 1 , wherein the data that uniquely identifies the user includes data obtained from authentication or login data.
10. The client system of claim 1 , wherein the data entry interface is for an electronic prescription system and the data records relating to the subject entity are data records from a prescription drug monitoring program.
11. A method comprising:
monitoring data input by a user entering data into a data entry interface for a data input event, the data input event occurring when the user has entered data in the data entry interface that uniquely identifies a subject entity;
sending, responsive to the data input event, data that uniquely identifies the user and the data that uniquely identifies the subject entity to a server;
receiving, from the server, an indication that a data record for the subject entity has been pre-fetched from a remote source, wherein the server stores the pre-fetched data record for the subject entity in an encrypted portion of a data record, the encrypted portion being encrypted with an encryption key built from a nonce, the data that uniquely identifies the user, and the data that uniquely identifies the subject entity; and
responsive to receiving the indication, making available a control in the data entry interface, the control sending a report request to the server in response to selection of the control by the user, wherein the report request includes the data uniquely identifying the user and the data uniquely identifying the subject entity and the server provides, from the encrypted portion of the data record, the pre-fetched data record in response to the report request.
12. The method of claim 11 , wherein the pre-fetched data record is a sensitive data record.
13. The method of claim 11 , further comprising:
receiving selection of the control; and
sending the report request to the server, wherein the server is configured to:
locate a key record using the data uniquely identifying the user and the data uniquely identifying the subject entity,
build the encryption key using the nonce from the key record the data that uniquely identifies the user, and the data that uniquely identifies the subject entity,
locate the data record using the data that uniquely identifies the user and the data that uniquely identifies the subject entity,
decrypt the encrypted portion of the data record using the encryption key, and
provide the decrypted data record as the response to the report request.
14. The method of claim 11 , wherein the data that uniquely identifies the user includes a professional license number for the user.
15. The method of claim 11 , wherein the data that uniquely identifies the user includes data obtained from authentication or login data.
16. The method of claim 11 , wherein the data that uniquely identifies the user includes data obtained from a device the user is logged into.
17. The method of claim 11 , wherein the data input event occurs before the user has finished completing data entry in the data entry interface.
18. The method of claim 11 , wherein the data entry interface is for an electronic prescription and the data that uniquely identifies the user and the data that uniquely identifies the subject entity is provided prior to receipt of medication information in the data entry interface.
19. The method of claim 11 , wherein the pre-fetched data record is fetched via a secure connection using an HTTPS protocol.
20. The method of claim 11 , wherein the server pre-fetches a plurality of pre-fetched records, each pre-fetched data record being encrypted with the encryption key and stored in a respective data record and the method further comprises:
receiving meta-information from the user; and
responsive to selection of the control by the user, providing the meta-information with the data uniquely identifying the user and the data uniquely identifying the subject entity,
wherein the meta-information is used to select from the respective data records, the pre-fetched data record provided in response to the report request.