Transparent encryption using secure JDBC/ODBC wrappers
A system and method for selectively encrypting and decrypting data in any given target database from a plurality of databases in a manner that is transparent to application programs that access data in such databases is described.
1 . A computer-implemented method for selective encryption of data for storing in a database of a plurality of databases in a manner that is transparent to a plurality of application programs that use said data, said method comprising:
intercepting communications between said plurality of application programs and a database connectivity driver that provides said plurality of application programs with connectivity to one or more databases of said plurality of databases;
determining if said intercepted communications reference encrypted data associated with said database; and
modifying said intercepted communications when said intercepted communications reference encrypted data associated with said database.
2 . The computer-implemented method of claim 1 , further comprising authenticating and authorizing said plurality of application programs when said intercepted communications reference encrypted data associated with said database.
3 . The computer-implemented method of claim 1 , further comprising using an NAE mechanism that is adapted for encrypting and decrypting data that is associated with said intercepted communications.
4 . The computer-implemented method of claim 3 , further comprising using a query language parse engine at said NAE mechanism.
5 . The computer-implemented method of claim 4 , wherein said parse engine is a SQL parse engine.
6 . The computer-implemented method of claim 1 , further comprising using a database connectivity API.
7 . The computer-implemented method of claim 6 , wherein said database connectivity API includes a JAVA® Database Connectivity (JDBC).
8 . The computer-implemented method of claim 6 , wherein said database connectivity API includes a Microsoft® Open Database Connectivity (ODBC).
9 . The computer-implemented method of claim 1 , further comprising using metadata tables for storing encryption information about encrypted database tables associated with said plurality of databases.
10 . The computer-implemented method of claim 9 , wherein said metadata tables are stored in said corresponding database where said encrypted database tables are stored.
11 . The computer-implemented method of claim 1 , further comprising using a GUI for configuring metadata tables for storing encryption information about encrypted database tables associated with said plurality of databases and for enabling and disabling said interception of communications.
12 . A system for encrypting data in a database, the system comprising:
a wrapper that is adapted to intercept communications between application programs and a database driver; and
a network attached encryption and decryption mechanism that is adapted for use with said wrapper.
13 . The system of claim 12 , further comprising metadata tables for storing encryption information about encrypted database tables associated with said database.
14 . The system of claim 13 , wherein said metadata tables are stored in said corresponding database where said encrypted database tables are stored.
15 . The system of claim 12 , further comprising a GUI for configuring metadata tables for storing encryption information about said encrypted database tables and for enabling and disabling said wrapper.
16 . The system of claim 12 , further comprising a query language parse engine for parsing said intercepted communications.
17 . A transparent encryption mechanism for encrypting data in a database, the encryption mechanism comprising:
a means for intercepting communications between application programs and a database driver; and
a means for modifying said intercepted communications said intercepted communications reference encrypted data.
18 . The encryption mechanism of claim 17 , further comprising a means for encrypting and decrypting data associated with said database.
19 . The encryption mechanism of claim 17 , further comprising a means for parsing said communications.
20 . The encryption mechanism of claim 17 , further comprising a means for storing encryption information about said encrypted columns associated with said database.