# US 2023/0055992 A1 · Protection of data of database clients from persistent adversaries > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0055992 A1 - Document ID: US20230055992A1 - Status: Published application - Kind: A1 - Application number: 17/408,878 - Filed: 2021-08-23 - Published: 2023-02-23 - Earliest claimed: 2021-08-23 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Dhinakaran Vinayagamurthy; Utsav Singhal; Akshar Kaul - Web page: https://patentgrep.com/patent/US20230055992A1 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract One embodiment provides a method, including: receiving, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; batching the set of queries into query batches; transforming, for each query batch, each query within the query batch, wherein the transforming includes changing the query to reduce data leakage; performing, responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; executing, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and calculating a remaining security budget based upon data leakage resulting from the executing. ## Claims ### Claim 1 A method, comprising: receiving, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; batching, at the database proxy, the set of queries into query batches; transforming, at the database proxy and for each query batch, each query within the query batch, wherein the transforming comprises changing the query to reduce data leakage; performing, at the database proxy and responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; executing, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and calculating, at the database proxy, a remaining security budget based upon data leakage resulting from the executing of the query batches. ### Claim 2 (depends on 1) The method of claim 1, comprising re-encrypting the data responsive to determining that the remaining security budget is below a predetermined threshold value. ### Claim 3 (depends on 2) The method of claim 2, wherein the security budget is reset responsive to re-encrypting the data. ### Claim 4 (depends on 1) The method of claim 1, wherein the order-preserving encryption algorithm comprises maintaining a value tree in a database for each of the plurality of database clients and maintained in the database proxy and modifying an order of values in the value tree as new values are added to the value tree. ### Claim 5 (depends on 1) The method of claim 1, wherein the transforming is based upon a type of the query within the query batch. ### Claim 6 (depends on 5) The method of claim 5, wherein the type comprises an insert query and wherein the transforming comprises hiding data inserted by the query by issuing fake insert queries. ### Claim 7 (depends on 5) The method of claim 5, wherein the type comprises a range query and wherein the transforming comprises identifying splits in a range corresponding to the range query and defining, based upon the security budget, a level in the value tree below which the query should not be transformed. ### Claim 8 (depends on 1) The method of claim 1, wherein the performing comprises creating, by combining sets of transformed values, at least one transformed query and augmenting false-positives. ### Claim 9 (depends on 1) The method of claim 1, wherein the data leakage is calculated based upon a function of a distance between a distribution of access and a uniform distribution. ### Claim 10 (depends on 1) The method of claim 1, wherein the data leakage is calculated based upon an order between elements. ### Claim 11 An apparatus, comprising: at least one processor; and a computer readable storage medium having computer readable program code embodied therewith and executable by the at least one processor; wherein the computer readable program code is configured to receive, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; wherein the computer readable program code is configured to batch, at the database proxy, the set of queries into query batches; wherein the computer readable program code is configured to transform, at the database proxy and for each query batch, each query within the query batch, wherein the transforming comprises changing the query to reduce data leakage; wherein the computer readable program code is configured to perform, at the database proxy and responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; wherein the computer readable program code is configured to execute, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and wherein the computer readable program code is configured to calculate, at the database proxy, a remaining security budget based upon data leakage resulting from the executing of the query batches. ### Claim 12 A computer program product, comprising: a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code executable by a processor; wherein the computer readable program code is configured to receive, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; wherein the computer readable program code is configured to batch, at the database proxy, the set of queries into query batches; wherein the computer readable program code is configured to transform, at the database proxy and for each query batch, each query within the query batch, wherein the transforming comprises changing the query to reduce data leakage; wherein the computer readable program code is configured to perform, at the database proxy and responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; wherein the computer readable program code is configured to execute, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and wherein the computer readable program code is configured to calculate, at the database proxy, a remaining security budget based upon data leakage resulting from the executing of the query batches. ### Claim 13 (depends on 12) The computer program product of claim 12, comprising re-encrypting the data responsive to determining that the remaining security budget is below a predetermined threshold value and wherein the security budget is reset responsive to re-encrypting the data. ### Claim 14 (depends on 12) The computer program product of claim 12, wherein the order-preserving encryption algorithm comprises maintaining a value tree in a database for each of the plurality of database clients and maintained in the database proxy and modifying an order of values in the value tree as new values are added to the value tree. ### Claim 15 (depends on 12) The computer program product of claim 12, wherein the transforming is based upon a type of the query within the query batch. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the type comprises an insert query and wherein the transforming comprises hiding data inserted by the query by issuing fake insert queries. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the type comprises a range query and wherein the transforming comprises identifying splits in a range corresponding to the range query and defining, based upon the security budget, a level in the value tree below which the query should not be transformed. ### Claim 18 (depends on 12) The computer program product of claim 12, wherein the performing comprises creating, by combining sets of transformed values, at least one transformed query and augmenting false-positives. ### Claim 19 (depends on 12) The computer program product of claim 12, wherein the data leakage is calculated based upon a function of a distance between a distribution of access and a uniform distribution. ### Claim 20 (depends on 12) The computer program product of claim 12, wherein the data leakage is calculated based upon an order between elements.