Transparent Column Encryption in Database Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database encryption methods either result in significant performance degradation due to bulk encryption or require explicit encryption and decryption operations, which are not transparent to applications and complicate system security and index management.
Innovation Solution
A system that transparently encrypts and decrypts data on a column-by-column basis by parsing database commands to include cryptographic operations within the parse tree, allowing for implicit transformation during database operations, key management, and support for changing encryption keys and algorithms without altering application schema.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If bulk encryption is used to encrypt entire database files, then implementation simplicity is improved, but system performance deteriorates due to long encryption/decryption times
Solution Approach 1:
The patent segments the database encryption approach by encrypting only specific columns rather than the entire database file. This allows selective encryption of sensitive data columns, reducing the encryption/decryption overhead during queries while maintaining security for critical data fields.
Solution Approach 2:
The patent applies local quality by differentiating encryption treatment across different columns. Sensitive columns are encrypted while non-sensitive columns remain unencrypted, allowing the system to optimize performance for frequently accessed data while maintaining security where needed.
2Ease of operation
If bulk encryption is used, then transparency to applications is maintained, but security is compromised because data is exposed in shared memory as plain text
Solution Approach 1:
The patent segments data encryption at the column level, allowing encrypted columns to remain encrypted in shared memory while still being accessible to applications through the database system's normal query mechanisms, thus maintaining both security and transparency.
Solution Approach 2:
The patent introduces an intermediary layer (the database management system) that handles encryption and decryption automatically. The system intercepts queries, decrypts encrypted columns as needed, performs the query, and re-encrypts results before returning them, thus maintaining security without requiring application-level changes.
3Productivity
If selective column encryption is used, then encryption overhead is reduced, but application transparency is lost requiring explicit encrypt/decrypt functions in queries
Solution Approach 1:
The patent implements self-service by having the database management system automatically handle encryption and decryption operations. When a query accesses an encrypted column, the system automatically decrypts the data, performs the query, and re-encrypts results without requiring the application to explicitly call encrypt/decrypt functions.
Solution Approach 2:
The patent introduces an intermediary layer (the database management system) that handles encryption and decryption automatically. The system intercepts queries, decrypts encrypted columns as needed, performs the query, and re-encrypts results before returning them, thus maintaining security without requiring application-level changes.
4Productivity
If selective column encryption is used, then encryption scope is limited, but index support is limited because encrypted data loses lexicographical order
Solution Approach 1:
The patent introduces an intermediary layer (the database management system) that handles encryption and decryption automatically. The system intercepts queries, decrypts encrypted columns as needed, performs the query, and re-encrypts results before returning them, thus maintaining security without requiring application-level changes.
Solution Approach 2:
The patent applies preliminary action by decrypting encrypted columns before they are used in index operations or comparisons. This allows the system to maintain encrypted storage while performing efficient index-based queries and operations on the decrypted data.
Data Source
AI summary
One embodiment of the present invention provides a system that facilitates encryption of data within a column of a database. The system operates by first receiving a command to perform a database operation. Next, the system parses the command to create a parse tree. The system then examines the parse tree to determine if a column referenced in the parse tree is an encrypted column. If a column referenced in the parse tree is an encrypted column, the system automatically transforms the command to include one or more cryptographic commands to facilitate accessing the encrypted column while performing the database operation.