Method and apparatus for secure storage of data

• US 5,963,642 A
• Filed: 12/30/1996
• Issued: 10/05/1999
• Est. Priority Date: 12/30/1996
• Status: Expired due to Term

• Current Assignee: Long Corner Security LLC
• Original Assignee: Benjamin D. Goldstein
• Inventors: Goldstein, Benjamin D.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/777,414
• Time in Patent Office: 1,009 Days
• Field of Search: 380/4, 380/9, 380/23, 380/25, 380/28, 380/49, 380/50, 380/59, 707/1, 707/100, 707/101, 707/102, 707/103, 707/104
• US Class Current: 713/193
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A mechanism and method for encrypting database information such that the data can be directly processed while still in an encrypted form. The mechanism and method make use of a distributed computing network. Internal level database information is located remotely from users in the form of property-oriented positional q-code suitable for directly performing database operations on. End-user workstations have external level or conceptual level information. End-user workstations make use of codebooks to decrypt the internal level database information which is located separately from the codebooks. External-level (user-level) and/or conceptual-level (community-level) schema information is located on end-user workstations (or accessible from them), while internal-level data in the form of compressed binary sparse matrices is located separately. The internal-level data is in effect encrypted as a positional q-code. The end-user workstations have codebooks (or access to codebooks) which along with the external-level and/or conceptual level schema information allow the encrypted internal-level database information to be locally decrypted.

Claims

1. An apparatus for secure storage of data comprising:

a database having a semantically encrypted store of data;

a database mechanism for performing database operations with semantically encrypted data without requiring decryption of the data, said database mechanism connected with said database; and

an access mechanism connected to the database mechanism for obtaining data from the database mechanism.

2. An apparatus as described in claim 1 wherein the access mechanism includes an encryption/decryption mechanism connected to the database mechanism for receiving the decrypted data, encrypting the data and providing it to the database, and for receiving encrypted data from the database mechanism, and decrypting it.

3. An apparatus as described in claim 2 wherein the semantically encrypted data is a property-oriented positional Q-code.

4. An apparatus as described in claim 3 wherein the property-oriented positional q-code comprises sparse binary matrices.

5. An apparatus as described in claim 4 wherein the access mechanism includes an end-user client workstation having a user CPU and a workstation memory connected to the CPU, and wherein the encryption/decryption mechanism includes a code book stored in the memory and a software program in the memory which accesses and updates the code book.

6. An apparatus as described in claim 5 including a database server computer having the database mechanism and the database.

7. An apparatus as described in claim 6 wherein the database mechanism includes a server CPU and a server memory connected to the server CPU, said server memory having said database.

8. An apparatus as described in claim 7 wherein the server memory includes a database command storage buffer, and a database response storage buffer.

9. An apparatus as described in claim 8 wherein the server computer includes a server communication port connected to the server memory and the server CPU.

10. An apparatus as described in claim 9 wherein the workstation includes a workstation communications port connected to the server communications port and to the workstation CPU and the workstation memory, an input port and an output port, both of which are connected to the workstation memory and the workstation CPU and the workstation communications port.

11. An apparatus as described in claim 4 wherein the property-oriented positional Q-code uses dummy columns, dummy rows, column splitting, column offsets, encryption of compressed sparse matrix dimension information or BPM column permutations to increase the security of the property-oriented positional Q-code.

12. An apparatus for secure storage of data comprising:

a database having fully indexed data;

a database mechanism for performing operations on or with fully indexed data having index information which permits access and interpretation of the fully indexed data, said database mechanism connected to said database; and

an access mechanism connected to the database mechanism for obtaining data from the database mechanism.

13. An apparatus for data storage comprising:

a database having a semantically represented store of data;

a database mechanism for performing database operations with the semantically represented data, said database mechanism connected with said database; and

an access mechanism connected to the database mechanism for obtaining data from the database mechanism such that the access mechanism provides different users with different representations of the semantically encrypted data.

14. An apparatus as described in claim 13 wherein the access mechanism provides different users with different natural language translations of the semantically represented data.

15. An apparatus as described in claim 13 wherein the access mechanism provides a sight-impaired person with an audio representation of the semantically represented data.

16. A method for secure storage of data comprising the steps of:

storing semantically encrypted data in a memory;

performing database operations with semantically encrypted data from the memory without requiring decryption of the data; and

obtaining data from the memory.