KR101330071B1 - Security apparatus and method for protecting numeric data in database - Google Patents

Abstract

The present invention relates to a book scanner which automatically sets a book on a scanning surface in the mounting process for scanning of the book to prevent discomfort in the wrist and improve convenience in use. That is, the present invention comprises a book mounting part (100), which is formed to incline rearwards, in the book scanner. Therefore, the present invention allows the book to slide on the scanning surface by book weight to be automatically set to a right position in the mounting process of the book by the book mounting part which is formed to incline rearwards. The present invention can improve the convenience in use by minimizing the discomfort in the wrist when the book scanner is used. [Reference numerals] (S31) Calculate the length of plane language number type data;(S32) Decoding;(S33) Encryption;(S34) Encoding;(S35) Size conversion from the length of the encoded data into the length of plane language number type data

Description

Security Apparatus and Method for Protecting Numeric Data in Database

The present invention relates to a database security apparatus and method, and more particularly, to a security apparatus and method for protecting numeric data in a database.

Recently, various companies, companies, and public institutions manage a large amount of customer information in a database, and provide various content services based on customer authentication or customer customization.

Among the many information stored in the database, personal information that must be protected by laws or regulations is data that requires encryption. However, data that needs to be encrypted increases in size through encryption and encoding (converted into human-recognizable characters). Therefore, the size of the storage space (column unit, etc.) of the database must be increased and stored.

Most database security programs currently in service store encrypted personal information by increasing the column size of the database when encrypting to protect personal information. Therefore, when storing personal information such as name, address, social security number, and card number in the database, it is necessary to encrypt the personal information for security reasons, so that the capacity of the database becomes large and the processing speed decreases.

For example, even in the case of numeric data having a fixed length such as a social security number or a card number, the encrypted data cannot be stored again in the storage space in which the original data is stored because its size increases after the data is encrypted.

Therefore, in the conventional database security device, even for encryption of unencrypted plain text numeric data, the size of the storage space must be increased in the database, and the programs of various service systems that use the data must be modified. There is a problem that occurs.

An object of the present invention is to provide a security apparatus and method for numeric data in a database that maintains the same length when encrypting numeric data in a database.

In order to solve the above technical problem, the security method of the numeric data of the database according to an embodiment of the present invention, the step of obtaining the length of the plain text numeric data input from the database and requested encryption, the length of the plain text numeric data Decoding the plain text numeric data so as to reduce the number, encrypting the decoded data, encoding the encrypted data, and size converting the length of the encoded data into the length of the plain text numeric data.

In one embodiment, the plain text numeric data is data that requires encryption in the database. The data that requires encryption is numeric user information or customer information including at least one of social security number, date of birth, telephone number, card number, financial account number, and password.

In one embodiment, the method of securing numeric data in a database further comprises, prior to the step of decoding, determining whether the length of the plain text numeric data is greater than or equal to the reference length. The minimum reference length may be four.

In one embodiment, the decoding step uses Hexadecimal (HEX) decoding.

In one embodiment, the method of securing numeric data in a database further comprises converting the decimal plain text numeric data to hexadecimal before decoding.

In one embodiment, the security method of the numeric data of the database, after determining whether the number of digits of the original data or the data converted to hexadecimal number is even, if the odd number is a preset number to the first digit to the even number of digits of the data It further comprises the step of adding. The preset number may be zero.

In one embodiment, a method of securing numeric data in a database may include determining whether the length of the plain text numeric data is of a particular length before the decoding step or before converting the decimal plain text data into hexadecimal. It includes more. Here, if the length of the plain text numeric data is not a specific length, the security method may directly perform decoding without performing the step of converting the decimal plain text numeric data into hexadecimal.

In one embodiment, the step of encoding comprises Base64 encoding the encrypted data.

In one embodiment, the step of encoding comprises dividing the number of digits of the encrypted data by dividing the number of digits of the encrypted data by three and rounding the remainder up to the number of digits multiplied by four.

In one embodiment, a method of securing numeric data in a database comprises, after encoding, comparing the length of encoded data to the length of plain text numeric data, and using padding set to Base64 encoding according to the comparison result. It further includes the step of adjusting the number of digits.

According to another aspect of the present invention, there is provided a method of securing numeric data in a database, the method comprising: obtaining a length of a cipher text input from the database and requested to be decrypted, base64 decoding the cipher text, decrypting the decoded data, and decrypting HEX (Hexadecimal) encoding of one data, and a size conversion step of adding zeros to the front of the encoded data when the length of the encoded data is different from the length of the cipher text.

Security apparatus for numeric data of a database according to an embodiment of the present invention, the length calculation unit for calculating the length of the plain text numeric data input from the database and the encryption is requested, the plain text number so that the length of the plain text numeric data is reduced A decoding unit for decoding the type data, an encryption unit for encrypting the decoding data of the decoding unit, an encoding unit for encoding the encryption data of the encryption unit, and a size conversion unit for size-converting the length of the encoding data of the encoding unit to the length of the plain text data. .

Security device for numeric data of a database according to another embodiment of the present invention, the length calculation unit for calculating the length of the plain text numeric data input from the database and the encryption is requested, the length of the plain text numeric data is more than the reference length A length determining unit for determining recognition, a decoding unit for HEX (Hexadecimal) decoding of plain text numeric data, an encryption unit for encrypting the decoding data of the decoding unit, an encoding unit for Base64 encoding the encryption data of the encryption unit, and padding the encoded data in the encoding unit. It includes a padding insert for inserting.

In accordance with still another aspect of the present invention, there is provided a security apparatus for numeric data in a database, comprising: a length calculator configured to calculate a length of a cipher text inputted from the database and requested to be decrypted; A decoder which decodes the data decoded by the decoder, an encoder which encodes the data decoded by the decoder, HEX (Hexadecimal) encoding, and a leading digit of the encoded data when the length of the data encoded by the encoder is different from the length of the ciphertext. Includes a size converter that adds zeros to.

According to the present invention, the encrypted numeric data is stored in the existing storage space of the database without changing the size of the storage space of the database by maintaining the same length even after encrypting the numeric data such as social security number and card number. It provides the effect of efficient management and operation of the system.

In addition, by storing the data encrypted with the same length as the length of the plain-text numeric data of the database in the same database, it provides the effect of reducing the encryption time of the data and the real-time processing speed of the database while meeting the security requirements of personal information .

In addition, according to the present invention, it is possible to provide a high performance database security algorithm of an API (Application Programming Interface) method for encrypting and decrypting numeric data of a database at a higher speed than the existing one.

1 is a schematic block diagram illustrating an apparatus for securing numeric data in a database according to the present invention.
2 is a schematic block diagram of an apparatus for securing numeric data in a database according to an embodiment of the present invention.
3 is a flow chart of a method for securing numeric data in a database applicable to the security device of FIG.
4 is a schematic block diagram of an apparatus for securing numeric data in a database according to another embodiment of the present invention.
5 and 6 are flowcharts of a method for securing numeric data in a database applicable to the security device of FIG. 4.
7 is a flowchart illustrating a decryption process of a security method of numeric data of a database applicable to the security device of FIG. 4.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail to avoid unnecessarily obscuring the subject matter of the present invention. In order to clearly explain the present invention in the drawings, parts not related to the description are omitted, and similar parts are denoted by similar reference numerals throughout the specification.

1 is a schematic block diagram illustrating an apparatus for securing numeric data in a database according to an embodiment of the present invention.

Referring to FIG. 1, a security device (hereinafter, simply referred to as a security device) 20 of numeric data of a database according to the present embodiment 20 is a length of encrypted data when encrypting plain text numeric data of a database 10. Is equal to the length of the original data. According to such a configuration, when the plain text numeric data stored in the database is encrypted and stored again, the data can be stored without changing the column size of the database, thereby efficiently managing and securing the database.

Briefly describing the database (DB) encryption method, DB encryption method is largely a plug-in method and an API (Application Programming Interface) method and a TDE (Encryption) database in block units. Transparent data encryption) and file encryption.

The plug-in method runs the encryption / decryption module inside a DBMS, creates a view with the same name as the original table, creates an Int of Trigger to change the actual table, and currently uses Oracle and MS-SQL. DB encryption method suitable for the environment using DB2. In addition, the API method is a DB encryption method in which an encryption / decryption module is executed in an application and operates to call an API function that encrypts data in a database when the data is stored or changed, and decrypts it when the data is retrieved, and does not generate a view or trigger. .

The TDE method creates an encrypted table space in the DB kernel, moves the table to be encrypted to the corresponding table space, performs automatic encryption / decryption on a block basis of the DB in the DBMS kernel, and works with a hard security machine (HSM) appliance. DB encryption method for key management. In addition, the file encryption method creates a table space using an encrypted file, moves the table to be encrypted to the table space, performs automatic encryption / decryption of the DB block by block in the OS kernel, and interlocks with the HSM appliance. DB encryption method to manage.

The above-described API method is a technology under research and development as a next generation DB encryption technology in many financial companies, and there is no load on the DB server, and it is faster than the plug-in method.

When the security device 20 according to the present embodiment operates in an API manner, the security device 20 is connected through an API 30 and an application server 12 having a function of mounting a database and encrypting and decrypting the database. It may be implemented as an encryption server. Here, the application server 12 may include a database server or a database management system.

The detailed configuration and operating principle of the security device 20 will be described with reference to FIGS. 2 to 7.

2 is a schematic block diagram of an apparatus for securing numeric data in a database according to an embodiment of the present invention.

Referring to FIG. 2, the security device 20 according to the present embodiment includes a length calculator 21, a decoder 22, an encryption unit 23, an encoding unit 24, and a size conversion unit 25. Equipped.

The length calculator 21 calculates the length of the plain text numeric data for which encryption is requested. Here, the plain text numeric data is data that requires encryption in a database. Data that requires encryption is data stored in a database encrypted according to an encryption policy or regulation, and refers to numeric personal information such as social security number, date of birth, telephone number, card number, financial account number, and password.

The decoding unit 22 decodes the plain text numeric data to reduce the length of the plain text numeric data to a desired length.

The encryption unit 23 encrypts the data output from the decoding unit 22. The encryption unit 23 encrypts the plain text numeric data according to the security policy or encryption policy setting obtained from the database server or the database management system.

The security policy or encryption policy may be selected and used from various existing database encryption methods. For example, transparent data encryption (TDE) encryption using algorithms such as AES (Advanced Encryption Standard), Three DES (Data Encryption Standard), column encryption, tablespace encryption, triggers, and View encryption schemes and the like may be used. Since each encryption method is a well-known technique, a detailed description thereof will be omitted.

The encoding unit 24 encodes the data encrypted by the encryption unit 23. The encoding section 24 adjusts the length of the encrypted data to a desired length so that the length of the encrypted data has the same length as that of the plain text numeric data that is the original data. In one embodiment, the encoding unit 24 divides the number of digits encrypted by the encryption unit 23 by 3 and adjusts the number of digits multiplied by 4 to the integer rounded up. According to the operation of the encoding unit, the number of digits of the data simply encrypted in the subsequent size conversion unit 25 can be equally matched to the length of the original data (plain text numeric data).

The size converting section 25 converts the length of the data encoded by the encoding section 24 to be equal to the length of the plain text numeric data calculated by the length calculating section 21. When the length of the encoded data is smaller than the length of the plain text numeric data, the size converter 25 inserts a predetermined value and converts the size (length) of the encoded data. In one embodiment, the size converter 25 may match the length of the encoded data using padding used when encoding the encoder 24 to be equal to the length of the plain text data.

3 is a flowchart illustrating a method of securing numeric data in a database applicable to the security device of FIG. 2.

Referring to FIG. 3, in the method of securing numeric data of a database according to the present embodiment (hereinafter, simply referred to as a security method), first, a length of plaintext numeric data inputted from a database and requested for encryption is calculated (S31). . For example, if you obtain the length of '999999', which is 6-digit numeric data, such as the social security number, it is '6'.

Next, the plaintext numeric data is decoded so that the length of the plaintext numeric data is reduced (S32). For example, when '999999' is hexadecimal (Hexadecimal, HEX) decoded, '0x99, 0x99, 0x99' becomes three digits. According to this decoding process, the number of digits of the plain text numeric data is reduced to 1/2.

Next, the decoded data is encrypted (S33). Encryption of data may be performed by various existing methods according to a security policy set in a database. In one embodiment, the data is encrypted in OFB mode (Output Feedback Mode) and None Padding.

Next, the encrypted data is encoded (S34). In one embodiment, the data encrypted by the encryption unit may be Base64 encoded. In this embodiment, the result of encrypting and encoding '0x12 Oxbe 0x3f' through Base64 encoding is 'Er4 /'. In the encoding process, data obtained by dividing the number of digits of the decoded data by 3 and rounding the remainder up to 4 digits of the integer obtained by multiplying the integer is output. In the present embodiment, the number of digits of encoded data is '4'.

Next, the length of the encoded data is size converted to the length of the plain text numeric data (S35). The size converting unit inserts padding set to be inserted in the encoding process at two leading positions of the encoded data, and sizes the length of the encoded data to be equal to the length (6 digits) of the original data. In one embodiment, the size-converted data is 6 digits equal to the number of digits of the first number with '== Er4 /'.

The padding may be a value '=' used for Base64 encoding, but the padding used in this size conversion process is not limited to such a configuration and may be changed according to the type of encoding unit.

According to the present embodiment, when encrypting original data (plain text numeric data), encrypted data having the same length as that of the original data can be generated and stored in the database as it is. According to such a structure, management and security of a database can be performed efficiently. In particular, the speed of the database can be greatly improved.

In other words, recently, personal information has been used in various internal marketing tasks such as internal customer relationship management (CRM), data warehouse (DW), and online analytical processing (OLAP), and efficient encryption considering the overall process of utilizing and managing personal information data. Policy making is emphasized. In other words, in an enterprise-wide database environment where thousands of applications simultaneously use dozens of databases, using the security device and method of this embodiment, data processing of the database is performed through the same length encryption of plain text numeric data such as social security number and card number. You can greatly speed up.

4 is a schematic block diagram of an apparatus for securing numeric data in a database according to another embodiment of the present invention.

Referring to FIG. 4, the security device 20 according to the present embodiment encrypts input text data (plain text numeric data) according to an encryption request from a database server or a database management system, and has the same length as the text data. Create encrypted data. To this end, the security device 20 is the length calculation unit 41, the length determination unit 42, the hexadecimal conversion unit 43, the number adding unit 44, the HEX decoding unit 45, the encryption unit 46 And a Base64 encoding unit 47, a digit conversion unit 48, and a padding insertion unit 49.

In the security device 20 of the present embodiment, the length calculation section 41, the HEX decoding section 45, the encryption section 46, and the Base64 encoding section 47 correspond to the configuration of the security device described above with reference to FIG. That is, the elements, that is, the length calculator 21, the decoder 22, the encryptor 23, and the encoder 24, are substantially the same, so that duplicate descriptions thereof will be omitted.

With respect to the original text data (plain text numeric data) whose length is calculated by the length calculating section 41, the length determining section 42 determines whether the original text data has a length to which the encryption scheme according to the present embodiment can be applied. . In one embodiment, the length determination unit 42 may determine whether the length of the original data is greater than or equal to the reference length.

When the original data is decimal data, the hexadecimal converter 43 converts the original data into hexadecimal data. In addition, depending on the implementation, the hexadecimal converter 43 may not be performed on all original data, but may be performed only to prevent an error from occurring when the length of the original text data is seven.

The number adding unit 44 converts the number of digits of the plain text numeric data converted by the hexadecimal converter 43 or the number of digits of all original data into even numbers. Since the HEX decoding unit 45 decodes even-digit data, the number adding unit 44 functions to make the digits of the original data or the digits of the data generated by the hexadecimal converter 43 even.

When the original data is reduced in size and encrypted through the HEX decoding unit 45 and the encryption unit 46, the Base64 encoding unit 47 divides the number of digits of the encrypted data into a predetermined value (reference length-1), and the rest of the original data. Converts the integer value obtained after rounding up to the number of digits multiplied by the reference length.

The padding inserter 48 first determines whether the length of the ciphertext generated by the Base64 encoding unit 47 is equal to the length of the plaintext numeric data that is the original data or is smaller than the length of the plaintext numeric data. If less than plaintext numeric data, padding is inserted in the ciphertext so that the number of digits in the ciphertext is the same as the digits of the plaintext numeric data.

A cipher text having a length equal to the length of the original data (plain text numeric data) may be transmitted from the security device to the database via the API 49 and stored.

5 and 6 are flowcharts of a security method for protecting numeric data of a database applicable to the security device of FIG. 4.

First, referring to FIG. 5, when data is input from a database (S51), the security apparatus calculates the length of plain text numeric data (original text data) (S52).

Next, the security apparatus determines whether the length of the original data is greater than or equal to the reference length (S53). In this embodiment, the reference length is four. If the length of the original data is smaller than the reference length, the security apparatus may recognize the data as the data that cannot be applied to the database encryption scheme of the present embodiment and perform an error procedure (error message output, etc.) thereto (S54).

If the length of the original data is greater than or equal to the reference length, the security apparatus determines whether the length of the original data is a specific length (S55). In this embodiment, the specific length is '7'.

If the length of the original data is a specific length, the security device converts the original data into hexadecimal (S56). If the original data is '9999999', the data converted to hexadecimal is '98967f'.

Next, the security device determines whether the length of the data converted to hexadecimal is even (S57). If the length of the data converted to hexadecimal is not even, the security device adds a preset number to the first digit of the data (S58). In this embodiment, the preset number is '0'.

If the predetermined number is added to the beginning of the data in the step S58 above, the length of the data converted to hexadecimal is even, or the length of the data in the step S55 above is not a specific length, the security device HEX decodes the original data, which is not yet encrypted, and reduces its length (S59).

Next, the security device encrypts the decoded data according to a preset security policy or an encryption policy (S60). In one embodiment, the HEX decoding data may be '0x98, 0x96, 0x7f', and the encrypted data may be '0x34, 0x63, 0x29'.

Next, as shown in Fig. 6, the security device encodes the encrypted data by the Base64 encoding method (S61). The Base64 encoding method involves dividing the number of digits of a data by a specific value (base length-1) and rounding the remainder up to an integer obtained by multiplying the base length by an integer.

Next, the security apparatus determines whether the length of the encoded data (the cipher text) is the same as the length of the plain text numeric data (the original data) (S62). If the length of the cipher text is not the same as the length of the original data, the security device inserts the padding used in Base64 encoding into the current data (cipher text) so that the length of the cipher text is equal to the length of the original data (S63).

Next, the security device outputs the current data in which the padding is inserted by the padding insertion unit, or the current data generated by the encoding unit and whose length of the cipher text is equal to the length of the original text data, and stored in the database DB (S64). .

According to this embodiment, when the fixed user information such as social security number, card number, etc. is encrypted and stored in the database, a cipher text having the same length as the length of the user information (original data or plain text numeric data) stored in the database is generated. By saving back to the database, you can improve the management and performance of the database (such as processing speed). In addition, since the length of the ciphertext is shorter than the original data, no space is input to the database, thereby preventing an error in the database due to the space input. In addition, the length of the ciphertext is longer than the original data, thereby preventing the loss of manpower and cost caused by changing the column size of the database.

FIG. 7 is a flowchart illustrating a decryption process in a security method of numeric data of a database applicable to the security device of FIG. 4.

As shown in FIG. 7, when the ciphertext is first input (S70), the security apparatus or the ciphertext decryption apparatus (here, the ciphertext decryption apparatus performs means for performing a ciphertext decryption function in the security apparatus or performs a function corresponding to such means). The length of the ciphertext is calculated (S71), and it is determined whether the length of the ciphertext is greater than or equal to the reference length (S72). If the length of the ciphertext is smaller than the reference length, the security device may recognize that the ciphertext is not an encrypted ciphertext by the security method of the numeric data of the present embodiment and output an error message according to an error policy.

If the length of the cipher text is greater than or equal to the reference length, the security device performs Base64 decoding on the cipher text (S73). In one embodiment, the security device may remove the padding preceding the cipher text before performing the Base64 decoding process. For example, the security device may remove the padding from the ciphertext '== NGMP' and convert it to 'NGMP'. In one embodiment, Base64 decoded data is converted to ciphertext '0x34 0x63 0x29' prior to Base64 encoding.

Next, the security device decrypts the Base64 decoded data according to the security policy setting and / or the ciphertext decryption policy (S74). In one embodiment, the decoded data is '0x98, 0x96, 0x7f'.

Next, the security apparatus HEX encodes the decrypted data (S75). In one embodiment, the HEX encoded data is '98967f'.

Next, the security apparatus determines whether the length of the ciphertext is a specific length (for example, 7) (S76), and if the length of the ciphertext is a specific length, converts the HEX encoded data into a decimal number (S77). In one embodiment, the data converted to decimal is '9999999'.

Next, the security apparatus determines whether the length of the data converted into decimal or encoded data other than a specific length is equal to the length of the cipher text (S78). If the length of the data is smaller than the length of the cipher text, the size converting unit of the security device adjusts the number of digits equally by adding 0 to the first digit of the current data. On the other hand, if the length of the data is the same as the length of the cipher text, the security device may omit the size conversion process. The security device then outputs the decrypted data (S80).

As described above, the present invention has been described based on the embodiments, which are merely exemplary and are not intended to limit the present invention, and those skilled in the art to which the present invention pertains do not depart from the essential technical details of the present embodiment. It will be appreciated that various combinations or modifications and applications not illustrated in the embodiments are possible. Therefore, technical matters related to modifications and applications easily derivable from embodiments of the present invention should be interpreted as being included in the present invention.

10: database
12: application server
20: security device

Claims (8)

Obtaining the length of the plain text numeric data inputted from the database and requested for encryption;
Decoding the plain text numeric data so that the length is reduced;
Encrypting the decoded data;
Encoding the encrypted data; And
And converting the length of the encoded data into the length of the plain text numeric data. The method according to claim 1,
And after determining whether the number of digits of the data is even before the decoding, adding a predetermined number to the first digit so that the number of digits of the data is even. The method according to claim 1,
The encoding method comprises converting the number of digits of the encrypted data into a number obtained by dividing the number of digits of the encrypted data by three and rounding the remainder up to four. The method according to claim 1,
The converting of the size may include inserting predetermined padding in the encoding to make the length of the encoded data equal to the length of the plain text numeric data. Obtaining a length of a cipher text input from a database and requesting decryption;
Base64 decoding the cipher text;
Decoding the decoded data;
HEX (Hexadecimal) encoding of the decoded data; And
Adding zeros to the beginning of the encoded data when the length of the encoded data is different from the length of the ciphertext;
Security method of numeric data in a database comprising a. A length calculation unit for calculating a length of the plain text numeric data inputted from the database and requested for encryption;
A decoding unit for decoding the plain text numeric data so that the length is reduced;
An encryption unit for encrypting the decoded data of the decoding unit;
An encoding unit for encoding encrypted data of the encryption unit; And
A size conversion unit for size-converting the length of encoding data of the encoding unit to the length of the plain text numeric data;
Security device of the numeric data of the database comprising a. A length calculation unit for calculating a length of the plain text numeric data inputted from the database and requested for encryption;
A length determination unit determining whether the length of the plain text numeric data is greater than or equal to a reference length;
A decoder configured to decode the HEX (Hexadecimal) decoding of the plain text numeric data when the reference length is greater than or equal to the reference length;
An encryption unit for encrypting the plain text numeric data or the decoded data of the decoding unit;
An encoding unit for base64 encoding the encrypted data of the encryption unit; And
A padding insertion unit inserting padding into the encoding data of the encoding unit;
Security device of the numeric data of the database comprising a. A length calculator configured to calculate a length of a cipher text inputted from a database and requested to be decrypted;
A decoding unit for base64 decoding the cipher text;
A decoder which decodes the data decoded by the decoder;
An encoder for encoding HEX (Hexadecimal) encoding of the data decoded by the decoder; and
A size converter for adding zeros to the first position of the encoded data when the length of the data encoded by the encoder is different from the length of the ciphertext;
Security device of the numeric data of the database comprising a.

Images