Database Control Means for Encrypted Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database encryption methods face challenges in preventing information leakage and improving processing efficiency, particularly in cloud computing environments, where encryption and decryption keys are managed on the database side, leading to vulnerabilities and high computational costs for fully homomorphic encryption.
Innovation Solution
A database apparatus and method that executes data access control by performing operations on both encrypted and plaintext data, allowing for efficient computation and encryption management, enabling transparent encryption and decryption processes without altering existing database queries or applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted before storage and decrypted upon retrieval, then information leakage is prevented, but processing efficiency deteriorates due to decryption overhead
Solution Approach 1:
The patent segments database operations into two types: Type-1 operations that process encrypted data directly (SELECT, WHERE, ORDER BY, etc.) and Type-2 operations that require decryption (INSERT, UPDATE, DELETE, JOIN, etc.). This segmentation allows the system to apply encryption selectively to operations where it provides security benefits without incurring decryption overhead for all operations, thus resolving the contradiction between information security and processing efficiency.
2Reliability
If fully homomorphic encryption is used to perform operations on encrypted data, then information leakage is prevented, but computational cost increases enormously
Solution Approach 1:
The patent extracts and implements only the necessary homomorphic encryption capabilities for specific Type-1 operations rather than using fully homomorphic encryption for all operations. By taking out only the essential cryptographic functions needed for selective operations (such as additive or multiplicative homomorphism for specific query types), the system achieves information security without the enormous computational cost of complete fully homomorphic encryption.
3Extent of automation
If encryption keys are managed on the database side, then automated encryption is achieved, but vulnerability to intrusion and malicious operations increases
Solution Approach 1:
The patent applies different key management approaches to different operation types. For Type-1 operations on encrypted data, the system uses automated encryption with database-managed keys. For Type-2 operations requiring decryption, the system implements enhanced security measures including multi-party key management and authorization protocols. This local quality differentiation allows automated encryption where safe while reducing vulnerability in areas requiring key exposure.
4Reliability
If existing database queries are modified to support encryption, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent implements a dynamic system that automatically determines whether to apply encryption based on the operation type and data sensitivity, rather than requiring static modification of all queries. The database management system dynamically selects between Type-1 and Type-2 operation processing, transparently handling encryption without requiring users to modify their queries. This dynamic approach maintains ease of operation while achieving security improvements.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Provided is a apparatus that prevents leakage of confidential information in a database and that improves processing efficiency. A database apparatus comprises: a control means to execute data access control on a database, wherein the control means, receives a database operation command from a user apparatus, comprises, regarding data and/or metadata to be handled associated with the database operation command, means for executing database operation or computation on encrypted data and/or encrypted metadata as is in ciphertext and means for executing database operation or computation on plaintext data and/or plaintext metadata to send a processing result to the user apparatus.