Encrypted Table Middleware for Database Write Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Online computer databases lack effective write protection mechanisms, making them vulnerable to attacks that can lead to catastrophic financial and operational consequences, especially in systems like online payments, where read attacks are not necessary to cause harm.
Innovation Solution
Implementing an encrypted table system with middleware software logic that abstracts database protection, using authenticated encryption with additional data (AEAD) algorithms to encrypt and validate data, and storing original table information alongside cipher text to detect and prevent write attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional database storage is used without encryption, then write access is easy and fast, but the database is vulnerable to write attacks that can cause catastrophic financial implications
Solution Approach 1:
The patent introduces an encrypted table as an intermediary layer between the application and the original database table. This encrypted table stores ciphertext versions of sensitive data and includes additional authenticated data (AAD) fields that contain metadata about the original data structure. The intermediary layer provides write protection by validating write operations through authenticated encryption without requiring changes to the underlying database infrastructure.
Solution Approach 2:
The patent segments the database storage into two distinct components: the original unencrypted table and the new encrypted table. The encrypted table contains separate fields for ciphertext data and additional authenticated data (AAD). This segmentation allows the system to maintain the original table for non-sensitive operations while protecting sensitive data in the encrypted table, resolving the contradiction between security and simplicity.
2Reliability
If encrypted tables with AEAD are implemented, then write protection and data integrity are improved, but the complexity of database operations increases
Solution Approach 1:
The encrypted table structure is designed to be self-validating through authenticated encryption. When data is written to the encrypted table, the AEAD algorithm automatically generates authentication tags that verify the integrity of both the ciphertext and the additional authenticated data. This self-service mechanism ensures data integrity without requiring complex external validation logic, maintaining ease of operation while improving reliability.
Solution Approach 2:
The encrypted table structure serves multiple functions simultaneously: it stores sensitive data in encrypted form, validates write operations through authentication tags, maintains metadata about the original data structure in AAD fields, and provides rollback capability by storing references to the original table. This multi-functionality reduces the need for separate security mechanisms, simplifying overall database operations.
3Reliability
If write protection mechanisms are added to prevent catastrophic losses, then system security is improved, but the productivity and speed of database operations may decrease
Solution Approach 1:
The system performs preliminary authentication validation during the write operation itself, before any data modification occurs. The AEAD encryption scheme validates the authenticity of the write operation by verifying authentication tags generated from the additional authenticated data. This preliminary validation prevents unauthorized writes without requiring post-operation verification or rollback procedures, maintaining high productivity while improving security.
Solution Approach 2:
The patent changes the parameter of data representation from plaintext to ciphertext while maintaining the same data structure and access patterns. By using authenticated encryption with additional data (AEAD), the system transforms the data parameter without fundamentally changing the operation flow. The encrypted table accepts writes in the same format as the original table, allowing existing applications to operate at full speed while security is enforced through cryptographic parameter transformation.
Data Source
AI summary
An online computer system including a database uses an encrypted table that allows for write protection its contents. Middleware logic operating on the system acts as an interface for access to the database, so that any business logic on the system accesses the database through simple procedural calls to the middleware rather than directly to the database itself. The middleware logic abstracts logic that helps implement write protection with the encrypted table. Data to be encrypted that has been traditionally written to other tables is migrated to the encrypted table, where the data encrypted using an authenticated encryption with additional data (AEAD) algorithm. To implement AEAD, the original table, column, and primary key indicating where the data would have otherwise been stored are together used as additional authenticated data (AAD). This tuple of information is also stored in the encrypted table.