Hooking-Based Database Encryption for Secure SQL Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database encryption methods, such as API and plug-in approaches, require manual coding and impose significant load on the database management system (DBMS), leading to security vulnerabilities and performance issues due to decryption of data across networks and the need for manual SQL code tuning.
Innovation Solution
A method using an application programming interface (API) to perform encryption and decryption at the application level, employing a hooking module to automatically encrypt input data and decrypt output data without modifying the source code, thereby offloading the DBMS load and maintaining data encryption during network transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the plug-in method is used for database encryption, then automatic encryption/decryption is achieved without source code modification, but the DBMS bears the entire encryption/decryption load and data is transmitted in decrypted state across the network
Solution Approach 1:
The system segments the encryption/decryption functionality into separate encryption/decryption modules that operate independently from the DBMS. The DBMS only handles encrypted data storage and retrieval, while dedicated modules perform encryption/decryption operations, preventing the DBMS from bearing the entire encryption load and ensuring data remains encrypted during transmission.
Solution Approach 2:
The patent introduces an intermediary encryption/decryption module that acts as a mediator between the application and the DBMS. This module intercepts data before it is sent to the DBMS, encrypts it, and then transmits the encrypted form. During retrieval, it decrypts the data before passing it to the application, thereby maintaining data security while enabling automatic encryption/decryption.
2Ease of operation
If the view/trigger method is used for database encryption, then source code is not modified and data access remains simple, but full access control cannot be implemented and additional inputs/outputs burden the DBMS performance
Solution Approach 1:
The patent extracts the encryption/decryption logic from the DBMS core operations and implements it as separate modules. This extraction removes the performance burden from the DBMS while maintaining automated encryption/decryption functionality. The DBMS focuses on its core strength of data management, while dedicated modules handle encryption tasks.
3Reliability
If manual API encryption/decryption is used, then data can be kept encrypted during network transmission, but developers must manually write and process encryption/decryption functions which is time-consuming and error-prone
Solution Approach 1:
The patent implements self-service encryption/decryption modules that automatically perform encryption and decryption operations without requiring manual intervention from developers. The system intercepts data automatically, applies the appropriate encryption/decryption functions, and manages the entire process autonomously, thereby maintaining data security while eliminating the complexity of manual implementation.
4Ease of operation
If data is decrypted in the DBMS and transmitted across the network, then data can be accessed by applications, but security vulnerabilities arise from decrypted data being exposed in network packets
Solution Approach 1:
The patent applies preliminary encryption action before data leaves the DBMS environment. The encryption module encrypts data immediately after retrieval from the DBMS and before it is transmitted across the network. This preliminary encryption ensures that data remains protected during transmission, eliminating security vulnerabilities while maintaining data accessibility for authorized applications.
Data Source
AI summary
Provided are a method of processing encryption of database (DB) storage data and a database management system (DBMS). The method includes, when an encrypted column inquiry request is received through an application, executing a hooking module, inquiring about, by the executed hooking module, encryption data in a DB of a DBMS, and decrypting retrieved encryption data and transmitting the decrypted data to the application. According to the method, a DB client intervenes in structured query language (SQL) transmission to a DB server and a data receiving process to automatically perform encryption and decryption. Accordingly, it is possible to automatically decrypt encrypted data without modifying an application source, or conversely, input data to a DB in an encrypted state.