Abstract: Techniques for managing data stored within a database, such as a decentralized database are provided. Some techniques involve managing some data within a lower-trust database and some other data within a higher-trust database. A higher-trust database may be a decentralize database including a blockchain. A lower-trust database may store references to data within the blockchain, and optionally other data in association with those references. Disclosed techniques include WHERE clause query handling in databases with reference values, replacement of distinct data in a relational database with a distinct reference to that data, number line storing for secure indexing, APIs for databases, and consensus operations for private blockchain networks.

Abstract: A system and method are provided for encryption key management, transparent decryption, and secure key sharing within a secure distributed storage environment. A master encryption key is generated for a user and encrypted using a wrapper key. Database keys are generated and encrypted using the master key, and then stored at a user-associated storage instance. In response to a query, the encrypted database key is decrypted using the master key and used to decrypt encrypted data. Masking policies may determine whether decrypted or encrypted data is returned to the user. Format-preserving encryption may be applied using a tweak value. Encrypted keys may be securely shared across independent encryption domains by re-encrypting under a temporary session master key. At no point is raw key material exposed to untrusted systems. The techniques improve key lifecycle security, enable policy-based access, and support multi-tenant data environments such as cloud-hosted data warehouses.

Abstract: Provided is a process including: receiving, with one or more processors, a first request to store a record from a computing entity; encoding, with one or more processors, the record in a first plurality of segments; arranging, with one or more processors, the first plurality of segments in respective content nodes of a first content graph, wherein at least some content nodes of the first content graph have two or more content edges of the first content graph pointing to two or more respective other content nodes of the first content graph; and storing, with one or more processors, the content nodes of the first content graph in a verification graph.

Abstract: Provided is a process including: obtaining criteria to select plain-text values in a lower-trust database; selecting, based on the criteria, a first plain-text value; in response, determining a first reference value; storing the first plain-text value in a higher-trust database in a second entry identified by the first reference value; storing the first reference value in the first entry of the lower-trust database; selecting another instance of the first plain-text value stored requested to be stored in a third entry in the lower-trust database; and in response, storing the first reference value in the third entry.

Abstract: Provided is a process including: receiving, with one or more processors, a first request to store a record from a computing entity; encoding, with one or more processors, the record in a first plurality of segments; arranging, with one or more processors, the first plurality of segments in respective content nodes of a first content graph, wherein at least some content nodes of the first content graph have two or more content edges of the first content graph pointing to two or more respective other content nodes of the first content graph; and storing, with one or more processors, the content nodes of the first content graph in a verification graph.

Abstract: A driver reads incoming database requests to obtain application-level user information delimited in the request. The driver may determine a subset or multiple subsets of data to which access is being request by an application. The driver may access a policy comprising rules governing application-level users and apply the rules to the request, such as to allow, mask, or disallowing respective subsets of data to pass from the database to the application.

Abstract: Provided are processes to increase security of database systems, in some cases with transparent retrofits. Examples may include the calling of external functions responsive to a data access event, such as detected by a database driver, upon connection attempt to, request attempt to, or retrieval of data from a database arrangement of a storage environment. The database driver, in response to detecting an event, may perform a call to an API, like a RESTful API, of a component or system that effectuates logic for determining instructions provided back to the database driver for responding to the event.

Abstract: Provided is a process including: receiving, with one or more processors, a first request to store a record from a computing entity; encoding, with one or more processors, the record in a first plurality of segments; arranging, with one or more processors, the first plurality of segments in respective content nodes of a first content graph, wherein at least some content nodes of the first content graph have two or more content edges of the first content graph pointing to two or more respective other content nodes of the first content graph; and storing, with one or more processors, the content nodes of the first content graph in a verification graph.

Abstract: Provided is a process including: receiving one or more write requests; selecting a first subset of the values as corresponding to higher-security fields; segmenting a first value in the first subset; instructing a first computing device to store a first subset of segments among the plurality of segments in memory; and instructing a second computing device to store a second subset of segments among the plurality of segments in memory.

Abstract: Provided is a process including: receiving, with one or more processors, a first request to store a record from a computing entity; encoding, with one or more processors, the record in a first plurality of segments; arranging, with one or more processors, the first plurality of segments in respective content nodes of a first content graph, wherein at least some content nodes of the first content graph have two or more content edges of the first content graph pointing to two or more respective other content nodes of the first content graph; and storing, with one or more processors, the content nodes of the first content graph in a verification graph.

Abstract: A driver reads incoming database requests to obtain application-level user information delimited in the request. The driver may determine a subset or multiple subsets of data to which access is being request by an application. The driver may access a policy comprising rules governing application-level users and apply the rules to the request, such as to allow, mask, or disallowing respective subsets of data to pass from the database to the application.

Abstract: Provided are processes to increase security of database systems, in some cases with transparent retrofits. Examples may include the calling of external functions responsive to a data access event, such as detected by a database driver, upon connection attempt to, request attempt to, or retrieval of data from a database arrangement of a storage environment. The database driver, in response to detecting an event, may perform a call to an API, like a RESTful API, of a component or system that effectuates logic for determining instructions provided back to the database driver for responding to the event.

Abstract: Provided is a process including: receiving one or more write requests to write a plurality of values to a plurality of fields in one or more tuples of a relational database, different ones of the values corresponding to different ones of the fields, detecting duplicates of the values with steps for expediting detection of duplicates, and selecting a first subset of the values based on the first subset of values corresponding to fields in a first subset of the fields, the first subset of fields being designated as higher-security fields than a second subset of fields among the plurality of fields.

Abstract: Provided is a process including: receiving one or more write requests; selecting a first subset of the values as corresponding to higher-security fields; segmenting a first value in the first subset; instructing a first computing device to store a first subset of segments among the plurality of segments in memory; and instructing a second computing device to store a second subset of segments among the plurality of segments in memory.

Abstract: Provided is a process including: receiving one or more write requests to write a plurality of values to a plurality of fields in one or more tuples of a relational database, different ones of the values corresponding to different ones of the fields, detecting duplicates of the values with steps for expediting detection of duplicates, and selecting a first subset of the values based on the first subset of values corresponding to fields in a first subset of the fields, the first subset of fields being designated as higher-security fields than a second subset of fields among the plurality of fields.

Abstract: Provided is a process including: obtaining criteria to select plain-text values in a lower-trust database; selecting, based on the criteria, a first plain-text value; in response, determining a first reference value; storing the first plain-text value in a higher-trust database in a second entry identified by the first reference value; storing the first reference value in the first entry of the lower-trust database; selecting another instance of the first plain-text value stored requested to be stored in a third entry in the lower-trust database; and in response, storing the first reference value in the third entry.

Abstract: Provided is a process including: receiving one or more write requests; selecting a first subset of the values as corresponding to higher-security fields; segmenting a first value in the first subset; instructing a first computing device to store a first subset of segments among the plurality of segments in memory; and instructing a second computing device to store a second subset of segments among the plurality of segments in memory.

Abstract: Provided is a process including: receiving one or more write requests to write a plurality of values to a plurality of fields in one or more tuples of a relational database, different ones of the values corresponding to different ones of the fields, detecting duplicates of the values with steps for expediting detection of duplicates, and selecting a first subset of the values based on the first subset of values corresponding to fields in a first subset of the fields, the first subset of fields being designated as higher-security fields than a second subset of fields among the plurality of fields.

Abstract: Provided is a process including: obtaining criteria to select plain-text values in a lower-trust database; selecting, based on the criteria, a first plain-text value; in response, determining a first reference value; storing the first plain-text value in a higher-trust database in a second entry identified by the first reference value; storing the first reference value in the first entry of the lower-trust database; selecting another instance of the first plain-text value stored requested to be stored in a third entry in the lower-trust database; and in response, storing the first reference value in the third entry.

Abstract: Provided is a process including: receiving one or more write requests; selecting a first subset of the values as corresponding to higher-security fields; segmenting a first value in the first subset; instructing a first computing device to store a first subset of segments among the plurality of segments in memory; and instructing a second computing device to store a second subset of segments among the plurality of segments in memory.