Abstract: Methods, systems, and computer program products for a secure database-as-a-service are provided herein. A computer-implemented method includes obtaining, by a database service, data associated with one or more client devices to be stored in at least one encrypted database; encrypting, without mutation and in accordance with one or more security requirements, at least a portion of the data using an order preserving encryption scheme, wherein the encrypting comprises (i) computing a set of encryption parameters for the portion of the data and (ii) applying a process that converts a fixed-length cipher text corresponding to the portion of the data to a variable-length cipher text; and storing the encrypted data in the at least one encrypted database, wherein the database service enables one or more indexes to be built over the encrypted data to improve performance of query processing.

Abstract: A method, computer system, and a computer program product for processing a computer dump by receiving at least one page of the computer system dump. The page includes a plurality of data tokens. The page may be parsed to extract a plurality of data tokens. The order of identifiers may be then determined for processing by using a probability sampling model. The probability sampling model calculates a plurality of reward based weights for each identifier using the tokens. The page may then be processed using the determined order of identifiers. The reward based weights may be updated after pages has been processed by determining frequency of each identifier detected during page processing.

Abstract: One embodiment provides a method, including: receiving, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; batching the set of queries into query batches; transforming, for each query batch, each query within the query batch, wherein the transforming includes changing the query to reduce data leakage; performing, responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; executing, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and calculating a remaining security budget based upon da

Abstract: A method for deduplicating a distributed ledger, a blockchain, and a computer program product. One embodiment may comprise splitting a new block on a distributed ledger into a plurality of partitions, comparing the plurality of partitions to a deduplication (dedup) map, replacing a first partition of the plurality of partitions with a first reference to the dedup map to produce a transformed block, and communicating the transformed block via a network interface to one or more peers.

Abstract: Methods, systems, and computer program products for memory protection in hypervisor environments are provided herein. A method includes maintaining, by a memory management layer of a hypervisor environment, a blockchain-based hash chain associated with a page table of the memory management layer, the page table corresponding to a plurality of memory pages; and verifying, by the first memory management layer, content obtained in connection with a read operation for a given one of the plurality of memory pages based at least in part on hashes maintained for the given memory page in the blockchain-based hash chain.

Abstract: Methods, systems, and computer program products for building an encrypted document store are provided herein. A computer-implemented method includes building an encrypted ordered key-value store; encrypting one or more sensitive keys to be stored in the ordered key-value store using an order preserving encryption scheme; storing a state of the order preserving encryption scheme in the ordered key-value store; and encrypting one or more values corresponding to the one or more sensitive keys using a semantically secure encryption scheme.

Abstract: Methods, systems, and computer program products for a secure database-as-a-service are provided herein. A computer-implemented method includes obtaining, by a database service, data associated with one or more client devices to be stored in at least one encrypted database; encrypting, without mutation and in accordance with one or more security requirements, at least a portion of the data using an order preserving encryption scheme, wherein the encrypting comprises (i) computing a set of encryption parameters for the portion of the data and (ii) applying a process that converts a fixed-length cipher text corresponding to the portion of the data to a variable-length cipher text; and storing the encrypted data in the at least one encrypted database, wherein the database service enables one or more indexes to be built over the encrypted data to improve performance of query processing.

Abstract: An example operation may include one or more of receiving a request to verify a first encrypted document from a computing device, retrieving a second set of encrypted tokens of a second encrypted document from a blockchain, determining a similarity value of the first encrypted document with respect to the second encrypted document based on a first set of encrypted tokens in the first encrypted document and the second set of encrypted tokens in the second encrypted document, and outputting the determined similarity value to the computing device in response to the request.

Abstract: Methods, systems, and computer program products for identifying and redacting data from diagnostic operations via monitoring of data are provided herein. A computer-implemented method includes automatically monitoring data, which includes determining which portions of the data are accessed during a diagnostic operation; parsing an input file into portions of parsed data, wherein the input file comprises an initial output of the diagnostic operation; classifying the portions of parsed data into classes by applying at least one of multiple classification models to the parsed data, wherein the at least one classification model is specific to the accessed portions of data; automatically identifying sensitive data in the classified portions of parsed data by applying a class-to-sensitivity mapping technique to the classified portions of parsed data; redacting the identified sensitive data from the input file; and generating and outputting an updated output of the diagnostic operation based on the redacting.

Abstract: One embodiment provides a method, including: receiving, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; batching the set of queries into query batches; transforming, for each query batch, each query within the query batch, wherein the transforming includes changing the query to reduce data leakage; performing, responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; executing, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and calculating a remaining security budget based upon da

Abstract: Methods, systems, and computer program products for building an encrypted document store are provided herein. A computer-implemented method includes building an encrypted ordered key-value store; encrypting one or more sensitive keys to be stored in the ordered key-value store using an order preserving encryption scheme; storing a state of the order preserving encryption scheme in the ordered key-value store; and encrypting one or more values corresponding to the one or more sensitive keys using a semantically secure encryption scheme.

Abstract: Methods, systems, and computer program products for generating a data migration plan for in-place encryption of data are provided herein. A computer-implemented method includes receiving, from a user, a request to generate a migration plan for performing in-place encryption of data within a database, wherein the migration plan indicates periods of time in which portions of the data are to be encrypted; determining a set of constraints for performing the in-place encryption; generating the migration plan based at least in part on the set of constraints; and performing the in-place encryption of the data in accordance with the migration plan such that only a single copy of each of the portions is maintained during the in-place encryption, wherein the single copy comprises one of a plaintext copy of data corresponding to the portion, and an encrypted copy of data corresponding to the portion.

Abstract: An example operation may include one or more of receiving a request to verify a first encrypted document from a computing device, retrieving a second set of encrypted tokens of a second encrypted document from a blockchain, determining a similarity value of the first encrypted document with respect to the second encrypted document based on a first set of encrypted tokens in the first encrypted document and the second set of encrypted tokens in the second encrypted document, and outputting the determined similarity value to the computing device in response to the request.

Abstract: One embodiment provides a method, including: receiving, from a user, a dataset for encryption before its storage at a data storage location, wherein the dataset comprises a plurality of portions; identifying (i) attributes of the dataset and (ii) dataset dependencies; generating a recommendation for an encryption scheme to be used for the dataset, wherein the generating comprises (i) generating, based upon the attributes and the dataset dependencies, a recommendation of an encryption scheme for each portion of the dataset and (ii) identifying, based upon the dataset dependencies, a key label for each portion of the dataset, wherein the key label identified for a portion of the dataset that is dependent on another portion of the dataset is the same as the key label identified for said another portion of the dataset; and providing, to the user, (i) the generated recommendation and (ii) a description identifying reasons for the generated recommendation.

Abstract: An example operation may include one or more of receiving blocks of a blockchain from one or more of a neighboring blockchain peer and an ordering service node, identifying two or more blocks from among the received blocks that belong to a same slot within the blockchain, validating the two or more identified blocks in parallel via execution of the two or more identified blocks at a same time, and in response to validation of the two or more identified blocks, storing the two or more identified blocks on a local blockchain ledger of a blockchain peer.

Abstract: Methods, systems, and computer program products for dynamically analyzing diagnostic operations data via machine learning techniques are provided herein. A computer-implemented method includes defining aspects of machine learning techniques to be performed in connection with diagnostic operation data analysis, including: defining dynamic analysis granularity selection functionality based on time constraints and the level of progress of the analysis; defining dynamic data classification identifier type selection functionality based on the time constraints and the level of progress of the analysis; and defining dynamic ordering of data classification identifiers during runtime based on data classification preferences, information pertaining to system workload, and information pertaining to requested analysis compliance parameters.

Abstract: A method for deduplicating a distributed ledger, a blockchain, and a computer program product. One embodiment may comprise splitting a new block on a distributed ledger into a plurality of partitions, comparing the plurality of partitions to a deduplication (dedup) map, replacing a first partition of the plurality of partitions with a first reference to the dedup map to produce a transformed block, and communicating the transformed block via a network interface to one or more peers.

Abstract: An example operation includes one or more of receiving a smart contract code by an analyzer node, building, by the analyzer node, a control flow-graph comprising a plurality of basic code blocks based on the smart contract code, computing, by the analyzer node, a read and write set for each of the basic code blocks from the plurality of the basic code blocks, and determining, by the analyzer node, at least two basic code blocks from the plurality of the basic code blocks that may be executed in parallel.

Abstract: Methods, systems, and computer program products for generating a data partitioning strategy for secure and efficient query processing are provided herein. A computer-implemented method includes obtaining at least (i) a database schema associated with a database and (ii) a query workload associated with the database; and generating, based at least in part on the database schema and the query workload, a distributed database structure for the database that (i) stores a first set of columns of the database within a private cloud environment in a plaintext format and (ii) stores a second set of columns of the database in a public cloud environment, wherein the second set of columns is stored in either a plaintext format or an encrypted format based on whether the second set of columns comprises sensitive data.

Abstract: A method (and structure and computer product) to encrypt plaintext data into ciphertext data includes encrypting, using a processor on a computer, plaintext into corresponding ciphertext, using a Property Preserving Encryption (PPE) protocol in which a predefined property is maintained when plaintext values are encrypted into ciphertext values. The predefined property is randomly flipped during encryption to reverse the predefined property in the corresponding ciphertext node. An indication of whether the predefined property has been maintained or reversed is stored as the state of encryption.