公开(公告)号：US20080059414A1

公开(公告)日：2008-03-06

申请号：US11516267

申请日：2006-09-06

Applicant: Elena Daniela Cristofor ,  Laurentiu Bogdan Cristofor ,  Tanmoy Dutta ,  Raul Garcia ,  Sung L. Hsueh

Inventor： Elena Daniela Cristofor ,  Laurentiu Bogdan Cristofor ,  Tanmoy Dutta ,  Raul Garcia ,  Sung L. Hsueh

IPC: G06F17/30

CPC classification number: G06F17/30312 ,  G06F21/606 ,  G06F21/6245 ,  H04L9/3236

Abstract: An indexing value may be determined, transparently with respect to a requester, based on a desired plaintext item of data and a cryptographic key. The indexing value may be used to access an entry in an indexing structure to obtain a corresponding database entry which includes a non-deterministically encrypted ciphertext item. In another embodiment, an indexing structure for a database may be accessed. Positions of items of the indexing structure may be based on corresponding plaintext items. References related to the corresponding plaintext items in the indexing structure may be encrypted and other information in the indexing structure may be unencrypted. A portion of the indexing structure may be loaded into a memory and at least one of the encrypted references related to one of the plaintext items may be decrypted. The decrypted reference may be used to access a corresponding non-deterministically encrypted data item from the database.

Abstract translation: 基于期望的明文数据项和加密密钥，可以相对于请求者透明地确定索引值。 索引值可以用于访问索引结构中的条目以获得包括非确定性加密的密文项目的相应数据库条目。 在另一个实施例中，可以访问用于数据库的索引结构。 索引结构的项目的位置可以基于相应的明文项目。 与索引结构中的相应明文项相关的引用可以被加密，并且索引结构中的其他信息可以是未加密的。 索引结构的一部分可以被加载到存储器中，并且与一个明文项目相关的加密引用中的至少一个可以被解密。 解密的引用可以用于从数据库访问相应的非确定性加密的数据项。

公开(公告)号：US07661141B2

公开(公告)日：2010-02-09

申请号：US10885815

申请日：2004-07-07

Applicant: Tanmoy Dutta ,  Girish Chander ,  Laurentiu Bogdan Cristofor ,  Rodger N. Kline ,  James R. Hamilton

Inventor： Tanmoy Dutta ,  Girish Chander ,  Laurentiu Bogdan Cristofor ,  Rodger N. Kline ,  James R. Hamilton

IPC: G06F7/04 ,  G06F17/30 ,  H04N7/16

CPC classification number: G06F21/6227

Abstract: The systems and methods of the present invention facilitate database row-level security by utilizing SQL extensions to create and associate named security expressions with a query initiator(s). Such expressions include Boolean expressions, which must be satisfied by a row of data in order for that data to be made accessible to the query initiator. In general, a query is augmented with security expressions, which are aggregated and utilized during querying rows of data. The systems and methods variously place security expressions within a query in order to optimize query performance while mitigating information leaks. This is achieved by tagging security expressions as special and utilizing rules of predicate to pull or push non-security expressions above or below security expressions, depending on the likelihood of a non-security being safe, as determined via a static and/or dynamic analysis.

Abstract translation: 本发明的系统和方法通过利用SQL扩展来创建和关联命名的安全表达式与查询启动器来促进数据库行级安全性。 这样的表达式包括布尔表达式，这些表达式必须由一行数据满足，以使该数据能够被查询启动器访问。 一般来说，查询会增加安全性表达式，这些表达式在查询数据行期间进行聚合和使用。 系统和方法将查询中的安全表达式各不相同，以优化查询性能，同时减轻信息泄漏。 这是通过将安全表达式标记为特殊的，并利用谓词的规则在安全表达式之上或之下拉取或推送非安全表达式，这取决于非安全性的可能性，通过静态和/或动态分析确定 。

公开(公告)号：US07689547B2

公开(公告)日：2010-03-30

申请号：US11516267

申请日：2006-09-06

Applicant: Elena Daniela Cristofor ,  Laurentiu Bogdan Cristofor ,  Tanmoy Dutta ,  Raul Garcia ,  Sung L. Hsueh

Inventor： Elena Daniela Cristofor ,  Laurentiu Bogdan Cristofor ,  Tanmoy Dutta ,  Raul Garcia ,  Sung L. Hsueh

IPC: G06F17/30

CPC classification number: G06F17/30312 ,  G06F21/606 ,  G06F21/6245 ,  H04L9/3236

Abstract: An indexing value may be determined, transparently with respect to a requester, based on a desired plaintext item of data and a cryptographic key. The indexing value may be used to access an entry in an indexing structure to obtain a corresponding database entry which includes a non-deterministically encrypted ciphertext item. In another embodiment, an indexing structure for a database may be accessed. Positions of items of the indexing structure may be based on corresponding plaintext items. References related to the corresponding plaintext items in the indexing structure may be encrypted and other information in the indexing structure may be unencrypted. A portion of the indexing structure may be loaded into a memory and at least one of the encrypted references related to one of the plaintext items may be decrypted. The decrypted reference may be used to access a corresponding non-deterministically encrypted data item from the database.

Abstract translation: 基于期望的明文数据项和加密密钥，可以相对于请求者透明地确定索引值。 索引值可以用于访问索引结构中的条目以获得包括非确定性加密的密文项目的相应数据库条目。 在另一个实施例中，可以访问用于数据库的索引结构。 索引结构的项目的位置可以基于相应的明文项目。 与索引结构中的相应明文项相关的引用可以被加密，并且索引结构中的其他信息可以是未加密的。 索引结构的一部分可以被加载到存储器中，并且与一个明文项目相关的加密引用中的至少一个可以被解密。 解密的引用可以用于从数据库访问相应的非确定性加密的数据项。