Budget-Based Encryption Selection for Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Long-running databases using adjustable encryption often transform into order-preserving encrypted databases, losing security due to the lack of reversion from 'cold' to 'hot' mode, where infrequent queries impact security similarly to frequent ones, and there's a need for intelligent encryption selection to manage query loads effectively.
Innovation Solution
Implementing a budget-based encryption selection mechanism that chooses between searchable encryption, deterministic encryption, and order-preserving encryption based on query frequency and performance requirements, using searchable encryption for infrequent queries to maintain security while minimizing performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If adjustable encryption is used to process queries on encrypted data, then query performance is improved, but security deteriorates as databases transform into order-preserving encrypted databases
Solution Approach 1:
The system dynamically selects encryption types based on query characteristics and frequency. The query optimizer determines whether to use order-preserving encryption, deterministic encryption, or searchable encryption for each query, allowing the encryption approach to adapt rather than remain static. This resolves the contradiction by making the encryption method flexible rather than fixed.
Solution Approach 2:
Different encryption types are applied to different queries based on their specific requirements. Frequent queries use order-preserving encryption for performance, while infrequent or sensitive queries use searchable or deterministic encryption for security. Each query receives the appropriate encryption treatment locally rather than applying a uniform encryption approach globally.
2Speed
If order-preserving encryption is used for frequent queries, then query execution speed is improved, but security is compromised
Solution Approach 1:
The system applies order-preserving encryption only partially - specifically for frequent queries where performance is critical. For infrequent queries, the system uses stronger encryption methods. This partial application of the weaker encryption method resolves the contradiction by limiting its use to scenarios where the performance benefit justifies the security trade-off.
Solution Approach 2:
The system changes the encryption parameter (encryption type) based on query frequency and characteristics. The query optimizer monitors query patterns and adjusts the encryption approach accordingly, switching between order-preserving, deterministic, and searchable encryption. This parameter change allows the system to optimize for speed when appropriate while maintaining security when needed.
3Reliability
If searchable encryption is used for all queries, then security is maintained, but query performance deteriorates
Solution Approach 1:
The system applies searchable encryption only partially - specifically for infrequent queries or queries where security is the primary concern. For frequent queries, the system uses faster encryption methods. This selective application resolves the contradiction by avoiding the performance penalty of searchable encryption when it is not strictly necessary for security.
Solution Approach 2:
The system dynamically changes the encryption parameter based on query frequency and security requirements. The query optimizer determines when to use searchable encryption versus other encryption types, adjusting the encryption approach to balance security and performance for each specific query scenario.
4Ease of operation
If encryption type is not reversed after adjustment, then query processing simplicity is improved, but long-term security deteriorates
Solution Approach 1:
The system implements dynamic encryption type selection that can adapt over time. The query optimizer monitors query patterns and can reverse or change encryption types based on evolving requirements. This dynamic approach resolves the contradiction by allowing the system to maintain simplicity in the short term while preserving the ability to adapt for long-term security.
Solution Approach 2:
The system incorporates feedback mechanisms where the query optimizer monitors query patterns, performance metrics, and security requirements. Based on this feedback, the system can adjust encryption types and reverse adjustments when appropriate. This feedback loop resolves the contradiction by enabling the system to learn from operation patterns and make informed decisions about encryption management.
Data Source
AI summary
Methods, systems, and computer-readable storage media for selecting columns for selecting encryption to perform an operator during execution of a database query. Implementations include actions of determining a current encryption type of a column that is to be acted on during execution of the database query, the column storing encrypted data, determining a minimum encryption type for performance of the operator on the column, selecting a selected encryption type based on the current encryption type, the minimum encryption type, and a budget associated with the column, and performing the operator based on the selected encryption type.