SQL Encryption Key Transfer Across Database Hierarchies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The transfer of encryption keys between database servers during migration processes is time-consuming and expensive due to the complexity of different key hierarchies, necessitating a secure and efficient mechanism.
Innovation Solution
A SQL transfer command (TRANSFER ENCRYPTION KEY) is used to securely transfer encryption keys between database servers, utilizing a password and filename to encrypt and export keys, with an optional override function to handle existing key conflicts, allowing for flexible and secure key management across different key hierarchies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key transfer methods are used between database servers with different key hierarchies, then security is maintained, but the transfer process becomes time-consuming and expensive
Solution Approach 1:
The patent introduces an intermediary mechanism that translates between different key hierarchy structures. The system uses a mapping table that associates keys from the source database's key hierarchy with corresponding keys in the target database's key hierarchy, enabling automated key translation during migration without manual intervention while maintaining security through encrypted key material transfer.
Solution Approach 2:
The system changes the parameters of key representation and structure during transfer. It transforms keys from one hierarchical format to another by modifying key identifiers, paths, and hierarchical relationships while preserving the cryptographic properties. This allows automatic adaptation to different database key structures without manual reconfiguration.
2Reliability
If manual key transfer processes are used, then security can be maintained, but the complexity and cost of the migration process increases
Solution Approach 1:
The system implements self-service automation where the key translation and transfer process occurs automatically without manual security operations. The translation service autonomously resolves key mappings, transfers encrypted key material, and updates the mapping tables based on the migration configuration, eliminating the need for manual security team intervention while maintaining security standards.
Solution Approach 2:
The patent creates a universal key translation mechanism that works across different database platforms and key hierarchy structures. The same translation service and mapping table approach can handle various key formats, hierarchical depths, and database types, providing a multi-functional solution that reduces overall migration complexity despite diverse target systems.
3Reliability
If external tools are used for key transfer, then security can be ensured, but the migration process requires additional external dependencies
Solution Approach 1:
The patent merges the key translation and transfer functionality directly into the database migration process itself. The translation service is integrated into the migration workflow, allowing key hierarchy translation to occur as part of the standard migration operations rather than as a separate external process. This reduces external dependencies while maintaining security through built-in encryption and authentication mechanisms.
Data Source
AI summary
Embodiments afford secure transfer of security key type(s) between different database servers having different key hierarchies. For example, a key transfer may occur from a source server to a target server during a database migration process. Particular embodiments comprise a SQL transfer command statement (e.g., TRANSFER ENCRYPTION KEY) recognized by an engine. Syntax of the SQL transfer command includes a password and a filename for a security key. Upon receiving the SQL transfer command, the engine references an information repository to identify a relevant key hierarchy and key type, encrypts the security key with a key derived from password, and stores (exports) the encrypted security key in a file for consumption (import) at the target server. The SQL transfer command may further comprise a direction component determining flow of key information, and an override function to deal with error messages arising from any already-existing security key having the same name.