Database Encryption Context Segmentation for Query Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional database management systems face performance overhead issues due to the high processing intensity of encryption and decryption operations, especially when handling large datasets, which can render queries unusable.
Innovation Solution
Implementing encryption and decryption at the block-level within database management systems, where data blocks associated with encrypted tables are encrypted and decrypted when written to and retrieved from storage, reducing the number of decryption operations required during queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If column-level encryption is used to protect sensitive data, then data security is improved, but query performance deteriorates due to millions or billions of decryption operations required
Solution Approach 1:
The patent segments the data storage structure by introducing encryption context identifiers that associate specific encryption contexts with data rows. This allows the system to divide decryption operations into targeted segments based on encryption context rather than requiring decryption of all sensitive columns across the entire dataset, thereby reducing the total number of decryption operations needed during queries.
Solution Approach 2:
The patent performs preliminary encryption context assignment during data insertion operations. By pre-establishing the relationship between data rows and their encryption contexts through context identifiers, the system prepares the decryption roadmap in advance, avoiding the need to determine and execute decryption operations on-the-fly during query processing, thus improving query performance.
2Reliability
If encryption algorithms with strong cryptographic techniques are used, then data security is improved, but processing overhead increases making queries unusable
Solution Approach 1:
The patent implements partial decryption action by using encryption context identifiers to determine exactly which data rows and columns need to be decrypted for a given query. Instead of decrypting all encrypted data in the queried tables, the system performs only the necessary partial decryption operations, significantly reducing processing time while maintaining security for non-queried data.
Solution Approach 2:
The patent introduces encryption context identifiers as an intermediary mechanism between the query processor and the decryption engine. This intermediary layer translates query requirements into targeted decryption operations by matching context identifiers, thereby reducing the overall processing time without compromising the strength of the cryptographic algorithms used.
Data Source
AI summary
The subject matter herein relates to database management systems and, more particularly, encrypted data management in database management systems. Various embodiments provide systems, methods, and software to maintain database tables, some of which are encrypted. Some embodiments include holding clear text in cache and servicing queries from the cache. When a query is received, a file system of the database management system determines if a table holding data to service the query is encrypted. If the table is encrypted, the file system decrypts the data and writes the data to the cache as clear text. Some embodiments, when writing clear text to a table from the cache, determine if the table to which the data is to be written is an encrypted table. If the table is encrypted, the file system encrypts the clear text and stores the cipher text to the encrypted table.