Space-efficient storage of encrypted data

• US 10,268,828 B2
• Filed: 04/04/2018
• Issued: 04/23/2019
• Est. Priority Date: 01/15/2016
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Calahan, Patrick
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US15/945,136
• Publication Number:
  US 20180232525A1
• Time in Patent Office: 384 Days
• Field of Search: 713189
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

An encryption platform may identify language characters in database fields and determine which of multiple encoding schemes more efficiently encodes the language characters. The encryption platform may use the selected encoding scheme to encode plaintext into a byte array and then encrypt the byte array into ciphertext. The encryption platform may assign encoding flags to the ciphertext identifying the encoding scheme used for encoding the plaintext. The encryption platform then may use the encoding flag to determine which encoding schemes to use for decoding the data back into plaintext. Using the different encoding schemes allows encrypted data to fit better into database storage structures. The encryption platform also may enable users to select different fields for different selectable objects for encoding and encrypting.

Claims

1. A computer program stored on a non-transitory storage medium in a database system, the computer program comprising a set of instructions, when executed by a hardware processor, cause the hardware processor to:

receive a data object from a user system;

identify types of language characters used in the data object;

select an encoding scheme from among multiple different encoding schemes to encode the data object in a smallest number of bytes or in a fewest number of bits based on the types of language characters in the data object;

use the selected encoding scheme to encode the data object into a byte array;

assign an encoding identifier to the encoded data object of the byte array to identify the selected encoding scheme; and

store the encoding identifier attached to the encoded data object of the byte array in the database system.

2. The computer program of claim 1, further comprising instructions operable to cause the hardware processor to select the encoding scheme from the multiple different encoding schemes that uses a fewest number of bytes to encode the data.

3. The computer program of claim 1, further comprising instructions operable to cause the hardware processor to:

detect a request from the user system to read the data object stored in the database system;

select the encoding scheme identified by the encoding identifier to decode the byte array back into the language characters; and

send the language characters to the user system.

4. The computer program of claim 1, further comprising instructions operable to cause the hardware processor to:

encrypt the byte array;

attach an encryption flag to the encrypted byte array identifying the byte array as encrypted; and

store the encryption flag and the encrypted byte array in the database system.

5. The computer program of claim 4, further comprising instructions operable to cause the hardware processor to:

display fields for different objects on a user interface;

receive selections of at least some of the fields for at least some of the different objects;

only encrypt the byte array for the data object associated with the selected fields.

6. The computer program of claim 1, further comprising instructions operable to cause the hardware processor to:

calculate a first number of bytes for encoding the data object using a first one of the encoding schemes;

calculate a second running sum of bytes to encode sequential characters in the data object using a second one of the encoding schemes;

select the first one of the encoding schemes for encoding the data object when the second running sum of bytes exceeds the first number of bytes; and

select the second one of the encoding schemes for encoding the data object when the second running sum of bytes for all of the characters in the data object does not exceed the first number of bytes.

7. The computer program of claim 1, further comprising instructions operable to cause the hardware processor to:

select a first one of the encoding schemes to encode the data object when a majority of the language characters are for a first language; and

select a second one of the encoding schemes to encode the data object when a majority of the language characters are for a second language.

8. The computer program of claim 1, further comprising instructions operable to cause the hardware processor to:

use an 8 bit unicode transform format (UTF8) encoding scheme to encode the data object when a majority of the language characters are Latin; and

use a 16-bit unicode transform format (UTF16) to encode the data object when a majority of the language characters are Chinese.

9. The computer program of claim 1, further comprising instructions operable to cause the hardware processor to:

detect requests to save the data object for different records; and

for each one of the different records, individually select from among the multiple different encoding schemes to encode the data object based on the types of language characters used in the data object for the different records.

10. An encryption platform for operating in a database system, comprising:

a hardware processor; and

memory storing one or more stored sequences of instructions which, when executed by the hardware processor, cause the hardware processor to;

receive a data object;

identify which encoding scheme from among multiple encoding schemes encodes the data object in a smallest number of bytes based on, at least, types of language characters in the data object;

encode the data object using the encoding scheme identified as encoding the data object in the smallest number of bytes;

assign an encoding identifier to the data object identifying the encoding scheme used for encoding the data object; and

storing the encoding identifier and attached to the encoded data object in the database system.

11. The encryption platform of claim 10, wherein the instructions further cause the hardware processor to:

calculate a first number of bytes used for encoding the data object with a first one of the encoding schemes;

calculate a second running sum of bytes used for serially encoding individual characters in the data object using a second one of the encoding schemes;

select the first one of the encoding schemes for encoding the data object when the second running sum of bytes exceeds the first number of bytes; and

select the second one of the encoding schemes for encoding the data object when the second running sum of bytes for all of the characters in the data object is less than the first number of bytes.

12. The encryption platform of claim 11, wherein the instructions further cause the hardware processor to:

use a 16-bit unicode transform format (UTF16) as the first one of the encoding schemes; and

use an 8-bit unicode transform format (UTF8) as the second one of the encoding schemes.

13. The encryption platform of claim 10, wherein the instructions further cause the processor to:

encrypt the encoded data object into ciphertext; and

attach a header to the ciphertext identifying the encoded data object as encrypted.

14. The encryption platform of claim 13, wherein the instructions further cause the hardware processor to:

identify fields for different objects in the database system;

receive selections of different ones of the fields for different ones of the objects to encrypt; and

create an encryption configuration file identifying the fields selected to encrypt.

15. The encryption platform of claim 14, wherein the instructions further cause the hardware processor to only encrypt the objects associated with the fields identified in the encryption configuration file.

16. The encryption platform of claim 10, wherein the instructions further cause the hardware processor to:

receive requests to store different data fields;

identify different types of language characters in the different data fields; and

for each of the different data fields, identify which of the multiple encoding schemes to use for encoding each of the different data fields based on the different types of language characters in the data fields.

17. A method for encoding a data object in a database system, comprising:

receiving a request to store the data object in the database system;

identifying types of plaintext characters in the data object;

identifying an encoding scheme from multiple different encoding schemes that encodes the plaintext characters in the data object in a fewest number of bits based on, at least, types of language characters in the data object;

using the identified encoding scheme to encode the data object;

assigning a header to the encoded data object to identify the encoding scheme used to encode the data object; and

storing the header attached to the encoded data object in the database system.

18. The method of claim 17, further comprising:

encrypting the encoded data object into encrypted data;

assigning an encryption flag to the encrypted data object identify the encoded data object as encrypted data; and

storing the encryption flag and the encrypted data object in the database system.

19. The method of claim 18 further comprising:

receiving selections of different fields for different objects for encryption; and

only encrypting the encoded data object associated with the selected fields.

20. The method of claim 17 further comprising:

receiving a request to read the encoded data object stored in the database system;

reading the header assigned to the encoded data object to identify the encoding scheme used to encode the data; and

using the identified encoding scheme to decode the encoded data object.