KR101375807B1 - Data management device - Google Patents

Abstract

A data management device of the present invention is installed in a database in which original data is inputted and includes an agent unit for encrypting the original data. The agent unit can store the encrypted data, which is the original data encrypted, into the database.

Description

DATA MANAGEMENT DEVICE}

The present invention relates to a data management device for encrypting or decrypting data or converting the data into a unique identifier (UID).

A database is a set of data organized according to a certain structure to receive, store, and supply data in response to the needs of multiple users so as to support multiple application tasks at the same time.

As the exchange of various data becomes more active, the importance of data security as well as the processing speed of data input / output to the database is increasing.

Korean Patent Laid-Open Publication No. 2001-0052853 discloses a data management program for protecting cyclic content, but does not disclose a method of improving data processing speed while satisfying data security.

Korean Laid-Open Patent Publication No. 2001-0052853

An object of the present invention is to provide a data management apparatus capable of quickly encrypting, decrypting, and infantizing data.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not intended to limit the invention to the precise forms disclosed. Other objects, which will be apparent to those skilled in the art, It will be possible.

The data management apparatus of the present invention is installed in a database into which original text data is input, and includes an agent unit for encrypting the original text data. The agent unit may store encrypted data encrypted with the original text data in the database.

The data management apparatus of the present invention includes an agent unit for encrypting or decrypting data and an infant ID server managing the agent unit, and an encryption key required for the encryption or decryption is transmitted from the infant ID server to the agent unit. An agent unit may erase the encryption key after completion of the encryption or decryption.

The data management apparatus of the present invention includes an infant ID server provided with a master key and an agent unit provided with a sub key, wherein the agent unit is encrypted using an encryption key in which the master key and the sub key are transmitted from the infant ID server. Data or original text data obtained by decrypting the encrypted data may be generated.

The data management apparatus of the present invention includes a plurality of agent units for encrypting original text data and a child ID server managing the plurality of agent units, and the child ID server may assign an agent code to each agent unit.

The data management apparatus of the present invention includes a plurality of agent units for encrypting original text data and a child ID server for managing the plurality of agent units, and each agent unit may be driven independently of each other.

The data management apparatus of the present invention includes an agent unit for kididizing a secure field of original text data, wherein the kididization replaces the secure field with a kidid value, and the agent unit is configured to input the kidid value before inputting the original data. Can be generated.

An apparatus for managing data of the present invention includes an agent unit for formatting an original text data consisting of a security field and a general field, and the agent unit is configured to generate the child ID data in which the security field is replaced with an infant ID value and the general field is mixed. Can be.

The data management apparatus of the present invention includes an agent unit for hashing original text data and storing the hashed hash data, wherein the agent unit generates hash data of the original data when the original data is input. The uniqueness of the original data can be checked by comparing with the previously stored hash data.

The data management apparatus of the present invention may include an infant server located between a terminal node and a database, and an agent unit located in the database and encrypting original text data input from the terminal node using a master key of the infant server. have.

According to the data management apparatus of the present invention, it is possible to perform encryption, decryption, and child IDization of data quickly.

1 is a block diagram showing a data management apparatus of the present invention.
2 is a block diagram showing an agent unit constituting the data management device of the present invention.
3 is a schematic diagram showing an agent code and a table name used in the data management apparatus of the present invention.
4 is a schematic diagram showing an infant ID value generated by the data management device of the present invention.
5 is a schematic diagram showing data stored in a database in the data management apparatus of the present invention.
6 is a schematic diagram showing a data flow of the data management apparatus of the present invention.
7 is a schematic diagram showing the data flow when the positions of the agent unit and the ID server are changed.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The sizes and shapes of the components shown in the drawings may be exaggerated for clarity and convenience. In addition, terms defined in consideration of the configuration and operation of the present invention may be changed according to the intention or custom of the user, the operator. Definitions of these terms should be based on the content of this specification.

FIG. 1 is a block diagram showing a data management apparatus of the present invention, and FIG. 2 is a block diagram showing an agent unit 100 constituting the data management apparatus of the present invention.

The data management apparatus shown in FIG. 1 may include an agent unit 100.

The agent unit 100 may be installed in the database 300 into which the original text data is input and may encrypt the original text data. To this end, the agent unit 100 may include an encryption unit 110 for migrating the original data ⓞ to the encrypted data ⓔ.

The encryption unit 110 may generate encrypted data ⓔ by applying various encryption algorithms to the original data ⓞ. The encryption algorithm may be, for example, DES, AES-128, AES-256, SEED-128, ARIA-128, or the like, and the encryption unit 110 may use an encryption algorithm selected according to an encryption policy.

The encryption unit 110 may store the encrypted data ⓔ in which the original text data ⓞ is encrypted in the database 300.

The agent unit 100 may infantize the original text data ⓞ, and map the original text data ⓞ to the encrypted data ⓔ and store it in the database 300. For this purpose, the agent unit 100 may include an infant ID unit 150.

On the other hand, the agent unit 100 may erase the original data ⓞ after encryption of the original data ⓞ. According to this, only encrypted data ⓔ and infant ID data are stored in the database 300, and original text data ⓞ is not stored, which is advantageous for enhanced security.

In addition, since the agent unit 100 that performs encryption and child IDization is installed in the database 300, communication speed with the database 300 can be maximized. According to this, by reducing the time spent transmitting and receiving data with the database 300, it is possible to quickly perform encryption and child IDization.

The agent unit 100 may be provided with a decryption unit 130 to recover the original data ⓞ by decrypting the encrypted data ⓔ stored in the database 300. At this time, the encryption key is required to decrypt the encrypted data ⓔ. In this case, the encryption key may be applied to the encryption of the original data ⓞ by the encryption unit 110 as it is.

Even if the database 300 is hacked, since the encrypted data ⓔ is leaked instead of the original data ⓞ, the original data ⓞ can be protected. However, if the encryption key is leaked together during the hacking of the database 300, it is possible to decrypt the encrypted data ⓔ, so security measures are required. Even if the encryption key is stored in the agent unit 100, it is difficult to exclude the fear that the agent unit 100 will also be hacked when hacking the database 300 due to the characteristics of the agent unit 100 installed in the database 300. Therefore, reliable security measures for encryption keys are required.

As part of such countermeasures, the data management apparatus of the present invention may include a unique IDentifier (UID) server 200 managing the agent unit 100.

The infant server 200 may store an encryption key necessary for encryption or decryption. Therefore, during the encryption and decryption operation, the agent unit 100 may receive and use an encryption key from the baby server 200.

If the encryption key transmitted from the baby server 200 is stored in the agent unit 100 or the database 300, the above-described problem may be derived as it is, so that the agent unit 100 erases the encryption key after completion of encryption or decryption. can do.

According to the above embodiment, since the subject performing encryption and decryption and the subject storing the encryption key necessary for encryption and decryption are separated, the original data ⓞ can be reliably protected.

In order to protect the encryption key, the encryption key may be stored separately in the server ID 200 and the agent unit 100.

For example, the encryption key may be a combination of a master key and a sub key. In this case, the master key may be stored in the baby server 200 and the sub key may be stored in the agent unit 100. When managing n agent units 100 in one child server server ⓢ, n is a natural number, one master key provided in the child server server ⓢ and each agent unit 100 are provided. There may be n subkeys. In this case, the subkeys allocated to each agent unit 100 may be different. For reference, since the agent units 100 are installed in the database 300, n databases may be provided, which is equal to the number of agent units 100. In addition, a sub key of each agent unit 100 may be generated by the baby server 200 and assigned to each agent unit 100.

When the subkey of the first agent unit ① is the first subkey, the subkey of the second agent unit ② is the second subkey, and the subkey of the nth agent unit ⓝ is the nth subkey, each agent unit ( The encryption key of 100) may be as follows.

Encryption key of the first agent unit ① = master key + first sub key

Encryption key of the second agent unit ② = master key + second sub key

...

Encryption key of control agent unit ⓝ = master key + control subkey

Accordingly, the n-th agent unit may generate the encrypted data ⓔ using the encryption key in which the master key and the n-th subkey are combined, or generate the original text data ⓞ from which the encrypted data ⓔ is decrypted.

As described above, the encryption key can be protected from the threat of hacking by separating and storing the encryption key in the infant server 200 and the agent unit 100. However, since the master key is transmitted from the ID server 200 to the agent unit 100 during encryption or decryption, there may be a problem that both the master key and the sub key exist temporarily in the agent unit 100. In this state, in order to minimize the threat of hacking, the agent unit 100 may temporarily store the master key transmitted from the ID server 200 in a second storage unit different from the first storage unit in which the sub key is stored. Thus, the master key temporarily stored in the second storage unit may be erased after generation of the encrypted data ⓔ or the original data ⓞ.

Even if the agent unit 100 becomes a hacking target, it is difficult to simultaneously hack the first storage unit and the second storage unit which are different storage units. Therefore, according to the agent unit 100 that temporarily stores the master key separately from the sub key, the risk of leakage of the master key can be minimized.

When a plurality of agent units 100 for encrypting the original text data ⓞ are provided, the infant server 200 may manage the plurality of agent units 100. In this case, the baby server 200 may assign an agent code to each agent unit 100.

When the agent unit 100 is installed in each of the plurality of databases 300 separated from each other, the agent code may function as an identifier for distinguishing each agent unit 100. Agent code may be, for example, ①, ②, ..., ⓝ. Since the agent unit 100 is installed in each database 300, the agent code may be used to distinguish the databases 300 from each other.

Each database 300 may store the encrypted data ⓔ and the agent code encrypted with the original data ⓞ.

One database 300 may include a plurality of tables classified according to different uses and functions. In this case, the baby server 200 may additionally assign a table name for identifying a storage space in each database 300.

3 is a schematic diagram showing an agent code and a table name used in the data management apparatus of the present invention.

Looking at it, the agent code ② is assigned to the agent unit 100. In addition, m tables (m is a natural number) are included in the database 300 in which the agent unit 100 is installed, and thus, table names a, b, ..., m are assigned.

If the encrypted data ⓔ is stored in the table b, the agent code ②, the table name b, and the encrypted data ⓔ may be mapped and stored in the table.

The agent unit 100 of the present invention is provided for each database 300 that is separated from each other. Therefore, each agent unit 100 should be able to be identified and an agent code may be used for this purpose.

Each agent unit 100 may be driven independently of each other. According to this, when the same information is input to different databases 300, each agent generates encrypted data for the corresponding information.

If each agent unit 100 is interlocked, the encrypted data for the same information will be processed in only one agent unit 100 and stored in the database 300 in which the agent unit 100 is installed. However, according to this, the request to store the same information in the plurality of databases 300 may not be satisfied. According to the present embodiment, since each agent is independently driven, encrypted data corresponding to the same original text data may be stored in the plurality of databases 300.

Referring to FIG. 5, the agent unit 100 having the agent code '001' for the same original data '701212-1234567' encrypts the original text to generate encrypted data 'asdfaqqqw3098kskj'. The generated encrypted data is stored in a table having a table name A in the database 300 in which the agent unit 100 is installed.

In addition, the agent unit 100 having the agent code '002' encrypts the original text data to generate encrypted data 'asfjlsfjalfjlljfljalrtyep'. The generated encrypted data is stored in a table to which the table name B is assigned in the database 300 in which the agent unit 100 is installed.

For reference, the table name may be given a different code for every database 300 managed by the server ID 200. According to this, when the table name is given in alphabet, all tables of the database 300 may be given alphabets which are not duplicated as table names. This case is disclosed in FIG. 5.

Alternatively, the table name may be given the same code that is divided into agent codes. For example, one table is provided in the database 300 in which the agent codes 001 and 002 exist and the agent unit 100 of the agent code 001 is installed, and the database 300 in which the agent unit 100 of the agent code 002 is installed. Assume that 3 tables are provided in the). In this case, the letter A is assigned to the table of the database 300 in which the agent unit 100 of the agent code 001 is installed as a table name, and A, in each table of the database 300 in which the agent unit 100 of the agent code 002 is installed. B and C may be given. Table name A is duplicated for the two databases 300, but since the agent code is attached and distinguished such as 001-A and 002-A, there is no difference.

A user accessing the infant ID server 200 may perform a search using the infant ID data. Thus, confusion may arise if the baby ID data are identical. To avoid this, baby ID data should be unique. Since the security field of the original data is replaced with the infant ID value, the infant ID data can be uniquely formed by forming the infant ID value uniquely. However, according to the independent agent unit 100, the same infant ID value may be generated for each agent unit 100, and the security field of the original text data may be replaced with the same infant ID value. In order to prevent this, the baby ID server 200 may manage the baby ID to be unique.

For example, after generating the baby ID value, the baby ID server 200 may distribute the baby ID value to all the agent units 100 having jurisdiction so that the baby ID value does not overlap. Alternatively, the infant ID server 200 may report the infant ID value generated by each agent unit 100 from the agent unit 100, check the duplicate infant ID value, and instruct the agent unit 100 to delete the duplicate infant ID value. Can be.

The infant ID value may be generated by randomly mixing English uppercase letters, lowercase English letters, and numbers. Infant ID values may be subject to constraints including one or more English characters.

The text data may be composed of a general field which may be exposed to a third party and a security field that needs to be prevented from being exposed. For example, when the original data is '701212-1234567', '701212-1' is a general field and '234567' without the general field may be a security field. If '701212' indicates date of birth and '1' after '-' indicates gender, it is difficult to identify an individual by the general field alone. Therefore, protecting only the secure field '234567' may be sufficient to protect the original data. In order to protect '234567', '234567' can be replaced with an infant ID value.

Infant IDization by the infant IDization unit 150 may be performed in various ways. For example, the infant ID value may be configured with the same number of digits as the security field. In FIG. 4, the security field is replaced by using the infant ID value 'aB3Def' having the same digit as '234567'.

The infant data is stored in the database 300 together with the encrypted data and may be used for indexing when searching for the encrypted data. If the infant ID value is unique, the encrypted data may be configured using only the infant ID value.

However, if the encrypted data is composed only of the child ID value, since the general field is not stored in the database 300, statistical calculation of data using the general field is not possible. In addition, when searching for a specific child ID value, since it is impossible to sort the general field and search the child ID value only within the sorted range, it is necessary to search all the child ID values. Accordingly, there is a problem that takes a long time to search the infant ID value. This problem may be prominent when the child server 200 attempts to retrieve data of all databases 300.

According to the data management apparatus of the present invention, the agent unit 100 may generate infant ID data including an infant ID field and a general field. According to this, since the general field is also stored in the database 300, various statistical operations can be performed using the storage field, and a specific infant ID value can be quickly searched. In addition, such a search environment corresponds to a user-friendly environment that is easier to use compared to an environment in which a search is performed using only a child ID value that is difficult for a user to recognize.

When one or more agent units 100 exist, the infant ID server 200 may collect the infant ID data of each agent unit 100 and store them in a storage provided separately from each database 300. For example, the storage may be stored in a format such as the bottom table of FIG. 5.

In this case, the agent unit 100 may use at least a portion of the general field as a searcher for the collected child ID data. Since the baby ID data of all the database 300 is stored in the storage, vast data may be stored. A user who wants to search for specific child ID data through the child ID server 200 may be provided with a user-friendly environment for searching for child ID values after sorting or filtering each data into general fields that are easily recognized.

For example, when the general field '701212' is used as a searcher in FIG. 5, '701212-1aB3Def' and '701212-1aZ4Def' are displayed, and the user can visually check the back child ID value and select desired data. . According to this, it is possible to minimize search through infant ID values such as 'aB3Def' which is difficult to recognize.

In order to increase the generation speed of the infant ID data by the infant ID unit 150 of the agent unit 100, the infant ID unit 150 may generate an infant ID value before inputting original text data.

4 is a schematic diagram showing an infant ID value generated by the data management device of the present invention.

As a result, it can be seen that a plurality of 'aB3Def', 'a33trZ', ... are provided before inputting the original data as RNG (Random Number Generator) corresponding to the baby ID value. The infant IDization unit 150 may apply the infant ID value to the original text in the order of generating the infant ID value when the original text data is input.

For example, when the original data '701212-1234567' is input, the infant IDization unit 150 may replace '234567' which is a security field of '701212-1234567' with the first generated infant ID value 'aB3Def'. Accordingly, '701212-1aB3Def' is generated as the baby ID data. Then, when other text data is input, the infant IDization unit 150 may perform infant IDization using the second generated infant ID value 'a33trZ'.

As such, when the infant ID value is generated in advance and applied to the original data, the infant ID unit 150 may improve the speed of the infant ID by comparing the process of generating the infant ID value and replacing the security field after inputting the original data. . In the case where communication with the infant ID server 200 is performed for the uniqueness of the infant ID value, the speed improvement will be more significant.

5 is a schematic diagram showing data stored in the database 300 in the data management apparatus of the present invention.

The first diagram above shows data stored in the database 300 where the agent unit 100 is installed.

Looking at the original text, Agent Code, Table Name, UID for infant data, RNG for infant data, Encipherment for encrypted data, and hash for hash data It is mapped and stored. Original text data is not stored in the database 300.

For example, when original data '701212-1234567' is input, agent code 001, table name A, UID 701212-1aB3Def, Encipherment asdfaqqqw3098kskj, and Hash asfasa54a6asawesdfh54se may be stored. Since the agent code 001 and the table name A in the table of the database 300 are the same for all original data, 001 and A may be stored in advance. Similarly, if an RNG corresponding to an infant ID value is generated before inputting original text data, the RNG may be stored in advance. At this time, RNG must satisfy uniqueness at least in the same table. Of course, the child ID server 200 is intervened according to the business policy, the RNG may satisfy the uniqueness in all the database 300, all tables.

The UID corresponding to the infant ID data is generated by referring to the original data and the RNG in the infant IDizer 150 and may be used as an index when performing statistical operations or searching for specific data.

Encipherment is generated using the original data, the encryption key, and the encryption algorithm in the encryption unit 110, it can be used later to recover the original data.

The hash is generated by using an encipherment which is original text data or encrypted data in a hash unit (not shown) included in the agent unit 100, and the figure discloses that the encrypted data is hashed. The hash data hash and the encrypted data encipherment may be mapped together and stored in the database 300.

Hash can be used to check the uniqueness of the original data when encrypting the original data. Encrypted data mapped to the same original text data may be stored in different databases 300 or different tables. However, it is not necessary to store encrypted data corresponding to duplicated original data in the same database 300 or the same table.

To prevent this, the agent unit 100 may check the uniqueness of the original data by generating the hash data of the original data when inputting the original data and comparing the hash data with previously stored hash data.

The data previously stored in the database 300 does not include the original text data. Therefore, there is a need for another object to verify the uniqueness of the original data. The hash data generated by hashing the original data or by encrypting the encrypted data may be used as the target.

The agent unit 100 may compare the hash data of the newly input original text data with previously stored hash data, and determine that the original input data is existing if the matching hash data exists. If there is no matching hash data as a result of the comparison, it may be determined as new original data and the UID of the original text data may be stored in the database 300.

In order to check the uniqueness of the original data, the newly inputted original data is hashed, so that the search speed naturally decreases.

If the child server server 200 hashes the original data input to all the database 300 as a target, the degree of deterioration of the search speed will be greater. In this case, there is also a problem in that the comparison target is increased by making all databases 300 a search range.

However, according to the data management apparatus of the present invention, the agent unit 100 hashes only original data input to itself as a target, and searches for previously stored hash data by limiting to the range of the database 300 in which the agent unit 100 is installed. Can be minimized. Alternatively, since the range of the original text data may be limited to the database 300 targeted by the new original data (using the agent code and the table name), the prestored hash data may be searched, thereby reducing the decrease in the search speed.

Since the encryption time of the original data includes the concept of checking the uniqueness of the original data, according to the present invention, the speed of encryption may also be increased. In addition, after checking the uniqueness, the encryption speed of the original data may be further increased by assigning the agent unit 100 installed in the database 300 to which the original text is targeted, instead of encrypting the original data in the infant ID server 200. .

When a large amount of text data targeting different databases 300 is input, instead of encrypting all text data in the infant server 200, the text data may be transmitted to the appropriate database 300 together with the master key. The load of 200) can be minimized. As a result, the encryption time can be shortened because an environment in which encryption is performed by dividing in the plurality of agent units 100 is performed instead of performing encryption in one baby server 200. The load reduction server 200 may set an encryption / decryption policy of each agent unit 100, and may process authentication tasks such as authorization of a visitor, batch creation of RNGs, and audit tasks. As an example of the audit operation, the server ID 200 may monitor the encryption status of the original data and the decryption status of the encrypted data by monitoring each agent unit.

When the server 200 performs encryption of all original data along with uniqueness checking of all original data for all databases 300, the TPS (Transaction Per Second) indicating the number of encryptions that can be performed per second is usually 3000 to 5000. However, when the uniqueness test of the original data is divided into the database 300 unit and performed by the agent unit 100 or the baby server 200, and the encryption of the original data is performed by the corresponding agent unit 100, the TPS is 30000 ~. It was confirmed that it appears as 50000.

In summary, the data management apparatus of the present invention may be located in the infant ID server 200 located between the terminal node 10 and the database 300 and the terminal node using the master key of the infant ID server 200 located in the database 300. It is possible to quickly encrypt the original data by including the agent unit 100 for encrypting the original data input from 10). In addition, since the child IDization of the original text data and the decryption of the encrypted data are also performed in each agent unit 100, it is possible to quickly child IDize and decrypt.

According to this configuration, fast encryption, decryption, and child IDization are possible, so that the security environment such as encryption, child ID, etc. can be reliably provided not only for a slow service access point (SAP) system due to security processing but also for a general database system that requires fast speed. can do.

FIG. 6 is a schematic diagram showing a data flow of the data management device of the present invention, and FIG. 7 is a schematic diagram showing a data flow when the positions of the agent unit 100 and the baby server 200 are changed. Original characters such as ①, ②, ③, and ④ shown in FIGS. 6 and 7 indicate the flow sequence of data, not the agent code.

First, the data flow of FIG. 6 will be described.

① The baby server 200 receives the original text data from the terminal node (10).

② The infant server 200 transmits the received text data to the agent unit (100). If necessary, the baby server 200 may additionally transmit a master key. When there are a plurality of agent units 100, the ID server 200 checks the database 300 targeted by the text data by analyzing the text data or communicating with the terminal node 10. Then, the text data is transmitted to the agent unit 100 installed in the confirmed database 300.

The agent unit 100 encrypts the received original text data and stores the encrypted original text data in the database 300. The agent unit 100 may transmit data stored in the database 300 to the baby server server 200. The infant server 200 may store data transmitted from each agent unit 100 in a storage in a format as shown in the bottom chart of FIG. 5. The infant server 200 may manage each agent unit 100 or the database 300 using data stored in the storage.

Next, the data flow of FIG. 7 will be described. In FIG. 7, the agent unit 100 is provided separately from the database 300 and is disposed between the terminal node 10 and the baby server 200.

① The terminal node 10 transmits original text data, and the agent unit 100 steals original text data between the terminal node 10 and the database 300.

② The agent unit 100 requests the master server 200 for the master key necessary for encrypting the original text data.

③ The baby server 200 transmits the master key to the agent unit 100.

④ Upon receiving the master key, the agent unit 100 encrypts the original data and transmits the original data to the database 300.

Comparing the embodiment of FIG. 7 with the embodiment of FIG. 6, it can be seen that data flow becomes complicated. If a plurality of agent units 100 and a database 300 are provided, a very large number of data transmissions will be made in the entire system. However, according to the embodiment of FIG. 6, since the original data is input to the agent unit 100 via the infant server 200 provided with the master key, the number of transfers of data can be greatly reduced. In addition, since the agent unit 100 is installed in the database 300, the communication speed between the two can be maximized, and as a result, rapid encryption, decryption, and child IDization are possible.

This effect can be achieved by arranging the baby server 200 between the terminal node 10 and the database 300, and installing the agent unit 100 in the database 300.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention as defined by the appended claims. Accordingly, the true scope of the present invention should be determined by the following claims.

10 ... terminal node 100 ... agent unit
110 ... Encryption Department 130 ... Encryption Department
150 ... YouTube HD 200 ... YouID Server
300 ... database

Claims (20)

An infant server provided with an encryption key for encrypting or decrypting original text data;
A database in which encrypted data in which the original text data is encrypted and infant ID data in which the original text data is inscribed are stored together; And
Installed in each database, generating the encrypted data using the encryption key or recovering the original data by decrypting the encrypted data using the encryption key, and using the generated child ID value, the infant ID data. It includes; Agent unit for generating,
The original data includes a security field and a general field,
The baby ID data includes a field in which the secure field is replaced with the baby ID value, and the general field;
The original data is not stored in the database,
The baby data is used for indexing when searching the encrypted data.
delete The method of claim 1,
And the agent unit erases the original data after the encryption.
The method of claim 1,
And the agent unit erases the encryption key transmitted from the infant server after completion of the encryption or decryption.
The method of claim 1,
The encryption key is a combination of a master key and a sub key,
The master server is provided with the master key,
The sub-key is provided in the agent unit,
And the agent unit performs the encryption or the decryption by using the encryption key in which the master key and the sub key are transmitted from the server.
delete 6. The method of claim 5,
The agent unit temporarily stores the master key transmitted from the ID server to a second storage unit different from the first storage unit in which the sub key is stored,
And the master key is erased after completion of the encryption or decryption.
The method of claim 1,
The agent unit is installed in a plurality of databases that are separated from each other,
The ID server assigns each agent unit an agent code which is an identifier of each agent unit,
And the agent code is stored in the database along with the encrypted data and the ID data.
delete 9. The method of claim 8,
The ID server assigns a table name to distinguish the storage space in each database,
And the table name is stored in the database along with the encrypted data, the ID data, and the agent code.
delete The method of claim 1,
The baby ID server is a data management device for managing the baby ID value is unique.
The method of claim 1,
And the agent unit generates the child ID value before inputting the original text data.
14. The method of claim 13,
And the agent unit generates a plurality of the infant ID values, and applies the infant ID values to the original data in the order of generating the infant ID values when inputting the original text data.
delete The method of claim 1,
And the infant ID server collects the infant ID data of the agent unit, and uses at least some of the general fields as searchers of the collected infant ID data.
The method of claim 1,
The agent unit generates hash data in which the original data is hashed.
The hash data is stored in the database along with the encrypted data and the baby ID data.
And the agent unit checks the uniqueness of the input text data by generating hash data of the input text data and comparing the hash data stored in the database when the text data is input. delete delete delete

Images