Microsoft Technology Licensing, LLC

Haohai Yu

Michael James Zwilling

Kapil Vaswani

Blake Douglas Pelton

Panagiotis Antonopoulos

Ajay S Manchepalli

Chirag Varde

Kenneth Hiroshi Eguro

Kaan Kara

Methods, systems, apparatuses, and computer program products are provided for protecting data in a memory of an integrated circuit (IC). A process token is obtained in a special purpose IC from a host that is external to and communicatively connected to the special purpose IC. The process token is stored in a first memory portion of the special purpose IC. In response to receiving a processing request from the host, the processing request is processed, and data generated by processing the processing request is written in a second memory portion of the special purpose IC. When a read request is received to read the data in the second memory portion, a determination is made whether the read request includes a read token that matches the previously stored process token. If the read token matches the process token, the data in the second memory portion may be returned to the host.

Protection of data in memory of an integrated circuit using a secret token

Methods, systems, apparatuses, and computer program products are provided for generating an instruction set for an evaluation engine. An arithmetic expression that combines multiple columns of data (e.g., a first column of data, a second column of data, etc.) is received. Instructions may be generated, that, when executed by an integrated-circuit-based processor, cause the integrated-circuit-based processor to evaluate the arithmetic expression. In examples, a set of instructions may be generated for each column of data represented in the arithmetic expression. For instance, the instructions may comprise a first set of instructions associated with the first column of data, a second set of instructions associated with the second column of data, and so on. The instructions may specify one or more parameters for operations associated with each column of data, such as operations to load data from a buffer, store data into a buffer, arithmetic operations to perform on data, etc.

Column data driven arithmetic expression evaluation

Methods, systems, apparatuses, and computer program products are provided for processing queries. A data server includes a query processor configured to receive a query from a database application, which was received by the database application from a requestor. The query is directed to data stored at the data server. The query processor includes a deferred evaluation determiner and deferred expression determiner. The deferred evaluation determiner is configured to analyze the query, and to designate the query for deferred evaluation by the database application if a predetermined factor is met, such as the query including an operation on encrypted data that is not supported at the data server. The deferred expression determiner is configured to determine expression evaluation information for evaluating at least a portion of the query at the database application. The query processor provides the encrypted data and the expression evaluation information to the database application for evaluation.

Computing on encrypted data using deferred evaluation

Methods, systems, apparatuses, and computer program products are provided for secure handling of queries by a data server (DS) and a database application (DA). A parameterized query is received by the DS from the DA based on a user query received from a requestor. The DS analyzes the parameterized query to attempt to determine an encryption configuration for a transformed version of the user query capable of being evaluated by the DS on encrypted data values. The DS responds to the DA with either a failure to determine the encryption configuration, or by providing the determined encryption configuration to the DA. The DA generates the transformed version of the user query, and provides the transformed version to the DS. The DS evaluates the transformed version of the user query, and provides results to the DA. The DA decrypts the results, and provides the decrypted results to the requestor.

Database server and client for query processing on encrypted data

Systems, methods and computer program products are described that analyze the code of an application and, based on the analysis, identify whether data elements (e.g., columns) referenced by the code can be encrypted, and for those data elements that can be encrypted, recommend an encryption scheme. The recommended encryption scheme for a given data element may be the highest level of encryption that can be applied thereto without affecting the semantics of the application code. The output generated based on the analysis may not only include a mapping of each data element to a recommended encryption scheme, but may also include an explanation of why each recommendation was made for each data element. Such explanation may include, for example, an identification of the application code that gave rise to the recommendation for each data element.

Growing community of inventors

Redmond, WA, United States of America

Haohai Yu