Patent ID: 8812877
Filing Date: 2014-08-19
Classification: G06F,H04L

Abstract:
1. A database encryption system, comprising: a database apparatus that comprises a hardware processor, a database, and a database controller that controls execution of database operation; and a user apparatus comprising a hardware processor, connected to the database controller via a network, wherein: the user apparatus further comprises: key usage logic that manages key information for encryption and decryption; security configuration logic that configures information related to configuration of security of at least one of data and metadata stored in the database; a first storage that stores information related to the configuration of security; and an application response receiver that receives a database operation command issued to the database apparatus, and determines whether encryption is necessary with respect to at least one of data and metadata handled by the database operation command, by referring to the information of the first storage, the application response receiver, when encryption is necessary, transmits to the database controller, as at least one of data and metadata of the database operation command, at least one of encrypted data and encrypted metadata that has been encrypted according to key information of the key usage logic by using an encryption algorithm corresponding to the security of the at least one of the data and the metadata, to cause the database controller to execute the database operation, the application response receiver, when encryption is not necessary, transmits the database operation command as it is, to the database controller, to cause the database controller to execute the database operation, the application response receiver receives a database processing result transmitted by the database controller, and when conversion or decryption of the at least one of the data and the metadata of the database processing result is necessary, returns a result of performing the conversion or the decryption according to key information of the key usage logic, to an issuing source of the database operation command as a response to the database operation command; the security configuration logic performs at least one of: a configuration or change with regard to whether the metadata including a table name and column name stored in the database is encrypted, a configuration or change with regard to whether the data is encrypted, and a configuration or change of privacy level information representing a data security level; the first storage holds information as to: whether metadata including a table name and column name stored in the database is encrypted, whether data is encrypted, privacy level information representing the security level of the data, and distinguishing information for an encryption algorithm corresponding to the privacy level information; and the first storage, when the table name and column name are encrypted, stores and holds, in addition to an encrypted table name and column name, the table name in plaintext and column name in plaintext before encryption, as a decrypted table name and column name.