Database Access Control for Encrypted Subset Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database processing systems face inefficiencies due to frequent encryption and decryption of data, leading to system crashes and difficulty in meeting business requirements, especially when the demand for database access is high, while also being vulnerable to malicious attacks.
Innovation Solution
Deploy a database in a trusted execution environment (TEE) that encapsulates all relevant data, performing authorization checks based on a user's identifier to determine if data access is authorized, allowing data that does not require encryption to be accessed directly, thereby reducing the need for frequent encryption and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent data encryption and decryption is performed to ensure security, then data security is improved, but data processing efficiency deteriorates
Solution Approach 1:
The patent segments data into two categories: encrypted data requiring authorization and public transparent data无需 authorization. This segmentation allows the system to apply different access control mechanisms to different data types, reducing unnecessary encryption/decryption operations for public data while maintaining security for sensitive data.
Solution Approach 2:
The patent applies local quality by providing different access characteristics to different data portions. Encrypted data requires authentication and authorization checks, while public transparent data can be accessed directly without encryption overhead. This localized differentiation optimizes both security and performance.
2Reliability
If all data is encrypted and stored in the database, then data security is improved, but data processing efficiency deteriorates
Solution Approach 1:
The patent segments data storage strategies by maintaining encrypted data in the database while storing public transparent data externally or in unencrypted form. This allows the database to contain only sensitive data requiring security protection, reducing encryption overhead during processing operations.
Solution Approach 2:
The patent extracts public transparent data from the encrypted data storage scope. By taking out data that does not require encryption, the system reduces the volume of data subject to encryption/decryption operations, thereby improving processing efficiency while maintaining security for remaining sensitive data.
3Reliability
If authorization checks are performed for all data access, then data security is improved, but data processing efficiency deteriorates
Solution Approach 1:
The patent segments data access requirements into two categories: authorized access for encrypted data and public access for transparent data. This segmentation enables the system to skip authorization checks for public data, improving processing efficiency while maintaining security for encrypted data.
Solution Approach 2:
The patent applies partial action by performing authorization checks only for encrypted data rather than all data. This selective authorization approach reduces the overhead of security checks for public data while ensuring proper access control for sensitive data.
4Reliability
If the database is deployed in a separated secure execution environment, then data security is improved, but system complexity increases
Solution Approach 1:
The patent segments the system into a secure execution environment for encrypted data processing and a public access path for transparent data. This segmentation allows the complex security infrastructure to be isolated from public data access, simplifying the overall system architecture while maintaining security.
Solution Approach 2:
The patent introduces an intermediary mechanism (authorization information table and access control logic) that mediates between the secure execution environment and public data access. This intermediary layer simplifies the interaction by providing a unified access control mechanism for both encrypted and public data.
Data Source
AI summary
A method includes: receiving an access request for a database, the access request carries a user identifier of an access party and a data processing instruction; when specified data and/or target data are subset data in encrypted data, querying an authorization information table in the database based on the user identifier of the access party to detect whether the access party is an authorized user for the specified data and/or the target data; detecting whether the subset data belongs to subset information in the specified data and/or the target data that does not require authorized access when the access party is not the authorized user for the specified data and/or the target data; and when the subset data belongs to the subset information that does not require authorized access, executing the data processing instruction to obtain target data, and returning the target data in response to the access request.