Microsoft Technology Licensing, LLC

Joachim Hammer

Lev Novik

Jason Duane Clark

Ajay Kalhan

Marc Todd Friedman

Andrew Eyring Kimball

Cihangir Biyikoglu

Istvan Cseri

Tomas Talius

Santeri Olavi Voutilainen

Tony Petrossian

Donald Kossmann

Panagiotis Antonopoulos

Arvind Arasu

Kenneth Hiroshi Eguro

Raghav Kaushik

Ravi Ramamurthy

Bala Neerumalla

Tobias Joakim Bertil Ternström

Jakub J Szymaszek

Kedar Dubhashi

A 'Database Confidentiality System' provides various techniques for using server-side trusted computing in combination with configurable type metadata and user- or system-definable rules associated with individual database fields to implement database confidentiality. In various implementations, type metadata and one or more rules are added to each database field. Metadata includes a domain, method of encryption, and a pointer to an encryption key used to encrypt the data in the corresponding field. The rules define one or more operations allowed on the corresponding data types. The type metadata and rules are optionally integrity protected and/or encrypted to avoid unauthorized changes or access. Various encryption techniques (e.g., probabilistic, Paillier, etc.) allow some computations to be performed in an untrusted environment without access to the encryption key. This enables the Database Confidentiality System to maintain database confidentiality while performing distributed computation and communications between the untrusted machine and the trusted machine.

Type-based database confidentiality using trusted computing

Methods, systems, and computer program products are provided for partitioning online databases. Online database operations, such as, for example, SPLIT, MERGE, and DROP, are used to alter the arrangement of partitions in a federated database. A SPLIT operation splits rows at one partition across a plurality of other partitions. A MERGE operation merges rows at a plurality of partitions in to one partition. A DROP operation shifts responsibility for rows of data from one partition to another partition and then drops the rows from the one partition.

Partitioning online databases

The present invention extends to methods, systems, and computer program products for scoping the context used to access a database partition. Embodiments of the invention enable data isolation using partitions in multi-tenant databases, while relieving client applications from dealing with the partitions. For example, a computer system that includes a distributed database system comprising a plurality of database partitions in a federation receives a context to use when performing database access operations within the distributed database system. The context identifies specified relevant portion of the federation. The computer system also receives a database access operation that is associated with the context. The computer system modifies the semantics of the database access operation in accordance with the associated context, to direct application of the database access operation to the specified relevant portion of the federation.

Scoped database connections

The present invention extends to methods, systems, and computer program products for partitioning online databases. Online database operations, such as, for example, SPLIT, MERGE, and DROP, are used to alter the arrangement of partitions in a federated database. A SPLIT operation splits rows at one partition across a plurality of other partitions. A MERGE operation merges rows at a plurality of partitions in to one partition. A DROP operation shifts responsibility for rows of data from one partition to another partition and then drops the rows from the one partition.

Growing community of inventors

Redmond, WA, United States of America

Joachim Hammer