FPGA Cache Selective Encryption for Database Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The use of FPGAs as cache in database systems poses security concerns, and encrypting all database queries to address these concerns results in significant performance overhead.

Innovation Solution

Implementing a programmable integrated circuit that dynamically reconfigures during runtime to apply encryption only to secure database queries, leaving non-secure queries unencrypted, thereby improving performance without compromising security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption is applied to all database queries to address security concerns, then system security is improved, but performance overhead increases significantly

Engineering Contradiction:

Improvesystem securityVSAvoiddatabase query performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies different encryption treatments to different parts of the database cache based on their security classification. Confidential data in the cache is encrypted while non-confidential data remains unencrypted, allowing selective security measures that improve overall performance while maintaining necessary protection.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system dynamically reconfigures the database cache during runtime to update security settings without interrupting operations. This allows the system to adapt encryption policies in real-time based on changing security requirements while maintaining continuous database access and performance.

Inventive Principle:

Principle #15Dynamics

2Productivity

If dynamic partial reconfiguration is implemented to apply encryption selectively, then performance overhead is reduced, but device complexity increases

Engineering Contradiction:

Improvedatabase query performanceVSAvoidFPGA reconfiguration mechanism

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The FPGA device is divided into static and partially reconfigurable regions. The static region contains permanent circuitry while the partially reconfigurable region can be dynamically updated to change encryption policies. This segmentation allows selective reconfiguration of only the necessary portions without affecting the entire device.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Instead of reconfiguring the entire FPGA device, the patent implements partial reconfiguration of only the specific regions needed for security policy changes. This partial action reduces the complexity and time required for reconfiguration while achieving the desired security updates.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11475145B2Methods and apparatus for implementing a secure database using programmable integrated circuits with dynamic partial reconfigurability

Publication Date: 2022.10.18 INTEL CORP

AI summary

A programmable logic device that is interposed between a client device and a database server is provided. The client device may issue read and write queries to the programmable logic device. The programmable logic device may serve as a cache. For read queries, confidential data that is stored locally on the programmable device or retrieved from the database server may be encrypted before sending it back to the client device. Non-confidential data may be left unencrypted and can be sent back to the client device in unencrypted form. The programmable logic device may be partially reconfigured during runtime to update database securities settings without causing unnecessary downtime for the overall system.