Encryption of security-sensitive data

• US 20060210071A1
• Filed: 03/16/2005
• Published: 09/21/2006
• Est. Priority Date: 03/16/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Springgay, Michael Ronald, Chandran, Gayathiri R., Pickel, James Willis
• Application Number:
  US11/082,474
• Publication Number:
  US 20060210071A1
• Time in Patent Office: Days
• US Class Current: 380/42
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols

Abstract

Techniques are provided for processing data. It is determined that a portion of a data stream to be transmitted includes a security-sensitive portion. The security-sensitive portion of the data stream is encrypted. The data stream with the encrypted security-sensitive portion is transmitted.

Claims

1. A method for processing data, comprising:

determining that a portion of a data stream to be transmitted includes a security-sensitive portion;

encrypting the security-sensitive portion of the data stream;

marking the encrypted security-sensitive portion as encrypted; and

transmitting the data stream with the encrypted security-sensitive portion.

2. The method of claim 1, wherein the data stream comprises a first data stream, further comprising:

receiving a second data stream with an encrypted security-sensitive portion;

decrypting the security-sensitive portion of the second data stream; and

processing the second data stream.

3. The method of claim 1, wherein the data stream comprises a first data stream, further comprising:

receiving a second data stream with an encrypted security-sensitive portion;

identifying an encryption seed and an encryption token used for encrypting the security-sensitive portion;

storing the encryption seed and the encryption token in a security override object; and

transmitting the second data stream with the security override object.

5. The method of claim 1, wherein the data stream comprises a first data stream, further comprising:

receiving a second data stream with a security override object;

decrypting the security override object to obtain the encryption seed and the encryption token; and

using the encryption seed and the encryption token to decrypt the encrypted security-sensitive data.

6. The method of claim 1, wherein the data stream comprises a database data stream and wherein the security-sensitive portion comprises an object data stream structure.

7. The method of claim 1, further comprising:

setting a data stream structure type in a data stream structure header to encrypted object.

8. The method of claim 1, further comprising:

establishing a connection with another computer system with an indication that a security-sensitive portion of each data stream is to be encrypted without encrypting the entire data stream.

4. The method of claim I, wherein the data stream comprises a first data stream, further comprising:

receiving a second data stream with a security override object;

decrypting the security override object;

re-encrypting the security override object; and

transmitting the second data stream with the re-encrypted security override object.

9. An article of manufacture including a program for processing data, wherein the program is capable of causing operations to be performed, the operations comprising:

determining that a portion of a data stream to be transmitted includes a security-sensitive portion;

encrypting the security-sensitive portion of the data stream;

marking the encrypted security-sensitive portion as encrypted; and

transmitting the data stream with the encrypted security-sensitive portion.

10. The article of manufacture of claim 9, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with an encrypted security-sensitive portion;

decrypting the security-sensitive portion of the second data stream; and

processing the second data stream.

11. The article of manufacture of claim 9, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with an encrypted security-sensitive portion;

identifying an encryption seed and an encryption token used for encrypting the security-sensitive portion;

storing the encryption seed and the encryption token in a security override object; and

transmitting the second data stream with the security override object.

12. The article of manufacture of claim 9, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with a security override object;

decrypting the security override object;

re-encrypting the security override object; and

transmitting the second data stream with the re-encrypted security override object.

13. The article of manufacture of claim 9, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with a security override object;

decrypting the security override object to obtain the encryption seed and the encryption token; and

using the encryption seed and the encryption token to decrypt the encrypted security-sensitive data.

14. The article of manufacture of claim 9, wherein the data stream comprises a database data stream and wherein the security-sensitive portion comprises an object data stream structure.

15. The article of manufacture of claim 9, and wherein the operations further comprise:

setting a data stream structure type in a data stream structure header to encrypted object.

16. The article of manufacture of claim 9, and wherein the operations further comprise:

establishing a connection with another computer system with an indication that a security-sensitive portion of each data stream is to be encrypted without encrypting the entire data stream.

17. A system for processing data, comprising:

circuitry capable of causing operations to be performed, the operations comprising;

determining that a portion of a data stream to be transmitted includes a security-sensitive portion;

encrypting the security-sensitive portion of the data stream;

marking the encrypted security-sensitive portion as encrypted; and

transmitting the data stream with the encrypted security-sensitive portion.

18. The system of claim 17, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with an encrypted security-sensitive portion;

decrypting the security-sensitive portion of the second data stream; and

processing the second data stream.

19. The system of claim 17, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with an encrypted security-sensitive portion;

identifying an encryption seed and an encryption token used for encrypting the security-sensitive portion;

storing the encryption seed and the encryption token in a security override object; and

transmitting the second data stream with the security override object.

20. The system of claim 17, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with a security override object;

decrypting the security override object;

re-encrypting the security override object; and

transmitting the second data stream with the re-encrypted security override object.

21. The system of claim 17, wherein the data stream comprises a first data stream, and wherein the operations further comprise:

receiving a second data stream with a security override object;

decrypting the security override object to obtain the encryption seed and the encryption token; and

using the encryption seed and the encryption token to decrypt the encrypted security-sensitive data.

22. The system of claim 17, wherein the data stream comprises a database data stream and wherein the security-sensitive portion comprises an object data stream structure.

23. The system of claim 17, and wherein the operations further comprise:

setting a data stream structure type in a data stream structure header to encrypted object.

24. The system of claim 17, and wherein the operations further comprise:

establishing a connection with another computer system with an indication that a security-sensitive portion of each data stream is to be encrypted without encrypting the entire data stream.