# US 2017/0255784 A1 · Database security model

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0255784 A1
- Document ID: US20170255784A1
- Status: Published application
- Kind: A1
- Application number: 15/448,698
- Filed: 2017-03-03
- Published: 2017-09-07
- Earliest claimed: 2016-03-03
- Assignees: Jjd Software LLC
- Applicants: JJD Software LLC
- Inventors: Justin Donohoe
- Web page: https://patentgrep.com/patent/US20170255784A1

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00)
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/0272: {Virtual private networks}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system, method and program product for implementing a database security model. A database security model is disclosed that includes: a system for maintaining private data in an encrypted storage area; an ENCR system for implementing a plurality of ENCR routines, wherein each of the ENCR routines is callable from a database application to access and process private data and wherein the ENCR system operates in a functional space separate from the database application; and a crypto system having a private key and decryption system, wherein the crypto system decrypts private data in response to receiving a decrypt request and public key from an ENCR routine, and wherein the crypto system operates in a functional space separate from the ENCR system.

## Claims

### Claim 1

A database security model for securing data in an application database, comprising:
a system for providing access to private data in an encrypted storage area;
an ENCR system for implementing a plurality of ENCR routines, wherein each of the ENCR routines is callable from a database application to access and process private data and wherein the ENCR system operates in a functional space separate from the database application; and
a crypto system having a private key and decryption system, wherein the crypto system decrypts private data in response to receiving a decrypt request and public key from an ENCR routine, and wherein the crypto system operates in a functional space separate from the ENCR system.

### Claim 2 (depends on 1)

The database security model of claim 1, wherein user access to the crypto system and ENCR system requires permission from a gate keeper.

### Claim 3 (depends on 1)

The database security model of claim 1, wherein the crypto system is prohibited from permanently storing the public key.

### Claim 4 (depends on 1)

The database security model of claim 1, wherein the crypto system is accessible by a key master with access rights granted by the gate keeper.

### Claim 5 (depends on 1)

The database security model of claim 1, wherein the ENCR system is accessible by a project lead with access rights granted by the gate keeper.

### Claim 6 (depends on 2)

The database security model of claim 2, wherein the gate keeper does not have access to the public key.

### Claim 7 (depends on 1)

The data security model of claim 1, further comprising a crypto sentry that verifies all routines involved in passing the public key.

### Claim 8

A computer program product stored on a computer readable storage medium, which when executed by a computing system, provides a database security model, the program product comprising:
program code for providing access to private data in an encrypted storage area;
first level program code for implementing a plurality of ENCR routines, wherein each of the ENCR routines is callable from a database application to access and process private data and wherein the first level program code operates in a functional space separate from the database application; and
second level program code having a private key and a decryption routine, wherein the decryption routines decrypts private data in response to receiving a decrypt request and public key from the first level program code, and wherein second level program code operates in a functional space separate from the first level program code.

### Claim 9 (depends on 8)

The computer program product of claim 8, wherein user access to the first level program code and second level program code requires permission from a gate keeper.

### Claim 10 (depends on 8)

The computer program product of claim 8, wherein the second level program code is prohibited from permanently storing the public key.

### Claim 11 (depends on 8)

The computer program product of claim 8, wherein the second level program code is accessible by a key master with access rights granted by the gate keeper.

### Claim 12 (depends on 8)

The computer program product of claim 8, wherein the first level program code is accessible by a project lead with access rights granted by the gate keeper.

### Claim 13 (depends on 9)

The computer program product of claim 9, wherein the gate keeper does not have access to the public key.

### Claim 14 (depends on 8)

The computer program product of claim 8, further comprising a crypto sentry that that verifies all routines involved in passing the public key.

### Claim 15

A computerized method for implementing a database security model, comprising:
maintaining private data in an encrypted storage area;
receiving a request at an application database that requires access to private data;
passing an ENCR request to an ENCR routine that operates in a first level functional space separate from the database application;
processing the ENCR request and submitting a decrypt request along with a public key to a crypto system that operates in a second level functional space separate from the ENCR routine;
retrieving and decrypting private data within the crypto system using a stored private key and a submitted public key;
passing decrypted private data to the ENCR routine; and
returning an ENCR result to the database application.

### Claim 16 (depends on 1)

The computerized method of claim 1, wherein user access to the first level functional space and the second level functional space requires permission from a gate keeper.

### Claim 17 (depends on 1)

The computerized method of claim 1, wherein the crypto system is prohibited from permanently storing the public key.

### Claim 18 (depends on 16)

The computerized method of claim 16, wherein the crypto system is accessible by a key master with access rights granted by the gate keeper.

### Claim 19 (depends on 16)

The computerized method of claim 16, wherein the first level functional space is accessible by a project lead with access rights granted by the gate keeper.

### Claim 20 (depends on 16)

The computerized method of claim 16, wherein the gate keeper does not have access to the public key.