Database Data Integrity Protection via Hidden Column Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security methods are ineffective in protecting data from unauthorized modification, especially by administrative users who have access to encryption keys, as they can replace encrypted data with their own, rendering simple encryption insufficient.
Innovation Solution
A system that generates an encrypted value for selected columns using a one-way hash function and stores it in a hidden column inaccessible to users or administrators, with an optional auditor process for additional encryption and verification, ensuring data integrity by comparing generated and stored encrypted values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using standard encryption methods, then data protection is improved, but the system becomes vulnerable to administrative users who possess the encryption key
Solution Approach 1:
The patent introduces a third-party auditor as an intermediary between the database administrator and the data. The auditor maintains a separate encrypted copy of the data using a different key held by an independent auditing entity. This intermediary structure prevents administrative users from unilaterally modifying data without detection, as any changes would be detected when the auditor compares the original data against the encrypted reference copy.
Solution Approach 2:
The patent creates a copy of the encrypted data and stores it in a separate hidden column within the database table. This copy serves as a reference for later verification. The copying mechanism allows the system to maintain the original encrypted data while providing a verifiable backup that can be compared to detect unauthorized modifications.
2Ease of operation
If encryption keys are stored with the data, then ease of access is improved, but security is worsened due to potential key compromise by administrators
Solution Approach 1:
The patent segments the key management function by separating the encryption key storage from the data storage. The encryption key is maintained by an independent auditing entity rather than being stored with the database. This segmentation ensures that even if database administrators compromise the data, they cannot access the encryption key used by the auditor, thereby maintaining security while allowing legitimate access through proper authentication mechanisms.
3Reliability
If a hidden column is added to store encrypted reference values, then data integrity verification is improved, but device complexity increases
Solution Approach 1:
The hidden column serves multiple functions: it stores encrypted reference values for integrity verification, maintains a compact representation of the original data for comparison, and provides a mechanism for detecting modifications. By making this single column multi-functional, the patent reduces the need for additional separate structures, thereby limiting the increase in device complexity while achieving robust integrity verification.
Data Source
AI summary
One embodiment of the present invention provides a system that protects data from unauthorized modification in a table, wherein the table contains one or more rows, and wherein each row contains one or more columns. During operation, the system chooses in a row one or more columns to be protected. The system then produces an encrypted value for the row based on the data stored in the chosen columns. Next, the system stores the encrypted value in a column which cannot be easily modified. In this way, a later-produced encrypted value generated from the values in the protected columns can be compared against the previously stored encrypted value to verify the integrity of the data stored in the protected columns.