Edge encryption with metadata

Patent metadata

Field	Value
Publication number	US-11038858-B2
Application number	US-202016793692-A
Country	US
Kind code	B2
Filing date	Feb 18, 2020
Priority date	May 30, 2017
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

Systems and methods are disclosed for encrypting portions of data for storage and processing in a remote network. For example, methods may include receiving a message that includes data for forwarding to a server device; encrypting a portion of the data to determine an encrypted portion; determining metadata based on the portion of the data, wherein the metadata indicates one or more properties of the portion of the data and enables one or more operations to be performed by the server device that depend on the one or more properties; determining a payload including the data with both the encrypted portion and the metadata substituted for the portion of the data; and transmitting the payload to the server device.

First claim

What is claimed is:

1. A system operable to process encrypted data, the system comprising:
a memory; and
a hardware processor;
wherein the memory includes instructions executable by the hardware processor to cause the system to perform operations comprising:
receiving a payload from a customer environment, wherein the payload comprises an encrypted portion of data and metadata, wherein the metadata is generated based on a portion of data that was encrypted to generate the encrypted portion of data, wherein the metadata is configured to describe one or more properties of the portion of data that was encrypted to generate the encrypted portion of data, wherein the one or more properties include one or more of the following: a request-type property, a served-by property, a summary property, a domain property, or a port property, or any combination thereof;
performing an operation on the encrypted portion of data based at least in part on the one or more properties indicated by the metadata to generate a result, wherein the operation comprises a filtering operation, a sorting operation, a grouping operation, an ordering operation, or a comparing operation, or any combination thereof, and wherein the operation is performed without decrypting the encrypted portion of data; and
transmitting the result for storage, for additional processing, to another device, to the customer environment, or any combination thereof.

2. The system of claim 1 , wherein the encrypted portion of data includes information related to one or more of the following: an internet protocol (IP) address, a host name, a credential, a Social Security number, a user identifier, an operating system version, an operating system patch level, a uniform resource locator (URL), a class, a name, a credit card number, a user login credential, a user password, a binary large object, a journal field, an attachment, or any combination thereof.

3. The system of claim 1 , wherein the encrypted portion of data comprises cypher-text.

4. The system of claim 1 , wherein the metadata comprises encoded data before performing the operation based on the one or more properties.

5. The system of claim 1 , wherein the customer environment is configured to be deployed within a private client network deployed separate from a network associated with the hardware processor.

6. The system of claim 1 , wherein the metadata comprises one or more of the following: a subset of the portion of data that was encrypted to generate the encrypted portion of data, a substring of the portion of data that was encrypted to generate the encrypted portion of data, a value inferred from the a subset of the portion of data that was encrypted to generate the encrypted portion of data, a value extracted from data accompanying the portion of data that was encrypted to generate the encrypted portion of data, or any combination thereof.

7. The system of claim 1 , wherein the instructions are configured to cause the hardware processor to receive the payload from the customer environment after validating a version of a software associated with the customer environment.

8. The system of claim 1 , wherein the instructions are configured to cause the hardware processor to determine the one or more properties indicated by the metadata based at least in part on a memory map configured to associated a property of the encrypted portion of data to a portion of the metadata.

9. A method for operating a server device, comprising:
determining that a payload comprises metadata and an encrypted portion of data, wherein the metadata is configured to describe one or more properties associated with the encrypted portion of data or with a customer environment, and wherein the one or more properties include one or more of the following: a request-type property, a served-by property, a summary property, a domain property, or a port property, or any combination thereof;
performing an operation on the encrypted portion of data based at least in part on the one or more properties indicated by the metadata to generate a result, wherein the operation comprises performing a database query, executing a user interface operation, a filtering operation, a sorting operation, a grouping operation, an ordering operation, a comparing operation, or any combination thereof, and wherein the operation is performed using the metadata as opposed to decrypting the encrypted portion of data; and
transmitting the result and the encrypted portion of data to the customer environment.

10. The method of claim 9 , comprising decoding the metadata to obtain the one or more properties indicated by the metadata.

11. The method of claim 9 , comprising interpreting the metadata to determine the request-type property, the served-by property, the summary property, the domain property, the port property, an identifier, a range, an address indication, a class, or any combination thereof associated with the encrypted portion of data or of the customer environment.

12. The method of claim 11 , wherein the one or more properties also include the identifier, the range, the address indication, the class, or any combination thereof.

13. The method of claim 9 , comprising:
determining that a first portion of the payload comprises the encryption portion of data and that a second portion of the payload comprises the metadata, wherein the metadata comprises one or more of the following: a double data type, a float data type, an integer data type, an unsigned integer data type, a Boolean variable, or any combination thereof; and
determining a type, a value, or both of the one or more properties indicated by the second portion of the payload.

14. The method of claim 9 , comprising:
determining that a first portion of the payload comprises the encrypted portion of data and that a second portion of the payload comprises the metadata, wherein the metadata comprises a plurality of Boolean variables; and
determining a type, a value, or both of the one or more properties indicated by the second portion of the payload regarding the first portion of the payload based at least in part on a relative position of a respective variable of the plurality of Boolean variables.

15. The method of claim 9 , comprising:
receiving an indication from the customer environment to perform a validation operation;
running a version of a metadata interpreter module installed on the customer environment to generate a validation result;
determining from the validation result that the customer environment is compatible for communication with the server device; and
transmitting an indication of compatibility to the customer environment, wherein the customer environment is configured to transmit the payload in response to receiving the indication of compatibility.

16. A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving metadata and an encrypted portion of data associated with private information of a customer environment, wherein the metadata is configured to describe one or more properties associated with the encrypted portion of data or with the customer environment, and wherein the one or more properties include one or more of the following: a request-type property, a served-by property, a summary property, a domain property, or a port property, or any combination thereof;
performing, using the metadata, a computing operation on the encrypted portion of data based at least in part on the one or more properties indicated by the metadata to generate a result, where

Assignees

• Servicenow Inc

Inventors

• Rohel Pierre Francois
• Shah Siddharth
• Wexler Martin

Classifications

• G06F21/6254 Primary

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• H04L67/5682

  Policies or rules for updating, deleting or replacing the stored data · CPC title

• G06F9/5083

  Techniques for rebalancing the load in a distributed system · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L63/0485 Primary

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title