Secure data replication in distributed data storage environments

Patent metadata

Field	Value
Publication number	US-11501014-B2
Application number	US-202016868902-A
Country	US
Kind code	B2
Filing date	May 7, 2020
Priority date	May 7, 2020
Publication date	Nov 15, 2022
Grant date	Nov 15, 2022

Abstract

A described method includes receiving, by a database system, an instruction to change a first data element in a table in a database, which includes a first copy and a second copy of the table. A first entry is created in a first change-table. The first entry includes an updated value for a first data element. A second entry is created in a second change-table. Creating the second entry includes, changing the updated value into a ciphertext if the first data element is secured, and storing the ciphertext into the second entry. If the first data element is non-secured, the updated value is stored into the second entry as is. The second copy of the table is modified using the second change-table. The second copy of the table is used to respond to subsequent queries.

First claim

What is claimed is:

1. A computer-implemented method for secure data replication in data storage environments, the method comprising:
receiving, by a database system, an instruction to change a first data element from a first row in a table that is in a database, the database comprising a first copy of the table and a second copy of the table; and
performing, by the database system, in response to the receiving:
creating a first entry in a first change-table, the first change-table comprises update-records that are to be applied to the first copy of the table, the first entry including an updated value provided by the instruction to apply to the first data element in the first copy of the table;
creating a second entry in a second change-table, the second change-table comprises update-records that are to be applied to the second copy of the table, the second entry corresponding to the first entry, and wherein the creating the second entry comprising:
in response to determining that the first data element is a secured data element, changing the updated value from the first entry into a ciphertext using a security algorithm, and storing the ciphertext into the second entry as content of the first data element in the second change-table, instead of the updated value; and
in response to determining that the first data element is a non-secured data element, storing the updated value into the second entry as content of the first data element of the second change-table without securing the updated value; and
modifying, by the database system, the second copy of the table based on security of the first data element according to the instruction that is received using the second change-table, wherein the second copy of the table is used to respond to subsequent queries.

2. The method of claim 1 , wherein the first data element is determined to be secured based on settings of the database.

3. The method of claim 1 , wherein the first entry further comprises a timestamp that indicates when the first entry was created.

4. The method of claim 3 , wherein the second entry is created as part of a periodic update to the table, and wherein the second entry is created in response to the timestamp indicating that the first entry was created after the most recent periodic update.

5. The method of claim 1 , wherein converting the updated value to the ciphertext comprises changing the updated value using a format preserving security algorithm.

6. The method of claim 1 , wherein converting the updated value to the ciphertext comprises changing a format of the updated value, wherein a schema of the first change-table is distinct from a schema of the second change-table.

7. The method of claim 1 , wherein converting the updated value to the ciphertext comprises storing security metadata that can revert the ciphertext back to the updated value.

8. The method of claim 7 , wherein the security metadata is stored in the second change-table.

9. A database system comprising:
a memory device; and
one or more processors coupled with the memory device, the one or more processors configured to perform a method for secure data replication in a database, the database comprising a first copy of a table and a second copy of the table, and the method comprising:
receiving an instruction to change a first data element in the table; and
performing, in response to the receiving:
creating a first entry in a first change-table, the first entry comprises a plurality of data elements including an updated value provided by the instruction to apply to the first data element;
creating a second entry in a second change-table, the creating the second entry comprising:
in response to determining that the first data element is a secured data element, changing the updated value from the first entry into a ciphertext using a security algorithm, and storing the ciphertext into the second entry as content of the first data element in the second change-table, instead of the updated value; and
in response to determining that the first data element is a non-secured data element, storing the updated value into the second entry as content of the first data element of the second change-table without securing the updated value; and
modifying the second copy of the table according to the instruction that is received using the second change-table, wherein the second copy of the table is used to respond to subsequent queries.

10. The system of claim 9 , wherein the first data element is determined to be secured based on settings of the database.

11. The system of claim 9 , wherein the first entry further comprises a timestamp that indicates when the first entry was created.

12. The system of claim 11 , wherein the second entry is created as part of a periodic update to the table, and wherein the second entry is created in response to the timestamp indicating that the first entry was created after the most recent periodic update.

13. The system of claim 9 , wherein converting the updated value to the ciphertext comprises changing the updated value using a format preserving security algorithm.

14. The system of claim 9 , wherein converting the updated value to the ciphertext comprises changing a format of the updated value, wherein a schema of the first change-table is distinct from a schema of the second change-table.

15. The system of claim 9 , wherein converting the updated value to the ciphertext comprises storing security metadata that can revert the ciphertext back to the updated value.

16. The system of claim 15 , wherein the security metadata is stored in the second change-table.

17. A computer program product comprising a non-transitory storage medium readable by one or more processing circuits, the storage medium storing instructions executable by the one or more processing circuits to perform a method for secure data replication in a database, the database comprising a first copy of a table and a second copy of the table, the method comprises:
receiving an instruction to change a first data element in the table, and in response:
creating a first entry in a first change-table, the first entry comprises a plurality of data elements including an updated value provided by the instruction to apply to the first data element;
creating a second entry in a second change-table, the creating the second entry comprising:
in response to determining that the first data element is a secured data element, changing the updated value from the first entry into a ciphertext using a security algorithm, and storing the ciphertext into the second entry as content of the first data element in the second change-table, instead of the updated value; and
in response to determining that the first data element is a non-secured data element, storing the updated value into the second entry as content of the first data element of the second change-table without securing the updated value; and
modifying the second copy of the table according to the instruction that is received using the second change-table, wherein the second copy of the table is used to respond to subsequent queries.

18. The computer program product of claim 17 , wherein the first data element is determined to be secured based on settings of the database.

19. The computer program product of claim 17 , wherein the first entry further comprises a timestamp that indicates when the first entry was created, and wherein the second entry is created as part of a periodic update to the table, and wherein the second entry is created in response to

Assignees

• IBM

Inventors

• Sofia Anthony Thomas
• Katonica Jason G
• Balta Trent Matthew
• Cohoon Michael Terrence
• Reilly Torin

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/27 Primary

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• G06F16/2358 Primary

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• G06F16/2322

  using timestamps · CPC title

• G06F16/2282

  Tablespace storage structures; Management thereof · CPC title