公开(公告)号：US11841967B2

公开(公告)日：2023-12-12

申请号：US17562387

申请日：2021-12-27

Applicant: salesforce.com, inc.

Inventor： Terry Chong ,  Jameison Bear Martin ,  Thomas Fanghaenel ,  Andrew Tucker ,  Nathaniel Wyatt ,  Raghavendran Hanumantharau ,  Assaf Ben Gur ,  William Charles Mortimore, Jr.

IPC: G06F21/62 ,  G06F16/2455 ,  G06F21/60 ,  H04L9/08

CPC classification number: G06F21/6218 ,  G06F16/24552 ,  G06F21/604 ,  H04L9/08

Abstract: System and methods of the disclosed subject matter provide segregating, at a memory storage coupled to a multitenant database system, first tenant data of a first tenant from at least second tenant data of a second tenant, based on a first tenant identifier. A first encryption key associated with the first tenant may be retrieved from a key cache memory based on the first tenant identifier, to encrypt one or more fragments of the first tenant data. The fragments of the first tenant data may be encrypted based on the retrieved encryption key. Non-encrypted header information may be generated for each of the encrypted fragments of the first tenant data, where the header information may have metadata including the first tenant identifier. The encrypted fragments of the first tenant data and the corresponding non-encrypted header information may be stored in the immutable storage.

公开(公告)号：US20220121766A1

公开(公告)日：2022-04-21

申请号：US17562387

申请日：2021-12-27

Applicant: salesforce.com, inc.

Inventor： Terry Chong ,  Jameison Bear Martin ,  Thomas Fanghaenel ,  Andrew Tucker ,  Nathaniel Wyatt ,  Raghavendran Hanumantharau ,  Assaf Ben Gur ,  William Charles Mortimore, JR.

IPC: G06F21/62 ,  G06F16/2455 ,  G06F21/60 ,  H04L9/08

Abstract: System and methods of the disclosed subject matter provide segregating, at a memory storage coupled to a multitenant database system, first tenant data of a first tenant from at least second tenant data of a second tenant, based on a first tenant identifier. A first encryption key associated with the first tenant may be retrieved from a key cache memory based on the first tenant identifier, to encrypt one or more fragments of the first tenant data. The fragments of the first tenant data may be encrypted based on the retrieved encryption key. Non-encrypted header information may be generated for each of the encrypted fragments of the first tenant data, where the header information may have metadata including the first tenant identifier. The encrypted fragments of the first tenant data and the corresponding non-encrypted header information may be stored in the immutable storage.

公开(公告)号：US20190097791A1

公开(公告)日：2019-03-28

申请号：US15716677

申请日：2017-09-27

Applicant: salesforce.com, Inc.

Inventor： Alexandre Hersans ,  John Bracken ,  Assaf Ben Gur ,  Charles Mortimore ,  Swaroop Shere

IPC: H04L9/08 ,  H04L9/14 ,  G06F12/0813 ,  G06F12/123

Abstract: Methods, systems, and devices for distributed caching of encrypted encryption keys are described. Some multi-tenant database systems may support encryption of data records. To efficiently handle multiple encryption keys across multiple application servers, the database system may store the encryption keys in a distributed cache accessible by each of the application servers. To securely cache the encryption keys, the database system may encrypt (e.g., wrap) each data encryption key (DEK) using a second encryption key (e.g., a key encryption key (KEK)). The database system may store the DEKs and KEKs in separate caches to further protect the encryption keys. For example, while the encrypted DEKs may be stored in the distributed cache, the KEKs may be stored locally on application servers. The database system may further support “bring your own key” (BYOK) functionality, where a user may upload a tenant secret or tenant-specific encryption key to the database.

公开(公告)号：US20200322139A1

公开(公告)日：2020-10-08

申请号：US16863402

申请日：2020-04-30

Applicant: salesforce.com, Inc.

Inventor： Alexandre Hersans ,  John Bracken ,  Assaf Ben Gur ,  William Charles Mortimore, JR. ,  Swaroop Shere

IPC: H04L9/08 ,  H04L9/14 ,  G06F12/123 ,  G06F12/0813

Abstract: Methods, systems, and devices for distributed caching of encrypted encryption keys are described. Some multi-tenant database systems may support encryption of data records. To efficiently handle multiple encryption keys across multiple application servers, the database system may store the encryption keys in a distributed cache accessible by each of the application servers. To securely cache the encryption keys, the database system may encrypt (e.g., wrap) each data encryption key (DEK) using a second encryption key (e.g., a key encryption key (KEK)). The database system may store the DEKs and KEKs in separate caches to further protect the encryption keys. For example, while the encrypted DEKs may be stored in the distributed cache, the KEKs may be stored locally on application servers. The database system may further support “bring your own key” (BYOK) functionality, where a user may upload a tenant secret or tenant-specific encryption key to the database.

公开(公告)号：US10680804B2

公开(公告)日：2020-06-09

申请号：US15716677

申请日：2017-09-27

Applicant: salesforce.com, inc.

Inventor： Alexandre Hersans ,  John Bracken ,  Assaf Ben Gur ,  William Charles Mortimore, Jr. ,  Swaroop Shere

IPC: H04L9/08 ,  H04L9/14 ,  G06F12/123 ,  G06F12/0813

Abstract: Methods, systems, and devices for distributed caching of encrypted encryption keys are described. Some multi-tenant database systems may support encryption of data records. To efficiently handle multiple encryption keys across multiple application servers, the database system may store the encryption keys in a distributed cache accessible by each of the application servers. To securely cache the encryption keys, the database system may encrypt (e.g., wrap) each data encryption key (DEK) using a second encryption key (e.g., a key encryption key (KEK)). The database system may store the DEKs and KEKs in separate caches to further protect the encryption keys. For example, while the encrypted DEKs may be stored in the distributed cache, the KEKs may be stored locally on application servers. The database system may further support “bring your own key” (BYOK) functionality, where a user may upload a tenant secret or tenant-specific encryption key to the database.

公开(公告)号：US20190114438A1

公开(公告)日：2019-04-18

申请号：US15782087

申请日：2017-10-12

Applicant: salesforce.com, inc.

Inventor： Alexandre Hersans ,  Je Woong Heo ,  Yunjia Zhou ,  Aleksandr Alexander ,  Assaf Ben Gur

IPC: G06F21/60 ,  G06F21/62 ,  G06F12/14 ,  G06F3/06

Abstract: Methods, systems, and devices for mass encryption management are described. In some database systems, users may select encryption settings for storing data records at rest. A database may receive a request to perform an encryption process on multiple data records corresponding to a user, for example, based on a user input or a change in encryption settings. A database server may partition the data records for encryption (e.g., encryption, decryption, key rotation, or scheme modification) into one or more data record groups of similar sizes, and may perform the encryption process on one record group at a time (e.g., to reduce overhead in the system). The database server may additionally support restricting user access to the data records being actively processed, estimating resources needed for the processing, determining data record encryption statuses to be displayed by a user device, or some combination of these features.

公开(公告)号：US20180375838A1

公开(公告)日：2018-12-27

申请号：US15634447

申请日：2017-06-27

Applicant: salesforce.com, inc.

Inventor： Alexandre Hersans ,  Assaf Ben Gur ,  Jesse Yarbro Collins ,  Shreemanth Karthik Hosahalli Venkateshamurthy

IPC: H04L29/06 ,  G06F21/62 ,  H04L9/06

Abstract: Some database systems may implement encryption services to improve the security of data stored in databases. Certain functionality may or may not be supported depending on the implemented encryption scheme. For example, the encryption service may perform deterministic encryption, which may support filtering and unicity on the resulting ciphertexts. To handle case insensitive filtering, the encryption service may encrypt both a plaintext value and a normalized (e.g., lowercased) plaintext value. A database may perform the case insensitive filtering on the stored ciphertexts corresponding to the normalized plaintext values, but may retrieve the ciphertexts corresponding to the standard plaintext values. To handle a unicity requirement, the database may generate additional unique identifiers to distinguish between duplicate ciphertexts. For example, during a key rotation process, potential duplicates may pass the unicity check based on the unique identifiers, and the database may later fix these potential duplicates.

公开(公告)号：US11700112B2

公开(公告)日：2023-07-11

申请号：US16863402

申请日：2020-04-30

Applicant: salesforce.com, inc.

Inventor： Alexandre Hersans ,  John Bracken ,  Assaf Ben Gur ,  William Charles Mortimore, Jr. ,  Swaroop Shere

IPC: H04L9/08 ,  H04L9/14 ,  G06F12/123 ,  G06F12/0813

CPC classification number: H04L9/0822 ,  G06F12/0813 ,  G06F12/123 ,  H04L9/0894 ,  H04L9/14 ,  G06F2212/60 ,  G06F2212/62

Abstract: Methods, systems, and devices for distributed caching of encrypted encryption keys are described. Some multi-tenant database systems may support encryption of data records. To efficiently handle multiple encryption keys across multiple application servers, the database system may store the encryption keys in a distributed cache accessible by each of the application servers. To securely cache the encryption keys, the database system may encrypt (e.g., wrap) each data encryption key (DEK) using a second encryption key (e.g., a key encryption key (KEK)). The database system may store the DEKs and KEKs in separate caches to further protect the encryption keys. For example, while the encrypted DEKs may be stored in the distributed cache, the KEKs may be stored locally on application servers. The database system may further support “bring your own key” (BYOK) functionality, where a user may upload a tenant secret or tenant-specific encryption key to the database.

公开(公告)号：US10860727B2

公开(公告)日：2020-12-08

申请号：US16667618

申请日：2019-10-29

Applicant: salesforce.com, inc.

Inventor： Alexandre Hersans ,  Je Woong Heo ,  Yunjia Zhou ,  Aleksandr Alexander ,  Assaf Ben Gur

IPC: G06F21/00 ,  G06F21/60 ,  G06F21/62 ,  G06F3/06 ,  G06F12/14 ,  G06F16/27 ,  H04L9/08

Abstract: Methods, systems, and devices for mass encryption management are described. In some database systems, users may select encryption settings for storing data records at rest. A database may receive a request to perform an encryption process on multiple data records corresponding to a user, for example, based on a user input or a change in encryption settings. A database server may partition the data records for encryption (e.g., encryption, decryption, key rotation, or scheme modification) into one or more data record groups of similar sizes, and may perform the encryption process on one record group at a time (e.g., to reduce overhead in the system). The database server may additionally support restricting user access to the data records being actively processed, estimating resources needed for the processing, determining data record encryption statuses to be displayed by a user device, or some combination of these features.

公开(公告)号：US20200143065A1

公开(公告)日：2020-05-07

申请号：US16667618

申请日：2019-10-29

Applicant: salesforce.com, inc.

Inventor： Alexandre Hersans ,  Je Woong Heo ,  Yunjia Zhou ,  Aleksandr Alexander ,  Assaf Ben Gur

IPC: G06F21/60 ,  G06F21/62 ,  G06F3/06 ,  G06F12/14 ,  G06F16/27

Abstract: Methods, systems, and devices for mass encryption management are described. In some database systems, users may select encryption settings for storing data records at rest. A database may receive a request to perform an encryption process on multiple data records corresponding to a user, for example, based on a user input or a change in encryption settings. A database server may partition the data records for encryption (e.g., encryption, decryption, key rotation, or scheme modification) into one or more data record groups of similar sizes, and may perform the encryption process on one record group at a time (e.g., to reduce overhead in the system). The database server may additionally support restricting user access to the data records being actively processed, estimating resources needed for the processing, determining data record encryption statuses to be displayed by a user device, or some combination of these features.