Database Processing in Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database processing methods suffer from poor credibility in their processing environments, making them vulnerable to malicious attacks. Current solutions require multiple communication exchanges and encryption/decryption processes between the database, security platforms, and clients, which compromises processing efficiency, especially under high demand.
Innovation Solution
A database processing method and apparatus that deploys the database in a separate secure execution environment, integrating it with a trusted execution environment (TEE). This solution receives access requests, queries authorization tables for encrypted data, and executes data processing instructions only for authorized users, eliminating the need for frequent encryption and decryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple communication exchanges and encryption/decryption processes are performed between database, security platform and client, then data security is improved, but data processing efficiency deteriorates
Solution Approach 1:
The patent merges the database and security platform into a single trusted execution environment (TEE), eliminating the need for multiple communication exchanges and encryption/decryption operations between separate systems. This integration maintains data security while significantly improving processing efficiency by reducing communication overhead and cryptographic operations.
Solution Approach 2:
The trusted execution environment acts as an intermediary that provides secure data processing without requiring external security platforms. The TEE performs authorization checks and data processing internally, eliminating the need for repeated authentication and encryption/decryption cycles with external security systems.
2Reliability
If database is deployed in separate secure execution environment, then data security is improved, but system complexity increases
Solution Approach 1:
The patent combines the database and security functions into a single trusted execution environment, reducing system complexity compared to having separate database servers and security platforms that require multiple communication interfaces and protocols.
3Reliability
If frequent encryption and decryption operations are performed, then data security is improved, but processing speed deteriorates
Solution Approach 1:
The patent performs authorization verification in advance within the trusted execution environment before data processing begins. This preliminary authorization check eliminates the need for repeated encryption and decryption operations during subsequent data access and processing, significantly improving processing speed while maintaining security.
Solution Approach 2:
Once data is authorized for access within the TEE, the system maintains continuous access without requiring repeated encryption/decryption cycles. The trusted execution environment preserves the authorized state, allowing continuous data processing operations without the performance penalty of frequent cryptographic operations.
Data Source
AI summary
Embodiments of the present disclosure provide a database processing method and apparatus, a device and a medium. The method includes: receiving an access request for a database, wherein the access request carries a user identifier of an access party and a data processing instruction, the data processing instruction is used for instructing to process specified data in the database to obtain target data; in response to determining that the specified data is encrypted data, querying an authorization information table in the database based on the user identifier of the access party, and detecting whether the access party is an authorized user of the specified data; and in response to determining that the access party is the authorized user of the specified data, executing the data processing instruction to process the specified data to obtain the target data, and returning the target data in response to the access request.