Data stream replication using staggered encryption

Patent metadata

Field	Value
Publication number	US-12537799-B2
Application number	US-202418582313-A
Country	US
Kind code	B2
Filing date	Feb 20, 2024
Priority date	Apr 30, 2020
Publication date	Jan 27, 2026
Grant date	Jan 27, 2026

Abstract

A method includes encoding, by at least one hardware processor, database data in a first portion of a first data file of a plurality of data files. The encoding of the database data is based on a first encryption key. The method further includes encoding the first encryption key in a second portion of the first data file. The encoding of the first encryption key is based on a second encryption key associated with a second data file of the plurality of data files. The method further includes causing transmission of the plurality of data files from a first database deployment to a second database deployment.

First claim

What is claimed is:

1 . A method comprising:
encoding, by at least one hardware processor, database data in a first portion of a first data file of a plurality of data files, the encoding of the database data based on a first encryption key; encoding the first encryption key in a second portion of the first data file, the encoding of the first encryption key based on a second encryption key associated with a second data file of the plurality of data files; and causing transmission of the plurality of data files from a first database deployment to a second database deployment.

2 . The method of claim 1 , further comprising:
receiving the plurality of data files as a data stream at the first database deployment, wherein the second data file precedes the first data file in the data stream.

3 . The method of claim 2 , further comprising:
decoding the second encryption key using the second data file and a public encryption key, the public encryption key associated with the second database deployment.

4 . The method of claim 3 , further comprising:
causing transmission of the second data file prior to the first data file during the transmission of the plurality of data files from the first database deployment to the second database deployment.

5 . The method of claim 1 , further comprising:
encoding a third encryption key in a third portion of the first data file, the third encryption key associated with a third data file of the plurality of data files.

6 . The method of claim 5 , further comprising:
encoding the third encryption key in the third portion of the first data file using a public encryption key, wherein the public encryption key is common to the first database deployment and the second database deployment.

7 . The method of claim 5 , further comprising:
encoding second database data in the third data file, the encoding of the database data based on a fourth encryption key; and encoding the fourth encryption key in the third data file, the encoding of the fourth encryption key based on the third encryption key.

8 . The method of claim 1 , wherein the first encryption key is a data encryption key (DEK), the second encryption key is a wrapping replication key (WRK), and the method further comprises:
encoding the DEK using the WRK to generate an encrypted DEK; and encoding a second WRK associated with a third data file to generate an encoded second WRK, and the encoding of the second WRK using a public key of the second database deployment.

9 . The method of claim 8 , further comprising:
encoding the first data file to include the encrypted DEK, the encoded second WRK, and the public key of the second database deployment before the transmission of the plurality of data files.

10 . The method of claim 1 , further comprising:
periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key; encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.

11 . A system comprising:
one or more processors of a machine; and at least one memory storing instructions that, when executed by the one or more processors of a first database deployment, cause the machine to perform operations comprising:
encoding database data in a first portion of a first data file of a plurality of data files, the encoding of the database data based on a first encryption key;
encoding the first encryption key in a second portion of the first data file, the encoding of the first encryption key based on a second encryption key associated with a second data file of the plurality of data files; and
causing transmission of the plurality of data files from the first database deployment to a second database deployment.

12 . The system of claim 11 , the operations further comprising:
receiving the plurality of data files as a data stream at the first database deployment, wherein the second data file precedes the first data file in the data stream.

13 . The system of claim 12 , the operations further comprising:
decoding the second encryption key using the second data file and a public encryption key, the public encryption key associated with the second database deployment.

14 . The system of claim 13 , the operations further comprising:
causing transmission of the second data file prior to the first data file during the transmission of the plurality of data files from the first database deployment to the second database deployment.

15 . The system of claim 11 , the operations further comprising:
encoding a third encryption key in a third portion of the first data file, the third encryption key associated with a third data file of the plurality of data files.

16 . The system of claim 15 , the operations further comprising:
encoding the third encryption key in the third portion of the first data file using a public encryption key, wherein the public encryption key is common to the first database deployment and the second database deployment.

17 . The system of claim 15 , the operations further comprising:
encoding second database data in the third data file, the encoding of the database data based on a fourth encryption key; and encoding the fourth encryption key in the third data file, the encoding of the fourth encryption key based on the third encryption key.

18 . The system of claim 11 , wherein the first encryption key is a data encryption key (DEK), the second encryption key is a wrapping replication key (WRK), and the operations further comprising:
encoding the DEK using the WRK to generate an encrypted DEK; and encoding a second WRK associated with a third data file to generate an encoded second WRK, and the encoding of the second WRK using a public key of the second database deployment.

19 . The system of claim 18 , the operations further comprising:
encoding the first data file to include the encrypted DEK, the encoded second WRK, and the public key of the second database deployment before the transmission of the plurality of data files.

20 . The system of claim 11 , the operations further comprising:
periodically regenerating the first encryption key and the second encryption key to generate an updated first encryption key and an updated second encryption key; encoding a configuration message for transmission to the second database deployment, the configuration message including the updated first encryption key and the updated second encryption key for decoding a subsequent transmission of the data stream.

21 . A computer-storage medium embodying instructions that, when executed by a machine of a first database deployment, cause the machine to perform operations comprising:
encoding database data in a first portion of a first data file of a plurality of data files, the encoding of the database data based on a first encryption key; encoding the first encryption key in a second portion of the first data file, the encoding of the first encryption key based on a second encryption key associated with a second data file of the plurality of data files; and causing transmission of the plurality of data files from the first database deployment to a second database deployment.

22 . The computer-storage medium of claim 21 , the op

Assignees

• Snowflake Inc

Inventors

• Gernhardt Robert Bengt Benedikt
• Kazhamiaka Mikhail
• Robinson Eric
• Weaver Rodney

Classifications

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L63/0281

  Proxies · CPC title

• G06F16/27 Primary

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title