Trusted DBMS Data Coherency via Encryption Component
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a hybrid cloud environment, maintaining data coherence and secure access to sensitive data across multiple DBMSs, especially with the rapid increase in data volume, is challenging due to the need for real-time database operations and ensuring encryption across different database systems.
Innovation Solution
A method is introduced where a first instance of a table is stored in plaintext in a trusted DBMS, with encryption information maintained for predefined columns, and data changes are encrypted and logged in plaintext before being applied to a second instance in an untrusted DBMS, enabling transparent and efficient data coherency across trusted and untrusted systems without modifying existing replication engines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is stored in plaintext in a trusted DBMS for real-time operations, then database operation speed and accessibility are improved, but data security and confidentiality deteriorate
Solution Approach 1:
The system segments data into two instances: a first instance stored in plaintext in the trusted DBMS for fast operations, and a second instance stored in encrypted form in the untrusted DBMS for security. This segmentation allows each instance to serve its specific purpose without compromise
Solution Approach 2:
An encryption component acts as an intermediary between the two DBMS instances. It maintains encryption information and transforms data changes from plaintext to encrypted form, enabling seamless synchronization while preserving security boundaries
2Object-affected harmful factors
If encryption is applied to all data in untrusted DBMS, then data security is improved, but query performance and analytical capabilities deteriorate
Solution Approach 1:
Different quality states are applied to different data instances: the first instance in the trusted DBMS maintains plaintext quality for high-performance queries and analytics, while the second instance in the untrusted DBMS maintains encrypted quality for security. Each instance's quality is optimized for its specific use case
Solution Approach 2:
Instead of encrypting data before storage and decrypting for all operations, the system inverts the approach by storing plaintext in the trusted environment and only encrypting when transferring to or storing in the untrusted environment, thereby minimizing decryption overhead and maximizing query performance where needed
3Reliability
If data is replicated across multiple DBMS instances, then data coherence and accessibility are improved, but synchronization complexity and maintenance overhead increase
Solution Approach 1:
The system performs preliminary encryption of data changes before replication using the encryption component. By pre-processing the data in the trusted DBMS with the encryption component, the actual replication to the untrusted DBMS involves simple encrypted data transfer, significantly reducing synchronization complexity
Solution Approach 2:
The system creates an encrypted copy of data changes and replicates it to the untrusted DBMS. This copying approach with pre-applied encryption simplifies the replication process compared to real-time encryption during each transfer operation
Data Source
AI summary
The present disclosure relates to a method for processing data in a database engine. The method includes storing a first instance of a first table in the database engine in plaintext. Encryption information about encryption methods and encryption keys of at least one predefined column of the first table may be maintained. In response to data changes in the column, first log entries for the data changes may be written in plaintext. The data changes may be encrypted by an encryption component using the encryption information. This results in encrypted data changes. Second log entries for the encrypted data changes may be written and applied to a second instance of the first table. The second instance of the first table is stored at a further database engine.