Transparent analytical query accelerator over encrypted data

Patent metadata

Field	Value
Publication number	US-10657128-B2
Application number	US-201916409920-A
Country	US
Kind code	B2
Filing date	May 13, 2019
Priority date	Oct 25, 2017
Publication date	May 19, 2020
Grant date	May 19, 2020

Abstract

The present disclosure relates to a method for processing queries in a database system having a first database engine and a second database engine. The method includes: storing a first instance of a first table in the first database engine in plaintext; encrypting at least one predefined column of the first table, resulting in a second instance of the first table containing at least part of the data of the first table in encrypted format. The second instance of the first table in the second database engine is stored in the second database engine. It may be determined whether to execute a received query in the first database engine on the first table or in the second database engine on the second instance of the first table, where the determination involves a comparison of the query with encryption information.

First claim

What is claimed is:

1. A method for processing queries in a database system having a first database engine and a second database engine, the method comprising:
storing a first instance of a first table in the first database engine in plaintext;
encrypting at least one predefined column of the first table, resulting in a second instance of the first table containing at least part of the data of the first table in encrypted format;
storing the second instance of the first table in the second database engine;
maintaining encryption information about encryption methods and encryption keys used for the encryption in the database system;
receiving a query against the first table;
determining whether to execute the query in the first database engine on the first table or the second database engine on the second instance of the first table, the determination involving a comparison of the query with the encryption information of the second instance of the first table, the determining resulting in a decision; and
in case of the decision to execute the query in the second database engine, rewriting the query against the second instance of the first table by using at least the encryption information.

2. The method of claim 1 , further comprising encrypting the column using a different encryption method, resulting in a third instance of the first table and storing the third instance of the first table on the second database engine or on a third database engine of the database system.

3. The method of claim 2 , further comprising determining whether to execute the query in the first database engine on the first table, on the second instance of the first table or on the third instance of the first table, the determination involving a comparison of the query with the encryption information of the second instance of the first table, the determining resulting in a decision to execute the received query on at least one of the second and third instance of the first table.

4. The method of claim 1 , further comprising:
determining that the first table is modified and repeating the encrypting and storing steps for modified values of the first table.

5. The method of claim 1 , where the determining further comprises:
in response to determining that the query comprises a read only operation, determining if the second instance of the first table results from a non-deterministic encryption of the column using the encryption information, wherein in case the second instance of the first table results from non-deterministic encryption of the column the decision is set to execute the query on the second instance of the first table, otherwise the decision is set to execute the query on the first instance of the first table.

6. The method of claim 1 , wherein the determining further comprises:
in response to determining that the query comprises a read operation only, determining if the second instance of the first table results from an order preserving encryption of the column using the encryption information, wherein in case the second instance of the first table results from an order preserving encryption of the column the decision is set to execute the query on the second instance of the first table, otherwise the decision is set to execute the query on the first instance of the first table.

7. The method of claim 1 , wherein the encrypting further comprises:
generating encryption keys using metadata of the first table, or retrieving encryption keys from a persistent storage if the encryption keys exist.

8. The method of claim 1 , wherein the encryption is performed using an encryption method that is user, and/or column and/or engine specific.

9. The method of claim 1 , wherein the database system is a hybrid online transaction processing (OLTP) and online analytical processing (OLAP) database system, wherein the first database engine is configured to perform OLTP processes, wherein the second database engine is configured to perform OLAP processes.

10. The method of claim 1 , wherein the method is automatically performed in response to storing the first table in the first database engine.

11. The method of claim 1 , wherein the first database engine is a trusted engine and the second database engine being an untrusted engine.

12. The method of claim 1 , wherein the encryption method comprises at least one of:
an order preserving encryption, a deterministic encryption, and a non-deterministic encryption.

13. The method of claim 1 , wherein the execution of the query in the second database engine results in encrypted data, the method further comprising enabling access to the encrypted data to predefined users by providing decryptions keys to the predefined users for decrypting the encrypted data.

Assignees

• IBM

Inventors

• Beier Felix
• Finnie Nicole
• Hrle Namik
• Müller Jens

Classifications

• G06F16/2455

  Query execution · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• G06F16/283

  Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP · CPC title

• G06F16/24547 Primary

  Optimisations to support specific applications; Extensibility of optimisers · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title