KR20180126853A - System and Method for automatic generation and execution of encryption SQL statements using meta-information and enterprise framework - Google Patents

Abstract

A system for automatically generating an encryption SQL statement using metadata and enterprise framework according to an embodiment of the present invention includes: a framework IDE for requesting the generation of an SQL statement based on SQL statement metadata which a user inputs; a DBIO server for providing the encryption SQL statement to the framework IDE after the encryption SQL statement is generated by using encryption metadata matched with the SQL statement metadata; and an encryption server for providing the encryption metadata matched with the SQL statement metadata to the DBIO server. Accordingly, the present invention can improve security and reduce development costs.

Description

[0001] The present invention relates to a system and method for automatic generation of encrypted SQL statements using meta information and an enterprise framework,

The present invention relates to a system and method for automatically generating encrypted SQL statements using meta information and an enterprise framework.

A personal information such as a resident registration number is stored in a database management system (DBMS) over a certain scale, the information is encrypted and stored.

In the case of an organization that manages a large amount of personal information, an external encryption package is registered in the software of the DBMS, and when a structured query language (SQL) sent to the DBMS is executed, The method of processing is considerably inefficient in terms of performance.

This is because there is an inter-process call (IPC) overhead or a Java Native Interface (JNI) overhead between the DBMS native process and the external package, and a data copy overhead between each interval.

In terms of security, personal information decrypted outside the DBMS is not secure in terms of being exposed at the network end.

That is, in the case of the work requiring decryption of personal information, the information is already decrypted in the DBMS and then transmitted to the WAS / Web server in the form of plaintext.

In addition, the tasks of the above-mentioned organizations are implemented based on system software for enterprise such as DBMS, WAS (Web Application Server), etc., and the corresponding tasks are also based on a separate enterprise-class It is implemented.

In particular, when using information stored in a database management server (DBMS) in business, it is an industry standard to develop a business using a common module called DBIO.

The representative function provided by DBIO module is SQL statement generation function.

The development IDE (Integrated Development Environment) provided by the framework enables business developers to automatically create, update, and delete SQL statements according to type and business requirements. The framework includes an SQL statement automatically generated through the DBIO module Provides the ability to create / build final business sources that contain business logic statements.

Existing DB encryption solutions are single product solution. By providing only the encryption / decryption function in the form of library, many developers can manually apply the corresponding application programming interface (API) functions to the mentioned enterprise-level development environment. This is a situation where you have to manually program directly into business logic, which is also inefficient in terms of development productivity.

Korean Patent Laid-Open Publication No. 10-2010-0135533 (entitled " Encryption Database Automatic Interworking Method of Application Program)

The present invention has been developed in order to solve the above problems, and it is an object of the present invention to provide a data encryption function as a simple library, and in cooperation with an enterprise class framework, The present invention provides a system and method for automatically generating an encrypted SQL statement using meta information and an enterprise framework in order to enhance efficiency in terms of performance, security, and development productivity.

According to an embodiment of the present invention, there is provided a system for automatically generating an encrypted SQL statement using meta information and an enterprise framework, the system comprising: an access target table name, an access type (select / insert / update / delete) , A column name, a condition (hereinafter, referred to as SQL statement meta information), and requesting generation of an SQL statement; A DBIO server for automatically generating an encrypted SQL statement using encryption meta information (table name, column name, policy name) matched with SQL statement meta information input from the framework IDE and providing the encrypted SQL statement to the framework IDE; And an encryption server for providing the encryption meta information to the DBIO server.

In one embodiment, the system for automatically generating an encrypted SQL statement using the meta information and the enterprise framework further includes a web application server (WAS) that executes an encrypted SQL statement and encrypts / decrypts personal information transferred to the encrypted SQL statement.

In one embodiment, The system for automatically generating an encrypted SQL statement using the meta information and the enterprise framework further includes a database management server (DBMS) for encrypting and storing personal information.

In one embodiment, the framework IDE includes a DBIO module that requests the DBIO server to generate an SQL statement based on the encryption meta information.

In one embodiment, the DBIO server includes a meta information verification unit for checking whether encryption meta information matched with the SQL statement meta information exists in the encryption server; And an encrypted SQL statement generator for generating an encrypted SQL statement that is processed differently according to inquiry and input, using the information provided by the DBIO module and the encryption meta information transmitted from the encryption server.

In one embodiment, the encryption server includes an encryption meta information repository for storing encryption meta information; And an encryption meta information providing unit for extracting the corresponding value from the encryption repository based on the request information provided by the DBIO server and providing the extracted value to the DBIO server.

According to an aspect of the present invention, there is provided a method for automatically generating an encrypted SQL statement using meta information and an enterprise framework, the method comprising: a first step of requesting a DBIO server to generate an SQL statement using a framework IDE; A second step of requesting the encryption server to inquire the encryption meta information matched with the value input from the DBIO server; A third step of determining whether or not the SQL statement meta information matches the registered encryption meta information in the encryption server; A fourth step of returning or not returning the encryption meta information to the DBIO server based on the determination result of the encryption server; A fifth step of generating an encrypted SQL statement according to whether the encryption meta information is returned from the encryption server; And providing the encrypted SQL statement to the framework IDE in the DBIO server.

In one embodiment, after the sixth step, the framework IDE further includes a step of deploying the service through the application container of the web application server.

In one embodiment, the web application server further includes executing an encrypted SQL statement generated by the DBIO server to check for anomaly.

In one embodiment, the method further comprises storing the encrypted personal information in the database management server through the encrypted SQL statement at the database management server.

The solution of the above-mentioned problems does not list all the features of the present invention. Various means for solving the problems of the present invention can be understood in detail with reference to specific embodiments of the following detailed description.

According to the present invention, it is understood that performance of encryption / decryption at the DBMS terminal has a performance overhead several tens of times higher than that of library calling at the web application server (WAS) side in terms of performance, The decoding position can be artificially transferred to the WAS stage.

Also, from the security aspect, it is expected that the data transmission from the WAS to the DBMS due to the encryption / decryption at the WAS terminal is made to enable only encrypted personal information, thereby improving the security compared to the existing method.

It is difficult to describe the effect quantitatively in the aspect of improvement of development productivity. However, as in the existing method, many developers use the encryption / decryption API to create / modify SQL statements manually, instead of manually creating / modifying SQL statements. It is clear that it is helpful for development, and the effect of reducing the development cost is clear, especially for larger organizations.

1 is a block diagram illustrating a system for automatically generating an encrypted SQL statement using meta information and an enterprise framework according to an exemplary embodiment of the present invention.
2 is a block diagram of the DBIO server shown in FIG.
3 is a block diagram of the encryption server shown in FIG.
4 is a flowchart illustrating a method for automatically generating an encrypted SQL statement using meta information and an enterprise framework according to an embodiment of the present invention.
5 is a diagram illustrating an SQL statement meta information input screen through the encryption policy editor UI of the framework IDE shown in FIG.
6 is an illustration of a DBIO SQL statement editing screen in a framework IDE input by a developer for generating an encrypted SQL statement.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "including" an element, it is to be understood that the element may include other elements as well as other elements, And does not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

Hereinafter, a system and method for automatically generating an encrypted SQL statement using meta information and an enterprise framework according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a system for automatically generating an encrypted SQL statement using meta information and an enterprise framework according to an exemplary embodiment of the present invention.

1, an automatic SQL statement generation system 100 according to an exemplary embodiment of the present invention includes a framework IDE 200, a DBIO server 300, an encryption server 400, a Web application server ) 500, and a DBMS (600).

The framework IDE 200 receives SQL statement meta information input by the user and requests SQL statement creation.

The framework IDE 200 may be a user interface (tool) used to implement business logic in an enterprise class framework.

The framework IDE 200 provides functions necessary for integrally packaging system modules or other service modules / common modules required for execution of various tasks.

Here, the framework IDE 200 includes a DBIO module 210. The DBIO module 210 provides a user interface (UI) for inputting and modifying SQL statement information to a business developer (see FIGS. 5 and 6).

2 is a block diagram of the DBIO server shown in FIG.

Referring to FIG. 2, the DBIO server 300 generates an encrypted SQL statement using encryption meta information matched with the SQL statement meta information input from the framework IDE 200, and then transmits the encrypted SQL statement to the framework IDE 200 to provide.

More specifically, the DBIO server 300 includes a meta information verification unit 310, an SQL statement generation unit 320, and an encryption SQL repository 330.

The meta information verification unit 310 checks whether the encryption meta information matching the SQL statement meta information is present and requests the encryption server 400. [

The SQL statement generating unit 320 generates an encrypted SQL statement or a plain text SQL that is processed differently according to inquiry and input by using the information provided from the DBIO module 210 and the encryption meta information transmitted from the encryption server 400. [ Generate a statement.

The encryption SQL repository 330 stores an encrypted SQL statement or a plain text SQL statement generated by the SQL statement generator 320.

3 is a block diagram of the encryption server shown in FIG.

Referring to FIG. 3, the encryption server 400 provides the DBI server 300 with encryption meta information matching the SQL statement meta information.

More specifically, the encryption server 400 includes at least one encryption meta information repository 410 and encryption meta information provision unit 420.

The encryption meta information repository 410 stores a meta ID, a table name, a column name, and a policy name.

The encryption meta information providing unit 420 provides encryption meta information matched with the SQL statement meta information transmitted from the DBIO module 210 to the encryption meta information repository 420 based on the request information provided from the DBIO server 300. [ (410) and provides it to the DBIO server (300).

Meanwhile, the system for automatically generating an encrypted SQL statement 100 according to an exemplary embodiment of the present invention executes the encrypted SQL statement generated in the DBIO server 300 to decrypt the encrypted private information in the encrypted SQL statement, And a Web application server (WAS) 500.

Also, And a database management system (DBMS) 600 for encrypting and storing the decrypted personal information.

Hereinafter, the configuration and operation of the framework IDE 200, the DBIO server 300, and the encryption server 400 will be described in more detail.

The framework IDE 200 A plain text SQL statement 201, a DBIO module 210, and an encrypted SQL statement 202. The detailed functions are as follows.

- Framework IDE -

The plain text SQL statement (201) is a general SQL statement used when the access target information is not encrypted.

When accessing the information to be encrypted through a plain text SQL statement, the encrypted string is returned in the case of a select (select), and the plain text string is stored in the case of an input (insert / update).

Accordingly, when accessing the encryption target information, the user must request the generation of the encrypted SQL statement 202 through the DBIO module 210 and process the personal information using the returned result.

In the case of the DBIO module 210, the SQL statement meta information is input to the developer through the interface provided by the framework IDE 200, and the corresponding information is transmitted to the DBIO server 300.

The returned encrypted SQL statement 202 is automatically changed to transfer the encryption / decryption API and the policy to the encryption target column as parameters.

For example, if the plaintext SQL statement 201 is "select A from T" and the column A stores personal information such as a resident number and encrypts the resident number using an encryption policy of P, then the DBIO module 210) automatically generates this as a work variable based on a host variable that performs the same function as the encryption SQL "select dec (A, P) from T".

- DBIO server -

The DBIO server 300 receives a request from the DBIO module 210 and receives a request from the meta information verification unit 310 to confirm whether the corresponding information exists in the meta form in the encryption server 400 and a new SQL statement to which the returned meta information is applied And an SQL statement generator 320 for generating an SQL statement.

The meta information verification unit 310 receives the encryption meta information by transmitting the table / column name to the encryption server 400. The transmitted encryption meta information includes a meta ID, a table name, a column name, and a policy name.

The encryption SQL statement generator 320 integrates the meta information transmitted from the meta-verification unit 310 and the information (SQL statement meta information) transmitted from the DBIO module 210 to generate a decryption API and a policy name in the case of inquiry, Generates an encrypted SQL statement that processes the API and the policy name as input, and returns the encrypted SQL statement to the DBIO module 210.

- Encryption server -

The encryption server 400 plays a role of managing an encryption infrastructure in a distributed environment. The encryption server 400 includes at least one encryption meta information repository 410 and an encryption meta information providing unit 420.

The encryption meta information repository 410 stores a meta ID, a table name, a column name, a policy name, and the like.

In the encryption policy information, the encryption algorithm to be used when encrypting specific information, the encryption key to be used, and the initial vector (IV) to be used in encrypting the block are determined by whether random values or fixed values are used , What to do with access control, and what to do with audit policies.

You can take separate policies for each column or you can define and operate a standardization policy for each task.

The encryption meta information repository 410 receives the registration from the security manager through a separate management interface when defining the encryption policy as described above.

4 is a flowchart illustrating a method for automatically generating an encrypted SQL statement using meta information and an enterprise framework according to an embodiment of the present invention.

4, when a user requests the DBIO server 300 to generate an SQL statement using the framework IDE 200 (S710), the method for automatically generating an encrypted SQL statement S700 according to an exemplary embodiment of the present invention, The DBIO server 300 parses the requested SQL statement and requests the encryption server to inquire the encryption meta information matched with the SQL statement meta information in step S720.

More specifically, S720 After checking whether the encryption meta information matching with the SQL statement meta information is present in the encryption server 300 and using the information provided by the DBIO module and the encryption meta information transmitted from the encryption server, And generating an encrypted SQL statement that is processed differently according to the input.

Thereafter, the encryption server 400 determines whether the SQL meta information matches the registered encryption meta information (S730), and then, based on the determination result of the encryption server 400, (S750) after the encryption meta information is returned from the DBIO server (300) (S741) or not returned (S742) to the DBI server (300) (S760) the encrypted SQL statement or the plain-text SQL statement to the framework IDE 200 in step S760.

The framework IDE 200 deploys the task in S770 through the application container of the web application server and transmits the encrypted SQL statement or the plain text SQL statement generated by the DBO server 300 in the web application server 500 (S780). ≪ / RTI >

Thereafter, the database management server 600 decrypts the encrypted private information of the encrypted SQL statement, and the decrypted private information is encrypted and executed and stored in the database management server 600 (S790).

The web application server 400 uses programs such as CGI, Servlet, ASP, JSP, and PHP.

Therefore, according to the present invention, performing encryption / decryption at a database management server (DBMS) terminal has a performance overhead several tens of times higher than a library call at a web application server (WAS) Advantageously, the encryption and decryption location can be artificially transferred to the web application server (WAS) end through the system and method of the present invention.

In terms of security, data transfer from a web application server (WAS) to a database management server (DBMS) is performed only by encrypting private information by performing encryption / decryption at a web application server (WAS) The effect of improving the contrast security can be expected.

It is difficult to describe the effect quantitatively in the aspect of improvement of development productivity. However, as in the existing method, many developers use the encryption / decryption API to create / modify SQL statements manually, instead of manually creating / modifying SQL statements. This helps development, especially for larger organizations, which reduces development costs.

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

100: Automatic generation of encrypted SQL statements
200: Framework IDE
210: DBIO module
300: DBIO server
310: Meta information verification unit
320: SQL statement generator
330: Encrypted SQL Repository
400: Encryption Server
410: Encryption Meta Information Repository
420: encryption meta information providing service
500: Web Application Server (WAS)
600: Database Management Server (DBMS)

Claims (10)

A framework IDE that requests to generate an SQL statement based on the SQL statement meta information entered by the user;
A DBIO server for generating an encrypted SQL statement using encryption meta information matched with the SQL statement meta information and providing the encrypted SQL statement to the framework IDE; And
And an encryption server for providing encryption meta information matched with the SQL statement meta information to the DBIO server, wherein the meta information and the enterprise framework are used.
The method according to claim 1,
And a web application server (WAS) for executing the encrypted SQL statement and decrypting the encrypted private information in the encrypted SQL statement, using the meta information and the enterprise framework.
3. The method of claim 2,
And a database management server for encrypting and storing the decrypted personal information, wherein the system comprises a meta information server and an enterprise framework.
The method according to claim 1,
The framework IDE
And a DBIO module for requesting the DBIO server to generate an SQL statement related to the SQL statement meta information.
5. The method of claim 4,
The DBIO server
A meta information verification unit for checking whether the encryption meta information matched with the SQL statement meta information is present in the encryption server; And
And an encrypted SQL statement generator for generating an encrypted SQL statement that is processed differently according to inquiry and input using the information provided by the DBIO module and the encryption meta information transmitted from the encryption server, An Automated Creation of SQL Statements Using Frameworks.
6. The method of claim 5,
The encryption server
An encryption meta information repository storing encryption meta information related to the meta ID, the table name, the column name, and the policy name; And
And an encryption meta information providing unit for extracting encryption meta information matched with the SQL statement meta information transmitted from the DBIO module from the repository based on the request information provided from the DBIO server and providing the extracted meta information to the DBIO server, An automated SQL statement generation system using an enterprise framework.
A first step of requesting a DBIO server to generate an SQL statement using a framework IDE;
A second step of parsing the SQL statement requested by the DBIO server and requesting the encryption server to inquire the encryption meta information matched with the SQL statement meta information;
A third step of determining whether or not the SQL statement meta information matches the registered encryption meta information in the encryption server;
A fourth step of returning or not returning the encryption meta information to the DBIO server based on the determination result of the encryption server;
A fifth step of generating an encrypted SQL statement or a plain text SQL statement according to whether the encryption meta information is returned from the encryption server; And
And providing the encrypted SQL statement or the plain-text SQL statement to the framework IDE in the DBIO server. The method of automatically generating an SQL statement using meta information and an enterprise framework.
8. The method of claim 7,
Further comprising the step of, after the sixth step, deploying a service in the framework IDE via an application container of the web application server, and automatically generating an encrypted SQL statement using meta information and an enterprise framework.
9. The method of claim 8,
Further comprising the step of executing an encrypted SQL statement or a plain-text SQL statement generated by the DBIO server in the web application server to check whether there is an abnormality, and automatically generating an encrypted SQL statement using the meta information and the enterprise framework.
10. The method of claim 9,
Further comprising the steps of: decrypting the private information encrypted with the encrypted SQL statement in the database management server, and encrypting the decrypted private information and storing the decrypted private information in the database management server, using the meta information and the enterprise framework.

Images