Salesforce Com, Inc.

Salesforce, Inc.

Salesforee.com, Inc.

Alexandre Hersans

Simon Y Wong

Swaroop Shere

Assaf Ben Gur

Parth Vijay Vaishnav

Patrick Calahan

Chenghung Ker

Igor Tsyganskiy

Samarpan Jain

William Charles Mortimore, Jr

Matthew Francis Davidchuk

Jan Asita Fernando

Valliappan Annamalai Natarajan

Alexey Syomichev

Cody Marcel

Samatha Sanikommu

Sahil Ramrakhyani

Seshank Kalvala

Daniel Tafner McGarry

Eugene Oksman

Shawna Wolverton

Assaf Ben-Gur

John Bracken

Victor Weilin Liu

Je Woong Heo

Yunjia Zhou

Aleksandr Alexander

Junichiro Sekiguchi

Danil Dvinov

Samantha Sanikommu

Disclosed herein are system, method, and computer program product embodiments for detecting duplicates with exact and fuzzy matching on encrypted match indexes using an encryption key in a cloud computing platform. An embodiment operates by determining a match rule index value upon reception of a new record. The embodiment encrypts the match index rule value using the customer's encryption key and a deterministic encryption method and stores the encrypted match rule index value. Duplicate detection may be later performed by using the same deterministic encryption method to determine a cypher text for a candidate entry and comparing the ciphertext to the stored encrypted match indexes.

Detect duplicates with exact and fuzzy matching on encrypted match indexes

Methods, systems, and devices for distributed caching of encrypted encryption keys are described. Some multi-tenant database systems may support encryption of data records. To efficiently handle multiple encryption keys across multiple application servers, the database system may store the encryption keys in a distributed cache accessible by each of the application servers. To securely cache the encryption keys, the database system may encrypt (e.g., wrap) each data encryption key (DEK) using a second encryption key (e.g., a key encryption key (KEK)). The database system may store the DEKs and KEKs in separate caches to further protect the encryption keys. For example, while the encrypted DEKs may be stored in the distributed cache, the KEKs may be stored locally on application servers. The database system may further support 'bring your own key' (BYOK) functionality, where a user may upload a tenant secret or tenant-specific encryption key to the database.

Distributed key caching for encrypted keys

A method is provided for processing a query. In some embodiments, the method includes creating a historical schema defining an ordered set of fields based on a current schema of an object and a field modification of the current schema. The method includes inserting, based on the field modification, a new field at an end of the historical schema and archiving records into a second storage device. The method includes receiving a query, which includes a command specifying a subset of fields and which indicates a non-current field. The method includes searching in the second storage device for archive records having a second schema including the subset of fields and the non-current field. The first and second schemas follow the field order in accordance with the historical schema. The method further includes accessing the subset of fields and the non-current field in accordance with the command.

Archiving objects in a database environment

Methods, systems, and devices for enabling and validating data encryption are described. A data storage system (e.g., including a database and validation server) may receive an encryption request indicating a data object or data field. Prior to performing encryption, the validation server may perform one or more validations to determine whether the system supports encrypting the indicated data. The validation server may identify any formula fields that directly or indirectly (e.g., via other formula fields) reference the data object or field, and may determine whether each of these formula fields is encryption compatible. In some cases, the validation process may involve synchronously executing a first set of validators, marking the data as pending encryption, and asynchronously executing a second set of validators. Based on the results of the validation process, the system may or may not encrypt the indicated data, and may transmit an indication of the validation results.

Enabling and validating data encryption

Provided herein are system, methods and computer program products for identifying duplicate records stored in a database system, comprising: generating a plurality of encrypted match indexes for each of a plurality of records stored in the database system, each of the plurality of encrypted match indexes encrypts a value of each encryption enabled field of a respective one of the plurality of records defined by at least one match rule, creating a cluster of records comprising at least one set containing at least two records of the plurality of records, the at least two records having respective encrypted match indexes corresponding to the at least one match rule, causing identification of duplicate records in the at least one set according to detection of records of the at least one set having respective match indexes matching the at least one match rule, and outputting an indication of the identified duplicate records.

Bulk duplication detection supporting data encryption

Methods, systems, and devices for mass encryption management are described. In some database systems, users may select encryption settings for storing data records at rest. A database may receive a request to perform an encryption process on multiple data records corresponding to a user, for example, based on a user input or a change in encryption settings. A database server may partition the data records for encryption (e.g., encryption, decryption, key rotation, or scheme modification) into one or more data record groups of similar sizes, and may perform the encryption process on one record group at a time (e.g., to reduce overhead in the system). The database server may additionally support restricting user access to the data records being actively processed, estimating resources needed for the processing, determining data record encryption statuses to be displayed by a user device, or some combination of these features.

Mass encryption management

During an encryption process, a database system may generate an index value based on the plaintext to be encrypted, an encryption key, a data field-specific salt, or a combination thereof. The database may store the index value in an index associated with the ciphertext output of the encryption process. In some cases, the database may receive a query specifying a plaintext value for filtering on a data field, where the database may return data objects with the specified plaintext value in the given data field. The database may compute a set of index values associated with the specified plaintext, and may identify indexes with index values included in the set of index values and associated with the given data field. The database may decrypt the ciphertexts associated with the identified indexes to check if they match the specified plaintext.

Filtering encrypted data using indexes

Categorizing data in an on-demand database environment is provided. The categorized data is accessed to provide results based on statistical likelihood that records provide a desired result of a query. The categorization of the data includes organizing queries based on semantic terms, with categorization based on a multidimensional categorization of data in the database environment. The generating of results includes accessing relationship metadata both for individual records and for categories. Relationships along the same category, or among categories can provide records that may answer the query. The relationships and statistics are updated based on usage of the results data. Records and relationships identified as being used to solve the query, or being a desired solution to the query, can be weighted more heavily, thus increasing the likelihood of providing the most relevant data for subsequent queries.

Querying a database using relationship metadata

In accordance with disclosed embodiments, there are provided methods, systems, and apparatuses for implementing cross organizational data sharing including, for example, means for storing customer organization data in a database of the host organization; allocating at least a sub-set of the customer organization data to be shared as shared data; configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data; configuring one or more spokes with access rights to the shared data of the hub via the proxy user; receiving a request from one of the hubs for access to the shared data of the customer organization via the proxy user at the hub; and returning a response to the hub having made the request. Other related embodiments are disclosed.

Systems, methods, and apparatuses for implementing cross-organizational data sharing

Systems, methods, and apparatuses for implementing cross organizational data sharing

Methods and systems are provided for retrieving, from a database containing a list of records, a subset of the list of records located within a user defined distance from a target point, each record in the list of records having a compound geo-location data type including a first data field and a second data field. The method involves generating a circle around the target point; identifying records having a geo-location within the circle; including the identified records in a result set; and presenting the result set to a user on a display screen. The method further includes treating the first data field and the second data field as a single data element.

System and method for geo-location data type searching in an on demand environment

Growing community of inventors

San Francisco, CA, United States of America

Alexandre Hersans