	US 7,490,248 B1
	Method for reencryption of a database
Thomas Valfridsson, Skelleftea (Sweden); and Ulf Mattsson, UM Cos Cob, Conn. (US)
Assigned to Protegrity Corporation, Stamford, Conn. (US)
Appl. No. 10/129,013 PCT Filed Nov. 13, 2000, PCT No. PCT/SE00/02219 § 371(c)(1), (2), (4) Date Sep. 27, 2002, PCT Pub. No. WO01/35226, PCT Pub. Date May 17, 2001.
Claims priority of application No. 9904094 (SE), filed on Nov. 12, 1999.
Int. Cl. H04L 9/00 (2006.01)

U.S. Cl. 713—193 [713/194; 713/165; 726/27; 380/277; 707/200]

13 Claims

1. A method for re-encrypting one or more data items that are encrypted and stored in a database, where said re-encrypting being an automated background process, said method for re-encrypting comprising the steps of:

in an initial time period, encrypting and storing the one or more data items in the database, wherein:

(1) the one or more data items are encrypted using an encryption key having a key life,

(2) the key life is associated with the one or more stored encrypted data items,

(3) a time stamp is stored one of with the encrypted one or more data items or in a another table or data set, and

(4) where the time stamp is representative of a time period during which the encryption key used to encrypt the one or more data items was generated or started to be used and representative of the time period the one or more encrypted items were last updated or inserted into the database;

entering a next time period, the next time period being at least subsequent to the time period(s) during which the one or more data items were updated or inserted into the database and having a corresponding time length, and wherein:

generating a new encryption key with an associated key life at the start of the next time period;

scanning the data base and identifying whether any of the one or more encrypted data items were previously encrypted using an encryption key now determined to be expired, wherein key expiration being determined from the key life and time stamp associated with the encrypted one or more data items in the database; and

identifying any of the one or more encrypted data items stored in the database that were determined to be previously encrypted using a now expired encryption key, and wherein:

(a) decrypting each of the identified one or more data items and re-encrypting each of the identified one or more data items using the new encryption key,

(b) changing the key life of the re-encrypted one or more encrypted data items to correspond to the key life for the new encryption, and

(c) storing another time stamp and an encryption key generation counter with the re-encrypted one or more data items, where the another time stamp is representative of the next time period.