Question

Could you please explain a lot about the 'plug-in method' in database encryption? Or find some sources of information?

Answer 1

Plug-In method iDB encryption is the concept of attaching an encryption package (encryption module) onto the DBMS. It allows following features:

> The encryption package in DBMS works independently of the application.

> It requires less code management & modification to the query and code.

> It's one of the most commonly used encryption method due to it's flexible to apply to both commercial DBMS and open source databases.

The Plug-In method usually allows for index column-level encryption, access control, and auditing.

There are two levels of DB encryption:

File-level encryption: In file-level encryption, the DB file is protected by encrypting the whole DB file and unauthorized access to the file is restricted. Only authorized servers can decrypt and access the data.

Column-level encryption is a DB encryption method in which instead of encrypting the entire database file, each column is encrypted separately. Data is more secure because each encrypted column in the table requires a separate decryption method. This makes it more difficult for all the data within each table to be accessed at the same time. This type of encryption, however, slows down database index and search performance, because each column now needs a unique key.

file-level Encryption
  
DATA TABLE USER A USERB Column level Encryption

Thus, Plugin method provide below advantages:

• Selective Encryption for Higher Performance: This allows users to choose and pick to encrypt specific columns or attributes only instead of having to encrypt the entire file. This allows for optimal selection of choosing only the sensitive data that needs to be encrypted. This also hugely boosts the performance of the system compared to encrypting the whole database file. There is no use in encrypting data that doesn’t need to be protected.

• Column Management and access control: While only OS-level access control is available for file-level encryption, with column-level encryption it is possible to set up and manage proper access control at the DB-level. The security administrator can set up an encryption/decryption policy to choose the authority of what users have access to. The Security administrator can also delegate the encryption/decryption keys to only authorized users.