Application Layer Encryption for Database Querying
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security schemes face challenges in protecting data while allowing easy access and querying, often requiring trade-offs between encryption and usability, with existing methods introducing complexity and vulnerabilities such as data exposure during transit or limited search capabilities.
Innovation Solution
Implementing encryption and decryption at the application layer, using secure multi-party computation (SMPC) servlet functionality to enable operations on encrypted data within the database, with daemons communicating via function calls and encryption key management handled via data tables, ensuring data remains encrypted throughout the database layer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted within the database for security protection, then data security is improved, but the ability to easily query and access the data deteriorates
Solution Approach 1:
The system segments encryption operations into two distinct layers: application-layer encryption for data at rest in the database, and transparent decryption/encryption for data in transit. This segmentation allows the database to store encrypted data securely while the application layer handles decryption for querying, thus maintaining both security and accessibility without requiring the database itself to perform decryption operations.
Solution Approach 2:
The application layer acts as an intermediary between the user and the encrypted database. It receives decryption requests, decrypts the necessary data using stored keys, performs queries on decrypted data in memory, and returns results to the user. This intermediary approach enables easy querying of encrypted data without compromising database security, as the database never needs to store or process unencrypted data.
2Reliability
If encryption is implemented at the database layer, then data protection is improved, but system complexity and vulnerabilities increase
Solution Approach 1:
The patent extracts encryption and decryption operations from the database layer and relocates them to the application layer. The database is simplified to only handle encrypted data storage and retrieval, while all complex cryptographic operations are performed by the application layer using libraries like Crypto++. This extraction reduces database complexity and attack surface while maintaining strong encryption capabilities.
Solution Approach 2:
The application layer implements self-service encryption by automatically encrypting data before inserting it into the database and automatically decrypting data when retrieving it for queries. Encryption keys are managed within the application layer itself, eliminating the need for complex database-integrated key management systems. This self-service approach simplifies the overall system architecture while maintaining robust security.
Data Source
AI summary
The present approaches generally relate to the encryption of data within a database in such a way that the encrypted data may still be easily accessed and utilized by an application. The present approach provides the ability to encrypt and decrypt data at an application layer though the data remains in an encrypted state at the database layer and when in transit.