Abstract: Disclosed are various embodiments for searching encrypted data stores. A first computing device can send a message authentication code (MAC) to a second computing device the MAC representing a tuple of a name of a data table, an identifier of a column of the data table, and a valid value for the column. Then, an encrypted bitmap can be received from the second computing device and decrypted to generate a decrypted bitmap. Bitwise operations can be performed on the decrypted bitmap to identify a plurality of encrypted rows of the data table containing a cell that comprises the valid value. Then, at least the plurality of at least partially encrypted rows of the data table can be requested from the second computing device and decrypted to generate a respective plurality of decrypted rows.

Abstract: A system and method for providing data such as credentials to a third-party service while protecting the data from exposure to intermediate services. The system receives a first request containing encrypted data, generates a second request by replacing the encrypted data from the first request with unencrypted data, and transmits the second request to the third-party service.

Abstract: Disclosed are various embodiments for searchable encrypted data stores. A plurality of rows in a data table that have a cell in a column of the row that matches a value are identified. A bitmap that represents the plurality of rows is generated. The bitmap is encrypted. A key is then generated for a key-value pair. The key can be represented by a message authentication code (MAC) based at least in part on a tuple of a name of the data table, an identifier of the column, and the value. The key-value pair with the key and the encrypted bitmap is then sent to a remote computing device for storage.

Abstract: A system and method for providing data such as credentials to a third-party service while protecting the data from being transmitted to unintended locations. The system receives a first request containing encrypted data and information identifying the third-party service, validates that the first request is to be transmitted to the third-party service, generates a second request by replacing the encrypted data from the first request with unencrypted data, and transmits the second request to the third-party service.

Abstract: A computing device may receive a compress data streams which may then be decompressed to generate decompressed data. The computing device may then determine if the decompressed data includes a flag indicating that the decompressed data should be modified. If the decompressed data is to be modified, the computing device may add padding values to the compressed data stream until a boundary block of the compressed data stream is reached. The modified compressed data stream may then be transmitted to an endpoint.