Data coherency between trusted DBMS and untrusted DBMS

Patent metadata

Field	Value
Publication number	US-10706039-B2
Application number	US-201916408568-A
Country	US
Kind code	B2
Filing date	May 10, 2019
Priority date	Oct 25, 2017
Publication date	Jul 7, 2020
Grant date	Jul 7, 2020

Abstract

The present disclosure relates to a method for processing data in a database engine. The method includes storing a first instance of a first table in the database engine in plaintext. Encryption information about encryption methods and encryption keys of at least one predefined column of the first table may be maintained. In response to data changes in the column, first log entries for the data changes may be written in plaintext. The data changes may be encrypted by an encryption component using the encryption information. This results in encrypted data changes. Second log entries for the encrypted data changes may be written and applied to a second instance of the first table. The second instance of the first table is stored at a further database engine.

First claim

What is claimed is:

1. A method for processing data in a database engine, the method comprising:
storing, by the database engine, a first instance of a first table in plaintext on a first storage device of a first computer system;
maintaining encryption information about encryption methods and encryption keys of at least one predefined column of the first table;
creating encrypted data on the first storage device based on the encryption methods and encryption keys of the at least one predefined column of the first table by creating a temporary table, encrypting data of the first table resulting in the encrypted data, and storing the encrypted data in the temporary table;
loading the encrypted data of the temporary table into a second instance of the first table on a second storage device of a second computer system using a further database engine, and deleting the temporary table after the loading of the encrypted data;
in response to data changes in the column, writing first log entries for the data changes in plaintext to the first storage device;
encrypting the data changes by an encryption component using the encryption information, resulting in creation of encrypted data changes in the temporary table; and
writing second log entries for the encrypted data changes and applying the encrypted data changes to the second instance of the first table based on the temporary table.

2. The method of claim 1 , wherein the database engine comprises a table loader configured to receive a request indicating a table and to transfer the table to the further database engine, wherein applying the encrypted data changes comprises sending a request to the table loader, the request indicating a temporary table comprising the encrypted data changes.

3. The method of claim 1 , further comprising locking the first table for preventing changes to the first table before creating the temporary table and unlocking the first table after loading the encrypted data into the further database engine.

4. The method of claim 1 , further comprising before writing the second log entries regularly reading the first log entries and in response to identifying first log entries of the data changes, performing the encrypting of the data changes and the writing of the second log entries.

5. The method of claim 1 , wherein applying the encrypted data changes comprises:
regularly reading the second log entries and in response to identifying second log entries of the encrypted data changes applying the encrypted data changes.

6. The method of claim 1 , wherein the database engine is configured to perform online transaction processing (OLTP) processes, wherein the further database engine is configured for performing online analytical processing (OLAP) processes.

7. The method of claim 1 , wherein the database engine is a trusted engine and the further database engine is an untrusted engine.

8. The method of claim 1 , wherein the maintaining of the encryption information comprises:
encrypting the column of the first table by the encryption component resulting in the second instance of the first table, the second instance of the first table containing at least part of the data of the first table in encrypted form; and
triggering storing of the second instance of the first table in the further database engine.

9. The method of claim 8 , further comprising:
receiving a query against the first table in a data processing system including the database engine;
determining whether to execute the query in the database engine or the further database engine, the determination involving comparison of the query type with the encryption information of the second instance of the first table; and
in response to deciding to execute the query in the further database engine, rewriting the query against the second instance of the first table by using at least the encryption information of the second instance.

Assignees

• IBM

Inventors

• Beier Felix
• Finnie Nicole
• Hrle Namik
• Lueck Einar

Classifications

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F16/2291

  User-Defined Types; Storage management thereof · CPC title

• G06F16/2365 Primary

  Ensuring data consistency and integrity · CPC title

• G06F16/221

  Column-oriented storage; Management thereof · CPC title

• G06F16/2219

  Large Object storage; Management thereof · CPC title