Database Encryption via SQL Annotation and Driver Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database encryption technologies, such as API, plug-in, and network proxy schemes, face challenges like requiring application rebuilding, increased database load, and complex configuration, especially when switching encryption on or off or when using cloud services.
Innovation Solution
A method and apparatus for data encryption and decryption using SQL syntax with encryption policy identification information as annotations, allowing encryption and decryption to be performed within the database connectivity driver, facilitating switching and reducing the need for application rebuilding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If API scheme is used for database encryption, then data security is improved, but application program must be rebuilt because encryption affects the logic of the application program
Solution Approach 1:
The patent introduces an intermediary component (encryption processing module or plug-in) that sits between the application program and the database. This intermediary handles encryption and decryption operations transparently, allowing data security to be improved without requiring changes to the application program logic. The intermediary acts as a mediator that translates encrypted data back into usable form for the application.
2Reliability
If plug-in scheme is used for database encryption, then data security is improved, but database load increases because encryption processing module is installed in the database and load is concentrated on the database
Solution Approach 1:
The patent segments the encryption functionality from the database core by implementing it as a separate plug-in or external module. This segmentation allows the encryption processing to be distributed or handled independently, preventing the database itself from bearing the full load of encryption operations. The segmentation enables the database to focus on data management while the plug-in handles security operations.
3Reliability
If network proxy scheme is used for database encryption, then data security is improved, but system configuration becomes complex because multiplexing of network proxy node instance is required
Solution Approach 1:
The patent creates a universal encryption processing module that can be applied across different database systems and configurations without requiring separate network proxy instances. This multi-functional module provides encryption capabilities that work seamlessly with various database architectures, simplifying the overall system configuration while maintaining data security.
Data Source
AI summary
A method of data encryption according to one embodiment includes generating a structured query language (SQL) syntax that includes manipulation target data and encryption policy identification information in the form of an annotation regarding the manipulation target data, receiving encryption policy information that corresponds to the encryption policy identification information in the form of an annotation from an encryption policy server, and converting the manipulation target data in the SQL syntax into cipher text on the basis of the encryption policy information.