International Business Machines Corporation

Akshar Kaul

Manish Kesarwani

Sameep Mehta

Gagandeep Singh

Pankaj Satyanarayan Dayama

Krishnasuri Narayanam

Hong Min

Ken Kumar

Dhinakaran Vinayagamurthy

Stefano Braghin

Spyridon Antonatos

Prasad G Naldurg

Santosh Ravi Kiran Penubothula

Srikanth Govindaraj Tamilselvam

Diptikalyan Saha

Amith Singhee

Supriyo Chakraborty

Vinayaka D Pandit

Prasad Manikarao Deshpande

James Willis Pickel

Himanshu Gupta

Yedendra Shrinivasan

Hugo M Krawczyk

Hima Patel

Vaibhav S Dantale

Shanmukha Chaitanya Guttula

Shashank Srivastava

Jayant R Haritsa

Utsav Singhal

Ravi Vishnu Israni

Selecting and ordering the execution of data quality rules includes generating a snapshot of a table-formatted dataset. The snapshot comprises a reduced number of rows of the dataset such that each column variation of the dataset is included in the snapshot. A predetermined collection of data quality (DQ) rules is executed on the snapshot. One or more performance statistics is determined for each of the DQ rules. The performance statistics indicate a likelihood that a DQ rule determines a data quality deficiency. Based on the performance statistics, a subset of the DQ rules is generated. Each DQ rule of the subset is selected based on the likelihood that the DQ rule selected detects a quality deficiency. An ordered subset of selected DQ rules is generated by ordering the application of each of the subset of DQ rules selected. The ordering specifies a sequence for executing each selected DQ rule.

Automated selection and ordering of data quality rules during data ingestion

A computer implemented method creates microservices for an application. A number of processor units clusters programs and data structures for the application using runtime metadata to form groups of the programs and data structures. The runtime metadata is obtained from running the application. The number of processor units creates a design for the microservices for the application using the groups of the programs and the data structures.

Microservice creation using runtime metadata

Methods, systems, and computer program products for a secure database-as-a-service are provided herein. A computer-implemented method includes obtaining, by a database service, data associated with one or more client devices to be stored in at least one encrypted database; encrypting, without mutation and in accordance with one or more security requirements, at least a portion of the data using an order preserving encryption scheme, wherein the encrypting comprises (i) computing a set of encryption parameters for the portion of the data and (ii) applying a process that converts a fixed-length cipher text corresponding to the portion of the data to a variable-length cipher text; and storing the encrypted data in the at least one encrypted database, wherein the database service enables one or more indexes to be built over the encrypted data to improve performance of query processing.

Secure database-as-a-service system

One embodiment provides a method, including: receiving, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; batching the set of queries into query batches; transforming, for each query batch, each query within the query batch, wherein the transforming includes changing the query to reduce data leakage; performing, responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; executing, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and calculating a remaining security budget based upon data leakage resulting from the executing.

Protection of data of database clients from persistent adversaries

A method for deduplicating a distributed ledger, a blockchain, and a computer program product. One embodiment may comprise splitting a new block on a distributed ledger into a plurality of partitions, comparing the plurality of partitions to a deduplication (dedup) map, replacing a first partition of the plurality of partitions with a first reference to the dedup map to produce a transformed block, and communicating the transformed block via a network interface to one or more peers.

Data deduplication in blockchain platforms

Methods, systems, and computer program products for building an encrypted document store are provided herein. A computer-implemented method includes building an encrypted ordered key-value store; encrypting one or more sensitive keys to be stored in the ordered key-value store using an order preserving encryption scheme; storing a state of the order preserving encryption scheme in the ordered key-value store; and encrypting one or more values corresponding to the one or more sensitive keys using a semantically secure encryption scheme.

Building an encrypted document store

Methods, systems, and computer program products for memory protection in hypervisor environments are provided herein. A method includes maintaining, by a memory management layer of a hypervisor environment, a blockchain-based hash chain associated with a page table of the memory management layer, the page table corresponding to a plurality of memory pages; and verifying, by the first memory management layer, content obtained in connection with a read operation for a given one of the plurality of memory pages based at least in part on hashes maintained for the given memory page in the blockchain-based hash chain.

Memory protection in hypervisor environments

An example operation may include one or more of receiving a request to verify a first encrypted document from a computing device, retrieving a second set of encrypted tokens of a second encrypted document from a blockchain, determining a similarity value of the first encrypted document with respect to the second encrypted document based on a first set of encrypted tokens in the first encrypted document and the second set of encrypted tokens in the second encrypted document, and outputting the determined similarity value to the computing device in response to the request.

Plagiarism detection from encrypted documents

Methods, systems, and computer program products for identifying and redacting data from diagnostic operations via monitoring of data are provided herein. A computer-implemented method includes automatically monitoring data, which includes determining which portions of the data are accessed during a diagnostic operation; parsing an input file into portions of parsed data, wherein the input file comprises an initial output of the diagnostic operation; classifying the portions of parsed data into classes by applying at least one of multiple classification models to the parsed data, wherein the at least one classification model is specific to the accessed portions of data; automatically identifying sensitive data in the classified portions of parsed data by applying a class-to-sensitivity mapping technique to the classified portions of parsed data; redacting the identified sensitive data from the input file; and generating and outputting an updated output of the diagnostic operation based on the redacting.

Dynamically identifying and redacting data from diagnostic operations via runtime monitoring of data sources

Methods, systems, and computer program products for generating a data migration plan for in-place encryption of data are provided herein. A computer-implemented method includes receiving, from a user, a request to generate a migration plan for performing in-place encryption of data within a database, wherein the migration plan indicates periods of time in which portions of the data are to be encrypted; determining a set of constraints for performing the in-place encryption; generating the migration plan based at least in part on the set of constraints; and performing the in-place encryption of the data in accordance with the migration plan such that only a single copy of each of the portions is maintained during the in-place encryption, wherein the single copy comprises one of a plaintext copy of data corresponding to the portion, and an encrypted copy of data corresponding to the portion.

Generating data migration plan for in-place encryption of data

One embodiment provides a method, including: receiving, from a user, a dataset for encryption before its storage at a data storage location, wherein the dataset comprises a plurality of portions; identifying (i) attributes of the dataset and (ii) dataset dependencies; generating a recommendation for an encryption scheme to be used for the dataset, wherein the generating comprises (i) generating, based upon the attributes and the dataset dependencies, a recommendation of an encryption scheme for each portion of the dataset and (ii) identifying, based upon the dataset dependencies, a key label for each portion of the dataset, wherein the key label identified for a portion of the dataset that is dependent on another portion of the dataset is the same as the key label identified for said another portion of the dataset; and providing, to the user, (i) the generated recommendation and (ii) a description identifying reasons for the generated recommendation.

Encryption scheme recommendation

An example operation may include one or more of receiving blocks of a blockchain from one or more of a neighboring blockchain peer and an ordering service node, identifying two or more blocks from among the received blocks that belong to a same slot within the blockchain, validating the two or more identified blocks in parallel via execution of the two or more identified blocks at a same time, and in response to validation of the two or more identified blocks, storing the two or more identified blocks on a local blockchain ledger of a blockchain peer.

Partially-ordered blockchain

Methods, systems, and computer program products for dynamically analyzing diagnostic operations data via machine learning techniques are provided herein. A computer-implemented method includes defining aspects of machine learning techniques to be performed in connection with diagnostic operation data analysis, including: defining dynamic analysis granularity selection functionality based on time constraints and the level of progress of the analysis; defining dynamic data classification identifier type selection functionality based on the time constraints and the level of progress of the analysis; and defining dynamic ordering of data classification identifiers during runtime based on data classification preferences, information pertaining to system workload, and information pertaining to requested analysis compliance parameters. The method also includes dynamically performing the analysis by applying the machine learning techniques to the diagnostic operation data, and outputting at least a portion of results of the analysis.

Dynamically analyzing diagnostic operations data via machine learning techniques

Methods, systems, and computer program products for generating a data partitioning strategy for secure and efficient query processing are provided herein. A computer-implemented method includes obtaining at least (i) a database schema associated with a database and (ii) a query workload associated with the database; and generating, based at least in part on the database schema and the query workload, a distributed database structure for the database that (i) stores a first set of columns of the database within a private cloud environment in a plaintext format and (ii) stores a second set of columns of the database in a public cloud environment, wherein the second set of columns is stored in either a plaintext format or an encrypted format based on whether the second set of columns comprises sensitive data.

Generating a data partitioning strategy for secure and efficient query processing

An example operation includes one or more of receiving a smart contract code by an analyzer node, building, by the analyzer node, a control flow-graph comprising a plurality of basic code blocks based on the smart contract code, computing, by the analyzer node, a read and write set for each of the basic code blocks from the plurality of the basic code blocks, and determining, by the analyzer node, at least two basic code blocks from the plurality of the basic code blocks that may be executed in parallel.

Growing community of inventors

Bengaluru, India

Akshar Kaul