Decentralized database optimizations

A tangible, non-transitory, machine-readable medium storing instructions that, when executed by one or more processors, effectuate operations comprising:

• receiving, with a computer system, a query in a query language, the query being sent from a workload application executing on a client computing device to a database remote from the client computing device via the computer system;
• inspecting, with the computer system, the query to determine that text of the query contains a plain-text value in a field of the database that is designated as being protected, the protection being implemented by storing ciphertexts that are encrypted versions of values of that field in the database;
• in response to the determination, translating, with the computer system, the query into a translated version that contains a ciphertext formed by encrypting the plain-text value;
• and
• sending, with the computer system, the translated query to the database, wherein the database is responsive to return entries satisfying the query based, at least in part, on those entries containing the ciphertext formed by encrypting the plain-text value, wherein:
• the database is part of a multi-tenant data cloud-based data platform;
• encrypting the plain-text value is performed with a symmetric-key encryption algorithm;
• a first subset of fields in a table in the database are encrypted;
• a second subset of fields in the table in the database are not encrypted;
• the first subset of fields are specified by a policy applied by the computer system;
• at least some rules of the policy specify members of the first subset of fields by pattern matching to a data format;
• and
• the data format is specified with a regular expression;
• and
• providing a result of the query to the workload application, the result having the values of the field in encrypted form, and the workload application not having the ability to access the values of the field in plain-text form.

A method, comprising:

• obtaining a security policy for a database in a multi-tenant cloud data platform;
• configuring the multi-tenant cloud data platform to rewrite a received query according to the security policy and return query results that include both cryptographically obfuscated values and un-obfuscated values based on permissions associated with a source of the query, wherein:
• different permissions in the security policy result in different users being able to access different subsets of data in the database in un-obfuscated form;
• and
• the cryptographically obfuscated values are obfuscated with a cryptographic hash function based on both a value that is different for different tenants of the multi-tenant cloud data platform but the same for values in a given table of a given tenant;
• designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to field names;
• and
• designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to values of fields.

A tangible, non-transitory, machine-readable medium storing instructions that, when executed by one or more processors, effectuate operations comprising:

• obtaining a security policy for a database in a multi-tenant cloud data platform;
• configuring the multi-tenant cloud data platform to rewrite a received query according to the security policy and return query results that include both cryptographically obfuscated values and un-obfuscated values based on permissions associated with a source of the query, wherein:
• different permissions in the security policy result in different users being able to access different subsets of data in the database in un-obfuscated form;
• and
• the cryptographically obfuscated values are obfuscated with a cryptographic hash function based on both a value that is different for different tenants of the multi-tenant cloud data platform but the same for values in a given table of a given tenant;
• designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to field names;
• and
• designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to values of fields.