Secure ingress and egress for data engines

Abstract

The disclosure includes receiving a query at a data engine. The data engine includes data stored in a secured database in a secured format and a copy of the data stored in a secured database replica in a clear text format. The query is received from a requestor. The query is processed at the secured database replica to generate a query response in a clear text format. The query response is converted to a secured format. The converted query response is provided to the requestor in a secured format.

Description

[Technical Field]

[0001] The present invention relates generally to computer processing, and more particularly to secure ingress and egress for data engines. [Background technology]

[0002] Enterprise environments often include a combination of public cloud, private cloud, and on-premises / privately managed information technology (IT) environments. When moving data to a destination environment that has a different data representation than the source environment(s), extraction, transformation, and loading (ETL) techniques can be used to move data between the two environments. When ETL techniques are applied, data is transformed before being stored in the source environment. Extraction, loading, and transformation (ELT) techniques can also be used to move data between environments. In this case, raw data from the source environment is stored in the target environment and transformed there. While each of the various IT environments typically provides a highly secure micro-pipeline within each environment, data traversal across site boundaries must be carefully managed, inspected, and analyzed to verify the authenticity and reliability of the data. Summary of the Invention

[0003] Embodiments of the present invention relate to secure ingress and egress for a data engine. One non-limiting example of a computer-implemented method includes receiving a query at a data engine. The data engine includes data stored in a secured format in a secured database and a copy of the data stored in a secured database replica in a clear text format. The query is received from a requestor. The query is processed at the secured database replica to generate a query response in a clear text format. The query response is converted to a secured format. The converted query response is provided to the requestor in a secured format.

[0004] Other embodiments of the present invention embody features of the above methods in a computer system and / or computer program product.

[0005] Additional technical features and advantages are realized by the techniques of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered a part of the claimed subject matter. For a fuller understanding, please refer to the detailed description and drawings.

[0006] The particulars of the exclusive rights set forth herein are particularly pointed out and distinctly claimed in the appended claims. These and other features and advantages of embodiments of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 illustrates a block diagram of a system for secure ingress and egress for a data engine in accordance with one or more embodiments of the present invention. [Figure 2] 1 illustrates a flow diagram of a method for providing secure ingress in a data engine in accordance with one or more embodiments of the present invention. [Figure 3]1 illustrates a flow diagram of a method for providing secure egress in a data engine in accordance with one or more embodiments of the present invention. [Figure 4] 1 illustrates a cloud computing environment in accordance with one or more embodiments of the present invention. [Figure 5] 1 illustrates an abstraction model layer in accordance with one or more embodiments of the present invention. [Figure 6] 1 illustrates a system for secure ingress and egress for a data engine in accordance with one or more embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0008] The accompanying drawings are for illustrative purposes. Many variations of the drawings, or of the operations depicted in the drawings, may exist without departing from the scope of the present invention. For example, operations may be performed in a different order, or operations may be added, deleted, or modified. Also, the term "coupled" and variations thereof refer to having a communication path between two elements, and do not imply a direct connection between the two elements with no intervening elements / connections between them. All of these variations are considered part of this specification.

[0009] One or more embodiments of the present invention provide secure ingress and egress for data engines. In data engines, protected views of data are often required to provide security and privacy for the data. Data queries are typically optimized based on data values ​​stored in cleartext (or unprotected) form. Running optimized queries against data stored in a protected form may prevent those queries from taking advantage of their respective optimizations. One or more embodiments of the present invention provide an efficient mechanism for accelerating queries against views of data protected by a particular data engine's protections.

[0010] As used herein, the term "data engine" refers to a data infrastructure that may include data stored in a protected format, a replica of that data stored in a clear format, and a data security system for providing security for the data and for converting data back and forth between the clear format and the protected format. According to one or more embodiments of the present invention, the data engine is implemented by a database management system (DBMS), such as, but not limited to, IBM® Db2®. Embodiments of the data engine are not limited to database infrastructures, but may also include file infrastructures, such as those used by Linux®. According to one or more embodiments of the present invention, data may be stored in a manner known in the art, such as, but not limited to, database formats (e.g., Db2®) and file formats (e.g., Linux® data sources).

[0011] One or more embodiments of the present invention can be used to integrate and de-integrate a secured gateway into data engines, including database accelerator infrastructures such as, but not limited to, the IBM Db2 Analytics Accelerator (IDAA). When IDAA is used to provide a replica of data organized to optimize certain types of queries, one or more embodiments of the present invention prevent selectable column / field-level tablespace data from being exposed in clear outside of IDAA and proprietary applications, including within Db2. The replica can also be another system, such as a secured database system designed for read-only queries (e.g., IBM HyperProtect DBaaS).

[0012] According to one or more embodiments of the present invention, direct connections to Db2 (a registered trademark of IBM Corporation) (or any other database or file system) never expose sensitive data in clear text; structured query language (SQL) queries or statements with access permissions to sensitive data can still be processed efficiently according to their respective SQL semantics via a gateway within the secure IDAA appliance. Data is in clear text only within the secured appliance and delivered directly back to the requesting application. According to one or more embodiments of the present invention, when IDAA is used, data key exchange between the gateway within the client application and the gateway on the secure IDAA input and output can be processed using existing methods, such as, but not limited to, indexed queries, searches, and sorting.

[0013] One or more embodiments of the present invention differ from existing approaches in which data in a secured database replica is in plaintext format and accessible to queries and applications outside the data engine, thereby exposing the data to security breaches. In other models, the data remains encrypted in the database engine, preventing functional use of queries.

[0014] One or more embodiments of the present invention address one or more shortcomings of conventional approaches by enabling queries against protected data in a DBMS over unprotected fields. Additionally, one or more embodiments of the present invention enable optimized queries over all fields in tables in a secure appliance, regardless of whether they are protected or not. This can occur at the file level, rather than the DBMS, when data files, such as Linux® data sources, are used. As used herein, the term "optimized query" refers to a query that is tuned to run as quickly as possible. This tuning can be achieved, for example, by setting up and utilizing specific indexes on the data, organizing the data in a particular way, and / or arranging the query statement in a particular way. Optimized queries can also be further tuned to conserve resource usage or to provide an agreed-upon quality of service (QOS) level.

[0015] Referring now to Figure 1, a block diagram 100 of a system for secure ingress and egress for a data engine is generally shown in accordance with one or more embodiments of the present invention. The components shown in Figure 1 include a secured database 102, a secured database replica 104, and a data security system 106. The processes described with reference to Figure 1 may be performed by computer instructions executed on a processor 605 located on computer 601 of Figure 6, or on a processor located on cloud computing node 10 of Figure 4, or both.

[0016] In one or more embodiments of the invention, database 102, secured database replica 104, and data security system 106 together perform the functions of the data engine and are collectively referred to as the data engine. Other data engines in one or more other embodiments may have a different configuration than the data engine shown in Figure 1. For example, all or some of the functions performed by data security system 106 shown in Figure 1 may be performed by database 102. In addition, other components may be included in one or more embodiments of the data engine.

[0017] According to one or more embodiments of the present invention, database 102 contains computer instructions for performing database management functions (e.g., controlling access to data, processing queries, organizing data) as well as data (e.g., database table(s), files). As shown in FIG. 1, secured database 102 contains data in a secured format. Secured database replica 104 contains a copy of the data in the secured database in an unsecured format, or after conversion to plain text. Secured database replica 104 may include its own database management functionality or may be controlled by a database management system used by database 102. Data security system 106 may be a standalone module as shown in FIG. 1 or may be integrated into the database management functionality.

[0018] As shown in FIG. 1 , data input from a client application is protected while the data resides within the data engine. For example, clear data 110 is received from a client application and input to the data security system 106. In other embodiments, the clear data 110 is received from a process such as, but not limited to, an extract, transform, and load (ETL) process or an extract, transform, and load (ELT) process. The data security system 106 secures the data 110 by converting the clear data 110 into protected data 108 for insertion into the database 102, for example, via a DBMS insert command 112. The data security system 106 may convert the clear data 110 to protected data using any method known in the art, such as, but not limited to, Advanced Encryption Standard (AES) encryption, Db2 (a registered trademark of IBM Corporation) native encryption, and Transparent Data Encryption (TDE). According to one or more embodiments of the present invention, data in database 102 is stored in a protected format. Access to a key or other mechanism is required to convert the data into clear, or unencrypted, format. Data security system 106 may apply multiple different security algorithms and / or keys to different users and / or different data fields, allowing different users to have different data access and security rules.

[0019] As also shown in FIG. 1 , protected data is replicated from database 102 to secured database replica 104. In this case, the consumer end of secured database replica 104 has the ability to securely transmit the required key portions using the same field protocol as the application providing plaintext data 110. According to one or more embodiments of the present invention, the data security system can be divided into multiple distinct parts, and key material can be moved between these parts, allowing, for example, a key created in one instance to be moved to another instance. In this manner, an object created in one instance can be moved to another instance. As shown in FIG. 1 , secured data in database 102 is converted to replicated plaintext data 114 by data security system 106 before being stored in secured database replica 104. Thus, on the replication path from database 102 to secured database replica 104, the data returns to data security system 106, where it is opened and returned as replicated plaintext data 114. This allows the data to be copied in plaintext format to secured database replica 104.

[0020] According to one or more embodiments of the present invention, the secured database replica 104 is a secure appliance. As used herein, the term "secure appliance" refers to an acceleration device such as IBM® Db2® IDAA or a secure database service such as IBM® HyperProtect® DBaaS.

[0021] According to one or more embodiments of the present invention, queries 118 to secured database replica 104 use cleartext data. However, before the data is returned to user 116, it is processed by data security system 106 to generate secured query responses 120. In this way, all output from secured database replica 104 is subjected to the same processing as the client application to provide secured data using the same negotiated key portions as the other steps. Thus, when creating secured data for insertion, the client application may use, for example, AES256 encryption and package the data in a specific format. According to one or more embodiments of the present invention, the data returned from secured query responses 120 has the same format as the data created by the client. This provides compatibility between what the client application inserts and the data returned.

[0022] As shown in the embodiment of FIG. 1 , a user 116 submits a query 118 to a secured database replica 104. The user 116 may be an individual user submitting a query through a user interface, or a computer program submitting queries in batch or online format. The secured database replica 104 processes the query and generates a cleartext query response 122. The cleartext query response 122 is sent to the data security system 106 to generate a secure, or protected, query response 120. The protected query response 120 is sent back to the secured database replica 104. The protected query response 120 is output to the user 116 in a secured format. If the user 116 is authorized, the user 116 can convert the protected query response 120 to a cleartext format. For example, the user 116 may be authorized if they have a copy of the key used by the data security system 106 to generate the protected query response 120.

[0023] Each embodiment described herein may be implemented with any suitable logic, with reference to block diagram 100 of Figure 1. This logic, as referred to herein, may, in various embodiments, include any suitable hardware (e.g., a processor, embedded controller, or application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware.

[0024] Referring now to Figure 2, a flow diagram of a method 200 for providing secure ingress in a data engine is generally shown, in accordance with one or more embodiments of the present invention. All or part of the processing shown in Figure 2 may be performed, for example, by database 102, and / or by secured database replica 104, and / or by data security system 106 executing on processor 605 located on computer 601 of Figure 6, and / or on a processor located on cloud computing node 10 of Figure 4.

[0025] At block 202, input data, such as clear data 110 of FIG. 1, is received at a data engine for insertion into a secured database or data file, such as database 102 of FIG. 1. This input data can be received from any data source known in the art, such as, but not limited to, a client (or user) application, an ETL process, or an ELT process. At block 204, the input data is converted to a secured format by a data security module, such as data security system 106 of FIG. 1, to generate secured data, such as secured data 108 of FIG. 1. As noted above, any type of data security scheme known in the art can be utilized to convert data from a clear (e.g., unencrypted) format to a secured (e.g., encrypted) format.

[0026] In block 206 of the embodiment shown in FIG. 2, the data in its protected form is stored in a secured database or data file, such as database 102 of FIG. 1. In block 208, the protected data is replicated in clear text form to a secured database replica, such as secured database replica 104 of FIG. 1. In accordance with one or more embodiments of the present invention, the protected data is replicated by a data security module that converts the protected data to clear text form before being copied or stored in the secured database replica. Using the same data security module to store the protected data in the secured database and also to store the clear text data in the secured database replica allows one or more embodiments of the present invention to support different security schemes for different applications or users.

[0027] In accordance with one or more embodiments of the present invention, data inserted into a secured database or data file Only some data fields is converted into protected data. For example, if the secured database is realized by a relational database, Only some columns is converted to a protected format , some The column data remains in plain text format within the secured database. profit do.

[0028] 2 is not intended to imply that the operations of method 200 should be performed in any particular order, or that all operations of method 200 should be included in any event. In addition, method 200 may include any suitable number of additional operations.

[0029] Referring now to Figure 3, a flow diagram of a method 300 for providing secure egress in a data engine is generally shown, in accordance with one or more embodiments of the present invention. All or a portion of the processing shown in Figure 3 may be performed by secured database replica 104, or data security system 106, or both, executing, for example, on processor 605 located on computer 601 of Figure 6, or on a processor located on cloud computing node 10 of Figure 4, or both.

[0030] At block 302, a query, such as query 118 of Figure 1, is received at a secured database replica of a data engine, such as secured database replica 104 of Figure 1. According to one or more embodiments of the present invention, the query is received in clear text form from a user, such as user 116 of Figure 1. According to one or more embodiments of the present invention, the secured database replica may be configured to optimize certain types of queries, including the query received at block 302. At block 304, the query is executed or processed in clear text form to generate a query response in clear text form, such as clear text query response 122 of Figure 1.

[0031] At block 306, the query response in clear text form is converted to a secured form by a data security module, such as data security system 106 of Figure 1. According to one or more embodiments of the present invention, the conversion of the query result, or response, to a secured form is performed by applying the same process and / or security key(s) used to convert the clear text data before insertion into the secured database. At block 308, the converted query response with the data in secured form is returned to the query originator.

[0032] According to one or more embodiments of the present invention, processing the received query further includes determining whether the received query should be executed against a secure database having data in a secured format, such as database 102 of FIG. 1, or against a secured database replica having data in a cleartext format, such as secured database replica 104 of FIG. 1. This determination may be based, for example, on whether the received query is a type of query for which the secured database replica is tuned. This determination may alternatively or additionally be based on environmental factors, such as the current usage of the two databases, QOS targets, and / or reliability, availability, and serviceability (RAS) requirements associated with the query. If it is determined that the query should be executed against the secured database replica, the processing at blocks 304 and 306 is performed. Alternatively, if it is determined that the query should be executed against the secured database, the query is converted to a secured format and executed against the secured database.

[0033] 3 is not intended to imply that the operations of method 300 should be performed in any particular order or that all operations of method 300 should be included in any event. In addition, method 300 may include any suitable number of additional operations.

[0034] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the present invention may be implemented in conjunction with any other type of computing environment now known or later developed.

[0035] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the provider of those services. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0036] The characteristics are as follows:

[0037] On-demand self-service: Cloud consumers can unilaterally provision computing capabilities, such as server time and network storage, as needed, without the need for human interaction with the provider of the service.

[0038] Broad network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs).

[0039] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model in which allocation and reallocation of multiple different physical and virtual resources is dynamic on demand. Consumers typically have no control or knowledge over the exact location of the resources provided, but a sense of location independence exists because they may be able to specify location at a relatively high level of abstraction (e.g., country, state, or data center).

[0040] Rapid Elasticity: Capabilities can be rapidly and elastically provisioned, sometimes automatically, for rapid scale out, and rapidly released for rapid scale in. To the consumer, the capabilities available for provisioning often appear unlimited, allowing any quantity to be purchased at any time.

[0041] Measured service: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0042] The service model is as follows:

[0043] Software as a Service (SaaS): The consumer is granted the right to use the provider's applications running on a cloud infrastructure. These applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, i.e., the network, servers, operating systems, storage, or individual application functions, with the possible exception of limited user-specific application configuration settings.

[0044] Platform as a Service (PaaS): The consumer is granted the right to deploy consumer-created or consumer-acquired applications written using provider-supported programming languages ​​and tools onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, i.e., networks, servers, operating systems, or storage, but does control the deployed applications and, in some cases, the configuration of the application hosting environment.

[0045] Infrastructure as a Service (IaaS): The consumer is provided with the provisioning of processing, storage, network, and other basic computing resources. The consumer can deploy and run any software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0046] The deployment model is as follows:

[0047] Private Cloud: The cloud infrastructure is operated solely for one organization. The cloud may be managed by that organization or a third party. It may exist on- or off-premises.

[0048] Community Cloud: This cloud infrastructure is shared by several organizations to support a specific community with shared interests (e.g., mission, security requirements, policies, and compliance considerations). The cloud may be managed by the organizations or a third party. It may exist on or off premises.

[0049] Public Cloud: This cloud infrastructure is available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0050] Hybrid Cloud: This cloud infrastructure is a configuration of two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies that allow data and application portability (e.g., cloud bursting for load balancing between clouds).

[0051] Cloud computing environments are service-oriented and emphasize statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0052] Referring now to FIG. 4, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10. Local computing devices used by cloud consumers, such as a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automotive computer system 54N, may communicate with the nodes 10. Multiple nodes 10 may communicate with each other. These nodes 10 may be physically or virtually grouped into one or more networks, such as private, community, public, or hybrid clouds, as described above, or a combination thereof (not shown). This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service, eliminating the need for cloud consumers to maintain resources on their local computing devices. It should be understood that the types of computing devices 54A-N shown in FIG. 4 are for illustrative purposes only, and that computing node 10 and cloud computing environment 50 can communicate with any type of computer device over any type of network, or network-addressable connection (e.g., using a web browser), or both.

[0053] Referring now to Figure 5, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 4) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 5 are for illustrative purposes only and are not intended to limit the scope of the present invention. As shown, the following layers and corresponding functions are provided:

[0054] Hardware and software layer 60 includes multiple hardware and software components. Examples of hardware components include mainframe 61, reduced instruction set computer (RISC) architecture-based server 62, server 63, blade server 64, storage device 65, and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0055] The virtualization layer 70 provides a layer of abstraction from which examples of virtual entities that may be provided include virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0056] In one example, the management layer 80 may provide the following functions: Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides allocation and management of cloud computing resources to ensure desired service levels are achieved. Service level agreement (SLA) planning and fulfillment 85 provides advance arrangement and procurement of cloud computing resources in anticipation of future requirements according to SLAs.

[0057] The workload layer 90 provides examples of target functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and data encryption / decryption 96.

[0058] It should be appreciated that one or more embodiments of the present invention may be implemented in connection with any type of computing environment now known or later developed.

[0059] Referring now to Figure 6, a computer system for secure ingress and egress for a data engine is generally illustrated, in accordance with one or more embodiments of the present invention. The methods described herein may be implemented in hardware, software (e.g., firmware), or a combination thereof. In one or more exemplary embodiments of the present invention, the methods described herein may be implemented in hardware as part of a microprocessor of a special-purpose or general-purpose digital computer, such as a personal computer, workstation, minicomputer, or mainframe computer. Thus, system 600 may include a general-purpose computer or mainframe 601 capable of simultaneously running multiple instances of an operating system (O / S).

[0060] In one or more exemplary embodiments of the invention, as shown in FIG. 6 , a computer 601, with respect to its hardware architecture, includes one or more processors 605, memory 610 coupled to a memory controller 615, and one or more input and / or output (I / O) devices 640, 645 (or peripherals) communicatively coupled via a local input / output controller 635. The input / output controller 635 can be, for example, but not limited to, one or more buses or other wired or wireless connections, as known in the art. The input / output controller 635 may include additional elements, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communication. These elements are omitted for simplicity. Additionally, the local interface may include address, control, and / or data connections to enable appropriate communication between the above components. The input / output controller 635 may include multiple sub-channels configured for access to the output devices 640 and 645. These sub-channels may include fiber optic communication ports.

[0061] Processor 605 is a hardware device for executing software stored in storage 620, particularly cache storage, or memory 610. Processor 605 can be any processor, whether custom or commercially available, a central processing unit (CPU), a coprocessor among several processors associated with computer 601, a semiconductor-based microprocessor (in the form of a microchip or chipset), a microprocessor, or any device for executing instructions in general.

[0062] The memory 610 may include one or a combination of volatile memory elements (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, etc.)) and non-volatile memory elements (e.g., ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), tape, compact disc read-only memory (CD-ROM), disk, diskette, cartridge, cassette, or the like). Furthermore, the memory 610 may incorporate electrical, magnetic, optical, and / or other types of storage media. Additionally, the memory 610 may have a distributed architecture, in which various components are located remotely from one another but are accessible by the processor 605.

[0063] The instructions in memory 610 may include one or more individual programs, each of which includes an ordered list of executable instructions for implementing a logical function. In the example of Figure 6, the instructions in memory 610 are executed by a suitable operating system (OS) 611. The operating system 611 essentially controls the execution of other computer programs and provides scheduling, input / output control, file and data management, memory management, and communication control, and related services.

[0064] According to one or more embodiments of the present invention, memory 610 may include multiple logical partitions (LPARs), each running an instance of an operating system. The LPARs may be managed by a hypervisor, which may be a program stored in memory 610 and executed by processor 605.

[0065] In one or more exemplary embodiments of the invention, a conventional keyboard 650 and mouse 655 can be coupled to the input / output controller 635. Other output devices, such as I / O devices 640, 645, can include input devices, such as, but not limited to, printers, scanners, microphones, and the like. Finally, I / O devices 640, 645 can further include devices that communicate with both input and output, such as, but not limited to, network interface cards (NICs) or modulators / demodulators (for accessing other files, devices, systems, or networks), radio frequency (RF) or other transceivers, telephone interfaces, bridges, routers, and the like. System 600 can further include a display controller 625 coupled to a display 630.

[0066] In one or more exemplary embodiments of the invention, system 600 may further include a network interface 660 for coupling to a network 665. Network 665 may be an IP-based network for communication between computer 601 and any external servers, clients, and the like via a broadband connection. Network 665 transmits and receives data between computer 601 and external systems. In one exemplary embodiment, network 665 may be an IP network managed by a service provider. Network 665 may be implemented wirelessly, for example, using wireless protocols and technologies such as Wi-Fi®, WiMax®, etc. Network 665 may also be a packet-switched network such as a local area network, wide area network, metropolitan area network, Internet network, or other similar type of network environment. Network 665 may be a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network (VPN), an intranet, or other suitable network system, including facilities for transmitting and receiving signals.

[0067] If computer 601 is a PC, workstation, intelligent device, or the like, the instructions in memory 610 may further include a basic input / output system (BIOS) (omitted for simplicity). The BIOS is a set of basic software routines that initializes and tests hardware at startup, starts the OS 611, and supports data transfer between hardware devices. The BIOS is stored in ROM so that it can be executed when computer 601 starts up.

[0068] When computer 601 is operating, processor 605 is configured to execute instructions stored in memory 610 to transfer data to and from memory 610 and to generally control the operation of computer 601 in accordance with the instructions. According to one or more embodiments of the present invention, computer 601 is an example of cloud computing node 10 of FIG. 4.

[0069] Various embodiments of the present invention are described herein with reference to the associated drawings. Alternative embodiments of the present invention may be devised without departing from the scope of the present invention. In the following description and in the drawings, various connections and relationships (e.g., over, below, adjacent, etc.) between elements are described. These connections and / or relationships may be direct or indirect unless specifically stated otherwise, and the present invention is not intended to be limited in this respect. Accordingly, connections between entities may refer to direct or indirect connections. Also, relationships between entities may refer to direct or indirect relationships. Furthermore, various tasks and process steps described herein may be combined into a more comprehensive procedure or process having additional steps or functions not specifically described herein.

[0070] One or more of the methods described herein may be implemented using any of the following technologies, each of which is known in the art: discrete logic circuit(s) having logic gates for performing logic functions on data signals, application specific integrated circuits (ASICs) having appropriate combinatorial logic gates, programmable gate array(s) (PGAs), field programmable gate arrays (FPGAs), etc., or a combination thereof.

[0071] For the sake of brevity, this specification may not describe in detail conventional techniques for making and using aspects of the present invention. In particular, various aspects of computing systems and specific computer programs for implementing various technical features described herein are well known. Therefore, for the sake of brevity, this specification only briefly mentions or omits entirely many details of conventional implementations, without providing details of well-known systems and / or processes.

[0072] In some embodiments, various functions or acts may occur at a given location, or in connection with the operation of one or more devices or systems, or both. In some embodiments, a portion of a given function or act may be performed at a first device or location, and remaining functions or acts may be performed at one or more additional devices or locations.

[0073] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It should be further understood that the terms "comprises" and / or "comprising," when used herein, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0074] The corresponding structures, materials, acts, and equivalents of all means or steps, as well as functional elements, within the scope of the appended claims are intended to include any structure, material, or acts for performing a function in combination with described elements other than those specifically recited. This disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the disclosed form. Many modifications and variations will be apparent to those skilled in the art that do not depart from the scope of the disclosure. These embodiments have been chosen and described to best explain the principles of the disclosure and its practical application, and to enable others skilled in the art to understand the disclosure for various embodiments with various modifications suitable for the particular uses contemplated.

[0075] The drawings shown herein are exemplary. Many variations of the drawings or the steps (or operations) shown therein may exist without departing from the scope of this disclosure. For example, operations may be performed in a different order. Or operations may be added, deleted, or modified. Also, the term "coupled" states that there is a signal path between two elements and does not imply a direct connection between elements with no intervening elements / connections between them. All of these variations are considered to be part of this disclosure.

[0076] The following definitions and abbreviations shall be used for interpreting the claims and the specification. As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having," "contains," or "containing," or other variations thereof, are intended to cover a non-exclusive inclusion. For example, a composition, mixture, process, method, article, or device comprising a list of elements is not necessarily limited to only those elements and may include other elements not expressly listed or inherent in such composition, mixture, process, method, article, or device.

[0077] Additionally, the word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" should be understood to include any integer number greater than one, i.e., 1, 2, 3, 4, etc. The term "a plurality" should be understood to include any integer number greater than two, i.e., 2, 3, 4, 5, etc. The term "connection" can include both an indirect and a direct connection.

[0078] The terms "about," "substantially," "approximately," and variations thereof are intended to include the degree of error associated with the measurement of a particular quantity based on equipment available at the time of filing. For example, "about" may include a range of ±8%, or 5%, or 2% of a given value.

[0079] The present invention may be implemented as a system, method, and / or computer program product at any possible level of technical detail, and may include one or more computer-readable storage media having computer-readable program instructions stored thereon for causing a processor to implement aspects of the present invention.

[0080] A computer-readable storage medium may be any tangible device capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media may be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, or semiconductor storage devices, or any suitable combination of the foregoing. More specific examples of computer-readable storage media include, but are not limited to, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves on which instructions are recorded, and any suitable combination of the foregoing. Computer-readable storage medium, as used herein, is not to be construed as being signals that are transitory in nature, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cable), or electrical signals transmitted over electrical wires.

[0081] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium into each computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper cables, fiber optics, wireless networks, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions for storage on a computer-readable storage medium within the respective computing / processing device.

[0082] Computer-readable program instructions for carrying out the operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, or the like, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN). Alternatively, the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry, including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry to implement aspects of the present invention.

[0083] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0084] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine that, when executed by the processor of the computer or other programmable data processing apparatus, creates means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0085] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to create a computer-implemented process, such that when those instructions are executed on the computer, other programmable apparatus, or other device, the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams are performed.

[0086] The flowcharts and block diagrams in these figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions described in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently. Or, the blocks may be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or acts or executes a combination of dedicated hardware and computer instructions.

[0087] The description of various embodiments of the present invention has been presented for purposes of illustration and is not intended to be exhaustive or limited to the disclosed forms. Many modifications and variations that do not depart from the scope of the described embodiments will be apparent to those skilled in the art. The terminology used herein has been selected to best explain the principles of the embodiments, applications, or technical improvements over existing technology, or to enable others skilled in the art to understand the embodiments described herein.

Claims

1. 1. A method comprising: receiving a query from a requestor at a data engine, the data engine including data stored in encrypted form in a secured database and a copy of the data stored in unencrypted form in a secured database replica, the secured database replica being tuned to be optimal for processing at least a first type of query; determining whether the query should be processed at the secured database replica or the secured database based on the type of the query; Based on determining that the query should be processed at the secured database replica, processing the query at the secured database replica and generating a query response in the unencrypted form; converting the query response to the encrypted format; providing the transformed query response to the requestor in the encrypted form; A method comprising:

2. The method of claim 1 , wherein the query is characterized as the first type of query.

3. receiving input data in said unencrypted form at said data engine; storing said input data in said encrypted form in said secured database by applying a security key or both, and the same process used to convert said query response into said encrypted form; The method of claim 1 or 2, further comprising:

4. The method further includes a step of replicating the input data, wherein the replicating step includes: converting said input data stored in said secured database into said unencrypted form; storing said input data in said unencrypted form in said secured database replica; The method of claim 3, comprising:

5. 5. The method of claim 3, wherein the input data is received from a client application in unencrypted form.

6. The data engine further comprises a data security system, the data security system comprising: converting the query response to the encrypted format; converting said input data into said encrypted form; converting the input data stored in the secured database into the unencrypted format; The method according to any one of claims 3 to 5, wherein a security scheme is applied to enforce

7. The method of any one of claims 1 to 6, wherein the secured database and the secured database replica are relational databases.

8. 8. The method of claim 7, wherein the contents of only some columns within a row of the secured database are in the encrypted form.

9. A method according to any one of claims 1 to 8, wherein the secured database is tuned to be optimal for processing at least a second type of query, and wherein the step of determining whether the query should be processed by the secured database replica or the secured database is further based on at least one of a quality of service target value and reliability, availability and serviceability (RAS) requirements associated with the query.

10. 1. A system comprising: one or more processors for executing computer readable instructions, said computer readable instructions comprising: receiving a query from a requestor at a data engine, the data engine including data stored in encrypted form in a secured database and a copy of the data stored in unencrypted form in a secured database replica, the secured database replica being tuned to be optimal for processing at least a first type of query; determining whether the query should be processed by the secured database replica or at the secured database based on the type of the query; Based on determining that the query should be processed by the secured database replica, processing the query at the secured database replica and generating a query response in the unencrypted form; converting the query response to the encrypted format; providing the transformed query response to the requestor in the encrypted form; and controlling the one or more processors to perform operations including:

11. The system of claim 10 , wherein the query is characterized as the first type of query.

12. The operation is receiving input data in said unencrypted form at said data engine; converting the input data into said encrypted form by the same process used to convert the query response into said encrypted form and / or by applying a security key; storing said input data in said encrypted form in said secured database; The system of claim 10 or 11, further comprising:

13. The operations further include replicating the input data, the replicating step comprising: converting said input data stored in said secured database into said unencrypted form; storing said input data in said unencrypted form in said secured database replica; The system of claim 12 , comprising:

14. 14. The system of claim 12 or 13, wherein the input data is received from a client application in unencrypted form.

15. The data engine further comprises a data security system, the data security system comprising: converting the query response to the encrypted format; converting said input data into said encrypted form; converting the input data stored in the secured database into the unencrypted format; A system according to any one of claims 12 to 14, which applies a security scheme to:

16. The system of any one of claims 10 to 15, wherein the secured database and the secured database replica are relational databases.

17. 17. The system of claim 16, wherein the contents of only some columns within a row of the secured database are in the encrypted form.

18. The system of claim 10, wherein the secured database is tuned to be optimal for processing at least a second type of query, and wherein the step of determining whether the query should be processed by the secured database replica or the secured database is further based on at least one of a quality of service target value and reliability, availability and serviceability (RAS) requirements associated with the query.

19. On the computer, receiving a query from a requestor at a data engine, the data engine including data stored in encrypted form in a secured database and a copy of said data stored in unencrypted form in a secured database replica, said secured database replica being tuned to optimally process at least a first type of query; determining whether the query should be processed at the secured database replica or the secured database based on the type of the query; Based on determining that the query should be processed at the secured database replica, processing the query at the secured database replica and generating a query response in the unencrypted form; converting the query response to the encrypted format; providing the transformed query response to the requestor in the encrypted form; A computer program for causing a computer to perform operations including:

20. The operation is receiving input data in said unencrypted form at said data engine; converting the input data into said encrypted form by the same process used to convert the query response into said encrypted form and / or by applying a security key; storing said input data in said encrypted form in said secured database; 20. The computer program of claim 19, further comprising:

Images