Transparent Database Encryption via External Security Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems that use External Security Modules (ESMs) to secure data in Relational Database Management Systems (RDBMS) require developers to modify applications, which is costly and inefficient, as different ESMs demand different programming methods and can compromise performance and scalability.
Innovation Solution
A system that transparently uses an external security device to perform encryption/decryption operations within a database without modifying database applications, by passing a wrapped column key to an external security module, decrypting it, and using it for encryption/decryption operations, then erasing the key from memory, allowing for secure data handling without application modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If developers modify applications to use ESMs, then security is improved, but development cost and complexity increase
Solution Approach 1:
The patent introduces a database-level intermediary layer that handles ESM interactions. The database system acts as a mediator between applications and ESMs, providing transparent encryption/decryption operations through database functions rather than requiring application-level ESM integration. This intermediary approach allows applications to use standard database APIs while the database infrastructure manages the complex ESM communications and key management.
2Reliability
If ESMs are integrated into RDBMS, then data security is improved, but performance and scalability may be compromised
Solution Approach 1:
The patent segments the encryption/decryption operations from the main database processing flow. By implementing these operations as separate database functions that can be called as needed, rather than integrating them deeply into the core database engine, the system maintains the performance and scalability of the RDBMS while adding security capabilities. The segmentation allows for optimized ESM communication paths and reduces the impact on overall database performance.
3Reliability
If different ESMs require different programming methods, then security customization is improved, but development time and cost increase
Solution Approach 1:
The patent creates a universal database interface that works with multiple types of ESMs through a standardized set of database functions. The database system provides a consistent API for encryption and decryptions that abstracts away the differences between various ESM implementations. This universal approach allows applications to interact with different ESM types (hardware security modules, software security modules, cloud-based ESMs) using the same programming methods, eliminating the need for custom code for each ESM type.
Data Source
AI summary
One embodiment of the present invention provides a system that facilitates using an external security device to secure data in a database without having to modify database applications. The system operates by receiving a request at the database to perform an encryption/decryption operation, wherein the encryption/decryption operation is performed with the assistance of the external security module in a manner that is transparent to database applications. In response to the request, the system passes a wrapped (encrypted) column key (a key used to encrypt data within the database) to an external security module, wherein the wrapped column key is a column key encrypted with a master key that exists only within the external security module. The system then unwraps (decrypts) the wrapped column key in the external security module to retrieve the column key. Next, the system returns the column key to the database. The system then performs an encryption/decryption operation on data in the database using the column key. Finally, the system erases the column key from memory in the database.