Column wise encryption for lightweight DB engine
AssigneeSamsung Electronics Co., Ltd.
InventorsAbdul Syed-Ebrahim, Peng Ning, Ken Chen
Life of this patent
Estimating the term…
Abstract
An apparatus and method for operating a relational database (DB) are provided. The method includes determining a sensitivity classification for a column of a table in the DB, performing encryption, using a data encryption key (DEK), of sensitive data when writing the sensitive data to the column determined to be sensitive, performing decryption, using the DEK, of the encrypted sensitive data when reading the sensitive data from the column determined to be sensitive, and performing writing to the column and reading from the column of unencrypted non-sensitive data when the column is determined to be non-sensitive.
Claims22
A method of securely storing and retrieving sensitive and non-sensitive data in a same relational database (DB), the method comprising:
- determining a sensitivity classification for each column of a table in the DB;
- determining a different data encryption key (DEK) corresponding to each cell of a column in the DB, wherein the sensitivity classification of the column is determined to be sensitive;
- encrypting sensitive data using the DEK of a corresponding cell in the column and writing the encrypted sensitive data to the corresponding cell;
- decrypting, using the DEK, the encrypted sensitive data when reading the sensitive data from the corresponding cell in the column;
- and
- performing writing to and reading from another column of unencrypted non-sensitive data in the DB, wherein the sensitivity classification of the other column is determined to be non-sensitive;
- prefixing an encoder type and related headers to the sensitive data;
- and
- wherein performing intercepting, parsing, the encrypting, and the decrypting of the data is configured to occur at a record processing layer,
- wherein the encoder type indicates an encryption used to encrypt the sensitive data.
An apparatus configured to securely store and retrieve sensitive and non-sensitive data in a same relational database (DB), the apparatus comprising:
- a storage configured to store the DB;
- a cache;
- and
- at least one processor comprising an engine configured to read from and write to the DB,
- wherein the engine comprises:
- a structured query language (SQL) statement processing layer;
- a byte code processing layer;
- a record processing layer;
- and
- a page processing layer,
- wherein the controller is configured to:
- determine a sensitivity classification for each column of a table in the DB,
- determine a different data encryption key (DEK) corresponding to each cell of a column in the DB, wherein the sensitivity classification of the column is determined to be sensitive,
- encrypt sensitive data using the DEK of a corresponding cell in the column and write the encrypted sensitive data to the corresponding cell,
- decrypt, using the DEK, the encrypted sensitive data when reading the sensitive data from the corresponding cell in the column, and
- perform writing to and reading from another column of unencrypted non-sensitive data in the DB,
- wherein the sensitivity classification of the other column is determined to be non-sensitive,
- wherein an encoder type and related headers are prefixed to the sensitive data,
- wherein the encoder type indicates an encryption used to encrypt the sensitive data, and
- wherein the record processing layer is configured to perform intercepting, parsing, the encrypting, and the decrypting of data.
A non-transitory computer readable storage medium encoded with instructions, executable by a processor, to perform a method comprising:
- determining a sensitivity classification for a column of a table in a relational database (DB), wherein the table includes both a column of sensitive data and another column of non-sensitive data;
- determining a different data encryption key (DEK) corresponding to each cell of the column in the DB, wherein the sensitivity classification of the column is determined to be sensitive;
- encrypting sensitive data using the DEK of a corresponding cell in the column and writing the encrypted sensitive data to the corresponding cell;
- decrypting, using the DEK, the encrypted sensitive data when reading the sensitive data from the corresponding cell in the column;
- performing writing to and reading from the other column of unencrypted non-sensitive data in the DB, wherein the sensitivity classification of the other column is determined to be non-sensitive;
- prefixing an encoder type and related headers to the sensitive data, and
- wherein performing intercepting, parsing, the encrypting, and the decrypting of data is configured to occur at a record processing layer,
- wherein the encoder type indicates an encryption used to encrypt the sensitive data.
Dependencies are inferred from the claim text.