Transparent Encryption Server for Database Data Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for transparent data encryption and decryption in databases, such as IBM DB2 on Z/OS, are limited due to the lack of support for 'Instead of' triggers, making it difficult to apply cryptographic functions without modifying existing software code or using specific database facilities.

Innovation Solution

A high-performance encryption server system that uses application program interfaces (APIs) and exit routines to transparently encrypt and decrypt data by coupling a cryptographic appliance with a data store, allowing cryptographic operations to be performed without application awareness, utilizing data flow events to automatically generate encryption and decryption requests.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If conventional transparent encryption methods using 'Instead of' triggers are used, then cryptographic functions can be applied to database data, but these methods are limited by database facility support and cannot be applied to databases like IBM DB2 on Z/OS that lack such triggers

Engineering Contradiction:

Improvedatabase compatibilityVSAvoidencryption functionality

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces an encryption server as an intermediary component between the application and the database. This server intercepts data I/O operations through a driver layer, performs encryption/decryption operations, and returns the processed data to the application. This mediator approach enables transparent encryption in databases that lack native trigger support, such as IBM DB2 on Z/OS, while maintaining encryption reliability through dedicated cryptographic processing.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If application modification is used to implement encryption, then cryptographic services can be integrated, but existing software code must be rewritten or modified to call cryptographic APIs

Engineering Contradiction:

Improvecryptographic service integrationVSAvoidsoftware modification requirement

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The encryption server acts as an intermediary that transparently handles cryptographic operations without requiring application modification. The driver layer intercepts data I/O operations and automatically performs encryption/decryption, allowing existing applications to continue functioning unchanged while still benefiting from integrated cryptographic services.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The encryption server provides self-service cryptographic processing by automatically encrypting data before it is written to the database and decrypting data when it is read. This automated process eliminates the need for applications to manually call cryptographic APIs, maintaining security integration while reducing software modification requirements.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If transparent encryption mechanism is implemented, then no application program modifications are needed, but specific database facilities like 'Instead of' triggers must be supported

Engineering Contradiction:

Improveapplication transparencyVSAvoiddatabase facility requirement

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The encryption server serves as an intermediary driver layer that provides transparent encryption without relying on database-specific facilities like 'Instead of' triggers. By operating at the driver level, it intercepts and processes data I/O operations before they reach the database, enabling applications to remain unchanged while expanding compatibility to databases that lack advanced trigger capabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Reliability

If bulk data encryption is performed in large databases, then data security is improved, but encryption and decryption speed must be maintained for efficient data access and query

Engineering Contradiction:

Improvedata securityVSAvoidencryption decryption speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The encryption server implements self-service cryptographic processing that automatically encrypts and decrypts data in bulk operations without manual intervention. This automated approach maintains data security while optimizing performance by handling encryption/decryption efficiently at the driver layer, reducing the performance overhead associated with processing large volumes of data.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS8386768B2High performance data encryption server and method for transparently encrypting/decrypting data

Publication Date: 2013.02.26 THALES DIS CPL USA INC

AI summary

High-performance data encryption/decryption server and method for transparently encrypting/decrypting data. System and method for encryption and/or decryption cryptographic services that have applicability small and large databases and especially to encryption and/or decryption of bulk data. Method for transparently applying a cryptographic operation to application-specific data. Encryption server for transparent encryption and decryption of application specific data. Method for transparently encrypting application specific data. Computer program stored on a computer readable media for modifying the operation of a computer process implementing a method for transparently encrypting application specific data. System and appliance for transparently encrypting application specific data. System for transparently applying a cryptographic operation to application-specific data.