Back to results
US 7,984,025 B2Granted
Method for reencryption of a database
AssigneeProtegrity Corporation
InventorsThomas Valfridsson, Ulf Mattsson
Life of this patent
Estimating the term…
Abstract
The present invention relates to a method for encryption of the content in a database, for accomplishing increased protection against unauthorised access to the data. The method assures that every row and item is re-encrypted with a valid key. More specifically this process, the so-called KeyLife process, is executed every time a row is inserted, updated or retrieved after a scanning operation. The key life value, defining the number of days a key is valid for each item, could differ for the items, and could typically be between 30 and 90 days. The scanning operation, checking the validity of the presently used keys, the so-called KeyLife checking, is executed each time a new key generation is created.
Claims11
A method for re-encrypting one or more data items that are encrypted and stored in a database, where said re-encrypting being an automated background process, said method for re-encrypting comprising the steps of:
- in an initial time period, encrypting and storing the one or more data items in the database, wherein:
- (1) the one or more data items are encrypted using an encryption key having a key life, wherein the key life is between 30 and 90 days in the future,
- (2) the key life is associated with the one or more stored encrypted data items,
- (3) a time stamp is stored one of with the encrypted one or more data items or in a another table or data set, and
- (4) where the time stamp is representative of a time period during which the encryption key used to encrypt the one or more data items was generated or started to be used and representative of the time period the one or more encrypted items were last updated or inserted into the database;
- entering a next time period, the next time period being at least subsequent to the time period(s) during which the one or more data items were updated or inserted into the database and having a corresponding time length, and wherein:
- generating a new encryption key with an associated key life at the start of the next time period;
- scanning the data base and identifying whether any of the one or more encrypted data items were previously encrypted using an encryption key now determined to be expired, wherein key expiration being determined from the key life and time stamp associated with the encrypted one or more data items in the database;
- identifying any of the one or more encrypted data items stored in the database that were determined to be previously encrypted using a now expired encryption key, and wherein:
- (a) decrypting each of the identified one or more data items and re-encrypting each of the identified one or more data items using the new encryption key,
- (b) changing the key life of the re-encrypted one or more encrypted data items to correspond to the key life for the new encryption, and
- (c) storing another time stamp and an encryption key generation counter with the re-encrypted one or more data items, where the another time stamp is representative of the next time period;
- and
- wherein said scanning step is performed automatically one of after insertion of a new row into the database, updating of an existing row in the database or retrieval of content from the existing row in the database.
11 more elements
A system comprising
- a computer on which is stored a program including instructions that are configured so as to carry out a method for re-encrypting one or more data items that are encrypted and stored in a database, wherein said method includes the steps of:
- in an initial time period, encrypting and storing the one or more data items in the database, wherein:
- (1) the one or more data items are encrypted using an encryption key having a key life, wherein the key life is between 30 and 90 days in the future,
- (2) the key life is associated with the one or more stored encrypted data items,
- (3) a time stamp is stored one of with the encrypted one or more data items or in a another table or data set, and
- (4) where the time stamp is representative of a time period during which the encryption key used to encrypt the one or more data items was generated or started to be used and representative of the time period the one or more encrypted items were last updated or inserted into the database;
- entering a next time period, the next time period being at least subsequent to the time period(s) during which the one or more data items were updated or inserted into the database and having a corresponding time length, and wherein:
- generating a new encryption key with an associated key life at the start of the next time period;
- scanning the data base and identifying whether any of the one or more encrypted data items were previously encrypted using an encryption key now determined to be expired, wherein key expiration being determined from the key life and time stamp associated with the encrypted one or more data items in the database;
- wherein said scanning is performed automatically one of after insertion of a new row into the database, updating of an existing row in the database or retrieval of content from the existing row in the database;
- and
- identifying any of the one or more encrypted data items stored in the database that were determined to be previously encrypted using a now expired encryption key, and wherein:
- (a) decrypting each of the identified one or more data items and re-encrypting each of the identified one or more data items using the new encryption key,
- (b) changing the key life of the re-encrypted one or more encrypted data items to correspond to the key life for the new encryption, and
- (c) storing another time stamp and an encryption key generation counter with the re-encrypted one or more data items, where the another time stamp is representative of the next time period.
12 more elements
A system comprising:
- a computer for executing a program for re-encrypting one or more data items that are encrypted and stored in a database, where said re-encrypting being an automated background process;
- and
- wherein said program is configured to perform the method steps of:
- in an initial time period, encrypting and storing the one or more data items in the database, wherein:
- (1) the one or more data items are encrypted using an encryption key having a key life, wherein the key life is between 30 and 90 days in the future,
- (2) the key life is associated with the one or more stored encrypted data items,
- (3) a time stamp is stored one of with the encrypted one or more data items or in a another table or data set, and
- (4) where the time stamp is representative of a time period during which the encryption key used to encrypt the one or more data items was generated or started to be used and representative of the time period the one or more encrypted items were last updated or inserted into the database;
- entering a next time period, the next time period being at least subsequent to the time period(s) during which the one or more data items were updated or inserted into the database and having a corresponding time length, and wherein:
- generating a new encryption key with an associated key life at the start of the next time period;
- scanning the data base and identifying whether any of the one or more encrypted data items were previously encrypted using an encryption key now determined to be expired, wherein key expiration being determined from the key life and time stamp associated with the encrypted one or more data items in the database;
- wherein said scanning is performed automatically one of after insertion of a new row into the database, updating of an existing row in the database or retrieval of content from the existing row in the database;
- and
- identifying any of the one or more encrypted data items stored in the database that were determined to be previously encrypted using a now expired encryption key, and wherein:
- (a) decrypting each of the identified one or more data items and re-encrypting each of the identified one or more data items using the new encryption key,
- (b) changing the key life of the re-encrypted one or more encrypted data items to correspond to the key life for the new encryption, and
- (c) storing another time stamp and an encryption key generation counter with the re-encrypted one or more data items, where the another time stamp is representative of the next time period.
14 more elements
Dependencies are inferred from the claim text.