Ciphertext header-based data security
Methods for landing encrypted data in a column, requesting access to decrypted data, and storing multiple data sets in a single column with different encryption schemes based on utilizing cryptographic key and algorithm identifiers in ciphertext headers. The methods comprise an application of a storage system receiving an access request to encrypt data to or decrypt data from (respectively) a database of the storage system. Next, the application determines whether the external source is permitted to encrypt to or decrypt from the database based on external source identifiers and permissions specified in an active directory of the storage system. When the external source is authenticated (i.e., permitted), performing the appropriate steps to write encrypted data by adding to ciphertext headers cryptographic key and algorithm identifiers or read decrypted data by obtaining cryptographic key and algorithm identifiers from ciphertext headers.
1 . A method for managing, authorizing, and encrypting data to be stored across a set of distinctly managed columns in a database of a storage system, the method comprising:
receiving, by an application of the storage system from a first external source, a first encrypt access request comprising a first data entry to be written to the database;
determining, by the application using an active directory of the storage system, whether the first external source is permitted to access a first encryption key to encrypt the first data entry to the database based on a first external source identifier and a first external source permission, wherein the active directory comprises identifiers of a plurality of external sources and corresponding permissions associated with the plurality of external sources; and
when the first external source is permitted to access the first encryption key to encrypt the first data entry to the database:
encrypting, by the application, the first data entry using a first encryption algorithm based on the first encryption key to obtain first ciphertext;
adding, by the application, a first header to the first ciphertext, wherein the first header comprises a first encryption key identifier identifying the first encryption key and a first encryption algorithm identifier identifying the first encryption algorithm; and
writing, by the application, the first ciphertext to a column in the database.
2 . The method of claim 1 , wherein the first encrypt access request further comprises a data type identifier identifying a type of data included in the first data entry to be written to the database.
3 . The method of claim 2 , wherein before encrypting, the method further comprises obtaining, by the application, the data type identifier to determine the first encryption key and the first encryption algorithm, wherein the first encryption key and the first encryption algorithm are associated with the data type identifier and used to encrypt the first data entry.
4 . The method of claim 2 , further comprising adding, by the application, the data type identifier to the first header, wherein the first encryption key identifier and the first encryption algorithm identifier are associated with the data type identifier.
5 . The method of claim 1 , wherein the first external source permission associated with the first external source indicates whether the first external source is permitted to at least one of access or write/encrypt to at least one of the columns or the first data entry.
6 . The method of claim 1 , wherein the storage system includes a data store comprising mappings between:
one or more encryption key identifiers and one or more encryption keys; and
one or more encryption algorithm identifiers and one or more encryption algorithms.
7 . The method of claim 6 , wherein the data store is accessed, by the application, to determine, based on the mappings in the data store, the first encryption key identifier and the first encryption algorithm identifier to add to the first header of the first ciphertext.
8 . The method of claim 1 , further comprising:
receiving, by the application from a second external source, a second encrypt access request comprising a second data entry to be written to the database;
determining, by the application using the active directory, whether the second external source is permitted to access a second encryption key to encrypt the second data entry to the database based on a second external source identifier and a second external source permission; and
when the second external source is permitted to access the second encryption key to encrypt the second data entry to the database:
encrypting, by the application, the second data entry using a second encryption algorithm based on the second encryption key to obtain second ciphertext, wherein the second encryption algorithm and the second encryption key are different from the first encryption algorithm and the first encryption key;
adding, by the application, a second header to the second ciphertext, wherein:
the second header comprises a second encryption key identifier identifying the second encryption key and a second encryption algorithm identifier identifying the second encryption algorithm; and
the second encryption algorithm identifier and the second encryption key identifier are different from the first encryption algorithm identifier and the first encryption key identifier; and
writing, by the application, the second ciphertext to the column in the database.
9 . The method of claim 8 , wherein the storage system includes a data store comprising mappings between:
one or more encryption key identifiers and one or more encryption keys; and
one or more encryption algorithm identifiers and one or more encryption algorithms.
10 . The method of claim 9 , wherein the data store is accessed, by the application, to determine, utilizing mappings in the data store:
the first and second encryption key identifiers and the first and second encryption algorithm identifiers to add to the first and second headers of the first and second ciphertexts, respectively; and
the first and second encryption key identifiers and the first and second encryption algorithm identifiers to add to the first and second headers of the first and second ciphertexts, respectively.
11 . The method of claim 1 , comprising:
receiving, by the application from a second external source, a decrypt access request for a second data entry comprising a second ciphertext to be read from the database;
reading, by the application, the second ciphertext from the column in the database;
determining, by the application using the active directory, whether the second external source is permitted to decrypt the second data entry from the database based on a second external source identifier and a second external source permission; and
when the second external source is permitted to decrypt the second data entry from the database:
obtaining, by the application, a decryption key identifier and a decryption algorithm identifier from a second header of the second ciphertext;
decrypting, by the application, the second data entry from the second ciphertext using a decryption algorithm identified by the decryption algorithm identifier based on a decryption key identified by the decryption key identifier; and
transmitting, by the application, the data entry to the second external source.
12 . The method of claim 11 , wherein the decrypt access request further comprises a data type identifier identifying a type of data included in the second data entry to be decrypted from the database.
13 . The method of claim 12 , wherein before decrypting, the method further comprises obtaining, by the application, the data type identifier to determine the decryption key and decryption algorithm, wherein the decryption algorithm and the decryption key are associated with the data type identifier, and wherein decrypting the second data entry is performed based on the decryption algorithm and the decryption key associated with the data type identifier.
14 . The method of claim 12 , further comprising obtaining, by the application, the data type identifier from the second header, wherein the decryption key identifier and the decryption algorithm identifier are associated with the data type identifier.
15 . The method of claim 11 , wherein the second external source permission associated with the second external source indicates whether the second external source is permitted to at least one of access or read/decrypt from one of the columns or the second data entry.
16 . The method of claim 11 , wherein the corresponding permissions in the active directory indicate at least one of: whether each of the plurality of external sources are permitted to connect to the database, whether each of the plurality of external sources are permitted to at least one of read/decrypt, write/encrypt, modify, or delete data within the database, access database scheme objects of the database, or perform administrative and database management tasks on the database.
17 . The method of claim 11 , wherein the storage system includes a data store comprising mappings between:
one or more decryption key identifiers and one or more decryption keys; and
one or more decryption algorithm identifiers and one or more decryption algorithms.
18 . The method of claim 17 , wherein the data store is accessed, by the application, to determine, based on the mappings in the data store, the decryption key and the decryption algorithm to use for decrypting the second data entry from the second ciphertext.
19 . The method of claim 11 , wherein the first external source and the second external source are the same.
20 . The method of claim 8 , wherein the first external source and the second external source are the same.