Secure multi database system

• US 20020065956A1
• Filed: 05/11/2001
• Published: 05/30/2002
• Est. Priority Date: 11/30/2000
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Yagawa, Yuichi, Maeda, Akira, Hayashi, Shigetoshi, Yoshimura, Mitsuhiko
• Granted Patent: US 6,792,425 B2
• Time in Patent Office: Days
• US Class Current: 719/330
• CPC Class Codes: G06F 16/25 Integrating or interfacing systems involving database management systems
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06Q 20/108 Remote banking, e.g. home banking
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation

Abstract

A definition tool of the present invention declares columns which are concealed in external tables to a multi-database server. The multi-database server controls a decomposition and an execution of query messages such that the multi-database server does not perform an arithmetic using the concealed columns. The external database server encrypts the data of concealed columns in tables of query result tables. The multi-database server designates a range to be decrypted at the time of acquiring and integrating respective result tables. A client program acquires an integrated result table and decrypts the designated range. Since the data encrypted by the external database server is decrypted by and is referred to the client program, it becomes difficult for the multi-database server to refer to a content of the concealed columns.

Claims

1. A multi-database system comprising:

a plurality of database devices for storing distributed data;

a multi-database processing device coupled to the plurality of database devices over a network to receive the distributed data and perform an integration process on the distributed data, the integration process generating integrally processed data; and

a user processing device coupled to the multi-database system over the network, the user processing device receiving said integrally processed data from said multi-database processing device,

wherein a partial data in a first data region included in said distributed data is subjected to a conversion processing based on a preliminarily rule.

2. The multi-database system of claim 1, wherein said user device performs a re-conversion processing, the re-conversion processing having a processing content corresponding to said conversion processing of the partial data.

3. The multi-database system of claim 2, wherein said conversion processing is an encrypting processing and said re-conversion processing is a decrypting processing corresponding to said encrypting processing.

4. The multi-database system of claim 1, wherein said multi-database processing device transmits first information specifying said first data region to the plurality of said database devices, and

the plurality of said database devices receives the first information and performs said conversion processing on the partial data based on said first information.

5. The multi-database system of claim 4, further comprising a multi-database definition device coupled to said multi-database processing device through the network, wherein said multi-database definition device transmits definition information which defines said first information to said multi-database processing device.

6. The multi-database system of claim 5, wherein said multi-database definition device and said user device are physically integrally formed.

7. The multi-database system of claim 1, wherein said integration processing is carried out on the partial data subjected to said conversion processing and on a second partial data which is included in the distributed data received from the plurality of database devices and is not subject to said conversion processing, and wherein the integration processing carried out on the partial data is different from the integration processing carried out on the second partial data.

8. A multi-database processing device comprising:

a path,

an interface part coupled to said path and to a network;

a storage device coupled to said path, the storage device storing a program for performing an integration processing operation, and

a processing device coupled to said interface part and said storage device through said path, the processing device executing the program to perform the integration processing operation on distributed data received at said interface part from a plurality of database devices,

wherein said storage device receives a plurality of distributed data that are obtained by applying a conversion processing operation to a partial data in a first data region in said distributed data based on a preliminarily determined rule, and said processing device generates integrated data, in accordance with said integration processing operation, by integrating a plurality of said received distributed data based on said program and transmits said integrated data from said interface part to a user device.

9. The multi-database processing device of claim 8, wherein said conversion processing operation is an encrypting processing operation.

10. The multi-database processing device of claim 8, wherein said processing device transmits first information from said interface part to specify said first data region to said plurality of database devices.

11. The multi-database processing device of claim 10, wherein said interface part is coupled to a multi-database definition device through the network and receives definition information which defines said first information transmitted from said multi-database definition device.

12. The multi-database processing device of claim 8, wherein said processing device integrates a plurality of said distributed data by respectively applying integration processings which are different from each other to the partial data which is received from said plurality of database devices and is subjected to said conversion processing and to the partial data which is received from a plurality of said database device and is not subjected to said conversion processing.

14. The method of claim 13, wherein said conversion processing operation is an encrypted processing.

15. The method of claim 13, further comprising transmitting first information specifying said given data region to the plurality of database devices.

16. The method of claim 13, wherein said multi-database processing device is connected to a multi-database definition device through said network and receives definition information which defines said first information transmitted from said multi-database definition device.

17. The method of claim 13, wherein integrating the plurality of received distributed data comprises carrying out an integration processing on the partial data and on a second partial data which is included in the distributed data received from the plurality of database devices and is not subject to said conversion processing, and wherein the integration processing carried out on the partial data is different from the integration processing carried out on the second partial data.

19. The database device of claim 18, wherein said database device further includes means for receiving information which specifies said given data region from said multi-database processing device, and said means for applying said conversion processing applies said conversion processing to the partial data based on said specified information.

13. An information processing method for a multi-database processing device in which a plurality of database devices, each respectively including stored data therein, and a user device are connected through a network, said information processing method comprising:

transmitting demand information to the plurality of databases devices,

applying a conversion processing operation to a partial data in a first data region in each of said stored data in the plurality of database devices, said conversion processing operation being based on a preliminarily determined rule and generating converted data;

transmitting the converted data in each of the plurality of database devices to the multi-database processing device as distributed data;

receiving the plurality of distributed data in the multi-database processing device;

integrating the plurality of received distributed data to generate integrated data; and

transmitting said integrated data to said user device through said network.

18. A database device of a multi-database system in which a plurality of database devices respectively storing data therein, a multi-database processing device which performs an integration processing of the data stored in a plurality of said data base device and a user processing device which receives an integrally processed data from said multi-database processing device are connected with each other through a network, wherein said database device comprising:

means which receives demand information demanding distributed data which becomes a subject of said integrated processing from said multi-database processing device;

means for retrieving said distributed data;

means for applying a conversion processing based on a preliminarily determined rule to a partial data in a given data region included in said retrieved distributed data; and

means for transmitting said distributed data including said partial data to which the conversion processing is applied to said multi-database processing device, wherein

said multi-database processing device receives a plurality of said distributed data including said partial data to which the conversion processing is applied from a plurality of said database device, and generates integrated data by integrating a plurality of received distributed data, and transmits said integrated data to said user device.

20. A user processing device in which a plurality of database devices which respectively store data and a multi-database processing device which performs an integration processing on data stored in a plurality of said database devices are connected through a network and said user processing device receives data which is subjected to said integration processing from said multi-database processing device, said user processing device comprising:

means for receiving integrated data which said multi-database processing device integrates, said integrated data generated by integrating a plurality of distributed data wherein among distributed data necessary for an integration processing by said multi-database processing device, a conversion processing is applied to a partial data in a given data region included in said distributed data based on preliminarily determined rule at a plurality of said database devices;

means for applying a re-conversion processing which has a processing content corresponding to said conversion processing to partial integrated data corresponding to the partial data to which said conversion processing is applied among said received integrated data; and

means for outputting integrated data including said partial integrated data to which said re-conversion processing is applied.

21. The user processing device of claim 20, wherein said conversion processing is an encrypting processing and said re-conversion processing is a decrypting processing corresponding to said encrypting processing.

22. The user processing device of claim 20, wherein said user processing device further includes means for transmitting information which specifies said given data region to said multi-database processing device,

wherein said multi-database processing device transmits the information which specifies said given data region to a plurality of said database device respectively, and

wherein a plurality of said database devices respectively apply said conversion processing to the partial data based on said specified information.