Edge encryption with metadata

Patent metadata

Field	Value
Publication number	US-10594670-B2
Application number	US-201715608580-A
Country	US
Kind code	B2
Filing date	May 30, 2017
Priority date	May 30, 2017
Publication date	Mar 17, 2020
Grant date	Mar 17, 2020

Abstract

Systems and methods are disclosed for encrypting portions of data for storage and processing in a remote network. For example, methods may include receiving a message that includes data for forwarding to a server device; encrypting a portion of the data to determine an encrypted portion; determining metadata based on the portion of the data, wherein the metadata indicates one or more properties of the portion of the data and enables one or more operations to be performed by the server device that depend on the one or more properties; determining a payload including the data with both the encrypted portion and the metadata substituted for the portion of the data; and transmitting the payload to the server device.

First claim

What is claimed is:

1. A system operable to encrypt portions of data for storage and processing in a remote network, the system comprising:
a memory; and
a processor;
wherein the memory includes instructions executable by the processor to cause the system to:
receive data to be transmitted to a server device;
encrypt at least a portion of the data to generate an encrypted portion;
determine metadata based on the at least the portion of the data that has been encrypted, wherein the metadata is configured to describe one or more properties of the at least the portion of the data that has been encrypted, and wherein the one or more properties include one or more of the following: a request type property, a served by property, a summary property, a domain property, or a port property, or any combination thereof;
generate a payload comprising the encrypted portion and the metadata, wherein the payload is configured to enable the server device to perform an operation based at least in part on the one or more properties indicated by the metadata, and wherein the operation comprises one or more filtering operations, one or more sorting operations, one or more grouping operations, one or more ordering operations, or one or more comparing operations, or any combination thereof; and
transmit the payload to the server device.

2. The system of claim 1 , comprising the server device, wherein the server device is configured to:
receive the payload;
store the encrypted portion in a database;
store the metadata in a manner that is associated with the encrypted portion; and
perform, using the metadata, the operation to obtain a result.

3. The system of claim 1 , wherein the metadata comprises a plurality of Boolean values that indicate properties of an Internet protocol address in the encrypted portion.

4. The system of claim 1 , wherein the metadata is formatted using an interface description language.

5. The system of claim 1 , wherein the
payload comprises the encrypted portion, an unencrypted portion of the data, and the metadata.

6. The system of claim 1 , wherein the data includes an indication of the one or more properties of the at least the portion of the data, and wherein the metadata is determined based on the indication.

7. The system of claim 6 , comprising an agent device that is configured to:
invoke a discovery probe against a target device to obtain probe data;
generate the indication of the one or more properties of a portion of the probe data, wherein the metadata is determined based at least in part on the indication; and
transmit, to a gateway device, the data to be transmitted to the server device, wherein the gateway device includes the processor, and wherein the data includes the probe data with the indication.

8. The system of claim 1 , comprising the server device, wherein the server device is configured to:
receive a request to perform the operation;
access the encrypted portion in a database;
determine that the encrypted portion is encrypted;
in response to determining that the encrypted portion is encrypted, access the metadata;
perform, using the metadata, the one of the operation to obtain a result; and
transmit the result.

9. The system of claim 1 , wherein the at least the portion of the data includes a uniform resource locator, and wherein the metadata based on the at least the portion of the data includes a substring of the uniform resource locator.

10. The system of claim 1 , wherein the instructions to generate the payload include instructions executable by the processor to cause the system to:
replace the encrypted portion and the metadata for the at least the portion of the data in an unencrypted format.

11. A method for encrypting portions of data for storage and processing in a remote network, comprising:
receiving data to be transmitted to a server device;
encrypting at least a portion of the data to determine an encrypted portion;
determining metadata based at least in part on the at least the portion of the data, wherein the metadata is configured to describe one or more properties of the at least the portion of the data that has been encrypted, and wherein the one or more properties include one or more of the following: a request type property, a served by property, a summary property, a domain property, or a port property, or any combination thereof;
generating a payload comprising the encrypted portion and the metadata substituted for the at least the portion of the data, wherein the payload is configured to enable the server device to perform an operation based at least in part on the one or more properties indicated by the metadata, and wherein the operation comprises one or more filtering operations, one or more sorting operations, one or more grouping operations, one or more ordering operations, or one or more comparing operations, or any combination thereof; and
transmitting the payload to the server device.

12. The method of claim 11 , comprising:
receiving the payload at the server device;
storing the encrypted portion in a database;
storing the metadata in a manner that is associated with the encrypted portion;
performing, by the server device using the metadata, the operation to obtain a result; and
transmitting the result.

13. The method of claim 11 , wherein the metadata comprises a plurality of Boolean values that indicate properties of an Internet protocol address in the at least the portion of the data.

14. The method of claim 11 , wherein the metadata is formatted using an interface description language.

15. The method of claim 11 , wherein the payload comprises the encrypted portion, an unencrypted portion of the data, and the metadata.

16. The method of claim 11 , wherein the one or more properties include the port property.

17. The method of claim 16 , comprising:
invoking, by an agent device, a discovery probe against a target device to obtain probe data;
generating, by the agent device, an indication of the one or more properties of a portion of the probe data, wherein the metadata is determined based at least in part on the indication; and
transmitting, to a gateway device, the data to be transmitted to the server device, wherein the data includes the probe data with the indication.

18. The method of claim 11 , comprising:
receiving, by the server device, a request to perform one of the operation;
accessing the encrypted portion in a database;
determining that the encrypted portion is encrypted;
in response to determining that the encrypted portion is encrypted, accessing the metadata;
performing, using the metadata, the operation to obtain a result; and
transmitting the result.

19. A system for discovering components of a computer network in a secure manner, the system comprising:
a memory; and
a processor;
wherein the memory includes instructions executable by the processor to cause the system to:
invoke a discovery probe against a target device to obtain probe data that includes attributes of the target device;
identify an attribute of the attributes from the probe data that is of an attribute type having a matching encryption profile; and
generate a payload to be communicated to a server device, wherein the payload includes an encrypted value of the identified attribute and metadata generated based on the identified attribute, wherein the metadata enables one or more operations to be performed by the server device that depend on properties of the identified attribute, wherein the one or more operations compris

Assignees

• Servicenow Inc

Inventors

• Rohel Pierre Francois
• Shah Siddharth
• Wexler Martin

Classifications

• H04L63/0485 Primary

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• G06F9/5083

  Techniques for rebalancing the load in a distributed system · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• G06F16/986

  Document structures and storage, e.g. HTML extensions · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title