External Key Management for Database Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in ensuring secure access to encrypted data, as internal key management may allow unauthorized access by database operators, violating regulatory requirements for data protection and privacy.
Innovation Solution
Integrating a database system with an external key management system (KMS) to manage key encryption keys, where the external KMS is used to encrypt and decrypt data encryption keys, allowing for segregation of duties and ensuring only authorized personnel can access and manage encryption keys, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If internal key management is used within the database system, then ease of operation is improved, but security and compliance with data protection regulations deteriorates due to potential unauthorized access by database operators
Solution Approach 1:
The system segments key management functions by separating the database system from the key management system. The key management system is deployed as a distinct service that operates independently, with only encrypted data stored in the database. This segmentation prevents database operators from accessing encryption keys while maintaining operational efficiency through automated key retrieval mechanisms.
Solution Approach 2:
The invention extracts the key management functionality from the database system and places it in an external key management system. The encryption keys are stored and managed outside the database environment, removing the potential security risk of internal key management while preserving the ability to encrypt and decrypt data through automated interfaces.
2Reliability
If encryption keys are stored outside the database system, then security and compliance are improved, but device complexity increases due to integration requirements
Solution Approach 1:
The system introduces an intermediary mechanism that automatically retrieves encryption keys from the external key management system when needed. This intermediary layer simplifies the integration by providing a standardized interface for key retrieval, eliminating the need for complex manual key management procedures while maintaining security through external key storage.
3Ease of operation
If database operators have access to encryption keys, then ease of data access is improved, but compliance with data protection regulations deteriorates due to potential unauthorized access
Solution Approach 1:
The invention extracts encryption keys from the database operator's environment and places them in an external key management system. Database operators can still access encrypted data through the database interface, but the keys themselves are stored externally, preventing unauthorized access while maintaining ease of data retrieval through automated key retrieval mechanisms.
Data Source
AI summary
The present disclosure involves systems, software, and computer implemented methods for database integration with an external key management system. One example method includes receiving, by a database system, a key encryption key from an external key management system external to the database system that is used to encrypt a data encryption key used to encrypt database data. The data encryption key is obtained, by the database system, using the key encryption key. Encrypted database data is decrypted, by the database system and using the data encryption key, to obtain decrypted database data before performing an operation on the decrypted database data. The database system determines that the external key management system has performed an operation on the key encryption key. In response to determining that the external key management system has performed the operation on the key encryption key, the database system modifies operation of the database system.