KR20060058546A - Database encryption and access control method and device - Google Patents

Abstract

The present invention relates to a method and apparatus for database encryption and access control. The present invention provides a method for encrypting a database and controlling access in a complementary management module coupled to at least one data processing terminal and a database, the method comprising: receiving data information from a data processing terminal, data information received by a secure memory of a database; Transmitting the security data verification request corresponding to the security data reception step; receiving the security data information corresponding to the security data verification request from the security memory of the database; and if the received security data information is valid, performing encryption based on the received data information. And transmitting the encrypted data information to the data memory of the database, wherein the encrypted data information is stored in the data memory of the database.

Database, password, access, control

Description

Method and apparatus for providing database encryption and access control             

1 is a schematic representation of a conventional database protection system.

2 is a schematic representation of a database encryption and access control system in accordance with a preferred embodiment of the present invention.

Figure 3 is a schematic diagram showing the internal structure of the database according to a preferred embodiment of the present invention.

4 is a signal flow diagram schematically illustrating a process of storing security data information according to a preferred embodiment of the present invention.

5 is a diagram schematically illustrating a process of storing encrypted data information in a data memory of a database through a complementary management module according to an exemplary embodiment of the present invention.

6 is a schematic diagram illustrating a process of storing encrypted additional data in a data memory of a database according to a preferred embodiment of the present invention.

7 is a diagram schematically illustrating a process of deleting data in a data memory of a database according to a preferred embodiment of the present invention.

8 is a diagram schematically illustrating a process of providing data information through a decryption process when the security management module according to an embodiment of the present invention receives data request information from a data processing terminal.

9 is a view schematically showing a processing procedure when a user without access authority accesses according to a preferred embodiment of the present invention.

10 is a view schematically illustrating a login process of a security management program corresponding to a security management module according to an embodiment of the present invention.

11 is a diagram schematically illustrating a security agent installation screen corresponding to an encryption function according to a preferred embodiment of the present invention.

12 is a diagram schematically illustrating a process of encrypting a database in column units according to a preferred embodiment of the present invention.

13 is a diagram schematically illustrating a security policy setting process according to a preferred embodiment of the present invention.

14 is a schematic diagram illustrating a process of encrypting using an initial vector according to a preferred embodiment of the present invention.

15 is a schematic diagram illustrating an encryption task processing procedure according to a preferred embodiment of the present invention.

16 is a view schematically showing a process of setting access rights according to an embodiment of the present invention.

17 is a diagram schematically illustrating a process of granting access authority according to an internet address according to a preferred embodiment of the present invention.

18 is a view schematically showing a process of granting access rights according to an application program according to a preferred embodiment of the present invention.

19 is a view schematically showing a process for protecting encrypted data information according to a preferred embodiment of the present invention.

20 schematically illustrates an audit log management screen according to a preferred embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

301: security management device 303: database

305: secure memory 307: encryption function

The present invention relates to a method and apparatus for database encryption and access control.

Conventional information processing systems can be accessed by anyone with a user name and password to a specific system that is accessed from the outside from the outside without a firewall or through the firewall.

Conventional database system was equipped with basic access control method through user management using user access information. However, if only user can access network system to network system using only user access information, anyone can access database system to access internal information. There was a problem that created a fatal risk by searching or making changes to the currently running system.

Accordingly, a method of protecting a database by controlling access to the database is disclosed. 1 is a view schematically showing a conventional database protection system. Referring to FIG. 1, a conventional database protection system 100 may include an access control system 101, at least one client system 103, at least one database operating server 107, and at least one database 107. Can be.

Referring to the above configuration, a conventional database protection method will be briefly described as follows. The conventional method of controlling access of a database system uses network sniffing to retrieve connection information of network sessions connected between a plurality of database systems and a plurality of client systems, and to block a connection of a client that is not authenticated by the database administrator. It was.

However, the conventional database protection method has a problem that the information of the database can be leaked when an error occurs in the search process using network sniffing.

An object of the present invention is to provide a database encryption and access control method and apparatus capable of encrypting a database in column units and setting access rights.

In order to achieve the above objects, according to an aspect of the present invention, a method for encrypting a database and controlling access in a complementary management module coupled to at least one data processing terminal and a database, the data information from the data processing terminal; Receiving a security data confirmation request corresponding to the received data information to a security memory of the database; receiving security data information corresponding to the security data confirmation request from the security memory of the database; Performing encryption based on the received data information and transmitting the encrypted data information to a data memory of the database, if the received secure data information is valid, wherein the encrypted data information includes: In base memory That the chapter can provide a database encryption and access control method according to claim.

In a preferred embodiment, the encryption is performed based on an encryption function prepared in advance in the database. The security data information stored in the security memory of the database may be prepared in advance based on the security column information and the access authority information transmitted from the security management module. The method may further include receiving data additional information from the data processing terminal, and in response to the data additional information, transmitting an access right confirmation request to a secure memory of the database, corresponding to the access right confirmation request from the database secure memory. Receiving access right information, if the access right information is valid, performing encryption based on additional data corresponding to the additional data information, and transmitting the encrypted additional data information to the data memory of the database. Further comprising, The encrypted additional data information is characterized in that stored in the data memory of the database. The method may further include receiving data request information from the data processing terminal, in response to the data request information, transmitting an access right confirmation request to a secure memory of the database, and corresponding to the access right confirmation request from the database secure memory. Receiving the access right information, if the access right information is valid, transmitting an encrypted data request corresponding to the data request information to the data memory of the database, from the data memory of the database to the encrypted data request. Receiving corresponding encrypted data information, performing decryption based on the received encrypted data information, and transmitting the decrypted data information to the data processing terminal.

According to another aspect of the present invention, there is provided a complementary management apparatus which is combined with at least one data processing terminal and a database, encrypts a database and controls access, comprising: means for receiving data information from the data processing terminal, a secure memory of the database; Means for transmitting a secured data confirmation request corresponding to the received data information to; means for receiving secured data information corresponding to the secured data confirmation request from a secure memory of the database, if the received secured data information is valid; Means for performing encryption on the basis of the received data information and means for transmitting the encrypted data information to the data memory of the database, wherein the encrypted data information is stored in the data memory of the database. Complementary management It can provide value.

According to another aspect of the present invention, a program of instructions that can be executed by a digital processing device is tangibly implemented to perform a method of encrypting a database and controlling access, and the method of encrypting and accessing a database by a digital processing device. Receiving data information from a data processing terminal, transmitting a security data confirmation request corresponding to the received data information to a secure memory of a database, and secure data corresponding to the security data confirmation request from a secure memory of a database. Receiving information, if the received security data information is valid, performing encryption based on the received data information, and transmitting the encrypted data information to a data memory of a database, wherein the encrypted Material Seeing that is stored in the data memory of the database, it is possible to provide a recording medium according to claim.

Next, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram schematically showing a database encryption and access control system according to a preferred embodiment of the present invention.

2, the database encryption and access control system includes a security management apparatus 200, an internet network 201, a virtual private network (VPN) 203, a firewall server 205, and an authentication server 207. ), Business server 209, accounting server 211, human resources server 213, at least one data processing terminal (eg, personal computer) 215, 217, 219, customer information database 221, human resources Information database 223 and accounting information database 225.

Here, the complementary management apparatus 200 may manage encryption and access control for a specific column in at least one database 221, 223, 225. On the other hand, the complementary management device 200 may be provided with a database encryption and access control program stored.

In addition, the database 221, 223, 225 may include a secure memory storing specific column information to be encrypted and access restriction information for a specific column in the database, a data memory for storing unencrypted data and encrypted data, and an encryption function storage memory. It may include.

Referring to the above configuration, a database encryption and access control method according to the present invention will be described.

The complementary management apparatus 200 may store security data information including security column information and access authority information in a security memory of the databases 221, 223, and 225. Meanwhile, the security management apparatus 200 may store the encryption function in the encryption function storage memory of the databases 221, 223, and 225.

Thereafter, the supplementary management apparatus 200 may receive data information from at least one data processing terminal 215, 217, or 219. Accordingly, the supplementary management apparatus 200 may transmit a security data confirmation request corresponding to the received data information to the secure memory of the database to determine whether to perform the encryption process on the received data information. Thereafter, when it is necessary to perform an encryption process on the received data information, the supplementary management apparatus 200 may collect secure data valid information from a secure memory of a database. Accordingly, the complementary management apparatus may perform an encryption process by referring to an encryption function prepared in advance in the encryption function storage memory of the database based on the received data information. Thereafter, the complementary management apparatus may transmit and store the encrypted data information to the data memory of the database.

3 is a diagram schematically showing the internal configuration of a database according to a preferred embodiment of the present invention.

Referring to FIG. 3, the database 303 may be coupled to the security management apparatus 301 and may include a security memory 305, an encryption function storage memory 307, and a data memory 309. Here, the data memory 309 may include encrypted data information 311.

The secure memory 305 is an area for storing specific column information to be encrypted and access restriction information for a specific column in the database. In addition, the encryption function storage memory 307 is a region for storing at least one function for encrypting data information. On the other hand, the data memory 309 is an area for storing encrypted data and unencrypted data.

4 is a signal flowchart schematically illustrating a process of storing security data information according to an exemplary embodiment of the present invention.

Referring to FIG. 4, the supplemental management module may transmit secure data information to the secure memory (step 401). Here, the security data information may include column information and access authority information to be encrypted in the data memory of the database. Accordingly, the database may store the transmitted security data information in the secure memory (step 403).

5 is a diagram schematically illustrating a process of storing encrypted data information in a data memory of a database through a complementary management module according to an exemplary embodiment of the present invention.

Referring to FIG. 5, a data processing terminal (eg, a personal computer) may transmit data information to the security management module (step 501). Accordingly, the security management module may transmit a security data confirmation request to the secure memory (step 503). In response to the security data verification request, the secure memory may transmit security data information corresponding to the security data verification request information to the security management module (step 505). In this case, if the security data information is valid, the security management module may perform an encryption process based on the received data information (step 507). The security management module may then transmit the encrypted data information to the data memory (step 509). Accordingly, encrypted data information may be stored in the data memory (step 511).

6 is a diagram schematically illustrating a process of storing encrypted additional data in a data memory of a database according to a preferred embodiment of the present invention.

Referring to FIG. 6, the data processing terminal (eg, a personal computer) may transmit data additional information to the security management module (step 601). Accordingly, the security management module may transmit an access right confirmation request to the secure memory (step 603). Thereafter, the security management module may collect access right information corresponding to the access right check request from the secure memory (step 605). Accordingly, the security management module may perform an encryption process based on the additional data corresponding to the additional data information received from the data processing terminal (step 607). The security management module can then send the encrypted additional data information to the data memory (step 609). Accordingly, the encrypted additional data may be stored in the data memory (step 611).

7 is a diagram schematically illustrating a process of deleting data in a data memory of a database according to a preferred embodiment of the present invention.

Referring to FIG. 7, the data processing terminal (eg, a personal computer) may transmit data deletion information to the security management module (step 701). Accordingly, the security management module may transmit an access right confirmation request to the secure memory (step 703). Thereafter, the security management module may collect access right information corresponding to the access right check request from the secure memory (step 705). Thereafter, the security management module may transmit deletion data information corresponding to the data deletion information received from the data processing terminal to the data memory (step 707). Accordingly, the material corresponding to the deleted data information can be deleted from the data memory (step 709).

8 is a diagram schematically illustrating a process of providing data information through a decryption process when the security management module according to an embodiment of the present invention receives data request information from a data processing terminal.

Referring to FIG. 8, the data processing terminal may transmit data request information to the security management module (step 801). Accordingly, the security management module may transmit an access right confirmation request to the secure memory (step 803). Thereafter, the security management module may collect access right information corresponding to the access right check request from the secure memory (step 805). In this case, if the data processing terminal has access authority based on the access authority information, the security management module may transmit an encrypted data request to the data memory (step 807). Here, the access right may be set according to a database account, an application, and an Internet address (IP). Accordingly, the security management module may collect encrypted data information corresponding to the encrypted data request from the data memory (step 809). Thereafter, the security management module may perform a decryption process based on the collected encrypted data information (step 811). Accordingly, the security management module may transmit the decrypted data information to the data processing terminal (step 813).

9 is a view schematically showing a processing process when a user without access authority approaches according to a preferred embodiment of the present invention.

Referring to FIG. 9, the data processing terminal may transmit data request information to the security management module (step 901). Accordingly, the security management module may transmit an access right confirmation request to the secure memory (step 903). Thereafter, the security management module may collect access right information corresponding to the access right check request from the secure memory (step 905). In this case, when the data processing terminal does not have access authority by the access authority information, the security management module may transmit a data access failure message to the data processing terminal (step 907).

10 is a diagram schematically illustrating a login process of a security management program corresponding to a security management module according to an exemplary embodiment of the present invention.

Referring to FIG. 10, the security manager may log in to the complementary management program through the security management login screen 1001 output to the display unit of the security management apparatus.

11 is a diagram schematically illustrating a security agent installation screen corresponding to an encryption function according to a preferred embodiment of the present invention.

Referring to FIG. 11, a security management module (eg, a diamo program) may include a security agent corresponding to an encryption function. The complementary management apparatus may output the security agent installation screen 1101 through the display unit. Accordingly, when the security manager selects the item "Security Agent Installation", the security management device may output the Security Agent Installation Wizard screen 1103 through the display unit. Here, the security manager may select a database system environment through the security agent installation wizard screen 1103. Accordingly, an encryption function corresponding to the security agent may be provided in the database. In this case, the security agent may be simply installed through a graphical user interface (GUI).

12 is a diagram schematically illustrating a process of encrypting a database in column units according to a preferred embodiment of the present invention.

Referring to FIG. 12, the security management apparatus may output a diamo management folder list screen 1203 through a display unit. In this case, when the security manager selects the "BONUS" item corresponding to the bonus table, the security management device may output the bonus table list screen 1205 through the display unit. In this case, the security manager may select an “SAL” item corresponding to the celery column to be encrypted through the bonus table list screen 1205. Accordingly, the celery column stored in the bonus table of the database 1201 can be encrypted.

13 is a diagram schematically illustrating a security policy setting process according to an embodiment of the present invention.

Referring to FIG. 13, the security management apparatus may output a database management menu screen 1301 through a display unit. In this case, when the security manager selects the database security policy setting item, the security management device may output the database security policy setting screen 1303 through the display unit. In this case, the security manager may select an auto rollback, an encryption algorithm, an initial vector, and an operation mode through the database security policy setting screen 1303. Security administrators can also select the Audit Log option.

14 is a diagram schematically illustrating a process of encrypting using an initial vector according to a preferred embodiment of the present invention.

Referring to FIG. 14, even if the same algorithm is applied to "Hong Gil-dong" 1403 corresponding to the original text to be included in the database 1401, the encrypted data may vary according to an initial vector. That is, the data 1405 encrypted using the initial vector may be generated with different result values for the same original text. However, data 1407 encrypted without using an initial vector can be generated with the same result for the same text. Therefore, by using the initial vector, even if the same encryption algorithm is used for the same text, different results can be generated to prepare for an attack that infers an encryption pattern.

15 is a view schematically showing an encryption task processing procedure according to a preferred embodiment of the present invention.

Referring to FIG. 15, the security management apparatus may output an encryption progress screen 1501 through a display unit. In this case, when an error occurs in step 5 of the encryption operation, the security management apparatus may output a job selection screen 1503 on an error through the display unit. Accordingly, when an error occurs during the encryption setting and removal operation, the operation may be continuously performed after automatic rollback or correction.

16 is a diagram schematically illustrating a process of setting access authority according to an embodiment of the present invention.

Referring to FIG. 16, the security management apparatus may output a column list screen 1601 through a display unit. In this case, when the security manager selects the "ENAME" column, for example, the security management apparatus may output the encryption authority setting screen 1603 through the display unit. Here, the encryption authority setting screen 1603 may include a user list 1603 that does not grant encryption authority and a user list 1605 to which encryption authority is granted. For example, a user corresponding to "DBSNMP" has encryption rights and a user corresponding to "OUTLN" has decryption rights.

17 is a diagram schematically illustrating a process of granting access authority according to an Internet address according to a preferred embodiment of the present invention.

Referring to FIG. 17, the security management apparatus may output an Internet Protocol (IP) list screen 1701 that is permitted to access through the display and an IP list screen 1703 that is blocked from access. For example, an IP corresponding to "192.168.0.138" has access rights. The security management apparatus may output the IP access authority setting screen 1705 through the display unit. For example, an IP corresponding to "192.168.1" in "192.168.0" has access rights.

18 is a diagram schematically illustrating a process of granting access authority according to an application program according to an exemplary embodiment of the present invention.

Referring to FIG. 18, the security management device may output an application list screen 1801 through a display unit. In this case, when the security manager wants to create a new application account, the security management device may output the application account creation screen 1803 through the display unit. In this case, the security manager may create a new application account through the application account creation screen 1803. Accordingly, the security management apparatus may output an application list screen 1805 including a new application (eg, "APP1") through the display unit.

19 is a diagram schematically showing a process for protecting encrypted data information according to a preferred embodiment of the present invention.

Referring to FIG. 19, the security management apparatus may output a security management file list screen 1901 through a display unit. In this case, when the security manager wants to change the password for the application account corresponding to the DAMO, the supplementary management apparatus may output the password change screen 1903 through the display unit. Accordingly, the security administrator can change the password of the application account corresponding to the DAMO.

20 is a diagram schematically illustrating an audit log management screen according to a preferred embodiment of the present invention.

Referring to FIG. 20, the security management apparatus may record access result information on the encrypted data information. Accordingly, the security management device may output the accessor list that attempted access through the audit log management screen 2001. At this time, when the security administrator selects the "save log" item of the audit log management screen 2001, the security management apparatus may output the accessor list screen 2003 through an Excel program.

The present invention is not limited to the above embodiments, and many variations are possible by those skilled in the art within the spirit of the present invention.

According to the present invention, it is possible to provide a method and apparatus for encrypting and accessing a database that can encrypt a database on a column basis and set access rights.

Claims (7)

A method of encrypting a database and controlling access in a complementary management module that combines at least one data processing terminal and a database, Receiving data information from the data processing terminal; Transmitting a security data confirmation request corresponding to the received data information to a security memory of the database; Receiving security data information corresponding to the security data confirmation request from the security memory of the database; Performing encryption based on the received data information if the received secure data information is valid; And Transmitting the encrypted data information to a data memory of the database. Including but not limited to: The encrypted data information is stored in a data memory of the database. The method of claim 1, And the encryption is performed based on an encryption function prepared in advance in the database. The method of claim 1, And secure data information stored in the secure memory of the database is prepared in advance based on the security column information and the access authority information transmitted from the security management module. The method of claim 1, Receiving data additional information from the data processing terminal; In response to the data addition information, transmitting an access right confirmation request to a secure memory of the database; Receiving access authority information corresponding to the access authority confirmation request from the database secure memory; If the access right information is valid, performing encryption based on additional data corresponding to the additional data information; And Transmitting the encrypted additional data information to a data memory of the database. Include more, The encrypted additional data information is stored in a data memory of the database. The method of claim 1, Receiving data request information from the data processing terminal; In response to the data request information, transmitting an access right confirmation request to a secure memory of the database; Receiving access authority information corresponding to the access authority confirmation request from the database secure memory; If the access right information is valid, transmitting an encrypted data request corresponding to the data request information to a data memory of the database; Receiving encrypted data information corresponding to the encrypted data request from the data memory of the database; Performing decryption based on the received encrypted data information; And Transmitting the decoded data information to the data processing terminal. Database encryption and access control method further comprising. In the complementary management device that is combined with at least one data processing terminal and database, encrypting the database and controlling access, Means for receiving data information from the data processing terminal; Means for sending a secured data confirmation request corresponding to the received data information to a secure memory of the database; Means for receiving security data information corresponding to the security data confirmation request from the security memory of the database; Means for performing encryption on the basis of the received data information when the received secure data information is valid; And Means for transmitting the encrypted data information to a data memory of the database Including, And the encrypted data information is stored in a data memory of the database. In order to perform a method of encrypting a database and controlling access, a program of instructions executable by a digital processing apparatus is tangibly implemented, and the database encryption and access control method is performed by a digital processing apparatus. Receiving data information from a data processing terminal; Transmitting a security data confirmation request corresponding to the received data information to a secure memory of a database; Receiving security data information corresponding to the security data confirmation request from a security memory of a database; Performing encryption based on the received data information if the received secure data information is valid; And Transmitting the encrypted data information to a data memory of a database. Including but not limited to: The encrypted data information is stored in the data memory of the database.

Images