# US 10,873,450 B2 · Cryptographic key generation for logically sharded data stores > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,450 B2 - Document ID: US10873450B2 - Status: Granted - Kind: B2 - Application number: 15/815,189 - Filed: 2017-11-16 - Published: 2019-05-16 - Granted: 2020-12-22 - Earliest claimed: 2017-11-16 - Assignees: Intuit Inc. - Applicants: Intuit Inc. - Inventors: Gleb Keselman; Ernesto Nebel; Jeffery Weber; Noah Kauhane; Vinu Somayaji; Yaron Sheffer - Web page: https://patentgrep.com/patent/US10873450B2 ## CPC - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - G06F 16/221: {Column-oriented storage; Management thereof} - G06F 16/2455: Query execution - G06F 16/248: Presentation of query results - G06F 16/278: {Data partitioning, e.g. horizontal or vertical partitioning} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/14: using a plurality of keys or algorithms - H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present disclosure relates to deriving cryptographic keys for use in encrypting data based on a plaintext to be encrypted. An example method generally includes receiving, from a querying device, a request for a cryptographic key. The request generally includes data derived from a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted. A cryptographic key is generated based, at least in part, on the derived data and the type of the plaintext value to be encrypted. The key deriver transmits the generated cryptographic key to the querying device. ## Claims ### Claim 1 A method for generating cryptographic keys to secure sensitive data in data queries, comprising: receiving, from a querying device, a request for a cryptographic key, the request including a cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted; generating a cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein: the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and n is less than a length of the cryptographic hash of the plaintext value to be encrypted; and transmitting the generated cryptographic key to the querying device. ### Claim 2 (depends on 1) The method of claim 1, wherein truncating the cryptographic hash of the plaintext value to be encrypted comprises: deleting characters in the cryptographic hash of the plaintext value to be encrypted up to a specified beginning location; and deleting characters in the cryptographic hash of the plaintext value to be encrypted after a predefined number of characters from the specified beginning location. ### Claim 3 (depends on 2) The method of claim 2, wherein the specified beginning location is associated with the type of the plaintext value to be encrypted. ### Claim 4 (depends on 1) The method of claim 1, wherein the cryptographic key is generated based further on a cryptographic salt associated with the type of the plaintext value to be encrypted. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining that a key rotation is in progress for a type of data stored in a database; generating a new base cryptographic key for the type of data; and upon determining that the key rotation has completed, discontinuing use of a deprecated base cryptographic key for generating cryptographic keys for the type of data stored in the database. ### Claim 6 (depends on 5) The method of claim 5, further comprising: receiving, while the key rotation is in progress, a second request for a cryptographic key from the querying device including cryptographic hash of a second plaintext value to be encrypted, wherein the second plaintext value is associated with the type of data for which the key rotation is in progress; generating a first cryptographic key based on the deprecated base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted and a second cryptographic key based on the new base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted; and transmitting the first cryptographic key and the second cryptographic key to the querying device. ### Claim 7 (depends on 1) The method of claim 1, further comprising: encrypting the portion of the cryptographic hash, wherein the cryptographic key is generated based on the encrypted portion of the cryptographic hash. ### Claim 8 A system, comprising: a processor; and a memory having instructions stored thereon which, when executed by the processor, causes the processor to perform an operation for generating cryptographic keys to secure sensitive data in data queries, the operation comprising: receiving, from a querying device, a request for a cryptographic key, the request including cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted; generating a cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein: the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and n is less than a length of the cryptographic hash of the plaintext value to be encrypted; and transmitting the generated cryptographic key to the querying device. ### Claim 9 (depends on 8) The system of claim 8, wherein truncating the cryptographic hash of the plaintext value to be encrypted comprises: deleting characters in the cryptographic hash of the plaintext value to be encrypted up to a specified beginning location; and deleting characters in the cryptographic hash of the plaintext value to be encrypted after a predefined number of characters from the specified beginning location. ### Claim 10 (depends on 9) The system of claim 9, wherein the specified beginning location is associated with the type of the plaintext value to be encrypted. ### Claim 11 (depends on 8) The system of claim 8, wherein the cryptographic key is generated further based on a cryptographic salt associated with the type of the plaintext value to be encrypted. ### Claim 12 (depends on 8) The system of claim 8, wherein the operation further comprises: determining that a key rotation is in progress for a type of data stored in a database; generating a new base cryptographic key for the type of data; and upon determining that the key rotation has completed, discontinuing use of a deprecated base cryptographic key for generating cryptographic keys for the type of data stored in the database. ### Claim 13 (depends on 12) The system of claim 12, wherein the operation further comprises: receiving, while the key rotation is in progress, a second request for a cryptographic key from the querying device including cryptographic hash of a second plaintext value to be encrypted, wherein the second plaintext value is associated with the type of data for which the key rotation is in progress; generating a first cryptographic key based on the deprecated base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted and a second cryptographic key based on the new base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted; and transmitting the first cryptographic key and the second cryptographic key to the querying device. ### Claim 14 (depends on 8) The system of claim 8, wherein the operation further comprises: encrypting the portion of the cryptographic hash, wherein the cryptographic key is generated based on the encrypted portion of the cryptographic hash. ### Claim 15 A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, performs an operation for generating cryptographic keys to secure sensitive data in data queries, the operation comprising: receiving, from a querying device, a request for a cryptographic key, the request including cryptographic hash of a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted; generating the cryptographic key based, at least in part, on at least a portion of the cryptographic hash of the plaintext value to be encrypted and the type of the plaintext value to be encrypted, wherein: the at least the portion of the cryptographic hash of the plaintext value to be encrypted comprises a truncated version of the cryptographic hash of the plaintext value to be encrypted having a length of n characters, and n is less than a length of the cryptographic hash of the plaintext value to be encrypted; and transmitting the generated cryptographic key to the querying device. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operation further comprises: determining that a key rotation is in progress for a type of data stored in a database; generating a new base cryptographic key for the type of data; and upon determining that the key rotation has completed, discontinuing use of a deprecated base cryptographic key for generating cryptographic keys for the type of data stored in the database. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the operation further comprises: receiving, while the key rotation is in progress, a second request for a cryptographic key from the querying device including cryptographic hash of a second plaintext value to be encrypted, wherein the second plaintext value is associated with the type of data for which the key rotation is in progress; generating a first cryptographic key based on the deprecated base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted and a second cryptographic key based on the new base cryptographic key and the cryptographic hash of the second plaintext value to be encrypted; and transmitting the first cryptographic key and the second cryptographic key to the querying device. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein truncating the cryptographic hash of the plaintext value to be encrypted comprises: deleting characters in the cryptographic hash of the plaintext value to be encrypted up to a specified beginning location; and deleting characters in the cryptographic hash of the plaintext value to be encrypted after a predefined number of characters from the specified beginning location. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the specified beginning location is associated with the type of the plaintext value to be encrypted. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the cryptographic key is generated further based on a cryptographic salt associated with the type of the plaintext value to be encrypted.