Database Encryption Key Management on User Terminal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database encryption methods face challenges in preventing information leakage due to external intrusions or administrative errors, and they are inefficient in processing database operations, especially when keys for encryption/decryption are managed on the database side or require extensive computational resources.
Innovation Solution
A database encryption system where a user apparatus manages key information and configures security settings, determining whether encryption is necessary for database operations, and either encrypts or decrypts data accordingly, using an encryption algorithm to securely execute database commands without restructuring existing applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encryption keys are managed on the database side, then database operations can be performed without modifying applications, but information leakage risk increases due to external intrusions or administrative errors
Solution Approach 1:
The patent extracts the key management function from the database side and relocates it to the user terminal side. The terminal apparatus now generates and manages encryption keys locally, while the database server only handles encryption/decryption operations without storing or managing keys. This separation eliminates the risk of key leakage through database intrusions or administrative errors, while maintaining ease of operation through automatic key generation and transparent encryption.
2Reliability
If encryption is performed for all database operations, then information leakage is prevented, but processing efficiency decreases due to extensive computational resources required
Solution Approach 1:
The patent applies encryption selectively based on data sensitivity rather than uniformly to all data. The terminal apparatus determines which data requires encryption based on sensitivity levels, and only encrypts those specific data items. This allows information security to be maintained for critical data while avoiding unnecessary computational overhead for less sensitive data, thus improving overall processing efficiency.
3Reliability
If existing applications are modified to support encryption, then security can be improved, but device complexity increases due to restructuring requirements
Solution Approach 1:
The patent implements self-service encryption where the terminal apparatus automatically generates encryption keys and performs encryption/decryption operations without requiring any modifications to existing applications. The terminal's key management function operates transparently in the background, making encryption a self-service feature that enhances security while maintaining application simplicity and avoiding structural complexity.
Data Source
AI summary
A user apparatus connected to database apparatus via network comprises: unit that manages key information in order to encrypt and decrypt; storage unit that stores security configuration information of data and/or metadata; application response unit that determines whether or not encryption is necessary for database operation command, and if encryption is necessary, selects encryption algorithm corresponding to data and/or metadata, performs encryption, and transmits result to database control unit to cause database control unit to execute database operation, if encryption is not necessary, transmits database operation command to database control unit to cause database control unit to execute database operation, and receives processing result transmitted by database control unit, and if decryption or conversion of data and/or metadata of processing result is necessary, performs necessary decryption or conversion, and returns response to database operation command; and security configuration unit that configures security information of data stored in database.