KR20100135533A - Method for converting user programs or queries into automated ones for transparent data encryption - Google Patents

Abstract

PURPOSE: A method for automatically connecting encrypted database of an application program is provided to automate SQL query correction of work program constructed based on java. CONSTITUTION: A query correction module(20) receives query including data from an application program(S201). The query correction module requests data encryption to a encode/decode API(Application Programming Interface)(S202). The query correction module receives encrypted data from a encode/decode API(S203). The query correction module corrects query suitable for the encrypted data. The query correction module transmits the corrected query to a database connectivity driver(S204).

Description

Method for Converting User Programs or Queries into Automated Ones for Transparent Data Encryption}

The present invention relates to a method for automatically interlocking an encryption database of an application. When a column of a query requested by the application is an encryption target, the JDBC driver intercepts and decrypts the query before going to the Java JDBC driver. It is about how to fix it.

In the early days of computers, data was simply stored and read using the file system provided by the operating system. However, in order to efficiently manage or access such data, there is a need for an application programmer to develop an application program directly on the file system. It became.

But depending on the user's needs and needs, the application had to be constantly changed, and even rebuilt from scratch. The term database, introduced since the 1960s, refers to a collection of operational data that is integrated and stored for sharing by application systems. In addition, a database management system (DBMS), which is a system for managing such a database, has been introduced.

A database management system is a program that allows a large number of computer users to write or access data in a database. The term DBMS is more commonly used.

The purpose is to provide a convenient and efficient environment for retrieving information in a database or storing information in a database. The database management system, along with the operating system and communication management system, has become the three main software of computers.

Functions include 1) the definition of accumulated data structures, 2) the accumulation of data according to data structures, 3) the retrieval and updating of data by database language, 4) the simultaneous execution control of data processing from multiple users, and 5) the failure during updating. 6) return to the state before the update when the error occurred. A common type of DBMS is a relational database management system. The standardized user and program interface of an RDBMS is called Structured Query Language (SQL). Typical relational DBMSs include Oracle, Sybase, and Infomix.

SQL, also known as structured query language, is a type of query language for databases, including data definition words (DDL) and data manipulation words (DML). It was initially used only on systems that were IBM's relational database, but is now widely used in other databases.

When an application communicates with a system program such as an operating system or a database management system, it uses a specific language and message format. Generally, when developing an application that uses a database, the database data query part is a library that is separate from the application. Application Programming Interface (API) is used. An API is implemented by calling a function that provides a link to a specific subroutine for execution in a program, and it is most efficient to use an already implemented API even when using an application.

In particular, when developing an application that uses a database in a Java environment, if API is separated from the application layer, database processing-related code can be separated from the application, thereby increasing the professionalism and efficiency of work among program developers. Minimize database code changes due to changes.

Java Database Connectivity (JDBC) is a Java API for executing database queries, or SQL, in Java programs. It provides a standard API for developers of databases and applications and allows you to create database applications with pure Java APIs. Also, if you write an application task in Java, you do not need to write it differently according to your own model or software, so the combination of Java and JDBC allows a single program to run anywhere. Java is the best language for building database applications that are robust, secure, easy to use, easy to understand, and all that's needed is to connect to a variety of databases. JDBC is the tool for this.

Recently, products that encrypt data in a database have been used for security, and user application programs for this task must be performed through an encryption / decryption function suitable for the encryption method. To this end, a data encryption / decryption API is used, and the data encryption / decryption API communicates with a policy daemon that stores and manages information on tables / columns to be encrypted / decrypted.

However, the database encryption product of the conventional API type database encryption product is stored in the database management system with the encryption result received by explicitly calling the appropriate encryption / decryption function to encrypt the data in the database. To apply this problem, the source code of the application program must be modified individually.

Figure 1 shows a schematic flowchart between such a conventional Java application and a cryptographic module including a database management system, a Java database connectivity (JDBC), a data encryption / decryption API, and a policy daemon.

When you encrypt data included in an application's query, the query that contains the encrypted data is different from the query that Java database connectivity can recognize. In such a case, the user needs to modify the application's code to include the data that has been encrypted and modify it in the form of a query that can be recognized by Java Database Connectivity.

In order to encrypt data in real time, it is necessary to interoperate between the database encryption product and the database management system. Up to now, the user has to modify the source code of the application by himself. There was an increasing problem.

The present invention introduces a Java database connectivity wrapper module between the API and a user application to solve the problems caused by performing encryption / decryption operations through the conventional direct API mentioned above. . That is, the Java database connectivity wrapper module automatically selects the necessary functions from the data encryption / decryption API, receives the results, and modifies the initial query accordingly. It solves the problem that source modification must be accompanied by application.

Encrypted database automatic linkage that is executed by a computer and automatically corrects an insert or update query of the application 10 to process encrypted data in relation to the database management system 50. In the method, the method comprises: a first step of receiving a query including data from the application (10); Requesting encryption of the data to an encryption / decryption API (30); A third step of receiving encrypted data from the encryption / decryption API (30); Modifying a query to fit the encrypted data; And a fifth step of delivering the modified query to the database connectivity driver 40.

The query is characterized in that the SQL of the Java Database Connectivity (JDBC), and uses an encryption algorithm of SEED, ARIA, AES, DES or 3-DES.

The database connectivity driver 40 may further include a sixth step of inserting or updating the encrypted data into the database management system 50 according to the modified query.

In addition, in the encryption database automatic interworking method executed by a computer, which automatically modifies a select query of the application program 10 to process encrypted data in relation to the database management system 50. The method may include: a first step of receiving a query including information of data to be read from the application program; A second step of modifying a query according to the information of the data to be read; Transmitting the modified query to a database connectivity driver (40); A fourth step of receiving encrypted data from the database connectivity driver 40; A fifth step of requesting decryption of the encrypted data to an encryption / decryption API (30); A sixth step of receiving decrypted data from the encryption / decryption API (30); And a seventh step of transmitting the decrypted data to the application program 10.

By introducing the Java database connectivity wrapper module, it is possible to automate the SQL query modification of the Java-based business program, and the linkage with the encryption module is also internally automated to minimize the burden on the developer. Provide effect.

Hereinafter, the present invention will be described in detail with reference to the drawings.

2 is a diagram schematically illustrating a process of automatically modifying an insert or update query of an application program.

The process includes 1) a step in which a query including data from the application 10 is transmitted to the query modification module 20 (S201), and 2) the query modification module 20 sends data to the data encryption / decryption API 30. Requesting encryption (S202), 3) data encryption / decryption API 30 performs data encryption after passing it to the query modification module 20 (S203), and 4) query modification module ( 20) modifying the query according to the encrypted data, 5) the query modification module 20 passes the modified query to the database connectivity driver 40 (S204).

Thereafter, 6) the database connectivity driver 40 may further include inserting or updating the encrypted data into the database management system 50 according to the modified query (S205).

The query is characterized in that the SQL of the Java Database Connectivity (JDBC).

SQL statements are divided into data definition statements, control statements, operation statements, and transaction processing. Double insert and update queries belong to data manipulation statements.

The query modification module 20 includes 1) an analysis module for parsing queries passed from an application and analyzing SQL requests, 2) a processing module for processing a Crypto module, a configuration file and an encryption module, and 3) a Java standard JDBC driver. It consists of three kinds of wrapping module that wraps.

4 is an explanatory diagram for each module constituting the query modification module 20.

The com.initech.driverwrapper.parser module is an example of an analysis module, the com.initech.driverwrapper.request module is an example of a processing module, and the com.initech.driverwrapper.wrapper module is an example of a wrapping module.

Step S201 of FIG. 2 is performed in the com.initech.driverwrapper.parser module, and step S203 is performed in the com.initech.driverwrapper.request module. The step of modifying the query and the step S204 are performed in the com.initech.driverwrapper.wrapper module.

5 shows a schematic diagram of a class belonging to the com.initech.driverwrapper.parser module. 6 is an explanatory diagram for each class constituting the com.initech.driverwrapper.parser module.

When an application receives a request for an insert query, the Insert class parses it, and the InsertRequest class handles the encryption-related behavior for insertion.

When a read query is requested, the Select class parses it and handles the relevant encryption / decryption behavior for reading. Other delete or update queries can also be processed.

7 is an explanatory diagram for each class constituting the com.initech.driverwrapper.request module. It consists of an Encorder class that calls the Crypto module, an encryption module, an EncryptedTables class that handles requests related to cryptographic arguments, and an Application class. 8 is an explanatory diagram for each class constituting the com.initech.driverwrapper.wrapper module. Description of each class is described in detail in the drawings, a duplicate description thereof will be omitted.

The following configuration file is an example of an XML file that sets the encryption target. The contents are registered SID (Oracle), Table name, and Column name of the table to be encrypted. In this case, the query modification module cross-checks the encryption target information described below and applies encryption / decryption.

For example, data before encryption is applied

Social Security Number (Varchar (15)): 700130-1735245

After encryption is applied

You can get a value like Social Security Number (Varchar (45)): fZ4et74Hs4bAmsedhB6A ==.

An example of an encryption configuration file is shown below.

<ENCRYPTED INFO>

<DB SID = ”ORA_SID”>

<TABLE = ”TEST_TABLE” COLUMN = ”TEST_COLUMN” />

<TABLE = ”TEST_TABLE2” COLUMN = ”TEST_COLUMN2” />

</ DB SID>

<DB SID = ”ORA_SID2”>

<TABLE = ”TEST_TABLE3” COLUMN = ”TEST_COLUMN3” />

<TABLE = "TEST_TABLE4" COLUMN = "TEST_COLUMN4" />

</ DB SID>

</ ENCRYPTED INFO>

9 is an example of an application program code when the encryption database automatic linkage method of the application program 10 according to the present invention is not applied.

To encrypt an insert query on a table with fields of number, column name, and name. The ssdb.encrypt function encrypts data. The query modification module needs to request the encryption operation by calling the ssdb.encrypt function on the data contained in the query. This part is not automated, and the part that calls the ssdb.encrypt function in the application's source code is the type of data. There is an inconvenience of having to modify one by one.

patchData stores the final encrypted data. After this encryption, the fields in the table must be changed to number, patchData (encrypted data), and plain Data (plain data) to create a new query.

As the algorithm used in the encryption process, it is preferable to use an encryption algorithm of SEED, ARIA, AES or 3-DES.

10 is an example of an application program code when the encryption database automatic linkage method of the application program 10 according to the present invention is applied.

The member table exists in the database you are using, and the member table has fields of number, social security number, and name.

After the query is written in the ssn field related to the social security number with the plain text value, the encryption function is automatically called internally by the pstmt.executeUpdate () function to automatically modify the query statement according to the type of Java database connectivity and save it in the DB. do. Therefore, unlike in FIG. 9, the process of calling the ssdb.encrypt function or generating a new query statement separately is omitted.

3 is a block diagram of automatically modifying a select query of an application.

In the above process, 1) the step including the information of the data to be read from the application 10 is transmitted to the query modification module 20 (S301), 2) the information of the data to be read by the query modification module 20 Modifying the received query according to, 3) transmitting the modified query to the database connectivity driver 40 by the query modification module 20 (S302), and 4) the database connectivity driver 40 Reading encrypted data from the database management system 50 based on the modified query (S303), 5) Delivering the encrypted data read by the database connectivity driver 40 to the query modification module 20. (S304), 6) the query modification module 20 requests decryption of the encrypted data with the encryption / decryption API 30 (S305), and 7) the query modification module 20 from the encryption / decryption API. Receiving the decrypted data (S306), 8) Qu Modification is made to the decoding data received module 20 is transferred to the step (S307) for transmitting to the application.

The query modification module 20 used for the read query is also 1) an analysis module for parsing a query passed from an application and analyzing an SQL request, 2) a processing module for processing a configuration file and a Crypto module, an encryption module, 3 It consists of three kinds of wrapping modules that wrap the Java standard JDBC driver.

In the above process, steps S301 and S307 are performed by the analysis module, and steps of modifying a query and steps S302 are performed by the wrapping module. Steps S305 and S306 are performed in the analysis module. Steps S303 and S304 are performed according to a request from the query modification module in the database connectivity driver connected with the query modification module.

 Create a query that takes the field value used as an input value as an input value, and uses the module that calls the stmt.executeQuery (query) function, which is a function that reads encrypted data from the database, and a value including the read encrypted data as an input value. It consists of a module for calling the ssdb.decrypt function, which is a decryption function of the encryption / decryption API (30).

11 is an example of an applicator code related to a read query when the encryption database automatic linkage method of the application program 10 according to the present invention is not applied.

Modifying a read query consisting of a number, a column name, a field value of a name, and a table name including the same, reading the field value from a database, and decrypting it. The ssdb.decrypt function decrypts data. The query modification module requests the decryption operation by calling the ssdb.decrypt function. Finally, the decoded data is stored in patchData. As in the insert query process, its work must be written directly in the application program's source code, and the code must be modified manually to match the associated encryption query.

As the algorithm used in the decoding process, it is preferable to use a decoding algorithm of SEED, ARIA, AES or 3-DES.

12 is an example of an applicator code related to a read query when the encryption database automatic linkage method of the application program 10 according to the present invention is applied.

The member table exists in the database you are using, and the member table has fields of number, social security number, and name. The ssn field is a state in which a field value is encrypted and stored. After calling stmt.executeQuery (query) function to create modified query based on this, encrypted data is automatically loaded from the database.

The present invention is not limited to the scope of the embodiments by the above embodiments, all having the technical spirit of the present invention can be seen to fall within the scope of the present invention, the present invention is the scope of the claims by the claims Note that is determined.

1 is a block diagram between a conventional application and an encryption / decryption API and a database management system.

2 is a diagram illustrating a process of automatically modifying an insert or update query of an application.

3 is a diagram illustrating a process of automatically modifying a read query of an application.

4 is an explanatory diagram of each module constituting the query modification module 20

5 is a schematic diagram of a class belonging to the com.initech.driverwrapper.parser module

6 is an explanatory diagram of each class constituting the com.initech.driverwrapper.parser module

 7 is an explanatory diagram of each class constituting the com.initech.driverwrapper.request module

8 is an explanatory diagram of each class constituting the com.initech.driverwrapper.wrapper module

9 is an example of an applicator code associated with the insert query when the encryption database automatic linkage method of the application 10 according to the present invention is not applied.

10 shows an example of an applicator code related to an insert query when the encryption database automatic linkage method of the application 10 according to the present invention is applied.

11 is an example of an applicator code associated with a read query when the encryption database automatic linkage method of the application 10 according to the present invention is not applied.

12 is an example of an applicator code associated with a read query when the encryption database automatic linkage method of the application 10 according to the present invention is applied.

Claims (7)

In the encryption database automatic interworking method, which is executed by a computer and automatically corrects an insert or update query of an application program to process encrypted data in relation to the database management system 50. , The method, A first step of receiving a query including data from the application program; Requesting encryption of the data with an encryption / decryption API; A third step of receiving encrypted data from the encryption / decryption API; Modifying a query to fit the encrypted data; And passing a modified query to a database connectivity driver. How to automatically link the encryption database of the application The method according to claim 1, The query is characterized in that the SQL of the Java Database Connectivity (JDBC), How to automatically link the encryption database of the application The method according to claim 1, A sixth step of the database connectivity driver inserting or updating the encrypted data into a database management system according to the modified query; How to automatically link the encryption database of the application The method according to claim 1, Using encryption algorithms of SEED, ARIA, AES, DES or 3-DES How to automatically link the encryption database of the application A method for automatically interlocking a cryptographic database, which is executed by a computer and automatically modifies a select query of an application to process encrypted data in relation to a database management system. A first step of receiving a query including information of data to be read from the application program; A second step of modifying a query according to the information of the data to be read; Transmitting the modified query to a database connectivity driver; A fourth step of receiving encrypted data from the database connectivity driver; A fifth step of requesting decryption of the encrypted data with an encryption / decryption API; A sixth step of receiving decrypted data from the encryption / decryption API; A seventh step of delivering the decrypted data to the application program; How to automatically link the encryption database of the application The method according to claim 5, The query is characterized in that the SQL of the Java Database Connectivity (JDBC), How to automatically link the encryption database of the application The method according to claim 5, Using a decoding algorithm of SEED, ARIA, AES or 3-DES How to automatically link the encryption database of the application

Images