Encryption Gateway for Transparent Database Sensitive Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database encryption methods face challenges in securely storing and managing encryption keys, and existing solutions either expose sensitive data to users or administrators or are not applicable to relational databases due to protocol constraints.
Innovation Solution
A method for transparently encrypting and decrypting sensitive information using a size-preserving encryption scheme, where sensitive data is encrypted inline as it flows between clients and a database server, with an encryption gateway managing access based on predefined policies, ensuring only authorized clients receive decrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If selective encryption is applied to specific sensitive columns to reduce overhead, then encryption performance is improved, but sensitive data cannot be protected from users or administrators with access permissions
Solution Approach 1:
The patent introduces an encryption gateway as an intermediary component between the database server and clients. This gateway transparently encrypts sensitive data before it is stored in the database and decrypts it only when authorized access is required. The gateway acts as a mediator that protects sensitive data from both unauthorized users and overprivileged administrators, while maintaining encryption performance through its specialized design.
2Ease of operation
If encryption keys are stored on the protected storage media to enable efficient access, then ease of operation is improved, but security is compromised
Solution Approach 1:
The encryption gateway serves as an intermediary that manages encryption keys separately from the protected storage media. The gateway loads keys into memory when needed and performs all cryptographic operations, eliminating the need to store keys on the database server's storage media. This approach maintains ease of operation through efficient in-memory key access while preserving security by keeping keys off protected storage.
Solution Approach 2:
The system segments the encryption functionality from the database server by introducing a separate encryption gateway component. This segmentation allows key management to be isolated from data storage, enabling efficient key access through the gateway's memory-based key store while preventing keys from being exposed on the protected storage media.
3Reliability
If entire database files are encrypted to protect sensitive data stored outside tables, then data protection is improved, but encryption overhead increases
Solution Approach 1:
The patent implements local quality by applying encryption selectively to only the sensitive data portions of the database through the encryption gateway, rather than encrypting entire database files. The gateway identifies and encrypts only the specific sensitive columns or data elements that require protection, reducing encryption overhead while maintaining comprehensive protection for sensitive information stored anywhere in the database.
4Reliability
If data is converted from clear text to ciphered text for encryption, then data security is improved, but data size increases affecting database logical structure
Solution Approach 1:
The encryption gateway employs parameter changes by using modern encryption algorithms with optimized key sizes and modes of operation that minimize expansion. The gateway configures encryption parameters such as block size, initialization vectors, and key lengths to achieve security requirements while controlling the increase in data volume, ensuring compatibility with the database's logical structure.
Data Source
AI summary
A method for transparently encrypting sensitive information, comprising detecting at least one literal in a database command that includes sensitive information. The literal is extracted from the database command. The literal is encrypted thereby forming an encrypted string. The literal is replaced by the encrypted string in the database command.