Encryption processing method for database stored data and database management system

Abstract

To provide a database storage data encryption processing method that brings about an effect as if a View / Trigger method is applied, while an encryption / decryption function does not put any load on a database management system (DBMS) at all, using an API.SOLUTION: According to a database storage data encryption processing method, a hooking module is caused to implement in a step S210, when receiving an encrypted column inquiry request through an application in a step S200, then, the implemented hooking module inquiries about encrypted data from a database of a DBMS, captures encrypted table column information from the DB in a step S220, perses SQL a user performs through the application in a step S230, as a result of the parsing, checks whether an encryption object of nearby table columns is present in a step S240, and decrypts the inquired encrypted data to transmit the decrypted data to the application in a step S250.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The embodiments relate to the encryption technology of database stored data.

Background Art

[0002] The methods of applying DB encryption are roughly classified into an "API method" and a "plug-in method". The API is an encryption / decryption function provided according to each development language such as C, JAVA (registered trademark), etc., and is mainly used by developers.

[0003] The plug-in is provided in the form of SQL functions and is a method that can be easily used by developers and general DB users.

[0004] Generally, both methods are introduced and used, and this is called a hybrid method.

[0005] Both the API and plug-in methods commonly require the user to directly create and process encryption / decryption functions in the part where data is input and output. Such work corresponds to the most significant inconvenience that users will experience after introducing DB encryption products.

[0006] In particular, developers have to search for all the codes related to the encrypted DB columns in the existing and stably operating source code and apply encryption / decryption functions, which can be a significant burden for them.

[0007] For these reasons, the "View / Trigger" method, which can access data in the same way as before without modifying the source code and without additional work in the query tool (Query tool), is preferred. This is a method in which the encrypted data is automatically decrypted through the view (View) generated in the DB during data query, and conversely, it is automatically encrypted by the trigger (Trigger) during data input.

[0008] However, while the "View / Trigger" method operates on a plugin basis, the "Plug-in" method uses the CPU and memory of the server where the DBMS is running, which has the disadvantage that all the load related to encryption / decryption in the entire network system will be concentrated on the DB server.

[0009] Furthermore, data decrypted using the "plug-in" method travels across the network already decrypted via the DBMS, creating a security vulnerability where decrypted data is immediately exposed when network packets are intercepted using methods such as packet sniffing.

[0010] Because data is automatically decrypted and made visible via a view in any environment that can access the DBMS, security issues arise. For this reason, DB encryption products themselves sometimes provide minimal access control functions, but such methods have inherent limitations in achieving complete access control, and this function also generates additional I / O in the DBMS, resulting in a performance burden.

[0011] Furthermore, a limitation of the "View / Trigger" approach is that, in order to use it smoothly, it must involve tuning existing SQL code. [Prior art documents] [Patent Documents]

[0012] [Patent Document 1] Republic of Korea Patent Publication No. 10-2023-0123715 [Patent Document 2] Registered Patent Gazette No. 10-1476039 of the Republic of Korea [Overview of the project] [Problems that the invention aims to solve]

[0013] This invention stems from the aforementioned technical background and aims to provide a database encryption / decryption method that uses an API to apply encryption / decryption functions without placing any load on the DBMS, while achieving an effect similar to that of applying a "view / trigger" method. [Means for solving the problem]

[0014] The present invention, which aims to achieve the aforementioned objectives, includes the following configuration.

[0015] In other words, the method for encrypting database data according to one embodiment of the present invention is a method performed on a computing device equipped with one or more processors and memory for storing one or more programs executed by the one or more processors, and includes the steps of: when an encrypted column query request is received through an application, executing a hooking module; the executed hooking module querying encrypted data from a database of a database management system DBMS; and decrypting the queried encrypted data and transmitting it to the application.

[0016] On the other hand, a database management system according to one embodiment is a system including a computer device having one or more processors and memory for storing one or more programs executed by the one or more processors, and includes a DB server that performs database management and an application server that includes a hooking module that, when an encrypted column query request is received from the database of the DB server through the application, queries the encrypted data through a DB client module, decrypts the queried encrypted data and transmits it to the application. [Effects of the Invention]

[0017] According to the present invention, by intervening in the SQL transmission and data reception processes from the DB client to the DB server and performing automatic encryption and decryption, it is possible to decrypt the automatically encrypted data without modifying the application source, or conversely, to input it into the DB in an encrypted state.

[0018] In addition, since encryption and decryption are performed at the DB client side, it is transmitted in an encrypted state over the network, which is advantageous for security, and there is an effect that no load is generated on the DBMS due to data encryption and decryption.

[0019] Further, according to the method for encrypting database stored data according to an embodiment, it is possible to derive an effect that not only maintains security, provides maximum convenience to users, but also additionally provides an advantage of performance improvement for the database server.

Brief Description of the Drawings

[0020] [Figure 1] It is a flowchart illustrating a method for encrypting database stored data according to an embodiment of the present invention. [Figure 2] It is an exemplary diagram for explaining the process of querying the encrypted column TEL in the method for encrypting database stored data according to an embodiment. [Figure 3] It is an exemplary diagram for explaining the process of querying the encrypted column TEL in the method for encrypting database stored data according to an embodiment. [Figure 4] It is an exemplary diagram for explaining the process of data input or modification in the method for encrypting database stored data according to an embodiment. [Figure 5] It is an exemplary diagram for explaining the process of data input or modification in the method for encrypting database stored data according to an embodiment. [Figure 6] It is a block diagram for explaining the configuration of a database management system according to an embodiment. [Figure 7]A block diagram for exemplarily explaining a computing environment including a computing device adapted to be used in an exemplary embodiment.

Best Mode for Carrying Out the Invention

[0021] The technical terms used in the present invention are merely used for explaining specific embodiments and are not intended to limit the present invention. Also, unless otherwise specifically defined in the present invention, the technical terms used in the present invention have the meanings generally understood by those with ordinary knowledge in the technical field to which the present invention pertains, and are not interpreted in an overly comprehensive meaning or an overly narrow meaning.

[0022] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0023] The database management system according to an embodiment of the present invention can be implemented by at least one computer device, and the method for encrypting database stored data according to an embodiment of the present invention can be performed through at least one computer device included in the database management system. At this time, a computer program according to an embodiment of the present invention can be installed and driven in the computer device, and the computer device can perform the method for encrypting database stored data according to an embodiment of the present invention under the control of the driven computer program. The aforementioned computer program can be stored in a computer-readable recording medium in combination with the computer device to cause the computer to execute the method for encrypting database stored data.

[0024] FIG. 1 is a flowchart illustrating a method for encrypting database stored data according to an embodiment of the present invention.

[0025] The method for encrypting database stored data according to an embodiment can produce an effect as if applying a "View / Trigger" method, although the encryption / decryption function uses an API.

[0026] In other words, users do not perform any source code modifications, and users who create SQL using a query tool use the same SQL as before without any additional work. As a result, input data is automatically encrypted and stored, and output data is automatically decrypted.

[0027] In particular, since this is performed on the application side rather than the DBMS, it places no load on the DBMS at all, and it is secure because the data remains encrypted even when it is moved over the network.

[0028] To handle this, we perform a hooking operation on the existing DB Client module that transmits the SQL generated by the application to the DBMS.

[0029] In one embodiment of the database data management method, when an encrypted column query request is received through the application (S200), the hooking module is executed (S210).

[0030] Then, the executed hooking module queries the database of the database management system (DBMS) for encrypted data.

[0031] In one aspect, encrypted table-column information is obtained from the database to query encrypted data (S220), and the SQL executed by the user through the application is parsed (S230).

[0032] Next, the SQL executed by the user is parsed. SQL parsing can be performed by an SQL parser built into the database management system (DBMS). The SQL parser can parse SQL statements by analyzing them and generating a syntax tree or execution plan. The SQL parser interprets SQL statements using a set of rules and converts them into a format that the database engine can understand.

[0033] In one embodiment, the SQL parser divides the SQL statement into smaller units, splitting them into meaningful tokens. It then converts the tokenized SQL statement into a tree structure according to syntactic rules, analyzes the statement tree to confirm the meaning of objects such as tables, columns, and functions. Finally, it checks for consistency with the database schema to confirm the validity of the query.

[0034] Then, the parsing results are used to check whether there are any tables or columns to be encrypted among the adjacent tables (S240).

[0035] At this point, checking whether there is data to be encrypted can be done based on pre-configured security requirements.

[0036] For example, sensitive information can be identified through data classification and monitoring. That is, by knowing which tables and columns contain sensitive data, security events can be detected by monitoring access to and changes to such data.

[0037] Furthermore, by defining security policies in advance, policy-based security can be used to determine access permissions for specific tables or columns, or to determine whether encryption is necessary.

[0038] You can either use user-defined functions (UDFs) to determine whether encryption is necessary to inspect the data before executing specific queries or data manipulation operations, or you can perform static analysis of the SQL statement to understand the characteristics of the query and determine whether the tables and columns used in the query handle sensitive data, thereby determining whether encryption is necessary.

[0039] Furthermore, the system may be implemented to dynamically analyze SQL queries during execution time to identify queries that access specific data, and to take additional protective measures for that data through encryption.

[0040] Subsequently, the requested encrypted data is decrypted and transmitted to the application (S250).

[0041] At this stage, the transmission process depends on the type of SQL statement used during the query phase. If the SQL statement is a SELECT statement and the target column is being queried, the user's data is decoded and the SQL result value is transmitted to the application.

[0042] Then, at the query stage, depending on the type of SQL statement, if the SQL statement is input data or comparison data for a statement other than a SELECT statement, the user's data is encrypted, the SQL is modified, and then transmitted to the database management system.

[0043] In an additional aspect of the present invention, when the executed hooking module inputs or modifies data into the database of the database management system DBMS (S260), the hooking module is executed (S215).

[0044] Then, the executed hooking module queries the database of the database management system (DBMS) for encrypted data.

[0045] In one aspect, encrypted table-column information is obtained from the database to query encrypted data (S225), and the SQL executed by the user through the application is parsed (S235).

[0046] Then, the parsing results are used to check whether there are any tables or columns to be encrypted among the adjacent tables (S245).

[0047] At this point, checking whether there is data to be encrypted can be done based on pre-configured security requirements.

[0048] Then, the system performs automatic encryption of the input or modified data (S270).

[0049] At this stage, the encryption process involves selecting an encryption key and encryption algorithm according to a predefined policy, deciding whether or not to perform partial encryption, and then carrying out the encryption.

[0050] In other words, the encryption processing method for database-stored data according to one embodiment can select an encryption key to be applied in the encryption and decryption process for data stored in the database according to a predefined policy.

[0051] At this time, different criteria may be applied to select the encryption key, depending on security, efficiency, and the specific case.

[0052] In other words, encryption keys can be selected based on the importance of the data to be stored and security policies. For example, one can choose one of the following: a Data Encryption Key (DEK) which plays a crucial role in protecting sensitive data within the database; a Master Key which protects symmetric keys and manages the numerous symmetric keys used in the database; or one of the following: a Public Key, a Private Key, a Hash Key, a key used in a Key Management Service, or a key used for tokenization. However, these are not the only options.

[0053] Alternatively, encryption algorithms may be selected according to predefined policies.

[0054] For example, one could choose from advanced encryption standards such as AES, the RSA algorithm primarily used for key exchange and digital signatures, elliptic curve cryptography (ECC), which is advantageous when used on mobile devices and in resource-constrained environments, or blockchain-based encryption algorithms for decentralized databases and blockchain-based applications. In other words, it can be implemented to select the optimal algorithm from a variety of algorithms based on predefined policies and monitored data retention conditions. However, it is not limited to this.

[0055] Furthermore, the settings for whether or not to perform partial encryption may be implemented differently. For example, it may be implemented to selectively encrypt fields containing sensitive information such as credit card numbers or social security numbers, by configuring the system to encrypt only the data stored in specific fields or columns.

[0056] Alternatively, depending on the importance of the data, critical data may be fully encrypted, while relatively less important data may not be encrypted or only partially encrypted, or an option may be provided to allow users or applications to choose whether or not to apply encryption, thereby encrypting only the sensitive information selected as needed.

[0057] According to one embodiment of the encryption processing method for database stored data, the DB client intervenes in the SQL transmission and data reception process to the DB server and automatically performs encryption and decryption. Therefore, the user can automatically decrypt or input encrypted data into the database (DB) without modifying the source code.

[0058] Furthermore, since this entire process takes place at the DB client end, the data is transmitted encrypted when crossing the network, which is advantageous for security. Moreover, it places no burden on the DBMS due to encryption and decryption.

[0059] In other words, the encryption method for database data according to one embodiment does not require modification of the application source code. Furthermore, query tools such as SQL*Plus, Toad, and Orange can automatically decrypt encrypted data for querying or automatically encrypt user-entered data without using plugin functions.

[0060] Because it doesn't use views or triggers, no additional work is required on the database, and data security can be maintained without the burden on the database from encryption and decryption.

[0061] Furthermore, since data is encrypted and transmitted during communication between the DB server and the application, it has the advantage of being secure even over the network.

[0062] In an additional aspect, the base data encryption processing method according to one embodiment may further perform verification to determine whether the columns requiring encryption among the data transmitted by the application from the DB server are actually encrypted.

[0063] Figures 2 and 3 are illustrative diagrams illustrating the TEL query processing process for encrypted columns using a database data encryption method according to one embodiment.

[0064] Generally, when querying an encrypted column TEL, the application will obtain the data through the process illustrated in Figure 2. Figure 2 shows the SELECT process in a typical scenario.

[0065] In Figure 2, the DB Client module dbclient.dll, which is used when the application executes SQL, is changed to client_org.dll, and then the DLL file created for hooking is renamed back to its original name, client.dll.

[0066] Consequently, when an application executes SQL, the hooking module client.dll is loaded instead of the original module, and this module internally calls the original module client_org.dll, allowing the basic functions of the DB Client to be performed as is.

[0067] Referring to Figure 3, a closer look at the SELECT statement processing process, or automatic decryption process, through the hooking module reveals that encrypted data queried from the DB by the hooking module is automatically decrypted and transmitted to the application.

[0068] Specifically, the DB client module (client_org.dll) retrieves table-column information that has been encrypted in the database.

[0069] Then, the SQL executed by the user is parsed, and the parsed result is checked to see if there are any tables or columns to be encrypted in the vicinity.

[0070] Then, if an approach to the encrypted data is detected, the appropriate action is performed depending on the type of SQL statement.

[0071] For example, in the case of a column being queried in a SELECT statement, the user data is decrypted and returned to the application as the SQL result value.

[0072] Furthermore, if the data is input data for other statements (INSERT, UPDATE, DELETE) or comparison data in a WHERE clause, the user's data is encrypted, the SQL is modified, and then transmitted to the DBMS.

[0073] Figures 4 and 5 are illustrative diagrams illustrating the data input or modification process in a database data encryption method according to one embodiment.

[0074] In other words, when new data is entered into the DBMS (INSERT) or data stored in the DBMS is modified (UPDATE), encryption can be automatically performed and transmitted to the DB Server for storage.

[0075] Generally, security and user convenience are often conflicting characteristics, and one must be sacrificed for the other. However, according to one embodiment of the encryption processing method for database stored data, it is possible to maintain security, provide maximum convenience to the user, and additionally provide the benefit of improved performance for the database server.

[0076] Figure 6 is a block diagram illustrating the configuration of a database management system according to one embodiment.

[0077] One embodiment of the database management system includes a DB server 120 and an application server 110.

[0078] DB Server 120 performs database management. DB Server 120 runs the database management system (DBMS) and handles various tasks related to the database. DB Server 120 can operate the database system by performing tasks such as database creation, management, updates, and query processing.

[0079] In one embodiment, the DB server 120 runs a specific DBMS and performs all management tasks for the database through it. The DBMS may be, but is not limited to, MySQL®, PostgreSQL, Microsoft SQL Server, or Oracle Database.

[0080] The DB server 120 then generates or modifies database objects such as tables, indexes, views, and storage procedures to create a new database, manages the structure of existing databases, processes data requests from applications or client applications and other systems driven by the application server 110, executes queries, and returns results.

[0081] It allows for data retrieval, insertion, updating, and deletion; manages access permissions to the database; applies security policies to protect sensitive information; and maintains database integrity and security through user authentication and authorization.

[0082] The application server 110 includes a hooking module 112 that, when it receives an encrypted column query request from the database of the DB server 120 through the application, queries the encrypted data through the DB client module, decrypts the queried encrypted data, and transmits it to the application.

[0083] The application server 110 is a server that executes and manages software application programs. The application server 110 accepts and processes user requests, returns the results, and provides them to the client application or user, and can be used in web applications and enterprise applications.

[0084] The application server 110 can run and manage multiple application programs simultaneously, manage communication with clients, and support a variety of protocols. For example, it can interact with clients using protocols such as HTTP, HTTPS, and TCP / IP. The application server 110 efficiently manages threads using a thread pool to handle a large number of simultaneous requests and provides security features such as user authentication, authorization, and data protection. The application server is used with a variety of languages ​​and frameworks such as Java EE, .NET, PHP, and Python, and is designed to allow for diverse server configurations and settings depending on the specific use case.

[0085] A hooking module 112 is a software module that intercepts or modifies specific events, functions, or tasks in a computer program or system. Hooking modules 112 are used to monitor and modify program behavior and can be utilized for a variety of purposes, primarily debugging, security, tracking specific actions, and modifying user interfaces.

[0086] In one embodiment, the hooking module 112 performs hooking on an existing DB Client module that transmits SQL created by an application on the application server 110 to the DBMS on the DB server 120. The hooking module 112 can perform functions such as API hooking, which intercepts or modifies a specific API function when a program calls it; function hooking, which intercepts or modifies a call to a specific function to perform a desired action; message hooking, which intercepts or modifies the transmission of messages between the system or application programs; event hooking, which intercepts or processes a specific event when it occurs; and file system hooking, which intercepts or modifies file system operations to monitor or control specific file operations. However, it is not limited to these functions.

[0087] The client DB module 114 facilitates interaction between the application and the database, and performs tasks related to coordinating with the DB server 120 and executing queries. The client DB module 114 is responsible for communication between the client application and the database and can handle CRUD (Create, Read, Update, Delete) operations on data.

[0088] The client DB module 114 can configure and manage connections with the DB server 120. It provides efficient connection management using connection pooling, enabling applications to securely connect to the database on DB server 120.

[0089] The client DB module 114 can execute queries on the database using SQL or other query languages, and perform tasks such as querying, updating, inserting, and deleting data at the request of the user or application.

[0090] Furthermore, it can receive query execution results from DB server 120, process them into the required format, and return them to the application. It can also perform error handling, data transformation, and filtering of the results.

[0091] Figure 7 is a block diagram illustrating a computing environment 10, including computing devices suitable for use in an exemplary embodiment.

[0092] In the illustrated embodiments, each component may have different functions and capabilities beyond those described below, and additional components may be included beyond those described below.

[0093] The illustrated computing environment 10 includes a computing device 12. In one embodiment, the computing device 12 may be a long-term observation-based active learning algorithm learning device.

[0094] The computing device 12 includes at least one processor 14, a computer-readable storage medium 16, and a communication bus 18. The processor 14 can be configured to operate the computing device 12 in accordance with the exemplary embodiments described above. For example, the processor 14 can execute one or more programs stored on the computer-readable storage medium 16. The one or more programs may include one or more computer-executable instruction words, which, when executed by the processor 14, can be configured to cause the computing device 12 to perform the operations according to the exemplary embodiments.

[0095] The computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. The program 20 stored on the computer-readable storage medium 16 includes a set of instructions that can be executed by the processor 14. In one embodiment, the computer-readable storage medium 16 may be memory (volatile memory such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, or other different forms of storage media that can be accessed by the computing device 12 to store desired information, or a suitable combination thereof.

[0096] The communication bus 18 interconnects various other components of the computing device 12, including the processor 14 and the computer-readable storage medium 16.

[0097] The computing device 12 may also include one or more input / output interfaces 22 and one or more network communication interfaces 26 that provide interfaces for one or more input / output devices 24. The input / output interfaces 22 and network communication interfaces 26 are connected to a communication bus 18. The input / output devices 24 may be connected to other components of the computing device 12 through the input / output interfaces 22. An exemplary input / output device 24 may include input devices such as pointing devices (such as a mouse or trackpad), keyboards, touch input devices (such as a touchpad or touchscreen), voice or sound input devices, various types of sensor devices and / or imaging devices, and / or output devices such as display devices, printers, speakers and / or network cards. The exemplary input / output device 24 may be included inside the computing device 12 as a component of the computing device 12, or it may be connected to the computing device 12 as a separate device distinct from the computing device 12.

[0098] The methods described above can be embodied in the form of program instructions that can be implemented in applications or executed through various computer components, and can be recorded on a computer-readable recording medium. The computer-readable recording medium may contain program instructions, data files, data structures, etc., individually or in combination.

[0099] The program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention, or they may be available to those skilled in the art in the field of computer software.

[0100] Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory.

[0101] Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the processing according to the present invention, and vice versa.

[0102] As described above with reference to examples, those skilled in the art can modify and change the present invention in various ways without departing from the spirit and scope of the invention as described in the following claims. [Explanation of Symbols]

[0103] 12: Computing devices 14: Processor 16: Computer-readable storage media 20: Program 22: Input / Output Interface 24: Input / Output Devices 26: Network communication interface 110: Application Server 120: DB Server

Claims

1. One or more processors, and A method to be executed on a computing device having memory for storing one or more programs executed by the one or more processors, When an encrypted column query request is received through the application on the application server to which the API is applied, the hooking module is executed; The executed hooking module includes the steps of querying encrypted data from a database management system (DBMS) database and decrypting the queried encrypted data and transmitting it to the application; The aforementioned inquiry step is, The process of obtaining encrypted table-column information from a database; The process of parsing SQL executed through the application; and, Based on the parsing results, the process includes checking whether any table columns are to be encrypted. The aforementioned transmission step is, At the querying stage, depending on the type of SQL statement, if the SQL statement is a column to be queried in a SELECT statement, the queried encrypted data is decrypted and the SQL result value is transmitted to the application; and, At the querying stage, depending on the type of SQL statement, if the SQL statement is input data or comparison data other than a SELECT statement, the queryed encrypted data includes a process of modifying the SQL in an encrypted state and transmitting it to the database management system. The data transmitted and received between the application server and the database management system is configured to remain encrypted. The encrypted data is In order to reduce the load on the aforementioned database management system, the application within the application server encrypts or decrypts the data. The aforementioned application server The DB client module dbclient.dll, used when executing SQL, is changed to the pre-configured client_org.dll, and then the dll file created for hooking is renamed back to its original name, client.dll, for management purposes. The aforementioned application is When the aforementioned SQL is executed, the hooking module client.dll is loaded, and then the loaded client.dll internally calls the original module client_org.dll to perform the encryption or decryption process. A method for encrypting database data, characterized by the features described above.

2. This further includes the step of performing automatic encryption of data when a hooking module executed on an application server to which the API is applied enters or modifies data into a database management system (DBMS) database; The method for encrypting database data as described in claim 1.

3. The step of performing the aforementioned encryption is: The encryption key and encryption algorithm are selected according to a predefined policy, and after deciding whether or not to perform partial encryption, encryption is carried out. The method for encrypting database data according to claim 2.

4. One or more processors, and A system including a computer device having memory for storing one or more programs executed by the one or more processors, DB server that performs database management; and, An application server including a hooking module that, upon receiving an encrypted column query request from the database of the DB server through the application, queries the encrypted data through the DB client module, decrypts the queried encrypted data, and transmits it to the application; The aforementioned application server The system retrieves encrypted table-column information from the database, parses the SQL executed through the application, and based on the parsing results, checks whether any of the table-columns are encrypted. Depending on the type of SQL statement, if the SQL statement is a column to be queried in a SELECT statement, the queried encrypted data is decrypted and the result value of the SQL is transmitted to the application; if the SQL statement is input data or comparison data for a statement other than a SELECT statement, the queried encrypted data is modified in an encrypted state and transmitted to the database management system. The data transmitted and received between the application server and the database management system is configured to remain encrypted. The encrypted data is In order to reduce the load on the aforementioned database management system, the application within the application server encrypts or decrypts the data. The aforementioned application server The DB client module dbclient.dll, used when executing SQL, is changed to the pre-configured client_org.dll, and then the dll file created for hooking is renamed back to its original name, client.dll, for management purposes. The aforementioned application is When the aforementioned SQL is executed, the hooking module client.dll is loaded, and then the loaded client.dll internally calls the original module client_org.dll to perform the encryption or decryption process. A database management system characterized by the following features.

Images