Encrypted Database Query Processing via Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in securely and efficiently processing queries on encrypted data, particularly in untrusted cloud environments where data servers lack access to encryption keys, leading to difficulties in executing queries and managing encryption metadata.
Innovation Solution
A system where a data server analyzes user queries, determines if they can be executed on encrypted data, transforms queries, and provides encryption configurations to the database application, allowing it to encrypt parameters and decrypt results, with the data server storing encryption keys encrypted under a master key accessible to the database application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored encrypted on cloud servers without key access, then data security is improved, but query processing capability deteriorates
Solution Approach 1:
The system segments the database into encrypted and unencrypted portions, allowing different query processing paths. The query processor divides incoming queries to operate only on unencrypted data segments, preserving security while enabling efficient processing for applicable queries.
Solution Approach 2:
An intermediary query processing layer is introduced between the encrypted storage and the user application. This intermediary analyzes queries, determines executable portions, and processes them without requiring decryption, thus maintaining security while providing partial query functionality.
2Adaptability or versatility
If all operations are permitted on encrypted data, then query flexibility is improved, but security deteriorates
Solution Approach 1:
Different security properties are applied locally to different parts of the database. Unencrypted data regions allow full query flexibility, while encrypted regions maintain strict security. The system dynamically adapts query processing based on the local encryption state of accessed data portions.
3Productivity
If encryption keys are stored on the data server, then query processing efficiency is improved, but security deteriorates
Solution Approach 1:
The encryption keys are extracted and removed from the data server environment entirely. Only unencrypted data remains on the server, eliminating the security risk of key storage while allowing efficient processing of queries that operate on unencrypted data portions.
Data Source
AI summary
Methods, systems, apparatuses, and computer program products are provided for secure handling of queries by a data server and a database application. A parameterized query is received from a client. Table column metadata is loaded for one or more table columns referenced by the parameterized query. Datatypes of expressions in the parameterized query are derived with any parameters and variables of the parameterized query indicated as having unknown datatypes. Unsupported datatype conversions in the parameterized query are determined. An encryption scheme is inferred for any parameters and variables to generate an inferred encryption scheme set. The datatypes of expressions in the parameterized query are re-derived with any parameters and variables having their inferred encryption schemes. Encryption key metadata corresponding to the inferred encryption scheme set is loaded. An encryption configuration is transmitted to the client that includes the inferred encryption scheme for any parameters and variables.