Data storage server and client device for securely storing data

Abstract

The present invention relates to a client device (110) for storing data in a database (125) of a data storage server (120). The data storage server stores security-sensitive data in one or more encrypted data structures of the database. The client device is configured to determine whether the data to be stored in the database includes security-sensitive data to be stored in one of the encrypted data structures of the database, and to encrypt the security-sensitive data using an encryption key. Furthermore, the client device is configured to provide the data including the encrypted security-sensitive data and an identifier of the encryption key to the server, so that the security-sensitive data is stored in the encrypted data structure of the database based on the identifier of the encryption key. Advantageously, the encryption of the security-sensitive data by the client device can achieve security protection of the data.

Description

Technical Field

[0001] This invention relates to data storage systems. More specifically, this invention relates to client devices and data storage servers for securely storing security-sensitive data. Background Technology

[0002] Remote data storage (such as cloud data storage) is gaining popularity because it allows user client devices (which typically store only limited data) to store data and files on one or more remote data storage servers accessible via public or private network connections. Data storage providers host, protect, manage, and maintain the data storage servers and associated infrastructure, and ensure user client devices' access to the data. One of the main advantages of cloud storage is the ability to recover user data from remote data storage servers if it has been deleted, corrupted, or is inaccessible on the user client device. However, because data storage providers are responsible for protecting user data transmitted to remote data storage servers, they may have access to security-sensitive user data, which is undesirable for users and / or violates laws and regulations. Summary of the Invention

[0003] The purpose of this invention is to provide an improved client device and an improved data storage server to achieve secure data storage of security-sensitive data.

[0004] The foregoing and other objectives are achieved through the subject matter claimed in the independent claims. Other implementations are apparent from the dependent claims, the specification, and the drawings.

[0005] According to a first aspect, a client device including a processor is provided. The processor in the client device is configured to determine whether data to be stored in a database of a data storage server includes security-sensitive data to be stored in one of one or more encrypted data structures in the database. In response to determining that the data to be stored in the database includes the security-sensitive data, the client device is further configured to encrypt the security-sensitive data using an encryption key. Furthermore, the client device is configured to provide the data including the encrypted security-sensitive data and an identifier of the encryption key to the data storage server to store the security-sensitive data in the encrypted data structure of the one or more encrypted data structures in the database according to the identifier of the encryption key. In other words, based on the identifier of the encryption key, the remote data storage server is configured to determine the location in the encrypted data structure where the encrypted security-sensitive data is stored. The client device may be one of a plurality of client devices used to store data in the remote data storage server.

[0006] Therefore, according to the first aspect, it is advantageous that the client device has encryption capabilities for security-sensitive data before the data is sent to the remote data storage server and stored in its database. The data storage server does not store the security-sensitive data or any encrypted information that might compromise the security of the encrypted security-sensitive data. However, the data storage server is still able to store the encrypted security-sensitive data in its database. The security-sensitive data stored in the data storage server remains encrypted at all times, even during query processing. The client device is the only entity capable of viewing and analyzing the data. Furthermore, different encrypted data structures in the database of the data storage server can be created and owned by different client devices.

[0007] In one possible implementation of the first aspect, the database is a relational database, and the encrypted data structure in the one or more encrypted data structures is an encrypted column of a table in the relational database. In one implementation, the encrypted column of the table in the relational database may include column elements encrypted using different encryption keys. For example, a first column element may be encrypted using an encryption key from a first client device, while a second column element may be encrypted using an encryption key from a second client device. In the case of encrypted columns, the data storage server is used to determine the row of the encrypted column based on the identifier of the encryption key to store the encrypted security-sensitive data.

[0008] In another possible implementation of the first aspect, the processor in the client device is further configured to encrypt the security-sensitive data using the encryption key via a random encryption scheme or a deterministic encryption scheme.

[0009] In another possible implementation of the first aspect, the processor in the client device is further configured to execute an application program, wherein the application program is configured to generate data to be stored in the database of the data storage server, and to store the data in the data storage server using a first type of data query request including the data, and the processor in the client device is further configured to replace the security-sensitive data in the first type of data query with the encrypted security-sensitive data.

[0010] In another possible implementation of the first aspect, the processor in the client device is further configured to: respond to a second type of data query from the application, retrieve data from the database, wherein the data includes cryptographically sensitive data stored in another cryptographic data structure (e.g., another cryptographic column of a table) within the one or more cryptographic data structures in the database; and decrypt the cryptographically sensitive data using the encryption key.

[0011] In another possible implementation of the first aspect, the second type of data query includes a query command for retrieving data from the database (particularly a relational database), the data to be retrieved from the database (particularly a relational database) being identified by parameters of the query command, and the processor in the client device is further configured to: encrypt the parameters of the query command using the encryption key before providing the second type of data query to the remote data storage server.

[0012] In another possible implementation of the first aspect, the processor in the client device is further configured to identify the security-sensitive data in the data to be retrieved from the relational database of the data storage server, based on at least one of the data type of the data and the identifier of the encryption key used to encrypt the data. In other words, in one implementation, the client device knows whether the data is encrypted according to the data type of the row of the encrypted column. Upon initiating a response to the data, the data storage server may inform the client device of the data types of all columns in one or more tables of the relational database in the response. The content of each row of the encrypted column may also include an encryption key identifier to be used to decrypt the corresponding row.

[0013] In another possible implementation of the first aspect, the client device further includes a memory for storing database configuration information for identifying the one or more encrypted data structures (particularly the one or more encrypted columns) encrypted using corresponding encryption keys. The processor in the client device is further configured to determine, based on the database configuration information, whether the data to be stored in the database includes security-sensitive data in one of the one or more encrypted data structures (particularly the encrypted columns) to be stored in the database. The database configuration information may be provided in the form of one or more metadata tables.

[0014] In another possible implementation of the first aspect, the memory is further configured to store the corresponding encryption key for encrypting security-sensitive data in one of the one or more encryption data structures to be stored in the database (particularly the encryption column).

[0015] In another possible implementation of the first aspect, the processor in the client device is further configured to obtain, based on the database configuration information, the corresponding encryption key from the data storage server for encrypting security-sensitive data in one of the one or more encrypted data structures to be stored in the database (particularly the encrypted column).

[0016] In another possible implementation of the first aspect, the processor in the client device is further configured to: obtain the corresponding encryption key in encrypted form from the data storage server; decrypt the corresponding encrypted encryption key using the client device master key; and obtain the client device master key from a remote key management server.

[0017] In another possible implementation of the first aspect, the processor in the client device is further configured to extract the security-sensitive data from the data to be stored in the database of the data storage server using a specific syntax tree (i.e., a parse tree).

[0018] In another possible implementation of the first aspect, the processor in the client device is further configured to convert the security-sensitive data from a human-readable format to a binary format (i.e., binary or bit sequences), and to encrypt the binary-formatted security-sensitive data using the corresponding encryption key used to encrypt the security-sensitive data in one of the one or more encrypted data structures to be stored in the database (particularly the encrypted column).

[0019] In another possible implementation of the first aspect, the processor in the client device is further configured to convert security-sensitive data to a data type defined by the query from one of the one or more encrypted data structures to be stored in the database and / or retrieved from one of the one or more encrypted data structures in the database.

[0020] According to a second aspect, a method for operating a client device is provided. The method includes the step of determining whether data to be stored in a database of a data storage server includes security-sensitive data to be stored in one of one or more encrypted data structures in the database. In response to determining that the data to be stored in the database includes the security-sensitive data, the method further includes the step of encrypting the security-sensitive data using an encryption key. Furthermore, the method includes the step of providing the data including the encrypted security-sensitive data and an identifier of the encryption key to the data storage server to store the security-sensitive data in the encrypted data structure of the one or more encrypted data structures in the database according to the identifier of the encryption key.

[0021] The method provided in the second aspect of the present invention can be executed by the client device provided in the first aspect of the present invention. Therefore, other features of the method provided in the second aspect of the present invention are directly derived from the functionality of the client device provided in the first aspect of the present invention and its various implementations described above and below.

[0022] According to a third aspect, a data storage server for operating a database is provided. The data storage server includes a processor configured to receive from a client device data comprising encrypted security-sensitive data encrypted using an encryption key and an identifier of the encryption key, wherein the encrypted security-sensitive data is to be stored in one of one or more encrypted data structures of the database. Furthermore, the processor in the data storage server stores the security-sensitive data in the encrypted data structure of the one or more encrypted data structures of the database based on the identifier of the encryption key. In other words, based on the identifier of the encryption key, the data storage server determines the location in the encrypted data structure where the encrypted security-sensitive data is stored.

[0023] In one possible implementation of the third aspect, the database is a relational database, and the encrypted data structure in the one or more encrypted data structures is an encrypted column of a table in the relational database. In one implementation, the encrypted column of the table in the relational database may include column elements encrypted using different encryption keys. For example, a first column element may be encrypted using an encryption key from a first client device, while a second column element may be encrypted using an encryption key from a second client device. In the case of encrypted columns, the data storage server is used to determine the row of the encrypted column based on the identifier of the encryption key to store the encrypted security-sensitive data.

[0024] In another possible implementation of the third aspect, the processor in the data storage server is further configured to provide database configuration information to the client device, wherein the database configuration information enables the client device to identify one or more encrypted data structures (particularly encrypted columns of tables) of the relational database encrypted using corresponding encryption keys.

[0025] In yet another possible implementation of the third aspect, the database configuration information includes a table that includes an identifier for the corresponding encryption key for each encryption column of the relational database.

[0026] In another possible implementation of the third aspect, the processor in the data storage server is further configured to respond to a data request query from the client device by providing data from the database to the client device, wherein the data includes encrypted security-sensitive data in one of the one or more encrypted data structures stored in the database (particularly encrypted columns of a table).

[0027] In yet another possible implementation of the third aspect, the relational database is used to store the security-sensitive data in encrypted columns of one or more tables of the relational database, which are encrypted using corresponding encryption keys, using a binary data type.

[0028] According to a fourth aspect, a method for operating a data storage server including a database is provided. The method includes the steps of: receiving from a client device data including encrypted security-sensitive data encrypted using an encryption key and an identifier of the encryption key, wherein the encrypted security-sensitive data is to be stored in one of one or more encrypted data structures of the relational database. Furthermore, the method includes the step of: storing the security-sensitive data in the encrypted data structure of the one or more encrypted data structures of the database according to the identifier of the encryption key.

[0029] The method provided in the fourth aspect of the present invention can be executed by the data storage server provided in the third aspect of the present invention. Therefore, other features of the method provided in the fourth aspect of the present invention are directly derived from the functionality of the data storage server provided in the third aspect of the present invention and its various implementations described above and below.

[0030] According to a fifth aspect, a computer program product including a non-transitory computer-readable storage medium is provided. The non-transitory computer-readable storage medium is used to store program code that, when executed by a computer or processor, causes the computer or processor to perform the method provided in the second aspect or the method provided in the fourth aspect.

[0031] The following drawings and description illustrate one or more embodiments in detail. Other features, objects, and advantages will be apparent from the description, drawings, and claims. Attached Figure Description

[0032] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings, in which:

[0033] Figure 1a This is a schematic diagram of a data storage system provided in one embodiment, including multiple client devices provided in one embodiment and a data storage server for operating a database provided in one embodiment;

[0034] Figure 1b An exemplary table for storing security-sensitive data is shown in one embodiment of a client device and an embodiment of a data storage server.

[0035] Figure 2 This is a timing diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server in order to generate a series of encrypted data.

[0036] Figure 3 This is a timing diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server to add data to a column of encrypted data;

[0037] Figure 4 This is a timing diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server to update data in a series of encrypted data.

[0038] Figure 5 This is a timing diagram showing the interaction between a client device provided in one embodiment, a data storage server provided in another embodiment, and a key management server to extract data from a series of encrypted data.

[0039] Figure 6 This is a flowchart illustrating a method for storing client device data in a database of a remote data storage server, as provided in one embodiment.

[0040] Figure 7This is a flowchart illustrating a method for operating a data storage server including a database, as provided in one embodiment.

[0041] In the following text, the same reference numerals refer to the same or at least functionally equivalent features. Detailed Implementation

[0042] In the following description, reference is made to the accompanying drawings, which form part of this invention, which illustrate specific aspects of embodiments of the invention or aspects in which embodiments of the invention may be used. It should be understood that embodiments of the invention can be used in other aspects and include structural or logical variations not depicted in the drawings. Therefore, the following detailed description should not be construed as limiting, and the scope of the invention is defined by the appended claims.

[0043] For example, it should be understood that the disclosure relating to the described method may also apply to the corresponding device or system for performing the method, and vice versa. For example, if one or more specific method steps are described, the corresponding device may include one or more units (e.g., functional units) to perform the described one or more method steps (e.g., one unit performs one or more steps, or multiple units perform one or more of a plurality of steps respectively), even if such one or more units are not explicitly described or illustrated in the drawings. On the other hand, for example, if a particular apparatus is described according to one or more units (e.g., functional units), the corresponding method may include a step to perform the function of one or more units (e.g., a step that performs the function of the one or more units, or multiple steps that perform the function of one or more of the plurality of units respectively), even if such one or more steps are not explicitly described or illustrated in the drawings. Furthermore, it should be understood that, unless otherwise expressly stated, features of the various exemplary embodiments and / or aspects described herein may be combined with each other.

[0044] Figure 1a This is a schematic diagram of a data (e.g., cloud) storage system 100 provided in one embodiment. As detailed below, the data storage system 100 includes multiple client or user devices 110 (e.g., smartphones, smartwatches, tablets, laptops, desktop computers, or other types of IoT devices), one or more remote data storage servers 120 operating a database 125, and a key management server 130. Figure 1a As shown, multiple client devices 110, one or more remote data storage servers 120, and a key management server 130 can be used to communicate with each other via a wireless (e.g., cellular) and / or wired communication network 140. In one embodiment, one or more remote data storage servers 120 can be one or more cloud storage servers 120 used to communicate with client devices 110 via the Internet.

[0045] like Figure 1a As shown, client device 110 may include a processor 111 for processing and generating data, a communication interface 113 (including an antenna, etc.) for exchanging data with other components in cloud storage system 100, and a non-transient memory 115 for storing data. The processor 111 in client device 110 may be implemented in hardware and software. The hardware may include digital circuitry, or both analog and digital circuitry. Digital circuitry may include components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The non-transient memory 115 may store data, such as electronic keys and executable program code, wherein, when executed by processor 111, the executable program code causes client device 110 to perform the functions, operations, and methods described herein. The communication interface 113 may include a wired or wireless communication interface 113. Similarly, the data storage server 120 may include a processor 121 for processing and generating data, a communication interface 123 for exchanging data with other components in the data storage system 100, and a database 125 for storing data.

[0046] As detailed below, client device 110 is used to store data in database 125 of remote (e.g., cloud) data storage server 120. Remote data storage server 120 is used to store security-sensitive data in an encrypted data structure in database 125, encrypted using appropriate encryption keys. Client device 110 is used to determine whether the data to be stored in database 125 of data storage server 120 includes security-sensitive data by parsing the data to be stored in relational database 125.

[0047] The following describes in detail embodiments of client device 110 and data storage server 120, wherein database 125 is implemented as a relational database, such as an SQL-based relational database 125. In these embodiments, as detailed below, data storage server 120 is used to store security-sensitive data in one or more encrypted columns of one or more tables of relational database 125. The encrypted columns of the tables of relational database 125 used herein include column elements encrypted using the same encryption key. Figure 1b An example of table 127 in relational database 125 is shown. Table 127 includes two plaintext columns 127a and 127c and an encrypted column 127b containing security-sensitive data.

[0048] However, it should be understood that data storage server 120 may include a non-relational database 125, and client device 110 may be used to operate with it, wherein security-sensitive data is stored in an encrypted data structure other than encrypted columns of tables. For example, in one embodiment, database 125 may be implemented as a MongoDB database (DB) 125. In this embodiment, data storage server 120 may be used to store security-sensitive data in one or more encrypted fields of MongoDB 125.

[0049] In one embodiment, database configuration information for identifying rows and / or columns of relational database 125 that are encrypted using corresponding encryption keys may be stored in the memory 115 of client device 110. In one embodiment, the database configuration information may include one or more metadata tables. In one embodiment, such metadata tables may use a first value (e.g., "1") to represent each encrypted row and / or column 127b in relational database 125, and a second value different from the first value (e.g., "0") to represent each unencrypted row and / or column 127a, 127c in relational database 125. Optionally or additionally, the database configuration information may include a column of encrypted rows and / or columns in the relational database and their respective encryption keys. For example, a first column element of a table in relational database 125 may be encrypted using an encryption key from a first client device 110, while a second column element may be encrypted using an encryption key from a second client device 110. In the case of encrypted column 127b, data storage server 120 uses the identifier of the encryption key to determine the row of encrypted column 127b to store encrypted security-sensitive data.

[0050] Based on the database configuration information, the client device 110 identifies encrypted rows and / or columns 127b in the tables of the relational database 125, thereby determining whether the data to be stored in the relational database 125 includes security-sensitive data in one of the encrypted rows and / or columns 127b in the table 127 of the relational database 125, wherein the encrypted rows and / or columns are identified by the database configuration information.

[0051] In one embodiment, client device 101 can be used to periodically obtain database configuration information from remote data storage server 120. In the event of changes to relational database 125, such as the presence of new or altered encrypted rows and / or columns, data storage server 120 can be used to provide updated database configuration information to client device 110.

[0052] In one embodiment, client device 110 is used to parse data to be stored in relational database 125 of data storage server 120 using a specific syntax tree (i.e., parse tree).

[0053] If client device 110 determines that the data to be stored in relational database 125 of data storage server 120 includes security-sensitive data to be stored in encrypted column 127b of relational database 125, then client device 110 is also used to use an encryption key (e.g. Figure 1a The encryption key 115b shown is used to encrypt security-sensitive data, wherein the encryption key is associated with the encryption column 127b of table 127 in relational database 125. In one embodiment, client device 101 can be used to encrypt security-sensitive data using encryption key 115b through a random encryption scheme (where the same plaintext produces different ciphertexts) or a deterministic random encryption scheme (where the same plaintext produces the same ciphertext).

[0054] Furthermore, the client device 110 provides data, including encrypted security-sensitive data, and an identifier for the encryption key 115b to the remote storage server 120. Based on the identifier for the encryption key 115b, the data storage server 120 identifies the corresponding encrypted column 127b of table 127 in the relational database 125 and stores the security-sensitive data therein.

[0055] In one embodiment, the memory 115 in the client device 110 is used to store a corresponding encryption key, such as encryption key 115b, for encrypting security-sensitive data in encrypted column 127b of table 127 in relational database 125, which is to be persistently stored. In another embodiment, the memory 115 in the client device 110 is used to temporarily store the corresponding encryption key, such as encryption key 115b.

[0056] In one embodiment, the client device 110 is further configured to obtain, based on database configuration information, a corresponding encryption key, such as encryption key 115b, from the remote data storage server 120 for encrypting security-sensitive data to be stored in the encryption column 127b of the relational database 125.

[0057] In another embodiment, client device 110 is further configured to obtain a corresponding encryption key (e.g., encryption key 115b) in encrypted form from data storage server 120, and decrypt the corresponding encrypted encryption key (e.g., encryption key 115b) using client device master key 115a. In one embodiment, client device 110 is configured to obtain client device master key 115a from key management server 130. In one embodiment, key management server 130 is operated by a trusted third party and is configured to manage the client device master keys of all client devices 110 in client storage system 100, including client device master key 115a of client device 110.

[0058] In one embodiment, client device 110 is also configured to convert any security-sensitive data to be stored in relational database 125 from a human-readable format to a binary format, and to encrypt the binary-formatted security-sensitive data using a corresponding encryption key 115b used to encrypt the security-sensitive data in encrypted column 127b of table 127 of relational database 125. Similarly, in order to extract security-sensitive data from relational database 125, client device 110 may be configured to (after decryption) convert the security-sensitive data back from binary format to a human-readable format. If client device 110 requests data in binary format, format conversion may not be necessary.

[0059] As a supplement to client device 110, data storage server 120 is used to store security-sensitive data in one or more tables of relational database 125 (encrypted by one or more client devices 110) using corresponding encryption keys (e.g., encryption key 115b) of encrypted columns (e.g., ...). Figure 1b The encrypted column 127b of Table 127 is shown. Data storage server 120 is used to receive data from client device 110, including encrypted security-sensitive data encrypted using encryption key 115b and an identifier of encryption key 115b, wherein the encrypted security-sensitive data is to be stored in an encrypted column of relational database 125. As described above, based on the identifier of encryption key 115b, data storage server 120 is used to identify the corresponding encrypted column 127b of relational database 125 and store the security-sensitive data therein. In one embodiment, data storage server 120 is used to implement a data definition language (DDL) capable of managing encrypted rows and / or columns, encryption keys, and client device master keys of relational database 125.

[0060] In one embodiment, relational database 125 is used to store security-sensitive data in encrypted columns of relational database 125 that are encrypted using corresponding encryption keys for binary data types. In one embodiment, data storage server 120 is also used to: in response to a data request query from client device 110, convert the security-sensitive data stored in encrypted rows and / or columns of relational database 125 from a binary data type to a data type defined by the data request query. In one embodiment, the binary data type is the "bytea" data type defined in PostgreSQL. In another embodiment, the binary data type is an extended version of the "bytea" data type, which, compared to the "bytea" data type, adds error checking for inserted data and prohibits certain types of operations on columns of this data type. For example, the data storage server attempts to concatenate two encrypted strings of this data type, thereby returning an error message to client device 110.

[0061] As described above, in one embodiment, the data storage server 120 is further configured to provide database configuration information to each client device 110. The database configuration information enables each client device 110 to identify columns of the relational database 125 that are encrypted using a corresponding encryption key (e.g., encryption key 115b). In one embodiment, the database configuration information includes a metadata table that includes one or more identifiers of a corresponding encryption key for each encrypted column of the relational database 125, wherein the corresponding encryption key is used to encrypt data in the corresponding row of the encrypted column of the relational database 125.

[0062] Figure 2 An embodiment is shown in which a client device 110, a remote data storage server (referred to as a database server) 120, and a remote key management server (KMS) 130 interact during the creation of an encrypted column (i.e., a column of encrypted data stored in a relational database 125 of the remote data storage server 120), including the following steps.

[0063] Step 201: The client driver 111a in the client device 110 (which may be software executed by the processor 111 in the client device 110) sends a request to create a client master key 115a to the KMS 130.

[0064] Step 203: If the client master key 115a is successfully created, the metadata is stored in the remote data storage server 120.

[0065] Step 205: The client driver 111a in the client device 110 generates a column encryption key 115b based on the client master key 115a.

[0066] Step 207: The client driver 111a in the client device 110 requests KMS 130 to encrypt the column encryption key 115b using the client master key 115a.

[0067] Step 209: KMS 130 returns the encrypted column encryption key 115b to the client device 110.

[0068] Step 211: The client driver 111a in the client device 110 sends the encrypted column encryption key 115b to the remote data storage server 120.

[0069] Step 212: The client driver 111a in the client device 110 creates a table that includes encrypted columns, wherein the encrypted columns are modified to include the data types to be used by the remote data storage server 120.

[0070] Step 213: The client driver 111a in client device 110 instructs the remote data storage server 120 to create table 127, which includes encrypted columns 127b containing security-sensitive data. For example, the client driver 111a may send a “CREATE TABLE” command, identifying two data types: the data type that the remote data storage server 120 intends to use and the data type expected by the user querying the data.

[0071] Step 215: Remote data storage server 120 stores configuration information (in Figure 2 This is referred to as metadata in the system, and a successful operation report is sent to the client device 110.

[0072] Therefore, as Figure 2 As shown, in one embodiment, client device 110 can be used to define which columns of relational database 125 store security-sensitive data in encrypted form. For example, this could occur during table creation or when a new column is added to a table in relational database 125. As described above, client device 110 can be used to detect which columns of relational database 125 only accept encrypted data during the parsing of a new query that includes SQL statements for creating a table or adding a new column, and to encrypt the data before sending it to data storage server 120.

[0073] Figure 3 The diagram illustrates client device 110, remote data storage server (referred to as database server) 120, and remote key management server (KMS) 130 inserting (i.e., adding) security-sensitive data 125a into an existing encrypted column (e.g., ...) in the relational database 125 of remote data storage server 120. Figure 1b An example of interaction in the process shown in column 127b) of Table 127.

[0074] Step 301: The application 111b running on the client device 110 instructs the client driver 111a to execute a query that inserts additional data into the relational database 125 of the remote data storage server 120.

[0075] Step 303: In response to step 301, client driver 111a parses the query of application 111b to obtain the column names associated with the data to be stored in relational database 125 of remote data storage server 120.

[0076] Step 305: The client driver 111a stores the column name in the memory 115 of the client device 110 according to the parsed query identifier.

[0077] Step 307: The client driver 111a in client device 110 requests KMS 130 to decrypt the corresponding encryption key 115b for each column identified in step 305 in the relational database 125 storing encrypted security-sensitive data. If one or more corresponding encryption keys 115b are cached in the memory 115 of client device 110, this step and the subsequent step 309 can be omitted.

[0078] Step 309: KMS 130 returns one or more requested decryption encryption keys 115b to the client device 110.

[0079] Step 311: The client driver 111a in the client device 110 uses one or more encryption keys 115b to encrypt security-sensitive data to be inserted into the relational database 125.

[0080] Step 313: The client driver 111a in client device 110 deletes one or more encryption keys 115b. According to a variant, the client driver 111a in client device 110 may cache one or more encryption keys 115b in memory 115 for future use.

[0081] Step 315: The client driver 111a in client device 110 sends other data, including encrypted security-sensitive data, and one or more identifiers of one or more encryption keys 115b used by client device 110 to encrypt the security-sensitive data to remote data storage server 120. Based on the one or more identifiers provided by client device 110, remote data storage server 120 stores the other data, including encrypted security-sensitive data, in one or more corresponding columns 127b of relational database 125 identified by the one or more identifiers, and reports the result to client device 110.

[0082] Therefore, as Figure 3 As shown, in one embodiment, application 111b in client device 110 is used to generate data to be stored in relational database 125 of remote data storage server 120, and to store the data in remote data storage server 120 using a first type of data query request that includes the data. In response to the query, client device 110 (specifically client driver 111a) is used to replace the security-sensitive data in the first type of data query with encrypted security-sensitive data.

[0083] Figure 4 An embodiment is shown in which client device 110, remote data storage server (referred to as database server) 120 and remote key management server (KMS) 130 interact during an update query (i.e., during the replacement of security-sensitive data in relational database 120 of remote data storage server 120).

[0084] Step 401: Application 111b instructs client driver 111a to perform an update query on data in relational database 125 of remote data storage server 120.

[0085] Step 403: In response to step 401, client driver 111a parses the update query of application 111b to obtain the column names associated with the data to be updated in the relational database 125 of remote data storage server 120.

[0086] Step 405: The client driver 111a identifies the column name stored in the memory 115 of the client device 110 based on the parsed update query identifier.

[0087] Step 407: The client driver 111a in client device 110 requests KMS 130 to decrypt the corresponding encryption key 115b for each column identified in step 405 in the relational database 125 storing encrypted security-sensitive data. If one or more corresponding encryption keys 115b are cached in the memory 115 of client device 110, this step and the subsequent step 409 can be omitted.

[0088] Step 409: KMS 130 returns one or more requested decryption encryption keys 115b to the client device 110.

[0089] Step 411: The client driver 111a in the client device 110 encrypts the value of the update query used to update the security-sensitive data of the relational database 125 using one or more encryption keys 115b.

[0090] Step 413: The client driver 111a in the client device 110 encrypts the conditions of the update query used to update the security-sensitive data of the relational database 125 using one or more encryption keys 115b.

[0091] Step 415: The client driver 111a in client device 110 sends an update query including encrypted values ​​and encrypted conditions, and one or more identifiers of one or more encryption keys 115b used by client device 110 to encrypt the values ​​and conditions of the update query, to remote data storage server 120. Based on the one or more identifiers provided by client device 110, remote data storage server 120 updates the data (including encrypted security-sensitive data) in the corresponding one or more columns of relational database 125 identified by the one or more identifiers, and reports the results to client device 110.

[0092] Step 417: The client driver 111a in client device 110 deletes one or more encryption keys 115b. According to a variant, the client driver 111a in client device 110 may cache one or more encryption keys 115b in memory 115 for future use.

[0093] Figure 5 This illustration shows an embodiment of the interaction between client device 110, remote data storage server (referred to as database server) 120, and remote key management server (KMS) 130 during the extraction of encrypted security-sensitive data from remote data storage server 120. For example, in... Figure 5In the illustrated embodiment, data retrieval is shown within the context of a selected query. Therefore, in one embodiment, the data storage server 120 is also configured to provide data from the relational database 125 to the client device 110 in response to a data request query from the client device 110, wherein the data includes encrypted columns stored in the relational database 125 (e.g., Figure 1b The encrypted security sensitive data in column 127b) of Table 127 shown.

[0094] Step 501: Application 111b instructs client driver 111a to execute a selection query to extract data from relational database 125 of remote data storage server 120.

[0095] Step 503: In response to step 501, client driver 111a parses the selection query of application 111b to obtain the column names associated with the data to be extracted from the relational database 125 of remote data storage server 120.

[0096] Step 505: The client driver 111a queries the column name of the parsed selection identifier stored in the memory 115 of the client device 110.

[0097] Step 507: The client driver 111a in client device 110 requests KMS 130 to decrypt the corresponding encryption key 115b for each column identified in step 505 in the relational database 125 storing encrypted security-sensitive data. If one or more corresponding encryption keys 115b are cached in the memory 115 of client device 110, this step and the subsequent step 509 can be omitted.

[0098] Step 509: KMS 130 returns one or more requested decryption encryption keys 115b to the client device 110.

[0099] Step 511: The client driver 111a in the client device 110 encrypts the conditions of the selection query used to extract security-sensitive data from the relational database 125 using one or more encryption keys 115b.

[0100] Step 513: The client driver 111a in the client device 110 sends one or more identifiers, including a selection query with encrypted conditions and one or more encryption keys 115b used by the client device 110 to encrypt the conditions of the selection query, to the remote data storage server 120.

[0101] Step 515: Based on one or more identifiers provided by the client device 110 in the previous step 513, the remote data storage server 120 extracts encrypted security sensitive data from one or more corresponding columns identified by one or more identifiers in the relational database 125, and sends the extracted encrypted security sensitive data to the client device 110.

[0102] Step 516: The client driver 111a in the client device 110 converts the data of the binary data type used by the relational database 125 into the data type used by the application 111b, such as a user-defined data type.

[0103] Step 517: The client driver 111a in the client device 110 decrypts the encrypted security-sensitive data provided by the remote data storage server 120 in response to the selection query (i.e., step 513) using one or more corresponding encryption keys 115b.

[0104] Step 518: The client driver 111a in the client device converts plaintext security-sensitive data from machine-readable binary format to human-readable text format.

[0105] Step 519: The client driver 111a in client device 110 deletes one or more encryption keys 115b. According to a variant, the client driver 111a in client device 110 may cache one or more encryption keys 115b in memory 115 for future use.

[0106] Step 521: The client driver 111a in the client device 110 sends the decrypted security-sensitive data to the application 111b in the client device 100, so that the application 111b can use the decrypted security-sensitive data.

[0107] Therefore, as Figure 5 As shown, in one embodiment, the client device 110 is further configured to retrieve data from the relational database 125 in response to a second type of data query from the application 111b, and decrypt the retrieved encrypted security-sensitive data using an encryption key 115b. In one embodiment, the second type of data query may include a query command for retrieving data from the relational database 125, such as a “SELECT” command, wherein the data to be retrieved from the relational database 125 is identified by parameters of the query command (e.g., the “SELECT” command). In one embodiment, the client device 110 is further configured to encrypt the parameters of the query command using the encryption key 115b before providing the second type of data query (e.g., a select data query) to the remote data storage server 120.

[0108] Figure 6 This is a flowchart of a method 600 for storing data from a client device 110 in a database 125 (particularly a relational database 125) of a remote data storage server 120. Method 600 includes the following steps:

[0109] Step 601: Client device 110 determines whether the data to be stored in relational database 125 includes security-sensitive data in the encrypted data structure 127b (specifically, encrypted column 127b) to be stored in relational database 125.

[0110] Step 603: If the data to be stored in relational database 125 includes the security-sensitive data, then client device 110 encrypts the security-sensitive data using encryption key 115b.

[0111] Step 605: Provide the data, including the encrypted security sensitive data, and the identifier of the encryption key 115b to the remote data storage server 120 so that the security sensitive data is stored in the encrypted data structure 127b (specifically the encrypted column 127b) of the relational database (125) according to the identifier of the encryption key (115b).

[0112] Figure 7 This is a flowchart of a method 700 for operating a data storage server 120, which includes a database 125 (particularly a relational database 125). Method 700 includes the following steps:

[0113] Step 701: Receive data from client device 110 including encrypted security sensitive data encrypted with encryption key 115b and an identifier of encryption key 115b, wherein the encrypted security sensitive data is to be stored in encrypted data structure 127b (specifically encrypted column 127b) of relational database 125.

[0114] Step 703: Based on the identifier of the encryption key 115b, store the security-sensitive data in the encrypted data structure 127b (specifically the encrypted column 127b) of the relational database 125.

[0115] As described above, although the embodiments described above have been in the context of relational database 125, in other embodiments, data storage server 120 may include non-relational database 125, and client device 110 may be used to operate with it, wherein security-sensitive data is stored in an encrypted data structure other than encrypted columns of tables. For example, in one embodiment, database 125 may be implemented as a MongoDB database (DB) 125. In this embodiment, data storage server 120 may be used to store security-sensitive data in one or more encrypted fields of MongoDB 125. When a new document (i.e., data) is added to a collection (insert statement), MongoDB client driver 111a may be used to detect whether fields in the document need to be encrypted. Field data may be encrypted by client driver 111a as needed. When retrieving a document (i.e., data) from a collection of MongoDB database 125, client driver 111a may use the field encryption key identifier in the ciphertext (equivalent to the column encryption key identifier described above) to determine which field encryption key to use to decrypt the ciphertext. This is similar to the column / row-level encryption described above.

[0116] Those skilled in the art will understand that “blocks” (“units”) in the various figures (methods and apparatuses) represent or describe the functionality of embodiments of the invention (and are not necessarily independent “units” in hardware or software), thereby equally describing the functionality or features (unit = step) of apparatus embodiments and method embodiments.

[0117] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the described apparatus embodiments are merely exemplary. For example, the unit division is only a logical functional division, and other division methods may be used in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the mutual coupling or direct coupling or communication connection shown or described can be implemented through some interfaces. Direct coupling or communication connection between devices or units can be implemented electronically, mechanically, or in other ways.

[0118] The units described as individual components may or may not be physically separate; the components shown as units may or may not be physical units, may be located in the same location, or may be distributed among multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiment scheme according to actual needs.

[0119] In addition, the functional units in the embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

Claims

1. A client device (110), characterized in that, The client device (110) includes a processor (111), the processor (111) being configured to: Determine whether the data to be stored in the database (125) of the data storage server (120) includes security-sensitive data in one of the one or more encrypted data structures (127b) of the database (125); the database (125) is a relational database (125), and the encrypted data structure (127b) in the one or more encrypted data structures (127b) is an encrypted column of a table (127) of the relational database (125); the encrypted column of the table of the relational database includes column elements encrypted using different encryption keys; In response to determining that the data to be stored in the database (125) includes the security-sensitive data, the security-sensitive data is encrypted using an encryption key (115b); The data, including the encrypted security-sensitive data, and the identifier of the encryption key (115b) are provided to the data storage server (120) to store the security-sensitive data in the encrypted data structure (127b) of the database (125) according to the identifier of the encryption key (115b).

2. The client device (110) according to claim 1, characterized in that, The processor (111) is also used to encrypt the security-sensitive data using the encryption key (115b) through a random encryption scheme or a deterministic encryption scheme.

3. The client device (110) according to claim 1 or 2, characterized in that, The processor (111) is also configured to execute an application (111b), wherein the application (111b) is configured to generate data to be stored in the database (125) of the data storage server (120), and to store the data in the data storage server (120) using a first type of data query request including the data, and the processor (111) is also configured to replace the security sensitive data in the first type of data query with the encrypted security sensitive data.

4. The client device (110) according to claim 3, characterized in that, The processor (111) is also used for: In response to a second type of data query from the application (111b), data is retrieved from the database (125), wherein the data includes encrypted security-sensitive data stored in another encrypted data structure (127b) within one or more encrypted data structures (127b) of the database (125); The encrypted security-sensitive data is decrypted using the encryption key (115b).

5. The client device (110) according to claim 4, characterized in that, The second type of data query includes a query command for retrieving data from the database (125), wherein the data to be retrieved from the database (125) is identified by parameters of the query command, and the processor (111) is further configured to encrypt the parameters of the query command using the encryption key (115b).

6. The client device (110) according to claim 5, characterized in that, The processor (111) is also configured to identify the security-sensitive data retrieved from the database (125) of the data storage server (120) based on at least one of the data type of the data and the identifier of the encryption key (115b) used to encrypt the data.

7. The client device (110) according to claim 1 or 2, characterized in that, The client device (110) further includes a memory (115) for storing database configuration information for identifying the one or more encrypted data structures (127b) of the database (125) encrypted using a corresponding encryption key (115b). The processor (111) is also configured to determine, based on the database configuration information, whether the data to be stored in the database (125) includes security-sensitive data in one of the encrypted data structures (127b) of the one or more encrypted data structures (127b) of the database (125).

8. The client device (110) according to claim 7, characterized in that, The memory (115) is also used to store the corresponding encryption key (115b) for encrypting security-sensitive data in one of the one or more encryption data structures (127b) to be stored in the database (125).

9. The client device (110) according to claim 7, characterized in that, The processor (111) is further configured to obtain, based on the database configuration information, the corresponding encryption key (115b) from the data storage server (120) for encrypting security-sensitive data in one of the one or more encrypted data structures (127b) to be stored in the database (125).

10. The client device (110) according to claim 9, characterized in that, The processor (111) is also used for: Obtain the corresponding encryption key (115b) in encrypted form from the data storage server (120); The corresponding encrypted encryption key (115b) is decrypted using the client device master key (115a); Obtain the client device master key (115a) from the remote key management server (130).

11. The client device (110) according to claim 1 or 2, characterized in that, The processor (111) is also used to extract the security-sensitive data from the data in the database (125) to be stored in the data storage server (120) using a syntax tree.

12. The client device (110) according to claim 1 or 2, characterized in that, The processor (111) is also configured to convert the security-sensitive data from a human-readable format to a binary format, and to encrypt the binary format security-sensitive data using a corresponding encryption key (115b) for encrypting the security-sensitive data in one of the one or more encrypted data structures (127b) to be stored in the database (125).

13. The client device (110) according to claim 1 or 2, characterized in that, The processor (111) is also configured to convert security-sensitive data from a binary data type to a data type defined by the query from one of the one or more encrypted data structures (127b) to be stored in the database (125) and / or retrieved from one of the one or more encrypted data structures (127b) in the database (125).

14. A method (600) for operating a client device (110), characterized in that, The method (600) includes: Determine (601) whether the data to be stored in the database (125) of the data storage server (120) includes security-sensitive data in one of the one or more encrypted data structures (127b) of the database (125); the database (125) is a relational database (125), and the encrypted data structure (127b) in the one or more encrypted data structures (127b) is an encrypted column of a table (127) of the relational database (125); the encrypted column of the table of the relational database includes column elements encrypted using different encryption keys; In response to determining that the data to be stored in the database (125) includes the security-sensitive data, the security-sensitive data is encrypted (603) using an encryption key (115b); The data, including the encrypted security-sensitive data, and the identifier of the encryption key (115b) are provided (605) to the data storage server (120) to store the security-sensitive data in the encrypted data structure (127b) of the database (125) according to the identifier of the encryption key (115b).

15. A data storage server (120) for operating a database (125), characterized in that, The data storage server (120) includes a processor (121), the processor (121) being used for: The client device (110) receives data including encrypted security-sensitive data encrypted using an encryption key (115b) and an identifier of the encryption key (115b), wherein the encrypted security-sensitive data is to be stored in one of one or more encrypted data structures (127b) of the database (125); the database (125) is a relational database (125), and the encrypted data structure (127b) is an encrypted column of a table (127) of the relational database (125); the encrypted column of the table of the relational database includes column elements encrypted using different encryption keys; The security-sensitive data is stored in the encrypted data structure (127b) of the database (125) in the one or more encrypted data structures (127b) according to the identifier of the encryption key (115b).

16. The data storage server (120) according to claim 15, characterized in that, The processor (121) is further configured to provide database configuration information to the client device (110), wherein the database configuration information enables the client device (110) to identify one or more encrypted data structures (127b) of the database (125) encrypted using a corresponding encryption key (115b).

17. The data storage server (120) according to claim 16, characterized in that, The database configuration information includes a table, which includes the identifier of the corresponding encryption key (115b) for each encryption column of the relational database (125).

18. The data storage server (120) according to claim 15, characterized in that, The processor (121) is also configured to respond to a data request query from the client device (110) by providing data in the database (125) to the client device (110), wherein the data includes encrypted security sensitive data in one of the encrypted data structures (127b) stored in the database (125).

19. The data storage server (120) according to claim 18, characterized in that, The database (125) is used to store the security-sensitive data in one or more encrypted data structures (127b) of the database (125) using a binary data type and encrypted with a corresponding encryption key (115b).

20. A method (700) for operating a data storage server (120) including a database (125), characterized in that, The method (700) includes: The client device (110) receives (701) data including encrypted security-sensitive data encrypted using an encryption key (115b) and an identifier of the encryption key (115b), wherein the encrypted security-sensitive data is to be stored in one of one or more encrypted data structures (127b) of the database (125); the database (125) is a relational database (125), and the encrypted data structure (127b) in the one or more encrypted data structures (127b) is an encrypted column of a table (127) of the relational database (125); the encrypted column of the table of the relational database includes column elements encrypted using different encryption keys; Based on the identifier of the encryption key (115b), the security-sensitive data is stored (703) in the encrypted data structure (127b) of the one or more encrypted data structures (127b) in the database (125).

21. A computer program product including a computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code that, when executed by a computer or processor, causes the computer or processor to perform the method (600) according to claim 14.

22. A computer program product including a computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code that, when executed by a computer or processor, causes the computer or processor to perform the method (700) according to claim 20.

Images