Data migration

• US 20070079140A1
• Filed: 09/26/2005
• Published: 04/05/2007
• Est. Priority Date: 09/26/2005
• Status: Abandoned Application

• Current Assignee: SafeNet Incorporated (Thales SA)
• Original Assignee: SafeNet Incorporated (Thales SA)
• Inventors: Sandell, Bruce, Metzger, Brian, Mauldin, Stephen, Chang, Jorge
• Application Number:
  US11/236,294
• Publication Number:
  US 20070079140A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

A system and method for providing a mechanism for automating the conversion of the relational database to a secure relational database with little or no impact on the resources of the relational database during the conversion.

Claims

1. A computer-implemented method for encrypting data from a database, said method comprising:

providing a mechanism having computing resources that is divorced from resources of said database for performing encryption operations;

providing an automated tool that is associated with said mechanism for;

selecting target data for encryption;

selecting an encryption method for said target data;

specifying one or more characteristics for said selected encryption method; and

modifying a corresponding schema for each database column where said target data resides in a manner for accommodating said target data after said target is encrypted.

2. The computer-implemented method of claim 1, further comprising providing a functionality for restoring said each database column to its original size and data type.

3. The computer-implemented method of claim 1, further comprising determining which data in said database can be modified by a user based on said user'"'"'s access rights to said database.

4. The computer-implemented method of claim 3, further comprising identifying which database tables in said database can be modified by said user.

5. The computer-implemented method of claim 4, further comprising determining which columns in said identified database tables can be modified by said user.

6. The computer-implemented method of claim 1, further comprising encrypting said target data using said selected encryption method.

7. The computer-implemented method of claim 1, further comprising restoring said target data to its original unencrypted form after said target data is encrypted.

8. The computer-implemented method of claim 1, further comprising providing a management console with a graphical user interface for using said automated tool.

9. The computer-implemented method of claim 8, wherein said interface is web-based.

10. The computer-implemented method of claim 1, wherein said one or more characteristics for said selected encryption method comprises an encryption algorithm type, a mode type, a padding and an initialization vector.

11. The computer-implemented method of claim 10, wherein said encryption algorithm type includes DES, DESede, AES, RC4, HMAC, RSA.

12. The computer-implemented method of claim 10, wherein said mode type includes CBC mode and EBC mode.

13. An encryption system for encrypting data in a database, the encryption system comprising:

a means for selecting target data for encryption;

a means for selecting an encryption method for said target data;

a means for specifying one or more characteristics for said selected encryption method; and

a means for modifying a corresponding schema for each database column where said target data resides in a manner for accommodating said target data after said target is encrypted.

14. The encryption system of claim 13, further comprising a means for providing a functionality for restoring said each database column to its original size and data type.

15. The encryption system of claim 13, further comprising a means for determining which data in said database can be modified by a user based on said user'"'"'s access rights to said database.

16. The encryption system of claim 15, further comprising a means for identifying which database tables in said database can be modified by said user.

17. The encryption system of claim 16, further comprising a means for determining which columns in said identified database tables can be modified by said user.

18. The encryption system of claim 13, further comprising a means for encrypting said target data using said selected encryption method.

19. The encryption system of claim 13, further comprising a means for restoring said target data to its original unencrypted form after said target data is encrypted.

20. An apparatus for encrypting data in a database, the apparatus comprising:

one or more processors;

a storage for encryption keys;

an authentication mechanism for authenticating users who desire to access said database;

a database interface for interfacing with said database;

a management console for allowing an administrator to manage said data in said database;

a storage medium carrying one or more sequences of one or more instructions which, when executed by said one or more processors, cause said one or more processors to perform the steps of;

selecting target data for encryption;

selecting an encryption method for said target data;

specifying one or more characteristics for said selected encryption method; and

modifying a corresponding schema for each database column where said target data resides in a manner for accommodating said target data after said target is encrypted.

21. The apparatus of claim 20, further comprising a first mechanism for restoring said each database column to its original size and data type.

22. The apparatus of claim 20, further comprising a second mechanism for determining which data in said database can be modified by a user based on said user'"'"'s access rights to said database.

23. The apparatus of claim 22, further comprising a third mechanism for identifying which database tables in said database can be modified by said user.

24. The apparatus of claim 23, further comprising a fourth mechanism for determining which columns in said identified database tables can be modified by said user.

25. The apparatus of claim 20, further comprising a fifth mechanism for encrypting said target data using said selected encryption method.

26. The apparatus of claim 20, further comprising a sixth mechanism for restoring said target data to its original unencrypted form after said target data is encrypted.

27. One or more propagated data signals collectively conveying data that causes a computing system to perform a method for encrypting data from a database, said method comprising:

providing a mechanism having computing resources that is divorced from resources of said database for performing encryption operations;

providing an automated tool that is associated with said mechanism for;

selecting target data for encryption;

selecting an encryption method for said target data;

specifying one or more characteristics for said selected encryption method; and

modifying a corresponding schema for each database column where said target data resides in a manner for accommodating said target data after said target is encrypted.

28. The propagated data signals of claim 27, further comprising providing a functionality for restoring said each database column to its original size and data type.

29. The propagated data signals of claim 27, further comprising determining which data in said database can be modified by a user based on said user'"'"'s access rights to said database.

30. The propagated data signals of claim 29, further comprising identifying which database tables in said database can be modified by said user.

31. The propagated data signals of claim 30, further comprising determining which columns in said identified database tables can be modified by said user.

32. The propagated data signals of claim 27, further comprising encrypting said target data using said selected encryption method.

33. The propagated data signals of claim 27, further comprising restoring said target data to its original unencrypted form after said target data is encrypted.

34. The propagated data signals of claim 27, further comprising providing a management console with a graphical user interface for using said automated tool.

35. The propagated data signals of claim 34, wherein said interface is web-based.

36. The propagated data signals of claim 27, wherein said one or more characteristics for said selected encryption method comprises an encryption algorithm type, a mode type, a padding and an initialization vector.

37. The propagated data signals of claim 36, wherein said encryption algorithm type includes DES, DESede, AES, RC4, HMAC, RSA.

38. The propagated data signals of claim 36, wherein said mode type includes CBC mode and EBC mode.