# US 12,603,783 B2 · Decentralized database optimizations

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,783 B2
- Document ID: US12603783B2
- Status: Granted
- Kind: B2
- Application number: 18/112,941
- Filed: 2023-02-22
- Published: 2023-08-03
- Granted: 2026-04-14
- Earliest claimed: 2016-08-12
- Assignees: ALTR Solutions, Inc.
- Applicants: ALTR Solutions, Inc.
- Inventors: James Douglas Beecham; Justin W. Fly; Christopher Edward Struttmann; Scott Nathaniel Goldfarb; Jackson Chaiken; Thomas Daly; Judson Benton Locke; Mark Snellman
- Web page: https://patentgrep.com/patent/US12603783B2

## CPC

- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques for managing data stored within a database, such as a decentralized database are provided. Some techniques involve managing some data within a lower-trust database and some other data within a higher-trust database. A higher-trust database may be a decentralize database including a blockchain. A lower-trust database may store references to data within the blockchain, and optionally other data in association with those references. Disclosed techniques include WHERE clause query handling in databases with reference values, replacement of distinct data in a relational database with a distinct reference to that data, number line storing for secure indexing, APIs for databases, and consensus operations for private blockchain networks.

## Claims

### Claim 1

A method, comprising:
receiving, with a computer system, a query in a query language, the query being sent from a workload application executing on a client computing device to a database remote from the client computing device via the computer system;
inspecting, with the computer system, the query to determine that text of the query contains a plain-text value in a field of the database that is designated as being protected, the protection being implemented by storing ciphertexts that are encrypted versions of values of that field in the database;
in response to the determination, translating, with the computer system, the query into a translated version that contains a ciphertext formed by encrypting the plain-text value; and
sending, with the computer system, the translated query to the database, wherein the database is responsive to return entries satisfying the query based, at least in part, on those entries containing the ciphertext formed by encrypting the plain-text value, wherein:
the database is part of a multi-tenant data cloud-based data platform;
encrypting the plain-text value is performed with a symmetric-key encryption algorithm;
a first subset of fields in a table in the database are encrypted;
a second subset of fields in the table in the database are not encrypted;
the first subset of fields are specified by a policy applied by the computer system;
at least some rules of the policy specify members of the first subset of fields by pattern matching to a data format; and
the data format is specified with a regular expression; and
providing a result of the query to the workload application, the result having the values of the field in encrypted form, and the workload application not having the ability to access the values of the field in plain-text form.

### Claim 2 (depends on 1)

The method of claim 1, wherein:
the encrypting the plain-text value comprises XOR'ing the plain-text value with a string based on a random value and that serves as a symmetric key.

### Claim 3 (depends on 1)

The method of claim 1, wherein:
encrypting the plain-text value is performed with an abstracted cryptographic function.

### Claim 4 (depends on 3)

The method of claim 3, wherein:
the abstracted cryptographic function is a lambda function received as a parameter.

### Claim 5 (depends on 1)

The method of claim 1, wherein:
the computer system comprises a translator operative to cause the translating based on an encryption key stored external to the computer system.

### Claim 6 (depends on 1)

The method of claim 1, wherein the computer system is a database gateway.

### Claim 7 (depends on 1)

The method of claim 1, wherein the computer system is on-premises with the client computing device and remote from the database.

### Claim 8 (depends on 1)

The method of claim 1, wherein the database is a multi-tenant database and encrypting is based on a value that varies by tenant.

### Claim 9 (depends on 1)

The method of claim 1, wherein an entity operating the database does not have access to an encryption key by which the field in the database is encrypted.

### Claim 10 (depends on 1)

The method of claim 1, wherein:
the query comprises a wildcard operator that takes the plain-text value as a parameter.

### Claim 11 (depends on 10)

The method of claim 10, comprising steps for translating a query with a wildcard operator.

### Claim 12 (depends on 1)

The method of claim 1, comprising:
receiving, with the computer system, from another client computing device, a request to write data to the database;
classifying, with the computer system, fields of the data to be written as being higher security fields or lower security fields;
causing, with the computer system, values in the higher security fields to be encrypted; and
providing, with the computer system, to the database, instructions to write the lower security fields in plain-text and the higher security fields in encrypted format, without providing the database access to the higher security fields in plain-text format.

### Claim 13 (depends on 1)

The method of claim 1, wherein the computer system is configured to transparently retrofit the workload application to selectively encrypt fields of the database specified by a policy.

### Claim 14 (depends on 13)

The method of claim 13, wherein transparently retrofitting comprises wrapping an interface by which the workload application accesses the database.

### Claim 15 (depends on 1)

The method of claim 1, comprising:
steps for performing relationship JOINs at an application layer.

### Claim 16 (depends on 1)

The method of claim 1, comprising:
steps for intercepting and inspecting the query.

### Claim 17 (depends on 1)

The method of claim 1, comprising:
calculating a risk metric based on the query or a result of the query; and
thresholding access to the database based on the risk metric.

### Claim 18 (depends on 17)

The method of claim 17, wherein:
thresholding access comprises determining that the risk metric satisfies a threshold and, in response, delaying providing to the client computing device at least some results of the query.

### Claim 19 (depends on 1)

The method of claim 1, wherein:
the database is a software-as-a-service application hosted by a third party and accessed via a third-party application program interface.

### Claim 20 (depends on 1)

The method of claim 1, wherein:
the database is a relational database;
the query is a structured query language statement;
the database is a software-as-a-service application hosted by a third party and accessed via a third party application program interface;
providing the result of the query to the workload application, the result having the values of that field in encrypted form;
encrypting the plain-text value is performed with a symmetric-key encryption algorithm specified to implement an abstracted cryptographic function;
the computer system is on-premises with the client computing device and remote from the database; and
the computer system is configured to transparently retrofit the workload application to selectively encrypt fields of the database specified by the policy.

### Claim 21

A tangible, non-transitory, machine-readable medium storing instructions that, when executed by one or more processors, effectuate operations comprising:
receiving, with a computer system, a query in a query language, the query being sent from a workload application executing on a client computing device to a database remote from the client computing device via the computer system;
inspecting, with the computer system, the query to determine that text of the query contains a plain-text value in a field of the database that is designated as being protected, the protection being implemented by storing ciphertexts that are encrypted versions of values of that field in the database;
in response to the determination, translating, with the computer system, the query into a translated version that contains a ciphertext formed by encrypting the plain-text value; and
sending, with the computer system, the translated query to the database, wherein the database is responsive to return entries satisfying the query based, at least in part, on those entries containing the ciphertext formed by encrypting the plain-text value, wherein:
the database is part of a multi-tenant data cloud-based data platform;
encrypting the plain-text value is performed with a symmetric-key encryption algorithm;
a first subset of fields in a table in the database are encrypted;
a second subset of fields in the table in the database are not encrypted;
the first subset of fields are specified by a policy applied by the computer system;
at least some rules of the policy specify members of the first subset of fields by pattern matching to a data format; and
the data format is specified with a regular expression; and
providing a result of the query to the workload application, the result having the values of the field in encrypted form, and the workload application not having the ability to access the values of the field in plain-text form.

### Claim 22

A method, comprising:
obtaining a security policy for a database in a multi-tenant cloud data platform;
configuring the multi-tenant cloud data platform to rewrite a received query according to the security policy and return query results that include both cryptographically obfuscated values and un-obfuscated values based on permissions associated with a source of the query, wherein:
different permissions in the security policy result in different users being able to access different subsets of data in the database in un-obfuscated form; and
the cryptographically obfuscated values are obfuscated with a cryptographic hash function based on both a value that is different for different tenants of the multi-tenant cloud data platform but the same for values in a given table of a given tenant;
designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to field names; and
designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to values of fields.

### Claim 23 (depends on 22)

The method of claim 22, comprising:
steps for determining a risk metric based on access to the database.

### Claim 24 (depends on 22)

The method of claim 22, wherein rewriting the received query comprises steps for rewriting queries.

### Claim 25 (depends on 22)

The method of claim 22, wherein obfuscating with the cryptographic hash function comprises iteratively applying a one-way compression function that accepts a fixed-size input and produces a fixed-size output, including parsing an input to the cryptographic hash function into a plurality of portions and, for each portion, combining an output of a previous iteration of the one-way compression function with a next one of the portions and inputting the combination to the one-way compression function to produce a subsequent fixed-size output, until an end of the input is reached.

### Claim 26 (depends on 22)

The method of claim 22, wherein at least some fields of the database having at least some of the obfuscated values are arranged hierarchically in the database.

### Claim 27 (depends on 22)

The method of claim 22, wherein:
obfuscating with the cryptographic hash function comprises iteratively applying a one-way compression function that accepts a fixed-size input and produces a fixed-size output, including parsing an input to the cryptographic hash function into a plurality of portions and, for each portion, combining an output of a previous iteration of the one-way compression function with a next one of the portions and inputting the combination to the one-way compression function to produce a subsequent fixed-size output, until an end of the input is reached;
at least some fields of the database having at least some of the obfuscated values are arranged hierarchically in the database;
pattern matching comprises steps for pattern matching to classify values as higher or lower security; and
access to the database in un-obfuscated form is determined based on roles and permissions stored in association with user accounts.

### Claim 28 (depends on 22)

The method of claim 22, wherein:
the cryptographically obfuscated values are obfuscated before being written to the database; and
the query is rewritten by cryptographically obfuscating a parameter of a where clause of a structured query language statement.

### Claim 29

A tangible, non-transitory, machine-readable medium storing instructions that, when executed by one or more processors, effectuate operations comprising:
obtaining a security policy for a database in a multi-tenant cloud data platform;
configuring the multi-tenant cloud data platform to rewrite a received query according to the security policy and return query results that include both cryptographically obfuscated values and un-obfuscated values based on permissions associated with a source of the query, wherein:
different permissions in the security policy result in different users being able to access different subsets of data in the database in un-obfuscated form; and
the cryptographically obfuscated values are obfuscated with a cryptographic hash function based on both a value that is different for different tenants of the multi-tenant cloud data platform but the same for values in a given table of a given tenant;
designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to field names; and
designating at least some fields of the database having at least some of the obfuscated values for obfuscation based on pattern matching to values of fields.

### Claim 30 (depends on 29)

The medium of claim 29, the operations comprising:
steps for determining a risk metric based on access to the database.

### Claim 31 (depends on 29)

The medium of claim 29, wherein rewriting the received query comprises steps for rewriting queries.

### Claim 32 (depends on 29)

The medium of claim 29, wherein obfuscating with the cryptographic hash function comprises iteratively applying a one-way compression function that accepts a fixed-size input and produces a fixed-size output, including parsing an input to the cryptographic hash function into a plurality of portions and, for each portion, combining an output of a previous iteration of the one-way compression function with a next one of the portions and inputting the combination to the one-way compression function to produce a subsequent fixed-size output, until an end of the input is reached.

### Claim 33 (depends on 29)

The medium of claim 29, wherein at least some fields of the database having at least some of the obfuscated values are arranged hierarchically in the database.

### Claim 34 (depends on 29)

The medium of claim 29, wherein:
obfuscating with the cryptographic hash function comprises iteratively applying a one-way compression function that accepts a fixed-size input and produces a fixed-size output, including parsing an input to the cryptographic hash function into a plurality of portions and, for each portion, combining an output of a previous iteration of the one-way compression function with a next one of the portions and inputting the combination to the one-way compression function to produce a subsequent fixed-size output, until an end of the input is reached;
at least some fields of the database having at least some of the obfuscated values are arranged hierarchically in the database;
pattern matching comprises steps for pattern matching to classify values as higher or lower security; and
access to the database in un-obfuscated form is determined based on roles and permissions stored in association with user accounts.

### Claim 35 (depends on 29)

The medium of claim 29, wherein:
the cryptographically obfuscated values are obfuscated before being written to the database; and
the query is rewritten by cryptographically obfuscating a parameter of a where clause of a structured query language statement.