Data coherency between trusted DBMS and untrusted DBMS

Patent metadata

Field	Value
Publication number	US-10698883-B2
Application number	US-201715792848-A
Country	US
Kind code	B2
Filing date	Oct 25, 2017
Priority date	Oct 25, 2017
Publication date	Jun 30, 2020
Grant date	Jun 30, 2020

Abstract

The present disclosure relates to a method for processing data in a database engine. The method includes storing a first instance of a first table in the database engine in plaintext. Encryption information about encryption methods and encryption keys of at least one predefined column of the first table may be maintained. In response to data changes in the column, first log entries for the data changes may be written in plaintext. The data changes may be encrypted by an encryption component using the encryption information. This results in encrypted data changes. Second log entries for the encrypted data changes may be written and applied to a second instance of the first table. The second instance of the first table is stored at a further database engine.

First claim

What is claimed is:

1. A computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code configured to be executed by a processor to perform:
storing, by a database engine, a first instance of a first table in plaintext on a first storage device;
maintaining encryption information about encryption methods and encryption keys of at least one predefined column of the first table;
creating encrypted data on the first storage device based on the encryption methods and encryption keys of the at least one predefined column of the first table by creating a temporary table, encrypting data of the first table resulting in the encrypted data, and storing the encrypted data in the temporary table;
loading the encrypted data of the temporary table into a second instance of the first table on a second storage device using a further database engine, and deleting the temporary table after the loading of the encrypted data;
in response to data changes in the column, writing first log entries for the data changes in plaintext to the first storage device;
encrypting the data changes by an encryption component using the encryption information, resulting in creation of encrypted data changes in the temporary table; and
writing second log entries for the encrypted data changes and applying the encrypted data changes to the second instance of the first table based on the temporary table.

2. The computer program product of claim 1 , wherein the database engine comprises a table loader configured to receive a request indicating a table and to transfer the table to the further database engine, wherein applying the encrypted data changes comprises sending a request to the table loader, the request indicating a temporary table comprising the encrypted data changes.

3. The computer program product of claim 1 , wherein the processor is configured to execute instructions to lock the first table for preventing changes to the first table before creating the temporary table and unlock the first table after loading of the encrypted data into the further database engine.

4. The computer program product of claim 1 , wherein the processor is configured to perform before writing the second log entries regularly reading the first log entries and in response to identifying first log entries of the data changes, performing the encrypting of the data changes and the writing of the second log entries.

5. The computer program product of claim 1 , wherein applying the encrypted data changes comprises:
regularly reading the second log entries and in response to identifying second log entries of the encrypted data changes applying the encrypted data changes.

6. The computer program product of claim 1 , wherein the database engine is configured to perform online transaction processing (OLTP) processes, wherein the further database engine is configured for performing online analytical processing (OLAP) processes.

7. The computer program product of claim 1 , wherein the database engine is a trusted engine and the further database engine is an untrusted engine.

8. The computer program product of claim 1 , wherein maintaining of the encryption information comprises:
encrypting the column of the first table by the encryption component resulting in the second instance of the first table, the second instance of the first table containing at least part of the data of the first table in encrypted form; and
triggering storing of the second instance of the first table in the further database engine.

9. The computer program product of claim 8 , wherein the processor is configured to perform a plurality of operations comprising:
receiving a query against the first table in a data processing system including the database engine;
determining whether to execute the query in the database engine or the further database engine, the determination involving comparison of the query type with the encryption information of the second instance of the first table; and
in response to deciding to execute the query in the further database engine, rewriting the query against the second instance of the first table by using at least the encryption information of the second instance.

10. A system for processing data, the system comprising:
a first computer system comprising a first processor and a first storage device, the first processor configured to execute a plurality of instructions to:
store, by a database engine, a first instance of a first table in the database engine in plaintext on the first storage device; and
maintain encryption information about encryption methods and encryption keys of at least one predefined column of the first table;
create encrypted data on the first storage device based on the encryption methods and encryption keys of the at least one predefined column of the first table by creating a temporary table, encrypting data of the first table resulting in the encrypted data, and storing the encrypted data in the temporary table;
in response to data changes in the column, write first log entries for the data changes in plaintext to the first storage device; and
encrypt the data changes by an encryption component using the encryption information, resulting in creation of encrypted data changes in the temporary table.

11. The system of claim 10 , further comprising:
a second computer system comprising a second processor and a second storage device, the second processor configured to execute a plurality of instructions to:
load the encrypted data of the temporary table into a second instance of the first table on a second storage device of a second computer system using a further database engine, wherein the temporary table is deleted after the loading of the encrypted data; and
writing second log entries for the encrypted data changes and applying the encrypted data changes to the second instance of the first table based on the temporary table.

12. The system of claim 11 , wherein the database engine comprises a table loader configured to receive a request indicating a table and to transfer the table to the further database engine, wherein applying the encrypted data changes comprises sending a request to the table loader, the request indicating a temporary table comprising the encrypted data changes.

13. The system of claim 11 , wherein the first processor is configured to execute instructions to lock the first table for preventing changes to the first table before creating the temporary table and unlock the first table after loading of the encrypted data into the further database engine.

14. The system of claim 11 , wherein the system is configured to perform before writing the second log entries regularly reading the first log entries and in response to identifying first log entries of the data changes, performing the encrypting of the data changes and the writing of the second log entries.

15. The system of claim 11 , wherein applying the encrypted data changes comprises:
regularly reading the second log entries and in response to identifying second log entries of the encrypted data changes applying the encrypted data changes.

16. The system of claim 11 , wherein the database engine is configured to perform online transaction processing (OLTP) processes, wherein the further database engine is configured for performing online analytical processing (OLAP) processes.

17. The system of claim 11 , wherein the database engine is a trusted engine and the further database engine is an untrusted engine.

Assignees

• IBM

Inventors

• Beier Felix
• Finnie Nicole
• Hrle Namik
• Lueck Einar

Classifications

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F16/221

  Column-oriented storage; Management thereof · CPC title

• G06F16/2291

  User-Defined Types; Storage management thereof · CPC title

• G06F16/2365 Primary

  Ensuring data consistency and integrity · CPC title

• H04L63/045

  wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title