Ciphertext Headers for Multi-Key Column Encryption Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database management systems face inefficiencies and security risks due to the complexity of managing multiple encryption keys and algorithms for different data types within the same column, leading to performance issues, key mismanagement, and compromised data integrity.
Innovation Solution
Implementing cryptographic key and algorithm identifiers in the ciphertext header allows for the use of different encryption algorithms and keys for different data types within the same column, enabling efficient data storage and access control without requiring re-encryption of entire columns or databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple encryption keys and algorithms are managed for different data types within the same column, then data security and flexibility are improved, but system complexity and management difficulty increase
Solution Approach 1:
The patent segments the encryption metadata by adding separate header fields for encryption key identifiers and encryption algorithm identifiers within the ciphertext structure. This allows different data types in the same column to be encrypted independently with different keys and algorithms, while the database management system only needs to manage these identifiers rather than the actual cryptographic complexity, thus reducing perceived system complexity while maintaining security
Solution Approach 2:
The patent introduces ciphertext headers as an intermediary layer between the encryption operations and the database storage. These headers contain metadata about the encryption keys and algorithms used, acting as a mediator that allows the database system to store and retrieve encrypted data without needing to manage the cryptographic details directly. This intermediary structure simplifies key management by externalizing the cryptographic information from the database core
2Reliability
If traditional column-level encryption is used, then data security is maintained, but processing load and latency increase due to re-encryption requirements
Solution Approach 1:
The patent applies segmentation at the row level by encrypting individual data entries rather than entire columns. Each row's data is encrypted independently with its own key and algorithm, allowing the system to process only the specific data that needs to be accessed. This eliminates the need to re-encrypt entire columns during updates or queries, significantly reducing processing load and latency while maintaining security through row-level encryption
Solution Approach 2:
The patent implements partial encryption by applying encryption only to the specific fields or rows that require security protection, rather than encrypting the entire column or database. This partial action approach allows the system to maintain security for sensitive data while leaving non-sensitive data unencrypted, thereby reducing the overall processing overhead and improving productivity
3Ease of operation
If centralized key management systems are used, then key management is simplified, but network dependency and potential single points of failure increase
Solution Approach 1:
The patent implements self-service key management by embedding the encryption key identifiers and algorithm identifiers directly within the ciphertext headers at the data storage location. This allows the database system to perform encryption and decryption operations autonomously using the embedded metadata, eliminating the need for external key management services. Each data entry carries its own encryption information, making the system self-sufficient and removing single points of failure while maintaining ease of operation
Solution Approach 2:
The patent uses ciphertext headers as an intermediary that stores encryption metadata locally at the data storage location rather than relying on external key management systems. These headers act as a self-contained intermediary that provides all necessary encryption information needed for operations, eliminating network dependencies for key retrieval while maintaining the ease of managing encryption through the structured header format
Data Source
AI summary
Methods for landing encrypted data in a column, requesting access to decrypted data, and storing multiple data sets in a single column with different encryption schemes based on utilizing cryptographic key and algorithm identifiers in ciphertext headers. The methods comprise an application of a storage system receiving an access request to encrypt data to or decrypt data from (respectively) a database of the storage system. Next, the application determines whether the external source is permitted to encrypt to or decrypt from the database based on external source identifiers and permissions specified in an active directory of the storage system. When the external source is authenticated (i.e., permitted), performing the appropriate steps to write encrypted data by adding to ciphertext headers cryptographic key and algorithm identifiers or read decrypted data by obtaining cryptographic key and algorithm identifiers from ciphertext headers.