International Business Machines Corporation

Jason G Katonica

Anthony Thomas Sofia

Christopher V Derobertis

Benjamin P Segal

James M Caffrey

Michael Terrence Cohoon

Trent Balta

Sarah Blodgett Hughes

Thomas Ginader

Torin Reilly

Marcos Barbieri

Aspects include receiving a query at a data engine. The data engine includes data in a protected format stored in a secured database and a copy of the data in a clear format stored in a secured database replica. The query is received from a requestor. The query is processed at the secured database replica to generate a query response in the clear format. The query response is converted into the protected format. The converted query response in the protected format is provided to the requestor.

Secure ingress and egress for data engines

A computer-implemented method for replicating data changes through distributed invalidation includes receiving, by a distributed database system, an instruction to change a data element in a table. The distributed database system includes at least a first server and a second server. A first copy of the table is stored on the first server, and a second copy of the table is stored on the second server. The method further includes in response to the instruction, determining that the data element is secured by a replication key that is stored on a shared key management system that is accessible by the first server and by the second server, wherein the replication key is unique to the data element. The method further includes invalidating the replication key and modifying the first copy of the table on the first server according to the instruction that is received.

Replicating data changes through distributed invalidation

Aspects of the invention include protecting data objects in a computing environment based on physical location. Aspects include receiving, by a computing system, a request to access an encrypted data from an authenticated user, wherein the encrypted data includes information about a data encryption key used to encrypt the encrypted data. Aspects also include providing, by the computing system, the encrypted data to the computer system where the user was authenticated, the computer system including a set of decryption keys protected by a master key stored within a hardware security module associated with the location of the hardware security module. Aspects further include decrypting, by the hardware security module, the encrypted data based on a determination that the data encryption key corresponds to one of the set of decryption keys, wherein the set of decryption keys are determined based on the location of the hardware security module.

Multi-phase protection for data-centric objects

A described method includes receiving, by a database system, an instruction to change a first data element in a table in a database, which includes a first copy and a second copy of the table. A first entry is created in a first change-table. The first entry includes an updated value for a first data element. A second entry is created in a second change-table. Creating the second entry includes, changing the updated value into a ciphertext if the first data element is secured, and storing the ciphertext into the second entry. If the first data element is non-secured, the updated value is stored into the second entry as is. The second copy of the table is modified using the second change-table. The second copy of the table is used to respond to subsequent queries.

Secure data replication in distributed data storage environments

Embodiments include encrypting an object such that the creator of the encrypted object can be identified. Aspects include receiving, by a processor, an unencrypted object that includes plaintext and metadata that describes the plaintext and obtaining, by the processor in response to a request from a user, a data encryption key (DEK) and a nonce key for the unencrypted object, the nonce key being unique to the user. Aspects also include encrypting, by the processor, the unencrypted object. The encrypting includes generating a nonce based at least in part of the plaintext and the nonce key and generating ciphertext and a metadata authentication tag comprising a signature of the metadata, the generating based at least in part on the plaintext, the metadata, the DEK, and the nonce. Aspects further include creating an encrypted object that includes the ciphertext, the metadata, and the metadata authentication tag.

Identification of a creator of an encrypted object

Aspects of the invention include receiving, by a processor, an unencrypted object that includes plaintext and metadata that describes the plaintext. A data encryption key (DEK) and a nonce key for the unencrypted object are obtained by the processor. The nonce key is different than the DEK. The unencrypted object is encrypted by the processor. The encrypting includes generating a nonce based at least in part of the plaintext and the nonce key. The encrypting also includes generating ciphertext and a metadata authentication tag that includes a signature of the metadata. The generating is based at least in part on the plaintext, the metadata, the DEK, and the nonce. An encrypted object that includes the ciphertext, the metadata, and the metadata authentication tag is created.

Consistent ciphertext creation

Cryptographic provider failover is performed. Upon receipt of a first security request, an integrated cryptographic provider constructs a table including a list of underlying cryptographic providers for service type algorithm pairs. The integrated cryptographic provider is one of the underlying cryptographic providers in the list. The underlying cryptographic providers are registered as hardware and software cryptographic providers in the list. The integrated cryptographic provider is registered as a routing cryptographic provider in the list. The list is arranged so that the integrated cryptographic provider has the highest priority. The integrated cryptographic provider specifies fai lover support for all registered service type algorithm pairs using one or more of the underlying cryptogaphic providers. In response to a subsequent security request, the integrated cryptographic utilizes the list of the underlying cryptographic providers to identify a second cryptographic provider to which the request will be routed if a first cryptographic provider fails.

Growing community of inventors

Glenmont, NY, United States of America

Jason G Katonica