Mass Encryption Management via Database Record Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Database systems face challenges in efficiently managing mass encryption processes, particularly in multi-tenant environments where tenants need to switch between encryption settings, schemes, or keys, while maintaining data security and user access continuity.
Innovation Solution
A system architecture that partitions data records into manageable groups, performs mass encryption estimation, and executes encryption processes in the background, allowing for seamless updates of encryption settings without disrupting user access, using a combination of query language-based processes and data chunking to manage resources effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mass encryption is performed on all data records, then data security is improved, but system resource consumption and processing time increase significantly
Solution Approach 1:
The patent divides the mass encryption process into manageable record groups with configurable sizes. The system partitions data records into groups and processes them sequentially, allowing resource management and preventing system overload during encryption operations
Solution Approach 2:
The system performs encryption operations in periodic batches rather than continuously. It processes one record group at a time, allows for resource management between batches, and can pause/resume operations, improving overall system productivity during mass encryption
2Reliability
If encryption settings are updated for all records, then data security is improved, but user access continuity is disrupted
Solution Approach 1:
The system performs encryption estimations and prepares record groups before actual encryption. It calculates resource requirements, partitions data into groups, and plans the encryption sequence in advance, allowing for smoother execution with minimal user disruption
Solution Approach 2:
The system maintains user access continuity by processing encryption in background batches. Users can continue accessing non-encrypted or previously encrypted records while the system progressively encrypts new batches, ensuring continuous useful action without complete system interruption
3Productivity
If record groups are processed individually, then resource management is improved, but total encryption time increases
Solution Approach 1:
The system dynamically adjusts record group sizes based on available resources and processing requirements. It can modify the number of records per group during execution, optimizing the balance between resource management efficiency and total encryption time based on real-time system conditions
4Productivity
If encryption estimation is performed, then resource allocation is improved, but additional processing overhead is added
Solution Approach 1:
The system performs partial estimation by calculating resource requirements for each record group separately rather than for all records at once. This approach provides sufficient resource allocation information while reducing the total estimation time and computational overhead
Data Source
AI summary
Methods, systems, and devices for mass encryption management are described. In some database systems, users may select encryption settings for storing data records at rest. A database may receive a request to perform an encryption process on multiple data records corresponding to a user, for example, based on a user input or a change in encryption settings. A database server may partition the data records for encryption (e.g., encryption, decryption, key rotation, or scheme modification) into one or more data record groups of similar sizes, and may perform the encryption process on one record group at a time (e.g., to reduce overhead in the system). The database server may additionally support restricting user access to the data records being actively processed, estimating resources needed for the processing, determining data record encryption statuses to be displayed by a user device, or some combination of these features.