FIELD OF THE DISCLOSURE

This patent application generally relates to protecting database backups against unauthorized access and theft of data. More particularly, the present disclosure provides methods and systems in which hashed globally unique identifiers (GUID) are embedded in each database instance of a given database management system (DBMS) and in which a different DBMS can only access or restore the backup if it possesses the identical GUID associated with the database instance.

BACKGROUND AND SUMMARY OF THE DISCLOSURE

Database systems typically include security protocols such as user authentication and access permissions. However, even with these measures in place, databases are still vulnerable to occurrences that can lead to a breach. Hackers from outside of an enterprise can surreptitiously siphon away data, an occurrence that's often not detected until well after the event. This can happen at any of several points in the lifespan of data in a standard enterprise client-server arrangement, as the data that resides in databases has the following natural states: data-in-motion, data-in-use, and data-at-rest. When client and server are not co-located, which is typical, a state of data-in-motion exists wherein data must transit the Internet. Security for this data traffic over public infrastructure is accomplished by using the set of encryption facilities and protocols known as Transport Layer Security (TLS), formerly known as the Secure Socket Layer (SSL). These protocols include the use of encryption algorithms to make data unusable by unauthorized entities and cryptographic keys that enable decryption of the data by duly-authorized parties. Even with these advanced security features, breaches have occurred that exploit vulnerabilities that exist in the standard protocols.

Regarding the data-in-use state, it is sometimes possible for an attacker to bypass enterprise safeguards and directly access data in the working memory of a database server, resulting in the compromise and theft of sensitive information.

Even data-at-rest, which refers to all data resident on the database server, except for that data which is currently traversing a network or which is temporarily residing in the server's memory, is not safe from theft. U.S. Pat. No. 9,934,388 proposes a solution to this technical problem by including a dedicated encryption module inside a Database Management System (DBMS), at a layer above the database cache. All necessary encryption keys are made accessible to the server during a valid user session, and the keys are retained only in the server's memory during the session. The encryption secures the data against an intruder breaking into the database, and for the same reason only an encrypted form of the data is stored on the backup site, providing “data at rest” security. The encryption function takes both the value of a data point and the data point's position coordinates within the database as inputs to generate the data point's encrypted value. The solution of the '388 patent is internal to the database management system provided by this specific architecture. However, because this solution resides between the database cache and the query engine, it effectively remains within the boundaries of the DBMS platform whereas solutions in the art remain needed to protect backup sets once detached from DBMS oversight.

Given this threat environment that enterprises face in today's increasingly interconnected world, there is a need for a solution that will preserve informational security even when database backups exist detached from a DBMS. The present disclosure addresses this and other needs in the art of data security in a computer network.

