KR101330072B1 - Method and system for restoring data in database - Google Patents

Abstract

The present invention relates to a method and a system for encoding or decoding data of a high-capacity table in a database and re-storing the data at high speeds. The method comprises the steps of: selecting a table to be encoded in the database; determining a number of multithreads; backing up the selected table; encoding a backup target column and storing the encoded backup target column in an original table; generating threads depending on the multithread number determined in the multithread number determination step; specifying an encoding range for each thread of the multithread; reading, through each thread and data in the encoding range given to each thread and encoding the read data; and storing the encoded data in the original table. [Reference numerals] (S30) Select table in DB;(S31) Determine the number of multithreads;(S32) Backup one table;(S33) Change one table;(S34) Generate thread;(S35) Designate an encoding range for each thread;(S36) Encode each thread;(S37) Store in one table

Description

Method and System for Restoring Data in Database

The present invention relates to a database management technology, and more particularly, to a method and system for encrypting or decrypting data of a large table in a database, and then restoring the data at high speed.

In general, when database (Database, DB) encryption is introduced in a database management system, it is necessary to encrypt data already stored in an existing database. Then, you usually back up the encryption table. In that case, the column will be backed up in its entirety or only for encryption. In this case, it is common to acquire a row number as a serial number and store it together.

Also, during encryption, the indexes and constraints of the encryption target table are removed for security. Then, data is sequentially read from the backed up table, encrypted, and stored again in the original table.

However, when encrypting or decrypting data of a large table in a database and storing the data in the database again, system resources are consumed considerably due to the capacity of the large data, thereby reducing the database speed.

For example, when data is sequentially read from the first data of the large table of the database in the backup table and the data is encrypted and stored again in the original table, data processing takes a long time. In addition, there is a problem that the service of the system using the database must be stopped for the time required for encryption.

As such, organizations, companies, corporations, and public offices that use the database reduce the encryption time by increasing the encryption speed even a little to improve customer convenience or service quality in consideration of the security of using the database. However, there is no solution yet with appropriate improvements.

The present invention is to solve the above-mentioned conventional problems, and to provide a method and system for re-storing at high speed after encrypting or decrypting data of a large table in a database.

In order to solve the above technical problem, a method of restoring database data according to an embodiment of the present invention is a method of restoring database data for encrypting and restoring data in a database in a database security system, and selecting a table to be encrypted in the database. Creating the number of multithreads determined in the step of determining the number of multithreads, determining the number of multithreads, backing up the selected table, encrypting the backup target column and storing it in the source table, and determining the number of multithreads. A step of specifying an encryption range for each thread of the multithread, a step of performing encryption by reading the data of the range granted for each thread through each thread, and storing the encrypted data in the original table as a commit unit. Steps.

In one embodiment, the step of backing up includes storing the serial number together for each record of the original table.

In an embodiment, the method of restoring database data may further include removing an index and a constraint of the original table after encrypting the backup target column and storing the column in the original table.

In one embodiment, specifying the encryption range includes assigning a range of serial numbers obtained in the step of backing up the original table.

Database data storage system according to an aspect of the present invention, the thread number setting unit for selecting a table to encrypt in the database and determine the number of multi-thread, data backup unit for backing up the table selected by the thread number setting unit, backup The table changer that encrypts the backup target column of the stored table and stores it in the source table, the thread generator that creates as many threads as the number of multithreads determined by the multithread number setter, and the encryption range for each thread of the multithread. An encryption / decryption unit that reads the range of data assigned to each thread through each thread and performs encryption, and an API (Application Programming Interface) that stores the data encrypted through the encryption / decryption unit in the source table of the database in the unit of commit. Include.

According to the present invention, a large number of threads in a database can be read simultaneously by several threads to improve the encryption speed, thereby providing an effect of minimizing the downtime of the database.

In addition, according to the present invention, when the database encryption system is introduced, the existing large-capacity plain text data existing in the database is encrypted and restored at a high speed, thereby reducing the service downtime of the customer, thereby improving reliability of the database management system or the database security system. Can be improved.

1 is a schematic block diagram illustrating a system for restoring database data according to an embodiment of the present invention.
2 is a block diagram of the database data storage system of FIG.
3 is a flow chart of a method for restoring database data applicable to the system for restoring database data of FIG. 2.
4 is a flowchart illustrating a decoding process applicable to the method of restoring database data of FIG. 3.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail to avoid unnecessarily obscuring the subject matter of the present invention. In order to clearly explain the present invention in the drawings, parts not related to the description are omitted, and similar parts are denoted by similar reference numerals throughout the specification.

1 is a schematic block diagram illustrating a database data storage system according to an embodiment of the present invention.

Referring to FIG. 1, the database data restoring system 20 according to the present exemplary embodiment may use an API (Application Programming) to improve a processing speed of a database when encrypting or decrypting a large amount of data in a database and storing the data in a single table again. Interface) It uses multithreaded parallel processing in the encryption method.

In other words, the database data restorage system 20 selects a table to be encrypted / decrypted among the data in the database, determines the number of multithreads, and then backs up the original table in which the data is stored. Then, the system encrypts / decrypts the backup target column, stores it in the original table, and creates a predetermined number of multithreads. Then, the database data storage system 20 specifies the encryption / decryption range for each thread, reads and decrypts the data of each given range through each thread, and when the encryption / decryption of each thread is completed, the API Stores data (password / plain text data) in the database.

Briefly describing the database (DB) encryption method, DB encryption method is largely a plug-in method and an API (Application Programming Interface) method and a TDE (Encryption) database in block units. Transparent data encryption) and file encryption.

The plug-in method runs the encryption / decryption module inside a DBMS, creates a view with the same name as the original table, creates an Int of Trigger to change the actual table, and currently uses Oracle and MS-SQL. DB encryption method suitable for the environment using DB2. In addition, the API method is a DB encryption method in which an encryption / decryption module is executed in an application and operates to call an API function that encrypts data in a database when the data is stored or changed, and decrypts it when the data is retrieved, and does not generate a view or trigger. .

The TDE method creates an encrypted table space in the DB kernel, moves the table to be encrypted to the corresponding table space, performs automatic encryption / decryption on a block basis of the DB in the DBMS kernel, and works with a hard security machine (HSM) appliance. DB encryption method for key management. In addition, the file encryption method creates a table space using an encrypted file, moves the table to be encrypted to the table space, performs automatic encryption / decryption of the DB block by block in the OS kernel, and interlocks with the HSM appliance. DB encryption method to manage.

The above-described API method is a technology under research and development as a next generation DB encryption technology in many financial companies, and there is no load on the DB server, and it is faster than the plug-in method.

When the database data storage system 20 according to the present embodiment operates in an API manner, the database data storage system 20 may include an application server 12 and an API (which has a function of mounting a database and encrypting and decrypting the database). 30 may be implemented as at least some of the functional units of the security device connected through or a component that performs a function corresponding to these functional units. The application server 12 may include a database server or a database management system.

The configuration and operation principle applicable to the database data storage system 20 will be described in detail with reference to FIGS. 2 to 4.

FIG. 2 is a block diagram of the database data storage system of FIG. 1.

Referring to FIG. 2, the database data storage system 20 according to the present embodiment includes a thread number setting unit 21, a data backup unit 22, an original table changing unit 23, and a thread generation unit 24. And an encryption / decryption unit 25 and an API 26.

The thread number setting unit 21 selects a table to be encrypted in the database and determines the number of multithreads. Thread count setting unit 21

The data backup unit 22 backs up the table selected by the thread number setting unit. The data backup unit 22 stores the serial number for each record together during the backup operation. The serial number can generally use the row number provided by the database.

The table changing unit 23 encrypts a backup target column of the backup stored table and stores the column in the original table. The table changing unit 23 may be operated in a different processing manner depending on how the encrypted data is stored in the original table (or the original table). For example, all columns of the original table can be backed up or only the encryption target can be backed up according to the insert method, update method, etc., and the update data condition can be used by backing up the row ID together.

The thread generation unit 24 generates threads as many as the number of multithreads determined by the multithread number setting unit. Multithreading may be determined in an appropriate number depending on the performance of the database or database management system.

The encryption / decryption unit 25 specifies an encryption range for each thread of the multi-thread, and performs encryption by reading data of a range given through each thread. The encryption / decryption unit 25 assigns a range of serial numbers obtained at the time of data backup for each thread to designate an encryption range for each thread.

The API 26 functions to store the data encrypted through the encryption / decryption unit in the original table of the database in units of commits. In this case, the commit refers to storing the data of the changed table in memory on the physical disk. The commit unit may vary depending on the performance or capacity of the system.

3 is a flowchart of a method of restoring database data according to an embodiment of the present invention.

The method of restoring database data according to the present embodiment may be applied to the database data restoration system of FIGS. 1 and 2.

Referring to FIG. 3, in the method of restoring database data according to the present embodiment, first, a table to be encrypted is selected by the database security system (S30).

Next, it is determined how many multithreads to perform (S31). Multithreading determines the appropriate number depending on the performance of the system.

The database security system is a system using a method for restoring database data, and may include the above-described database data restoration system. In addition, depending on the implementation, the database security system may refer to a means mounted on a database management system to perform a database data restore function of the present embodiment, or a component that performs a function of such a means.

Next, the original table is backed up (S32). The serial number is saved for each record at the time of backup. The serial number can generally use the row number provided by the database.

Next, the backup target column is encrypted and stored in the original table (S33). Depending on how the encrypted data is stored in the original table (hereinafter referred to as the original table), the processing may vary.

If you save by insert method, back up all columns of the original table. In case of storing by the update method, only the encryption target is backed up. In the case of the update method, the row ID can be backed up together to use the row ID as a condition of the update data.

In addition, when the original table is changed, indexes and constraints can be removed, and the database itself can be changed so as not to leave a log when the data is stored. In this step, all data types of the column to be encrypted may be converted into a variable character type.

And, if the encrypted data is stored in the insert method, all original data can be deleted in this step (S33).

Next, as many threads as the number of multi-threads input in the above step (S31) is created (S34).

Next, an encryption range is designated for each thread (S35). Encrypting range can be performed by assigning a range of serial numbers obtained at the time of data backup.

Next, each thread reads the data in the given range and performs encryption (S36).

Finally, the database data restoring system stores the encrypted data in the original table in units of commits (S37).

According to the present embodiment, the speed of storing ciphertext after data encryption can be improved by distributing data of a large table in a database through a plurality of threads. The above-described method for restoring database data is particularly useful when the first DB encryption of a database storing a large amount of plain text data is introduced.

FIG. 4 is a flowchart illustrating a decoding process applicable to the method of restoring database data of FIG. 3.

The method of restoring database data of the present embodiment can be applied not only to encryption of plain text data in a database, but also to decryption of cipher text in a database as in the method of restoring database data of FIG. 3.

Referring to FIG. 4, a database security system or a database data storage system first selects a table to be decrypted among cipher texts in a database, determines the number of multithreads, and then backs up the original table in which the cipher text is stored. The system decrypts the backup target column and stores it in the original table, and generates a predetermined number of multithreads. The processing up to this point is similar to the steps S30 to S34 described above with reference to FIG. 3.

Next, the database data storage system designates a decryption range for each thread (S35A). The decryption range for each thread may be one of those obtained by dividing the serial number of the data table obtained at the time of the ciphertext by the number of threads.

Next, each thread reads the data in the given range and performs decryption (S36A).

When the decryption of each thread is completed, the decrypted data (plain text data) may be transmitted to the database through the API and stored in a commit unit.

As described above, the present invention has been described based on the embodiments, which are merely exemplary and are not intended to limit the present invention, and those skilled in the art to which the present invention pertains do not depart from the essential technical details of the present embodiment. It will be appreciated that various combinations or modifications and applications not illustrated in the embodiments are possible. Therefore, technical matters related to modifications and applications easily derivable from embodiments of the present invention should be interpreted as being included in the present invention.

10: database
12: application server
20: Security device or database data restore system
30: Application Programming Interface

Claims (5)

A method of restoring database data in which a database security system encrypts and then stores data in a database again.
Selecting a table to encrypt in the database;
Determining the number of multithreads;
Backing up the selected table;
Encrypting a backup target column of the backed up table in the backup step and storing it in the original table;
Creating threads as many as the number of multithreads determined in the step of determining the number of multithreads;
Designating an encryption range for each thread of the multithread;
Performing encryption by reading data of a range assigned through each thread; And
Storing the encrypted data in an original table of the database;
Database data restore method comprising a. The method according to claim 1,
The step of backing up, database data storage method comprising storing the serial number for each record of the original table together. The method according to claim 1,
And after the encrypting the backup target column and storing the column in the original table, removing the index and the constraint of the original table. The method according to claim 1,
The step of specifying the encryption range is to give a range of the serial number obtained in the step of backing up the original table. A thread count setting unit for selecting a table to be encrypted in the database and determining the number of multithreads;
A data backup unit which backs up the table selected by the thread number setting unit;
A table changing unit which encrypts a backup target column of the backed up table and stores the encrypted column in an original table;
A thread generation unit generating threads as many as the number of multithreads determined by the multithread number setting unit;
An encryption / decryption unit that specifies an encryption range for each thread of the multithread, and performs encryption by reading data of a range given through each thread; And
And an input / output unit which stores the data encrypted by the encryption / decryption unit in an original table of the database.

Images