Database File Encryption Without Downtime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database encryption methods often result in downtime and access interruptions during the encryption or re-encryption process, especially when dealing with large amounts of data.
Innovation Solution
A system and method that encrypt or re-encrypt database data in the background or on-the-fly, allowing customer queries to proceed without interruption by using a processing engine with key generation, encryption, and atomicity components to manage encryption keys and update file mappings atomically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If database encryption is performed using traditional methods, then data security is improved, but system downtime and access interruptions occur
Solution Approach 1:
The system performs preliminary actions by creating encrypted copies of database files before the original encryption operation. The metadata store is updated to point to these pre-created encrypted files, allowing seamless switching without interrupting ongoing queries. This preliminary preparation enables encryption to occur without system downtime.
Solution Approach 2:
The patent introduces an intermediary mechanism - the metadata store that acts as a mediator between the unencrypted and encrypted database files. During transition, the metadata store is updated to point to encrypted files while query processing continues uninterrupted. This intermediary layer decouples the encryption process from query execution, maintaining system availability.
2Reliability
If encryption is performed on large amounts of database data, then data security is improved, but processing time and downtime increase
Solution Approach 1:
The encryption process is segmented into independent operations: key generation, file encryption, and metadata updates. Each segment can be executed separately without blocking query processing. The system encrypts database files in segments rather than requiring complete encryption before access, reducing overall processing time impact.
Solution Approach 2:
The system maintains continuity of useful action by allowing query processing to continue uninterrupted during encryption operations. Multiple queries can execute concurrently with encryption in progress, and the system seamlessly switches between unencrypted and encrypted files without stopping useful work. This continuous operation minimizes time loss.
3Manufacturing precision
If database files are locked during encryption, then encryption integrity is ensured, but query access is blocked
Solution Approach 1:
The system creates copies of database files during encryption rather than modifying originals in place. These encrypted copies are created independently while original files remain accessible for queries. The metadata store is updated to point to the copied encrypted files, ensuring encryption integrity while maintaining query access to unencrypted files during the transition.
Solution Approach 2:
The system dynamically switches between unencrypted and encrypted file versions based on metadata updates. Rather than static locking, the system allows concurrent access to different file versions - queries can access unencrypted files while encryption proceeds, then seamlessly transition to encrypted files. This dynamic approach ensures both encryption integrity and continuous query access.
Data Source
AI summary
A method of preventing queries from accessing database files based on metadata. The method includes determining a first metadata associated with a particular file and a second metadata associated with a changed version of the particular file. The method includes directing, based on the first metadata associated with the particular file, a first query for the particular file to a first file that is associated with the particular file. The method includes preventing a second query for the particular file from accessing the particular file by directing, based on the second metadata associated with the changed version of the particular file, the second query to the changed version of the particular file instead of the particular file.