Database Monitor Intercepts Plaintext Data in Transit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data level security approaches struggle to intercept and scrutinize encrypted transactions between applications and databases, as they require decryption, which is not always feasible, especially with end-to-end encryption rendering data unsuitable for midstream analysis.
Innovation Solution
Identifying a transition point between encrypted and plaintext data where cryptographic operations are invoked and transferring control to a database monitor application to intercept and analyze the plaintext data without disrupting the flow, using mechanisms like system calls, DLL calls, or static linkages to capture and return the data to the intended stream.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data level security intercepts encrypted transactions in transit, then data can be scrutinized and analyzed, but the intercepted data cannot be decrypted for analysis because end-to-end encryption renders it unsuitable for midstream analysis
Solution Approach 1:
The patent introduces a database monitor application as an intermediary component that sits between the encrypted data stream and the analysis function. This monitor application intercepts the encrypted data, decrypts it using its own cryptographic capabilities, performs the security analysis, and then returns the processed data to the original stream. This resolves the contradiction by providing a trusted intermediary that can access the plaintext data without compromising the end-to-end encryption security.
Solution Approach 2:
The patent segments the data processing function by separating the encryption/decryption operation from the security analysis operation. The database monitor application handles the cryptographic operations independently, while the security scrutiny function analyzes the decrypted data. This segmentation allows each component to operate optimally - the monitor maintains encryption security while the analysis function can process plaintext data for security compliance checking.
2Loss of information
If conventional data level security provides scrutiny of data access transactions, then audit trails can be maintained, but encrypted transactions elude scrutiny because they cannot be decrypted for analysis
Solution Approach 1:
The database monitor application serves as a mediator that bridges the gap between encrypted data transmission and security auditing requirements. It intercepts encrypted transactions, decrypts them locally, performs comprehensive security analysis including audit trail maintenance, and returns the data unchanged to the original stream. This ensures both encryption security is maintained and complete audit capability is achieved.
Solution Approach 2:
The database monitor application performs self-service by maintaining its own cryptographic credentials and decryption capabilities independently. It uses its own private keys to decrypt intercepted encrypted transactions, eliminating the need for shared keys or complex key management between different systems. This self-service approach enables comprehensive auditing while maintaining compatibility with modern encryption standards.
3Difficulty of detecting and measuring
If the database monitor application intercepts and decrypts data, then plaintext data can be analyzed for security compliance, but the decryption process requires cryptographic keys that must be managed securely
Solution Approach 1:
The database monitor application implements self-service key management by storing and using its own cryptographic private keys to decrypt intercepted transactions. This eliminates the need for complex shared key distribution systems or external key management services. The monitor application independently manages its credentials, simplifying the overall system architecture while maintaining strong security.
Solution Approach 2:
The database monitor acts as an intermediary that absorbs the key management complexity into itself rather than propagating it throughout the system. By centralizing the cryptographic operations within the monitor application, the patent simplifies the interfaces between other system components and the encryption infrastructure, reducing overall system complexity despite the added functionality.
Data Source
AI summary
In a data level security environment, the data level security mechanism operates on plaintext data. Data level security operations identify a point in the information stream where plaintext data is available for interception. Typically this is a point in the processing stream just after the native DBMS decryption functionality has been invoked. A database monitor intercepts and scrutinizes data in transit between an application and a database by identifying a transition point between the encrypted and plaintext data where the cryptographic operations are invoked, and transfers control of the data in transit to a database monitor application subsequent to the availability of the data in plaintext form.