Workday, Inc.

Lendingclub Bank, National Association

Edward Suryadi

Raul Acevedo

Tianhao Gu

Roger Santosa Tanuatmadja

Pranamya Raghuveer Nayak

Mohsin Roowalla

A system, method, and device for managing updates to a hypercube is provided. The method includes (i) obtaining a tree data structure to represent the data, (ii) receiving a request to rearrange data stored in the N-conjoined tree data structure, (iii) enforcing a first rule that requires each leaf node to have an associated linkage to each tree in the N-conjoined tree data structure while rearranging the N-conjoined tree data structure in accordance with the request, and (iv) providing a rearranged N-conjoined tree data structure. The tree data structure is an N-conjoined tree data structure, and N is a positive integer.

Rearranging nodes for conjoined tree data structure

A system, method, and device for managing updates to a hypercube is provided. The method includes (i) obtaining a tree data structure to represent the data, (ii) receiving a request to change the N-conjoined tree data structure, (iii) enforcing a rule that requires each leaf node to have an associated linkage to each tree in the N-conjoined tree data structure while changing the N-conjoined tree data structure in accordance with the request, and (iv) providing an updated N-conjoined tree data structure. The tree data structure is an N-conjoined tree data structure, and N is a positive integer.

Changing nodes for conjoined tree data structure

Techniques are described herein for efficiently and expeditiously performing key rotation and key replacement. In an embodiment, a key replacement request is received that specifies one or more key names of a plurality of key names. A location-to-key-name mapping that maps the plurality of key names to a plurality of encrypted-data locations is used to determine one or more encrypted-data locations that are mapped to the one or more key names. A first set of messages is generated where each message identifies a table that is associated with the one or more encrypted-data locations. The first set of messages is stored in a queue for processing by a first plurality of worker processes. Each worker process of the first plurality of worker processes retrieves a message of the first set of messages from the queue and generates a message of a second set of messages that identifies a subset of encrypted data records from the table identified in the message of the first set of messages. Each message of the second set of messages is stored in a distinct queue which is assigned to a worker process of a second plurality of worker processes. Each worker process of the second plurality of worker processes retrieves the message from the assigned queue, decrypts the subset of encrypted data records identified in the respective message, re-encrypts the decrypted data records using a new encryption key that corresponds to a new key name, and stores the re-encrypted data records in a database.

Encryption key rotation framework

Techniques are described herein for performing key rotation and key replacement. In an embodiment, a request is received that specifies key names. A first set of messages is generated, where each message identifies a table that is associated with the encrypted-data locations, and stored in a queue for processing by a first plurality of worker processes. Each worker process retrieves a message from the queue and generates a second message that identifies a subset of encrypted data records from the table. Each second message is stored in a distinct queue which is assigned to a worker process of a second plurality of worker processes. Each worker process retrieves the message from the assigned queue, decrypts the subset of encrypted data records, re-encrypts the decrypted data records using a new encryption key that corresponds to a new key name, and stores the re-encrypted data records in a database.

Growing community of inventors

San Ramon, CA, United States of America

Edward Suryadi