CACHING OF DATA RECORDS IN A DISTRIBUTED DATABASE SYSTEM

Description

[0001] The invention relates to a method for granting caching authorization to cache an image of a data record which is stored in and managed by a database, for another database, a corresponding database and a distributed database system comprising the two databases.

[0002] With increasing digitalization, automation, and networking in all areas of life and work, complex distributed systems are emerging, and their technical interaction presents new technical challenges. For example, such distributed systems generally do not include a shared storage system, which complicates the execution of data processing functions. Instead, multiple storage systems, such as databases, are used. Data processing may therefore require the consideration of data records stored in different databases. Conversely, there is a need to restrict access to these data records to ensure adequate data security.

[0003] EP 3 683 684 A1 describes an information processing device for handling an increasing volume of query information without increasing the load on a peer-to-peer database system. The information processing device comprises a capture unit that retrieves data provided by a peer-to-peer database based on query information, and a storage control unit that manages the storage of the data, which is performed by a cache storage unit.

[0004] The article "AuthPrivacyChain: A Blockchain-Based Access Control Framework With Privacy Protection in Cloud" by Caixia Yang et al., published in IEEE Access, Volume 8, pages 70604 to 70615, April 27, 2020, describes a blockchain-based access control framework with privacy protection called AuthPrivacyChain. A node's account address on the blockchain serves as its identity, and access control permissions are defined for data in the cloud, which is encrypted and stored on the blockchain. AuthPrivacyChain also defines processes for access control, authorization, and revocation of permissions. Finally, AuthPrivacyChain is implemented on the basis of an Enterprise Operating System (EOS). AuthPrivacyChain is not only capable of preventing hackers and administrators from illegally accessing resources but also of protecting the privacy of authorized users.

[0005] The invention is based on the objective of creating an improved method for enabling access to data records between different databases.

[0006] The problem underlying the invention is solved by the features of the independent claims. Embodiments of the invention are specified in the dependent claims.

[0007] Implementations include a method for granting caching permission to cache an image of a data record, which is stored in and managed by a first database, for a second database. The data record is associated with an authorization structure that specifies which users of the first database have caching rights to grant caching permissions for caching images of the data record. The method includes: Receiving a request from a user of the first database to issue a caching credential for the second database, wherein the caching credential proves the second database's caching authorization to cache an image of the record; checking the record's authorization structure to see if the requesting user has caching rights to grant caching permissions; verifying the check is successful; creating the caching credential for the second database, wherein the caching credential includes a record ID of the record to be cached, a statement of the granted caching authorization, a user ID of the user granting the caching authorization, and a database ID of the second database to which the caching authorization is granted; and wherein the caching credential is signed by the first database.Providing the caching authorization certificate for the second database.

[0008] Implementations allow a second database to be provided with caching authorization to cache an individual record from the first database. This makes it possible to individually determine for each record in the first database whether caching authorization is granted, or whether the corresponding record is released for caching in the second database.

[0009] The record ID uniquely identifies the record to be cached, for which caching permission is granted. The granted caching permission indicates that it is limited to caching the record. This grants the second database, for example, a right to use the record. The second database is not authorized to modify the record; that is, caching does not grant the second database write access to the corresponding record. Rather, the image of the second record is merely a copy of the record, reflecting its state at the time the image was created. The actual content of the record remains solely the responsibility of the first database, which manages the record. In other words, the record can only be modified in the first database.Thus, the data record in the first database determines its content.

[0010] Caching grants the second database, for example, only read and / or select rights to the image of the corresponding data record. Read rights allow the owner to read the content of the data record. Select rights allow the owner, for example, to perform statistical analyses based on the image of the data record. For instance, it can be analyzed to determine how many data records or images of data records in the second database a user has specific access rights to, such as read and / or select rights. Furthermore, it can be analyzed to determine how many data records contain a specific piece of data, such as a name or other attribute of a user, as payload data or as data within a payload field. For example, using select rights, only relevant statistical data, such as frequencies, are provided.For example, using a selection right, the data records and / or images of data records that meet a specific search criterion are additionally identified, without granting access to the content of the corresponding data records. If a user of the second database wants to access the data records or images of data records selected using the selection right, they also need read access. If they do not have this read access, they can request it from the second database, for example.

[0011] For example, the second database grants read and / or selection rights for a cached image of a record from the first database. For instance, the second database, or its database management system, receives a user request to grant selection rights for images of records. The request can be general, targeting images of records from any database, or specific, targeting images of records from the first database. Upon receiving the request, the second database can, for example, check whether the requesting user meets one or more predefined criteria. If the check is successful, the requested selection rights are granted to the user. If, during an analysis, such as a statistical analysis, the user identifies one or more images of records, the second database can then grant these rights.Once a user has selected the database whose content they wish to access, they can, for example, send a request for read permissions for the corresponding images to the second database or its database management system. The second database or its database management system checks whether the requesting user meets one or more predefined second criteria. If the check is successful, the requested read permissions are granted to the user. For example, the first and second criteria might be identical. For example, the first and second criteria might be different.

[0012] Using several different types of access rights for different access methods to manage access, and / or individually linking these access rights to individual users to grant them different permissions, can be advantageous because it allows for particularly fine-grained access control. For example, the following access or usage rights can be assigned to records in the first and / or second database: read, write, select, and / or caching rights. Similarly, the following access or usage rights can be assigned to copies of records in the first and / or second database: read and / or select rights.

[0013] Using the user ID of the user granting caching permission, it is possible to clearly trace who granted caching permission to the second database. For example, the granted caching permission can only be revoked by the granting user. Alternatively, the granting user's caching right, i.e., their right to grant caching permission, can be revoked. This removes the basis for the caching permission and thus revokes it. The granting user's caching right can only be revoked by one of the users who are part of an authorization chain that ends with the granting user's caching right and / or that includes the granting user's caching right.The authorization chain comprises, for example, a sequence of users of the first database, starting with the creator of the corresponding data record and ending with the granting user, where each preceding user in the sequence has granted caching rights to the subsequent user. If the authorization chain is broken, for example by revoking one of the granted caching rights, the granting user loses their caching right, and the basis for the caching authorization is revoked.

[0014] The recipient of the caching authorization, which is verified by the caching authorization certificate, can be uniquely identified using the database ID of the second database. For example, the database ID includes an address of the second database, which can be used to address the second database. Alternatively, the address of the second database could be independent of the database ID of the second database. For example, the caching authorization certificate could also include an address of the second database.

[0015] The validity and authenticity of the caching credential can be verified using the signature of the first database. For example, the caching credential is signed with a signature key from the first database, which is a private cryptographic key of an asymmetric key pair from the first database. The signature can then be verified with a signature verification key from the first database, which is a public cryptographic key of the asymmetric key pair from the first database.

[0016] Asymmetric key pairs are used in a variety of cryptosystems and play a crucial role in the secure transmission of electronic data. An asymmetric key pair consists of a public key, which is used to encrypt and / or decrypt data and may be shared with third parties, such as a sender or recipient of data, and a private key, which is used for encryption and / or decryption as well as for signing data and must generally be kept secret. The public key allows anyone to encrypt data for the owner of the private key or to verify digital signatures created with the private key. A private key allows its owner to decrypt data encrypted with the public key or to create digital signatures of data.

[0017] A digital signature of data involves, for example, generating a verification value of the data, such as a hash value, which is encrypted using a private cryptographic key from an asymmetric key pair that serves as the signature key. In the case of a signature, only the signer knows the private cryptographic key used to create the signature, i.e., the signature key, of the asymmetric key pair used for the signature. The signature recipient only possesses the public key, i.e., the signature verification key, of the asymmetric key pair used for the signature. The signature recipient can therefore verify the signature, but cannot calculate it themselves. For signature verification, the signature recipient calculates, for example, the verification value of the signed data and compares it with the result of decrypting the signature using the signature verification key.If the calculated hash value matches the decryption result, the signature is correct. Furthermore, if the authenticity of the signature verification key is confirmed, for example by a certificate, the signature is valid.

[0018] Here, a certificate refers to a digital certificate, which consists of structured data used to associate a public key of an asymmetric cryptosystem with an identity, such as a person, institution, or device. For cryptographic security and to verify the authenticity of the certificate's data, it is signed by a certificate issuer. A certificate chain is established through certificates based on asymmetric key pairs, each of which (except for the root certificate) is signed by a certificate issuer with a signature key. The corresponding signature verification key is assigned to the certificate issuer by a certificate from that same certificate issuer.

[0019] Furthermore, the caching credential can, for example, include a database ID of the first database, which signs the caching credential. The sender of the caching credential can be uniquely identified using the database ID of the first database. For example, the database ID includes an address of the first database, which can be used to address the first database. For example, the address of the first database is independent of the database ID of the first database. For example, the caching credential also includes an address of the first database.

[0020] In some implementations, the authorization structure for the data record defines access and usage rights. For example, rights are assigned hierarchically, starting with the creator of the corresponding data record, to users of the first database, resulting in a hierarchical chain structure. If one user grants rights to multiple users, a branched chain or tree structure results. In contrast, caching permission is granted not to users of the first database, but to users of the second database.

[0021] In some embodiments, when a request is made to access a record in the first database, the authorization structure, which establishes the requesting user's right to the requested access, is sent along with the request. In these embodiments, the authorization structure is stored in the first database and is used by the first database or its database management system to validate the request. For example, the request is signed with a private cryptographic key of the requesting user, while the authorization structure provides a public cryptographic key of the requesting user as a signature verification key.

[0022] In some implementations, the authorization structure comprises a chain of certificates, each confirming one or more access or usage rights for a record in the first database. These are, for example, authorization certificates. Each certificate in the hierarchical certificate chain following a root certificate is derived from a higher-level certificate or signed with a private cryptographic key from an asymmetric key pair associated with the higher-level certificate. The root certificate, for example, is a certificate issued by the creator of the record. A derived certificate can only have the same rights as the higher-level certificate. For example, the root certificate has maximum rights, such as write, read, select, and caching rights.

[0023] In some embodiments, the authorization structure comprises a blockchain, for example, a unidirectionally or bidirectionally linked blockchain. For instance, the blocks of the blockchain that follow a root block are each assigned to a user of the first database and define which rights have been granted to that user by a user of the first database to whom the immediately preceding block of the blockchain is assigned. In some embodiments, the blockchain allows for branching if one user grants rights to multiple users. A block of the blockchain can only grant a user of the first database, to whom the corresponding block is assigned, those rights that the user to whom the immediately preceding block is assigned also possesses.

[0024] A blockchain provides an expandable list of data records arranged in blocks. The integrity of each block is ensured by linking it to one or more neighboring blocks using a cryptographic function, such as a hash function. Because each block contains cryptographic checksums resulting from applying the cryptographic function to the data content of neighboring blocks and / or the block itself, the blocks are linked. This linking can be, for example, unilateral or bilateral.

[0025] Therefore, it is difficult to manipulate such a blockchain retroactively, as this would require manipulating not just a single block, but all blocks linked to it, whose verification values ​​depend on the data content of the respective individual block. If the block to be manipulated is indeed manipulated, its verification value changes. This changed verification value no longer matches the verification values ​​of the neighboring blocks, making the manipulation detectable and revealing it during an audit using the verification values.

[0026] In some embodiments, the caching authorization credential proves that the second database has caching rights to a copy of exactly one record from the first database. For example, the caching authorization credential includes exactly one record ID of the single record to be cached.

[0027] In some implementations, the caching authorization credential, for example, proves caching permissions of the second database for images of a plurality of records from the first database. For instance, the caching authorization credential includes a plurality of record IDs of the plurality of records to be cached.

[0028] In some embodiments, the first database stores a plurality of first data records, which are managed by the first database. The plurality of first data records stored in the first database includes the data record whose image is released for caching. In other embodiments, the first database stores one or more images of data records from the second database.

[0029] In some embodiments, the second database stores a plurality of second data records, which are managed by the first database. In other embodiments, the first and second data records are different from each other. In other embodiments, the second database stores a plurality of copies of data records from the first database.

[0030] In some embodiments, providing the caching credential includes storing the caching credential in the first database. When the second database requests a copy of a record from the first database, the first database uses the one or more caching credentials stored in the first database to check whether the second database has been granted caching permission to cache the requested record. For example, the request is signed by the second database, and a signature verification key for verifying the signature is included in the caching credential. Alternatively, the signature verification key can be associated with the database ID of the second database, for example, by storing the corresponding association in the first database and / or by means of a certificate.If a caching authorization certificate is issued for the second database, information is sent to the second database, for example, regarding which data record has been granted caching authorization.

[0031] In some embodiments, providing the caching credential involves sending it to the second database. These embodiments offer the advantage that the second database possesses the caching credential and can include it as proof of caching authorization when requesting a copy of a record from the first database. For example, the request is signed by the second database, and a signature verification key for verifying the signature is included in the caching credential. Alternatively, the signature verification key can be associated with the database ID of the second database, for instance, by storing the corresponding association in the first database and / or by means of a certificate.

[0032] According to embodiments, the method, provided that a valid caching authorization for the second database exists for caching an image of the data record, further comprises providing the image of the data record to the second database. The provisioning includes: Creating an image of the data set for caching in the second database, sending the created image to the second database for caching.

[0033] Implementations can have the advantage that the second database can be provided with and use one or more copies of records from the first database. For example, the provided copies can be used for statistical evaluations and / or content analyses or searches.

[0034] In some implementations, the provision of the image of the data record to the second database occurs automatically upon provision of the caching authorization credential for the second database. For example, the caching authorization credential is sent to the second database along with the image.

[0035] In some embodiments, the image of the data record is provided to the second database in response to a request from the second database to provide an image of the data record for caching in the second database. The method further comprises: Receiving the request from the second database to provide an image of the record, wherein the request includes the caching rectification proof of the second database, validating the caching rectification proof of the second database, upon successful validation of the caching rectification proof, providing the image of the record for caching in the second database.

[0036] Implementations can have the advantage that the second database can request a copy of the data record from the first database if needed. Caching authorization allows the second database to verify its ownership using caching credentials. For example, the request is signed by the second database. The caching credentials include a signature verification key to check the signature of the second database. This signature verification key is a public cryptographic key associated with the database ID of the second database.

[0037] According to some implementations, validating the caching authorization credential includes checking the authorization structure of the data record to see if a caching right to grant caching authorizations is entered into the authorization structure of the data record for the user who, according to the user ID of the caching rectification credential, grants the caching authorization of the second database.

[0038] Implementation methods can have the advantage of ensuring that the user in question still possesses caching rights, i.e., the right to grant caching permission. If this is no longer the case, the caching permission also becomes invalid.

[0039] In some embodiments, the created image of the data set is signed by the first database. These embodiments can have the advantage of ensuring the validity and authenticity of the provided image.

[0040] In some embodiments, metadata is also associated with the image of the data set, and this metadata, along with the image of the data set, is signed by the first database. These embodiments can have the advantage of ensuring the validity and authenticity of the metadata provided with the image.

[0041] In some embodiments, the metadata includes an authorization structure for the image. The authorization structure of the second database grants read and / or select rights for the image of the data record. These embodiments offer the advantage that the authorization structure of the image can be managed and handled by the second database or its database management system in the same way as the authorization structure of one of the data records in the second database.

[0042] The authorization structure of the image is, for example, the authorization structure of the data record, whereby the user granting the caching authorization to the second database additionally grants a read right and / or selection right in the authorization structure, which applies to the image.

[0043] For example, an independent authorization structure is initiated for the image by the first database, which, as the creator of the image, grants the second database read and / or select rights.

[0044] In some embodiments, the authorization structure of the second database further grants the right to delegate read and / or select rights for the image of the data record to users of the second database. These embodiments can have the advantage that the second database can not only grant users of the second database read and / or select rights for the image, but can also allow these users to grant other users of the second database read and / or select rights for the image.

[0045] In some embodiments, the metadata also includes a timestamp of the image's creation. These embodiments can have the advantage that the timeliness of the image can be determined or estimated based on the timestamp.

[0046] In some embodiments, the metadata further includes information on the time-limited validity of the image of the data record. These embodiments can have the advantage that the cached image allows for time-limited use of the data record from the first database by the second database. Furthermore, this can prevent, for example, the second database from using an image of an outdated or very outdated version of the data record. If the validity has expired and / or is about to expire, the second database requests an updated version of the image from the first database.

[0047] In some embodiments, the caching authorization certificate has a limited validity period. Once the validity of the caching authorization certificate has expired, the second database requires a caching authorization certificate. In alternative embodiments, the caching authorization certificate has no time limit.

[0048] In some embodiments, specifying the time-limited validity of the image of the data record includes indicating when the validity expires, for example, in the form of a timestamp. In other embodiments, specifying the time-limited validity includes specifying the length of a validity period for the image. The image of the data record is therefore valid, for example, from the time of its creation, documented by a corresponding timestamp, until the expiration of the assigned validity period.

[0049] According to embodiments, the method further comprises updating the provided image of the data set. The update includes: Receiving a request from the second database to provide an updated image of the record by the second database, wherein the request includes the caching proof of the second database, validating the caching proof of the second database, upon successful validation, creating an updated image of the record for caching to the second database, sending the updated image for caching to the second database.

[0050] Embodiments can have the advantage that, for example, when the validity of the data record's image expires, an updated image of the data record can be made available to the second database for further use. According to some embodiments, this updating process can implement a synchronization mechanism to synchronize the data record image stored in the second database with the data record stored in the first database.

[0051] According to embodiments, the updated image is assigned an extended validity period, i.e., the validity of the updated image is later than the validity of a previous version of the image.

[0052] In some embodiments, the request to provide the updated image of the data record with the extended validity period is received within a predefined period before the expiration of the validity of the image of the data record to be updated. In other embodiments, the receipt of the request within the predefined period before the expiration of the validity of the image of the data record to be updated is a prerequisite for creating the updated image of the data record with the extended validity period. In other embodiments, the receipt of the request within the predefined period before the expiration of the validity of the image of the data record to be updated is not a prerequisite for creating the updated image of the data record with the extended validity period.

[0053] In some embodiments, the request to provide the updated image of the data record with the extended validity period is received after the expiration of the validity period of the image of the data record to be updated. In other embodiments, receiving the request after the expiration of the validity period of the image of the data record to be updated is a prerequisite for creating the updated image of the data record with the extended validity period. In other embodiments, receiving the request after the expiration of the validity period of the image of the data record to be updated is not a prerequisite for creating the updated image of the data record with the extended validity period.

[0054] In some embodiments, the metadata further includes an image ID of the data record. These embodiments allow the image to be uniquely identified using the image ID. For example, the image ID can be used to assign an independent authorization structure to the image. In other embodiments, the metadata further includes the data record ID of the data record. In other embodiments, the image ID includes the data record ID of the data record. These embodiments can have the advantage that the data record of which the image is being used can be uniquely determined using the data record ID.

[0055] In some embodiments, the metadata further includes a database ID of the first database. In other embodiments, the image ID includes the database ID of the first database. These embodiments can have the advantage that the database from which the data record being imaged originates can be uniquely identified using the database ID.

[0056] In some embodiments, sending the caching correction proof from the first database to the second database and / or sending the image of the data record to the second database requires successful authentication of the first database by the second database and / or successful authentication of the second database by the first database. In other embodiments, sending the caching correction proof from the first database to the second database and / or sending the image of the data record to the second database requires successful mutual authentication between the first and second databases.

[0057] According to some embodiments, the receipt of a query from the second database by the first database and / or the validation of the caching correction proof of the second database requires successful authentication of the second database by the first database. According to other embodiments, the receipt of a query from the second database by the first database and / or the validation of the caching correction proof of the second database requires successful mutual authentication between the first and second databases.

[0058] In some embodiments, the first database is authenticated by the first database using a certificate issued by the first database. In these embodiments, the certificate of the first data record provides a first public cryptographic key of a first asymmetric key pair of the first database. In these embodiments, the first asymmetric key pair of the first database further comprises a first private cryptographic key.

[0059] In some embodiments, the second database is authenticated by the first database using a certificate from the second database. In these embodiments, the certificate of the second database provides a second public cryptographic key of a second asymmetric key pair for the second database. In these embodiments, the second asymmetric key pair of the second database further comprises a second private cryptographic key.

[0060] In some implementations, communication between the two databases is encrypted. For example, end-to-end encryption is used. An ephemeral symmetric key, negotiated between the two databases after successful authentication, is used for encryption.

[0061] In some embodiments, the second database is a slave database with respect to the data record. In others, the first database is a master database with respect to the data record. In other words, the first database determines the content of the data record or is authoritative for it, while the second database can only use the content provided by the first database.

[0062] In some embodiments, the two databases are part of a distributed database system. For example, the distributed database system may include additional databases besides the first and second databases. These embodiments offer the advantage that, by caching images of data records, the databases of the distributed database system can grant each other access to individual data records stored within them and make these records available to each other for use.

[0063] In some embodiments, each data record stored in one of the databases of the distributed database system is stored in exactly one of the databases of the distributed database system and is managed by that database. One or more further databases of the distributed database system may, for example, contain copies of the corresponding data record.

[0064] According to some embodiments, the authorization structure of the data record comprises a hierarchical authorization chain. For each user of the first database who possesses a right to use the data record, this chain contains a chain of authorization. Starting with the creator of the data record and continuing to the user with the corresponding right of use, a sequence of users of the first database is recorded. Within this sequence, each preceding user has granted the corresponding right of use to the subsequent user.

[0065] Depending on the implementation, the usage rights entered in the dataset's authorization structure include, in addition to a caching right, one or more of the following usage rights: read right, write right, and selection right. A read right grants the right to read the dataset's content. A write right grants the right to modify the dataset's content. A selection right grants the right to use the dataset's content for evaluation, such as statistical analysis, without granting read access to the content itself. For example, the selection right can be used to select relevant datasets with relevant content. The caching right serves, for example, to issue or initiate the issuance of caching authorization.

[0066] In some implementations, the usage rights categories of read, write, and select are each assigned a category-specific delegability parameter, which determines whether the right of the corresponding category is delegable. If the usage right of the corresponding category is delegable, the holder of the corresponding usage right is entitled to delegate their usage right, e.g., a read right, write right, select right, and / or caching right.

[0067] In some embodiments, the second database initiates an authorization structure for the image, which comprises a hierarchical authorization chain. This chain includes a chain of authorization for each user of the second database who is granted a right to use the image. Starting with the first database, which created the image or is the second database, and continuing to the user with the corresponding right of use, a sequence of users of the second database is recorded. Within this sequence, each preceding user has granted the corresponding right of use to the subsequent user. In alternative embodiments, the first database initiates the authorization structure for the image.

[0068] According to various embodiments, the usage rights entered in the authorization structure of the image include a read right and / or a selection right.

[0069] In some embodiments, the image's usage rights, specifically the authorization categories "Read" and "Select," are each assigned a category-specific delegability parameter, which determines whether the right of the corresponding category is delegable. If the usage right of the corresponding category is delegable, the holder of the corresponding usage right is entitled to delegate their usage right, e.g., a read right and / or a select right.

[0070] In some embodiments, upon a revocation request from the user of the first database, who has granted the second database caching permission to cache the data record, the caching permission of the second database is revoked, and the caching permission credential of the second database is rejected as invalid. These embodiments can have the advantage that the caching permission of the second database, and thus the caching permission credential of the second database, is revocable. For example, the first database includes a revocation directory in which a revocation of the caching permission is recorded. During the validation of the caching permission credential, the first database checks, for example, whether a revocation entry for the caching permission credential exists in the revocation directory. If so, the caching permission credential is rejected as invalid.

[0071] In some implementations, if a user of the first database revokes their caching rights (the user who granted the second database caching rights to cache the data record), the caching rights of the second database are revoked, and the caching rights credential of the second database is rejected as invalid. For example, if a revocation of the caching rights has been made, it is entered into the revocation directory of the first database. Alternatively, a revocation is entered into the authorization structure of the data record. During the validation of the caching rights credential, the first database checks, for example, whether a revocation of the user's caching rights is documented. If so, the caching rights credential is rejected as invalid.

[0072] Further embodiments include a database with a database management system. A data record managed by the database management system is stored in a memory location within the database. The database management system is configured to grant another database caching permission to cache an image of the data record. A permission structure is associated with the data record, specifying which database users have caching rights to grant caching permissions for caching images of the data record. Granting caching permission includes: Receiving a request from a database user to issue a caching authorization certificate for the other database, wherein the caching authorization certificate proves the other database's caching authorization to cache an image of the record; checking the record's authorization structure to see if the requesting user has caching rights to grant caching permissions; verifying the check is successful; creating the caching authorization certificate for the other database, wherein the caching authorization certificate includes a record ID of the record to be cached, a specification of the granted caching authorization, a user ID of the user granting the caching authorization, and a database ID of the other database to which the caching authorization is granted; and wherein the caching authorization certificate is signed by the database.Providing the caching authorization certificate for the wider database.

[0073] According to embodiments, the database is configured to execute each of the previously described embodiments of the method for granting caching authorization.

[0074] In this context, a "database management system" refers to administrative software running on a computer system for storing and retrieving data in a database. The database management system is configured, among other things, as an access control system, managing access to the corresponding data. Ideally, the data is stored consistently and permanently in the access control system and efficiently made available to various application programs and users in the required format. Furthermore, the database management system is configured to create images of the database records. The term "storage" here refers to both volatile and non-volatile electronic storage media or digital storage devices.

[0075] In this context, "non-volatile memory" refers to electronic storage for the permanent storage of data, particularly static cryptographic keys, attributes, or identifiers. Non-volatile memory can be configured as immutable memory, also known as Read-Only Memory (ROM), or as modifiable memory, also known as Non-Volatile Memory (NVM). Specifically, it can be an EEPROM, for example, a Flash EEPROM, or simply Flash. A key characteristic of non-volatile memory is that the data stored on it is retained even after the power supply is switched off.

[0076] In this context, an "interface" or "communication interface" refers to an interface through which data can be received and sent. This interface can be configured to be either contact-based or contactless. For example, a communication interface can enable communication over a network. Depending on its configuration, a communication interface can provide wireless communication using a mobile communication standard, Bluetooth, RFID, Wi-Fi, and / or NFC. Depending on its configuration, a communication interface can also provide wired communication. The communication interface can be internal or external.

[0077] Encrypted communication channels include, for example, encrypted end-to-end connections. An "encrypted end-to-end connection" or "encrypted end-to-end transmission channel" refers to a connection between a sender and a receiver with end-to-end encryption, where data to be transmitted is encrypted by the sender and only decrypted by the receiver. The encryption of transmitted data thus occurs across all transmission stations, so that intermediate stations cannot gain knowledge of the content of the transmitted data due to the encryption. The connection is cryptographically secured by encryption to prevent eavesdropping and / or manipulation of the transmission, for which a so-called secure messaging method can be used.End-to-end encryption, for example, relies on two symmetric cryptographic keys. One symmetric key is used to encrypt messages, and the other is used to authenticate the sender, for instance, using Message Authentication Code (MAC) algorithms. For example, during the setup of an encrypted communication channel, ephemeral keys are negotiated for encryption. These keys become invalid when the communication channel is terminated. Using different ephemeral keys for different communication channels allows for the parallel operation of multiple communication channels.

[0078] In some embodiments, a plurality of database records are stored in the database's memory. In other embodiments, one or more copies of data records from one or more additional databases are stored in the database's memory.

[0079] In some embodiments, the database management system manages the data records and / or images of data records stored in the memory.

[0080] In some embodiments, the memory of the additional database stores a plurality of further data records from the additional database. In other embodiments, the memory of the additional database stores one or more further copies of further data records from one or more additional databases.

[0081] According to embodiments, a further database management system of the further database manages the further data records and / or further images of further data records stored in the memory.

[0082] In some embodiments, the database management system is further configured to provide the image of the data record to the other database, provided that a valid caching authorization for caching an image of the data record is available. This provisioning includes: Creating an image of the data set for caching in the second database, sending the created image to the second database for caching.

[0083] Embodiments further include a distributed database system comprising a database according to one of the aforementioned embodiments and another database according to one of the aforementioned embodiments with additional storage and a database management system that manages records and images of records stored in the additional storage.

[0084] According to embodiments, the database system is configured to execute each of the previously described embodiments of the method for granting caching authorization.

[0085] Embodiments of the invention will now be explained in more detail with reference to the drawings. These show: Figure 1 is a schematic diagram of an exemplary distributed database system, Figure 2 is a schematic diagram of an exemplary caching credential, Figure 3 is a schematic diagram of an exemplary authorization structure, Figure 4 is a flowchart of an exemplary procedure for providing the image of the data record, Figure 5 is a flowchart of an exemplary procedure for updating the image of the data record, and Figure 6 is a flowchart of an exemplary procedure for revoking a caching credential.

[0086] Elements of the following embodiments that correspond to each other are marked with the same reference numerals.

[0087] Figure 1Figure 101 shows an exemplary distributed database system comprising a plurality of databases 100 and 120. The databases 100 and 120 can communicate with each other via a network 140 using communication interfaces 114 and 134. The network 140 could be, for example, a public network such as the Internet, or a private network such as an intranet. Databases 100 and 120 each comprise a memory 108 and 138 containing a plurality of data records 110 and 130. The computer systems on which databases 100 and 120 are implemented each comprise a processor 102 and 122, on which a database management system 104 and 124, or program instructions of a corresponding database management system 104 and 124, respectively, are executed. The database management systems 104 and 124 manage the data records 110 and 130 of the respective databases 100 and 120.Furthermore, processors 102 and 122 of databases 100 and 120 are configured to execute cryptographic protocols 106 and 126 for the cryptographic security of communication between databases 100 and 120 over network 140. This cryptographic security includes, for example, mutual authentication of databases 100 and 120, as well as the negotiation of ephemeral cryptographic keys, such as an ephemeral symmetric cryptographic key, to implement an encrypted communication channel between databases 100 and 120. This encrypted communication channel provides, for example, end-to-end encryption of communication between the two databases 100 and 120.

[0088] For example, the first database 100 creates a caching credential 132, which authorizes the second database 120 to cache an image 112 of a record 110 from the first database 100. The first database 100 sends the caching credential 132 to the second database 120, for example, using an encrypted communication channel over the network 140. The second database 120 stores the received caching credential 132, for example, in its memory 128. Furthermore, the second database 120 uses the caching credential 132, for example, to request an image 112 of the record 110 from the first database 100. To do this, the second database 120 sends a corresponding request to the first database 110, for example, using an encrypted communication channel over the network 140.The request includes, for example, the caching credential 132 to prove the second database's authorization to cache the image 112 of record 110 from the first database 100. The first database 100 checks the provided caching credential 132. If it is valid, the first database 100 creates the requested image 112 of record 110 and sends it to the second database 120, for example, using the encrypted communication channel over network 140. The second database receives the image 112 of record 110, stores it in memory 128, and manages it using the database management system 124, along with the records 130 of the second database 120. For example, the database management system 124 allows authorized users of the second database 120 access, such as selection and / or read access, to the image 112 of the record. 110.

[0089] Figure 2 Figure 132 shows an example of a caching authorization certificate. The caching authorization certificate includes a record ID 150, which identifies the record in the source database for which the caching authorization certificate 132 grants caching authorization. Furthermore, the caching authorization certificate 132 includes a specification of the granted caching authorization 152, indicating which authorization 152 is granted; a user ID 154, which identifies the user granting the caching authorization; and a database ID 156 of the recipient database, which indicates to whom the corresponding caching authorization 152 is granted. The caching authorization certificate 132 is signed by the source database and includes a corresponding signature 158. For example, the caching authorization certificate 132 also includes a database ID of the source database.

[0090] Figure 3Figure 171 shows an exemplary authorization structure of a data record from one of the databases of the distributed database system. Figure 1The authorization structure 171 defines which user of the corresponding database has which rights with respect to the corresponding data record. For example, the following rights are defined: write right (S) to modify the data record, read right (L) to read the data record, selection right (SI) to select the corresponding data record and / or to use the data record in statistical applications, and a caching right (C) to grant caching permission to cache an image of the data record. The authorization structure 171 has, for example, a chain or tree structure starting from the creator (U1) of the data record. The creator (U1) has all rights, i.e., S, L, SI, and C. These rights are, for example, recorded in a first block (170) or a first certificate of the authorization structure 171.Creator U1 can grant rights to other users U2, which are entered into a block 172 or a certificate of the authorization structure 171. The rights granted to user U2 can be delegated, allowing user U2 to grant access or usage rights to other users of the database. For example, user UN requests the issuance of a caching authorization certificate. The database checks whether a caching right C for granting caching permissions is entered into the authorization structure 171 of the record for the requesting user UN. If the authorization structure 171 includes a block 174 or a certificate that grants user UN the corresponding caching right C, the database creates a caching authorization certificate confirming the granting of the requested caching permissions.

[0091] Figure 4This section illustrates an exemplary procedure for providing a copy of a record from a first database. In block 200, a request from a user of the first database is received, requesting the first database to issue a caching credential for a second database. The requested caching credential should prove that the second database has caching permission to cache a copy of the record from the first database. The request includes, for example, a user ID of the requesting user, a record ID of the corresponding record, and a database ID of the second database. In block 202, the first database, or a database management system of the first database, checks the record's permission structure to determine whether the requesting user has caching rights to grant caching permissions.If this is not the case, the creation of a caching credential is denied. If it is, the process continues to block 204. In block 204, the requested caching credential is created. This includes, for example, a record ID of the record to be cached, a specification of the granted caching permission, a user ID of the user granting the caching permission, and a database ID of the second database to which the caching permission is granted. Furthermore, the caching credential is signed by the first database. In block 206, for example, a first encrypted communication channel is established between the first database and the second database. The establishment of the first encrypted communication channel includes, for example, mutual authentication and the negotiation of a first ephemeral symmetric cryptographic key for encrypting the communication.In block 208, the caching credential is sent from the first database to the second database via the first encrypted communication channel. Alternatively, the caching credential can be made available to the requesting user, who can then send it to the second database via an encrypted communication channel between their computer system and the second database. The second database receives the caching credential and can use it.

[0092] For example, the second database uses the caching credential to request an image of the corresponding data record. In block 210, a second encrypted communication channel is established between the first and second databases for this purpose. Establishing this second encrypted communication channel includes, for example, mutual authentication and negotiating a second ephemeral symmetric cryptographic key to encrypt the communication. In block 212, the first database receives a request from the second database via the second encrypted communication channel to provide the image of the data record. This request includes, for example, the caching credential from the second database. In block 214, the first database or database management system validates the caching credential from the second database.Validating the caching authorization credential includes, for example, checking the authorization structure of the data record to ensure that the user who granted caching authorization to the second database according to the user ID of the caching rectification credential still has a valid caching right to grant caching authorizations entered into the data record's authorization structure. Furthermore, it can be checked whether the caching rectification credential has been revoked in the meantime, i.e., whether, for example, a revocation entry exists in a revocation register. If the validation is unsuccessful, the creation of an image of the data record is denied. If the validation is successful, the process continues with block 216. In block 216, the first database or database management system creates the requested image of the data record for caching in the second database.For example, the image is assigned only a limited validity period. For instance, the first database or database management system signs the image. In block 218, the first database sends the created image to the second database via the second encrypted communication channel. The second database receives the image and stores it together with the data records of the second database for further use. For example, the second database grants users of the second database selection rights and / or read rights for the image.

[0093] Figure 5This section illustrates an exemplary procedure for updating the image of the data record. In block 300, for example, a third encrypted communication channel is established between the first and second databases for this purpose. The establishment of this third encrypted communication channel includes, for example, mutual authentication and the negotiation of a third ephemeral symmetric cryptographic key for encrypting the communication. In block 302, the first database receives a request from the second database via the third encrypted communication channel to provide an updated image of the data record. The request includes, for example, the caching correction proof from the second database. In block 304, the first database, or rather the first database management system, validates the caching correction proof from the second database.Validating the caching authorization credential includes, for example, checking the authorization structure of the data record to ensure that the user who granted caching permission to the second database according to the user ID of the caching rectification credential still has a valid caching right to grant caching permissions entered into the data record's authorization structure. Furthermore, it can be checked whether the caching rectification credential has been revoked in the meantime, i.e., whether, for example, a revocation entry exists in a revocation register. If the validation is unsuccessful, the creation of an updated image of the data record is denied. If the validation is successful, the process continues to block 306. In block 306, the first database or database management system creates the updated image of the data record for caching in the second database.For example, the first database or database management system signs the updated image. For example, the validity of the updated image is extended. In block 308, the first database sends the updated image to the second database via the second encrypted communication channel. The second database receives the image and replaces the previous image with the updated image for further use. For example, the second database or database management system assigns the selection and / or read rights of the previous image to the updated image as well. Alternatively, the second database or database management system can, for example, grant new selection and / or read rights for the updated image.

[0094] Figure 6Finally, an exemplary procedure for revoking a caching authorization is shown. In block 400, the first database or database management system receives a revocation request from the user of the first database who granted the second database caching authorization to cache the record. Alternatively, the revocation request could originate from a user belonging to the authorization chain from which the caching right of the user who granted the caching authorization is derived. In block 402, it is checked whether the requesting user actually granted the caching authorization to be revoked or belongs to the authorization chain from which the caching right of the user who granted the caching authorization is derived. If this is not the case, the revocation is denied. If it is, the process continues in block 404.In block 404, the caching authorization of the second database is revoked. This means that the caching authorization credential of the second database becomes invalid. This is done, for example, by creating a revocation entry in a revocation register of the first database. If the second database attempts to request a copy or an updated copy using the revoked caching authorization credential, the creation of such a copy or updated copy will be denied. Reference symbol list

[0095] 100 Database 101 Distributed database system 102 Processor 104 Database management system 106 Cryptographic protocol 108 Storage 110 Record 112 Image 114 Communication interface 120 Database 122 Processor 124 Database management system 126 Cryptographic protocol 128 Storage 130 Record 132 Caching credential 134 Communication interface 140 Network 150 Record ID 152 Caching authorization 154 User ID 156 Database ID 158 Signature 170 Authorization structure 171 Rights 172 Rights 174 Rights

Claims

1. A method for granting a caching authorization (152) to cache an image (112) of a data record (110) which is stored in and managed by a first database (100) for a second database (120), wherein the data record (110) is assigned an authorization structure (170) in which it is recorded which users of the first database (100) have a caching right to grant caching authorizations (152) for caching images (112) of the data record (110), wherein the method comprises: • receiving a request from a user of the first database (100) to issue a proof of caching authorization (132) by the first database (100) for the second database (120), wherein the request is signed with a private cryptographic key of the requesting user, while the authorization structure provides a public cryptographic key of the requesting user as a signature verification key of the requesting user, wherein the proof of caching authorization (132) proves a caching authorization (152) of the second database (120) for caching an image (112) of the data record (110), • checking the authorization structure (170) of the data record (110) to determine whether a caching right for granting caching authorizations (152) is recorded in the authorization structure (170) of the data record (110) for the requesting user, wherein the authorization structure (170) of the data record (110) comprises a hierarchical authorization chain in the form of a certificate chain or a blockchain, which comprises, for each user of the first database (100), who has a right of use for using the data record (110), a granting chain in which starting from the creator of the data record (110) to the user with the corresponding right of use a sequence of users of the first database (100) is recorded, wherein, within the sequence, each preceding user granted the corresponding right of use to the subsequent user, • upon a successful checking, creating the proof of caching authorization (132) for the second database (120), wherein the proof of caching authorization (132) comprises a data record ID (150) of the data record (110) to be cached, an indication of the granted caching authorization (152), a user ID (154) of the user granting the caching authorization (152), and a database ID (156) of the second database (120) to which the caching authorization (152) is granted, wherein the authorization (152) is limited to caching the data record (110), wherein the proof of caching authorization (132) is signed by the first database (100) with a signature key of the first database (100), which is a private cryptographic key of an asymmetric key pair of the first database (100), wherein the signature of the proof of caching authorization (132) is verifiable using a signature verification key of the first database (100), which is a public cryptographic key of the asymmetric key pair of the first database (100), • providing the proof of caching authorization (132) to the second database (120), wherein the method further comprises, subject to a presence of a valid proof of caching authorization (132) of the second database (120) to cache an image (112) of the data record (110), providing the image (112) of the data record (110) to the second database (120), wherein the providing comprises: • creating the image (112) of the data record (110) for the caching in the second database (120), wherein the created image (112) of the data record (110) is signed by the first database (100), wherein the image (112) of the data record (110) is further assigned metadata which is signed together with the image (112) of the data record (110) by the first database (100), wherein the metadata comprises an authorization structure of the image (112), • sending the created image (112) to the second database (120) for caching.

2. The method of claim 1, wherein the providing of the image (112) of the data record (110) to the second database (120) is performed automatically upon the providing of the proof of caching authorization (132) to the second database (120), or wherein the providing of the image (112) of the data record (110) to the second database (120) is performed in response to receiving a request from the second database (120) to provide an image (112) of the data record (110) for the caching in the second database (120), the method further comprising: • receiving the request from the second database (120) to provide an image (112) of the data record (110), wherein the request comprises the proof of caching authorization (132) of the second database (120), • validating the proof of caching authorization (132) of the second database (120), • upon a successful validating of the proof of caching authorization (132), providing the image (112) of the data record (110) for the caching in the second database (120), wherein the validating of the proof of caching authorization (132) comprises, for example, checking the authorization structure (170) of the data record (110) to determine whether for the user, who according to the user ID (154) of the proof of caching authorization (132) grants the caching authorization (152) for the second database (120), a caching right to grant caching authorizations (152) is recorded in the authorization structure (170) of the data record (110).

3. The method of any of the preceding claims, wherein the authorization structure of the second database (120) grants a read right and / or selection right for the image (112) of the data record (110), wherein the authorization structure of the second database (120) further grants, for example, the right to delegate the read right and / or selection right for the image (112) of the data record (110) to users of the second database (120).

4. The method of any of the preceding claims, wherein the metadata further comprises an indication of a time-limited validity of the image (112) of the data record (110).

5. The method of any of the preceding claims, wherein the method further comprises updating the provided image (112) of the data record (110), wherein the updating comprises: • receiving a request from the second database (120) to provide an updated image of the data record (110) by the first database (100), wherein the request comprises the proof of caching authorization (132) of the second database (120), • validating the proof of caching authorization (132) of the second database (120), • upon a successful validating, creating an updated image of the data record (110) for the caching in the second database (120), • sending the updated image for the caching to the second database (120), wherein the updated image of the data record (110) is assigned, for example, an extended period of validity.

6. The method of any of the preceding claims, wherein the two databases (100, 120) are databases of a distributed database system (101).

7. The method of any of the preceding claims, wherein the rights of use recorded in the authorization structure (170) of the data record (110) comprise, in addition to a caching right, one or more of the following rights of use: read right, write right, selection right.

8. The method of any of the preceding claims, wherein the second database (120) initiates an authorization structure of the image (112), which comprises a hierarchical authorization chain, which comprises a grant chain for each user of the second database (120) who is granted a right of use for using the image (112), in which a sequence of users of the second database (120) is recorded, starting from the first database (100) as the creator of the image (112) or the second database (120) up to the user with the corresponding right of use, wherein within the sequence the preceding user granted the corresponding right of use to the subsequent user, wherein the rights of use recorded in the authorization structure of the image (112) comprise, for example, a read right and / or a selection right.

9. The method of any of the preceding claims, wherein, in response to a revocation request from the user of the first database (100) who granted the second database (120) the caching authorization (152) to cache the data record (110), the caching authorization (152) of the second database (120) is revoked and the proof of caching authorization (132) of the second database (120) is rejected as invalid, and / or wherein, upon revocation of the caching right of the user of the first database (100) who granted the second database (120) the caching authorization (152) for caching the data record (110), the caching authorization (152) of the second database (120) is revoked and the proof of caching authorization (132) of the second database (120) is rejected as invalid.

10. A database (100) with a database management system (104), wherein a data record (110) managed by the database management system (104) is stored in a memory (108) of the database (100), wherein the database management system (104) is configured to grant a further database (120) a caching authorization (152) to cache an image (112) of the data record (110), wherein the data record (110) is assigned an authorization structure (170) in which it is recorded which users of the database (100) have a caching right to grant caching authorizations (152) for caching images (112) of the data record (110), wherein granting the caching authorization (152) comprises: • receiving a request from a user of the database (100) to issue a proof of caching authorization (132) by the database (100) for the further database (120), wherein the request is signed with a private cryptographic key of the requesting user, while the authorization structure provides a public cryptographic key of the requesting user as a signature verification key of the requesting user, wherein the proof of caching authorization (132) proves a caching authorization (152) of the further database (120) for caching an image (112) of the data record (110), • checking the authorization structure (170) of the data record (110) to determine whether a caching right for granting caching authorizations (152) is recorded in the authorization structure (170) of the data record (110) for the requesting user, wherein the authorization structure (170) of the data record (110) comprises a hierarchical authorization chain in the form of a certificate chain or a blockchain, which comprises an issuance chain for each user of the database (100), who has a right of use for using the data record (110), in which starting from the creator of the data record (110) to the user with the corresponding right of use a sequence of users of the database (100) is recorded, wherein, within the sequence, each preceding user granted the corresponding right of use to the subsequent user, • upon a successful checking, creating the proof of caching authorization (132) for the additional database (120), wherein the proof of caching authorization (132) comprises a data record ID (150) of the data record (110) to be cached, an indication of the granted caching authorization (152), a user ID (154) of the user granting the caching authorization (152), and a database ID (156) of the further database (120) to which the caching authorization (152) is granted, wherein the authorization (152) is limited to caching the data record (110), wherein the proof of caching authorization (132) is signed by the database (100) with a signature key of the database (100), which is a private cryptographic key of an asymmetric key pair of the database (100), wherein the signature of the proof of caching authorization (132) is verifiable using a signature verification key of the database (100), which is a public cryptographic key of the asymmetric key pair of the database (100), • providing the proof of caching authorization (132) to the further database (120), wherein the database management system (104) is further configured, subject to a presence of a valid proof of caching authorization (132) of the further database (120) to cache an image (112) of the data record (110), to provide the image (112) of the data record (110) to the further database (120), wherein the providing comprises: • creating the image (112) of the data record (110) for the caching in the further database (120), wherein the created image (112) of the data record (110) is signed by the database (100), wherein the image (112) of the data record (110) is further assigned metadata which is signed together with the image (112) of the data record (110) by the database (100), wherein the metadata comprises an authorization structure of the image (112), • sending the created image (112) to the further database (120) for caching.

11. A distributed database system (101) comprising a database (100) according to claim 10 and a further database (120) according to claim 10 with a further memory (128) and a database management system (124) which manages data records (130) and images (112) of data records (110) stored in the further memory (128).