Methods, systems, and computer programs (database hierarchical encryption for hybrid cloud environments)

Abstract

To disclose techniques for hierarchical encryption for data storage in one or a plurality of embodiments.SOLUTION: Techniques include parsing an electronic database storage request on the basis of syntax of the request to identify a plurality of request elements and determining, using one or a plurality of trained machine learning (ML) models, one or a plurality of levels of necessity for protection associated with the plurality of request elements. The techniques further include identifying one or a plurality of encryption techniques for the plurality of request elements based on the basis of one or the plurality of levels of necessity for protection, encrypting data associated with the database storage request using the identified one or the plurality of encryption techniques, and storing the encrypted data and one or a plurality of associated encryption keys in an electronic database, using the electronic database storage request.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention relates to data security, and more particularly to hierarchical encryption for data storage. Data security is a highly difficult and important issue. Data encryption for data storage is generally selected by a customer (e.g., during the design stage) and often uses a single or static encryption technique for each data set. However, in an actual data set, different data generally have different levels of data protection requirement. Applying a single or static encryption technique to each data set results in excessive encryption for some data, which consumes computing resources and degrades system performance, or results in insufficient encryption for other data, which may bring security risks.

Background Art

[0002] For example, in "Enhanced Security of PHR System in Cloud Using Prioritized Level Based Encryption" by D. Sangeetha et al. (hereinafter "Sangeetha"), a system for encrypting "Personal Health Records (PHRs)" that would otherwise require separate encryption techniques for text and image data is disclosed. (Sangeetha's Abstract) According to Sangeetha, "data classification into one of three "protection rings" is performed before storage." "Protection ring 3 corresponds to PHR files with a low criticality level. Protection ring 2 corresponds to PHR files with a medium criticality level. Protection ring 1 corresponds to PHR files with an extremely high criticality level." (Sangeetha, pp. 62-63) Prioritized level-based encryption techniques (PLBE) are applied to all data at each level. (Ibid., 58, 63) Encryption based on this predetermined level may be over-encrypted for some data, resulting in the consumption of computing resources and poor system performance, or it may be insufficiently encrypted for other data, potentially creating security risks. [Overview of the project] [Problems that the invention aims to solve]

[0003] Encryption based on these predetermined levels can be over-encrypted for some data, resulting in increased computing resources and degraded system performance, or it may be insufficiently encrypted for other data, potentially creating security risks. [Means for solving the problem]

[0004] The embodiment comprises a method. The method comprises the step of parsing an electronic database storage request based on the syntax of the request to identify a plurality of request elements. The method further comprises the step of determining one or more protection requirements associated with the plurality of request elements using one or more trained machine learning (ML) models. The method further comprises the step of identifying one or more encryption techniques for the plurality of request elements based on the one or more protection requirements. The method further comprises the step of encrypting the data associated with the database storage request using the identified one or more encryption techniques. The method further comprises the step of storing the encrypted data and one or more associated encryption keys in an electronic database using the electronic database storage request.

[0005] The embodiment further comprises a system having memory and a processor communicatively coupled to the memory, wherein the processor is configured to perform an operation. The operation includes parsing an electronic database storage request based on the syntax of the request to identify a plurality of request elements. The operation further includes determining one or more protection requirements associated with the plurality of request elements using one or more trained machine learning (ML) models. The operation further includes identifying one or more encryption techniques for the plurality of request elements based on the one or more protection requirements. The operation further includes encrypting the data associated with the database storage request using the identified one or more encryption techniques. The operation further includes storing the encrypted data and one or more associated encryption keys in an electronic database using the electronic database storage request.

[0006] Embodiments include a computer program product having a computer-readable storage medium in which computer-readable program code is embodied, the computer program product further comprising the computer program product being executable by one or more computer processors to perform an operation. The operation includes parsing an electronic database storage request based on the syntax of the request to identify a plurality of request elements. The operation further includes determining one or more protection requirements associated with the plurality of request elements using one or more trained machine learning (ML) models. The operation further includes identifying one or more encryption techniques for the plurality of request elements based on the one or more protection requirements. The operation further includes encrypting the data associated with the database storage request using the identified one or more encryption techniques. The operation further includes storing the encrypted data and one or more associated encryption keys in an electronic database using the electronic database storage request.

[0007] The embodiments described above offer numerous technical advantages. For example, existing encryption technologies may use a single or static encryption technique for data storage, which can result in over-encryption, consuming computational resources and degrading system performance, or insufficient encryption, leading to security risks. The embodiments described above can be used for hierarchical encryption for data storage, where data storage (e.g., database storage) encryption and decryption can be optimized in terms of performance, efficiency, and security.

[0008] Optionally, identifying the one or more cryptographic techniques in one or more of the embodiments described above involves identifying multiple different cryptographic techniques based on identifying multiple different protection requirements corresponding to the multiple requirements using the one or more trained ML models. This has the further advantage of classifying requirements with different protection requirements and applying a different cryptographic technique to each.

[0009] Optionally, the method or operation described above includes, for each requirement element, selecting an ML model from several different ML models based on the characteristics of the requirement element, and determining the protection requirement for each requirement element based on analyzing the requirement element using the respective selected ML model. This has the further advantage of determining the protection requirement for each requirement element using an appropriate ML model.

[0010] Optionally, the method or operation described above includes identifying multiple different cryptographic techniques for the database storage request based on the determined protection requirements corresponding to each request element, and encrypting the data using the identified multiple different cryptographic techniques. This has the advantage of applying multiple different cryptographic techniques to the request based on the determined protection requirements.

[0011] Optionally, identifying the one or more encryption techniques in one or more of the embodiments described above includes determining pairs of data elements and encryption techniques in the electronic database storage request based on providing one or more of the multiple request elements to the one or more trained ML models.

[0012] Optionally, in one or more of the embodiments described above, the electronic database storage request includes a data manipulation language (DML) statement, and parsing the electronic database storage request includes constructing a syntax tree from the electronic database storage request and using the syntax tree to identify the plurality of request elements.

[0013] Optionally, identifying the one or more encryption techniques in one or more of the embodiments described above includes determining the one or more encryption techniques based on analyzing the determined one or more protection requirements using one or more second ML models.

[0014] Optionally, identifying the one or more encryption techniques in one or more of the embodiments described above includes determining the one or more encryption techniques based on searching for the determined one or more protection requirements in a lookup table.

[0015] Optionally, the methods or operations described above include parsing an electronic database query to identify a plurality of query elements, determining one or more decoding techniques associated with the plurality of query elements, retrieving data from the electronic database using the electronic database query, and decoding the data using the determined one or more decoding techniques. Furthermore, optionally, determining the one or more decoding techniques associated with the plurality of query elements includes retrieving the one or more decoding techniques from an electronic catalog. [Brief explanation of the drawing]

[0016] [Figure 1] This document presents a computing environment for hierarchical encryption of data storage, according to one embodiment. [Figure 2] This document illustrates a hierarchical encryption controller according to one embodiment.

[0017] [Figure 3] It is a flowchart illustrating hierarchical encryption for data storage according to one embodiment.

[0018] [Figure 4A] It is a flowchart illustrating parsing of a hierarchical encryption request for data storage according to one embodiment.

[0019] [Figure 4B] It illustrates construction of a syntax tree for parsing a request according to one embodiment.

[0020] [Figure 5A] It is a flowchart illustrating classification of request elements for hierarchical encryption for data storage according to one embodiment.

[0021] [Figure 5B] It illustrates request elements for hierarchical encryption for data storage according to one embodiment.

[0022] [Figure 6A] It illustrates training and use of a machine learning (ML) model for classifying request elements for hierarchical encryption for data storage according to one embodiment.

[0023] [Figure 6B] It further illustrates training and use of an ML model for classifying request elements for hierarchical encryption for data storage according to one embodiment.

[0024] [Figure 6C] It shows a security matrix for hierarchical encryption for data storage according to one embodiment.

[0025] [Figure 7]This is a flowchart illustrating encryption for hierarchical encryption of data storage according to one embodiment.

[0026] [Figure 8] This is a flowchart illustrating decryption for hierarchical encryption of data storage according to one embodiment.

[0027] [Figure 9] This document illustrates a cloud computing environment in one embodiment.

[0028] [Figure 10] An abstraction model layer according to one embodiment is shown. [Modes for carrying out the invention]

[0029] As discussed earlier, existing encryption techniques that use a single or static encryption method for data storage have significant drawbacks. As a result, over-encryption can occur, which consumes computing resources and degrades system performance, or insufficient encryption can lead to security risks. This is especially true in cloud storage environments (e.g., public cloud storage, private cloud storage, hybrid cloud storage, or any other suitable cloud storage environment). In cloud environments, the amount of data stored is often very large, and unstructured data can be mixed with varying levels of sensitive information. This makes secure data storage extremely difficult.

[0030] One or more techniques disclosed herein can be used for hierarchical encryption for data storage, in which data storage (e.g., database storage) encryption and decryption can be optimized for performance, efficiency, and security. For example, it is possible to parse a database storage request and classify each element based on its possible protection needs. In one embodiment, one or more ML models can be used to classify each element. Furthermore, each element can be paired with an appropriate encryption technique. For example, for each element, one or more ML models can be used to identify an appropriate encryption technique based on its protection needs. Using the identified encryption technique, it is possible to encrypt data for secure storage and decrypt previously stored data.

[0031] Figure 1 shows a computing environment 100 for hierarchical encryption for data storage according to one embodiment. In one embodiment, the computing environment 100 facilitates both secure storage of data (e.g., storage of encrypted secure data) and secure retrieval of data (e.g., secure decryption of stored encrypted data). Starting with secure storage of data, a storage request 102 is provided to a request parser 112 in the data access layer 110. For example, the storage request 102 could be a database storage request for storing data in a suitable database (e.g., a Structured Query Language (SQL) request for storing data in a relational database).

[0032] In one embodiment, the request parser 112 receives a storage request 102 and parses the request into multiple elements. For example, the request parser 112 can parse a data manipulation language (DML) (e.g., SQL) statement and abstract it into multiple elements. This will be discussed further below with reference to Figures 3 and 4A and 4B.

[0033] In one embodiment, the request parser 112 then provides the parsed storage request 102 (e.g., parsed elements obtained from a DML statement) to the element classifier 114. The element classifier 114 can analyze the parsed storage request 102 and determine an appropriate encryption level for the storage request 102. This can be done for the entire storage request 102 (e.g., based on the parsed elements) or for each different parsed element of the storage request 102 (e.g., different elements of a DML statement). This will be discussed further below with reference to Figures 3 and 5A, 5B. Furthermore, in one embodiment, the element classifier 114 can determine one or more appropriate ML models for each parsed element of the storage request 102, and the ML models can infer an appropriate encryption level for the statement. This will be discussed further below with reference to Figures 6A to 6C.

[0034] Next, the element classifier 114 uses the data encryption service 122 within the data mediation layer 120 to encrypt the data for storage. For example, the element classifier 114 can identify one or more encryption techniques to use to encrypt the data identified in the storage request 102 (e.g., using an appropriate ML model). The data encryption service 122 can then encrypt the data using the identified encryption techniques. This will be discussed further below with reference to Figure 7.

[0035] In one embodiment, the data encryption service 122 then stores the encrypted data using the encryption data storage engine 132 and the encryption key storage engine 134 within the storage access layer 130. For example, the encryption data storage engine 132 can store the encrypted data in data storage 142. Data storage 142 can be any suitable data repository, including any suitable electronic database (e.g., relational database, graph database, or any other suitable electronic database), cloud storage location (e.g., public cloud storage location, private cloud storage location, hybrid cloud storage location, or any other suitable cloud storage location), on-premises cluster, or any other suitable data repository. The encryption key storage engine 134 can store encryption keys (e.g., used to encrypt data) in encryption key storage 144. In one embodiment, encryption key storage 144 can be a part of data storage 142 (e.g., a table in an electronic database). Alternatively, or in addition to that, encryption key storage 144 can be separated from data storage 142.

[0036] Returning to the data access layer 110, the environment 100 can also facilitate the secure retrieval of data (e.g., decryption of encrypted data). Queries 104 (e.g., DML queries) can be provided to the query engine 116. In one embodiment, the query engine 116 can identify encryption associated with stored data referenced in the query and decrypt the data using the data decryption service 124. For example, the query engine 116 can provide a query service to the user. The query engine 116 can parse the query string and optimize the query path (e.g., rewrite the query string). After the query results have been fetched, the query engine 116 can call the data decryption service 124 to decrypt the data. The data decryption service 124 can use the encryption data storage engine 132 to identify encrypted data in data storage 142, use the encryption key storage engine 134 to identify one or more encryption keys associated with the data in encryption key storage 144, and decrypt the data. This will be discussed further below with reference to Figure 8.

[0037] Figure 2 shows a hierarchical encryption controller 200 according to one embodiment. The hierarchical encryption controller 200 includes a processor 202, memory 210, and network components 220. The processor 202 generally retrieves and executes programming instructions stored in memory 210. The processor 202 can represent a single central processing unit (CPU), multiple CPUs, a single CPU with multiple processing cores, and a graphics processing unit (GPU) with multiple execution paths, etc.

[0038] The network component 220 includes components necessary for the hierarchical encryption controller 200 to interface with an appropriate communication network (for example, a communication network that interconnects various components of environment 100 shown in Figure 1, or that interconnects environment 100 with other computing systems). For example, the network component 220 may include a wired interface component, a WiFi interface component, or a cellular network interface component, and associated software. Although memory 210 is shown as a single entity, memory 210 may comprise one or more memory devices having memory blocks associated with physical addresses, such as random access memory (RAM), read-only memory (ROM), flash memory, or other types of volatile or non-volatile memory, or both.

[0039] Memory 210 generally contains program code for performing various functions related to the use of the hierarchical encryption controller 200. The program code is generally described as various functional "applications" or "modules" within memory 210, but alternative implementations may have various functions, combinations of functions, or both. Within memory 210, the request parser 112 facilitates parsing database storage requests, the element classifier 114 facilitates classifying the protection needs of various elements within the database storage request and identifying appropriate encryption techniques, the data encryption service 122 facilitates encrypting the data identified by the database storage request (e.g., by using encryption techniques identified using the element classifier 114), and the data decryption service 124 facilitates decrypting the stored encrypted data (e.g., identified by queries). This will be further discussed below with reference to Figures 3 to 8.

[0040] Although the hierarchical encryption controller 200 is presented as a single entity, in one embodiment, various components can be implemented using any suitable combination of physical services, cloud compute nodes, and storage locations, or any other suitable implementation form. For example, the hierarchical encryption controller 200 may be implemented using a server or a cluster of servers (e.g., maintained by a data owner). As another example, the hierarchical encryption controller 200 can be implemented using a combination of compute nodes and storage locations in a suitable cloud environment. For example, one or more components of the hierarchical encryption controller 200 can be implemented using a public cloud, private cloud, hybrid cloud, on-premises cluster, or any other suitable implementation form.

[0041] Figure 3 is a flowchart 300 illustrating hierarchical encryption for data storage according to one embodiment. In block 302, a request parser (e.g., the request parser 112 shown from Figure 1 to Figure 2) receives a request. In one embodiment, the request is a storage request (e.g., storage request 102 shown in Figure 1) for storing data in a suitable and secure storage location (e.g., for storing data in an encrypted format in a suitable electronic database). Alternatively, the request is a query (e.g., query 104 shown in Figure 1) for retrieving data from a suitable and secure storage location (e.g., for decrypting data stored in an encrypted format in a suitable electronic database).

[0042] In block 304, the requirements parser parses the requirements. In one embodiment, the requirements may be a suitable DML request (e.g., an SQL request), and the requirements parser parses the requirements based on their syntax. For example, the requirements parser can construct a syntax tree from the DML request and use the syntax tree to parse the requirements into various elements. This will be discussed further below with reference to Figures 4A and 4B.

[0043] In block 306, the element classifier determines whether the request is a query (e.g., the opposite of a storage request). This is just one example; any suitable software or hardware component can determine whether a request is a query (e.g., a request parser or any other suitable software or hardware component). If the request is not a query (e.g., it is a database storage request), the flow proceeds to block 308. If the request is a query, the flow proceeds to block 316.

[0044] In block 308, an element classifier (for example, element classifier 114 shown in Figures 1 and 2) classifies the protection needs of requirement elements (for example, memory requirement elements). For example, the element classifier can receive parsed DML requirements generated by the requirements parser in block 304. The element classifier can use these parsed elements to classify the protection needs of the entire requirement or of various requirement elements. For example, the element classifier can select an appropriate ML model for each requirement element and use the ML model to classify the protection needs of the requirement. This will be discussed further below with reference to Figures 5A and 5B.

[0045] In block 310, a data encryption service (for example, data encryption service 122 shown in Figures 1 and 2) matches encryption techniques to the request elements. For example, as will be discussed below with respect to Figures 5A and 5B, in one embodiment, an element classifier associates a security level (for example, a numerical security level) with each element in the request. The data encryption service can use this security level to determine an appropriate encryption technique for each request element. This will be discussed further below with respect to Figure 7.

[0046] In one embodiment, the data encryption service can select from various encryption technologies, and there is a trade-off between security and computational load and speed. For example, stronger encryption technologies provide greater security but require more computational resources and tend to take longer to encrypt and decrypt. Weaker encryption technologies offer slightly less security but require fewer computational resources and may take less time to encrypt and decrypt. In one embodiment, the data encryption service selects stronger encryption technologies for requirements with a higher security level and weaker encryption technologies for requirements with a lower security level.

[0047] In block 312, the data encryption service encrypts the data. In one embodiment, the data encryption service encrypts the data associated with the received request (e.g., the request received in block 302) using a selected encryption technique (e.g., selected in block 312). This generates encrypted ciphertext that replaces the data, which can be securely stored.

[0048] In block 314, the data encryption service stores encrypted data and encryption keys (or multiple encryption keys). For example, the data encryption service may store the ciphertext generated in block 312 in a suitable data storage (e.g., data storage 142 shown in Figure 1). The data storage may be a relational database, a graph database, another form of electronic database, or any other suitable storage repository. The data encryption service further stores the associated encryption keys or multiple encryption keys (e.g., if multiple encryption techniques are used). For example, the data encryption service may store the keys in a suitable encryption key storage (e.g., encryption key storage 144 shown in Figure 1).

[0049] Returning to block 306, if the request is a query, the flow proceeds to block 316. In block 316, a data decryption service (e.g., data decryption service 124 shown from Figure 1 to Figure 2) retrieves the protection needs of the query elements. For example, as discussed earlier for block 308, it is possible to classify database storage requests based on the protection needs of the request elements. In one embodiment, the protection needs of the entire storage request are classified based on the elements. Alternatively, or in addition to that, the protection needs of each of the various elements of the storage request are classified separately. In one embodiment, these classified protection needs are stored (e.g., in appropriate data storage) and retrieved by the data decryption service. This is just one example, and in one embodiment, the decryption techniques associated with each query element may be stored directly (e.g., in a catalog as discussed below for Figure 8). In this embodiment, the data decryption service skips block 316 and proceeds to block 318 instead.

[0050] In block 318, the data decryption service matches the classified query elements to decryption techniques. As discussed earlier with respect to block 310 and as discussed below with respect to Figure 7, when storing secure data, the data encryption service matches the request elements to one or more suitable encryption techniques. In one embodiment, the data decryption service identifies one or more encryption techniques related to the data requested by the query (for example, by using the protection requirements retrieved in block 316 or directly from the catalog). This is discussed further below with respect to Figure 8.

[0051] In block 320, the data decryption service retrieves one or more encryption keys related to the query. For example, the data decryption service can retrieve an encryption key from a suitable encryption key memory (e.g., encryption key memory 144 shown in Figure 1). This will also be discussed further below with respect to Figure 8.

[0052] In block 322, the data decryption service decrypts the data. For example, the data decryption service uses one or more encryption keys retrieved in block 318 to generate the original data from the stored ciphertext.

[0053] Figure 4A is a flowchart illustrating the parsing of a request for hierarchical encryption over data storage according to one embodiment. In one embodiment, Figure 4A corresponds to block 304 shown in Figure 3. In block 402, a request parser (e.g., the request parser 112 shown in Figures 1 and 2) constructs a syntax tree from the request (e.g., the DML request received in block 302 shown in Figure 3) and parses the request based on its syntax.

[0054] For example, Figure 4B shows the construction of a syntax tree for parsing a request (e.g., an SQL request) according to one embodiment. In one embodiment, request 452 attempts to insert the values ​​(1,2) at position (COL1,COL2) in table FOO. In one embodiment, this request adds a new row to table FOO with value 1 as COL1 and value 2 as COL2.

[0055] It is possible to parse this request 452 and generate a syntax tree using a graphical representation 460 and a textual representation 470. As shown in the figure, the request body contains an SQL statement which contains three elements: an INSERT element, an INTO element, and a Value element. The INSERT element is the action. The INTO element specifies the target location, which in this case is COL1 and COL2 of table FOO. The Value element specifies the value to be inserted, which in this case is the decimal value 1 and 2. In one embodiment, this is shown using a graphical representation 460 and a textual representation 470 of the syntax tree.

[0056] Returning to Figure 4A, in block 404, the requirements parser extracts column elements using the syntax tree. For example, using the example shown in Figure 4B, the requirements parser can extract column elements COL1 and COL2 for table FOO from requirement 452. In block 406, the requirements parser provides the column elements to the classification service for classification (for example, to determine the protection need level for the column elements). This will be discussed further below with respect to Figures 5A and 5B.

[0057] Figure 5A is a flowchart illustrating the classification of request elements for hierarchical encryption of data storage according to one embodiment. In one embodiment, Figure 5A corresponds to block 306 shown in Figure 3. In block 502, an element classifier (e.g., element classifier 114 shown in Figures 1 and 2) identifies the extracted elements. For example, the element classifier can receive a request (e.g., a storage request 102 or query 104 shown in Figure 1) that has been parsed by a request parser (e.g., as discussed earlier for Figures 4A and 4B). The element classifier can identify the extracted elements within the parsed request (e.g., extracted using the syntax tree shown in Figure 4B). These may include various elements of a DML request (e.g., an SQL request), including operations, column and row identifiers, values, and any other appropriate elements.

[0058] In block 504, the element classifier selects a corresponding ML model for the risk assessment. For example, as discussed below with respect to Figures 6A to 6C, it is possible to train multiple ML models to identify the level of protection needed for a given requirement element (e.g., a given element parsed within a DML statement). In one embodiment, it is possible to train an ML model to identify the level of protection needed for each element in the requirement, or for any subset of elements in the requirement. Alternatively, or in addition to the above, it is also possible to train an ML model to identify the level of protection needed for the entire requirement.

[0059] In one embodiment, the element classifier can select an appropriate ML model for various elements. For example, the element classifier can select an appropriate ML model based on the characteristics of the element or any other appropriate factor. The element classifier can use any appropriate characteristics, including the type of element (e.g., operation, column identifier, row identifier, value), the content of the element (e.g., column name), the data type of the element (e.g., floating-point, blob, etc.), the frequency of access to the element, the owner of the element (e.g., user level), the data length of the element, the communication method for the element (e.g., encrypted or unencrypted communication), the data source for the element (e.g., private cloud, public cloud, etc.), or the type of operation (e.g., GRANT, REVOKE, UPDATE, INSERT, etc.). These are merely examples, and the element classifier can use any appropriate technique.

[0060] In block 506, the element classifier can identify the cryptographic technique for an element. In one embodiment, the corresponding cryptographic technique can also be identified using the ML model identified in block 504. For example, as discussed below with respect to Figures 6A to 6C, it is possible to train the ML model to identify both the protection need level for an element and the corresponding cryptographic technique. Alternatively, or in addition to that, the ML model identified in block 504 can also identify the protection need level for one or more elements, and the element classifier can use that identified protection need level to identify the corresponding cryptographic technique. For example, the element classifier can also infer the cryptographic technique from the identified protection need using an additional ML model. Alternatively, or in addition to that, the element classifier can also use a lookup table or any other suitable technique.

[0061] Figure 5B shows a requirement element 540 for hierarchical encryption for data storage according to one embodiment. As discussed earlier, an element classifier (e.g., the element classifier 114 shown in Figures 1 and 2) classifies the requirement elements using a number of factors. In one embodiment, the element classifier can identify the protection requirement for each requirement element. Furthermore, in one embodiment, the element classifier can also identify a corresponding encryption algorithm for an element (e.g., based on the protection requirement and other factors).

[0062] For example, as shown in Figure 5B, the element classifier can use column names as factors to determine the level of protection needed for an element. A column name like "User ID" might suggest that the element is not highly sensitive (e.g., because User ID is public), while columns like "Salary" or "Date of Birth" might suggest that the element is highly sensitive (e.g., because this information is not public). Furthermore, data types (e.g., Short int, float, Char, date, etc.) can also be used as factors along with access frequency, owner, data length, communication method, data source, and database operation. In one embodiment, these factors are used to determine the level of protection needed for an element.

[0063] Alternatively, or in addition to the above, it is also possible to use the factors described above to determine an appropriate encryption technique assigned a high level of protection need. For example, different encryption techniques require different levels of computing resources. Two elements may both be considered to have a high level of protection need, but they may have very different access frequencies. The element with the higher access frequency can be associated with an encryption technique that requires fewer resources (for example, to conserve computing resources through frequent access), and the element with the lower access frequency can be associated with an encryption technique that requires more resources.

[0064] Figure 6A illustrates the training and use of an ML model for classifying requirement elements for hierarchical encryption for data storage, according to one embodiment. Data elements 602, encryption techniques 604, and encryption context 606 are provided to the element classification ML model 610. In one embodiment, as discussed earlier with respect to Figures 4A to 4B, data elements 602 are parsed elements derived from the requirement. The encryption context 606 can identify contextual information about appropriate encryption techniques, including recognized encryption techniques, frequently used encryption techniques, vendors or providers of encryption techniques, or other relevant information.

[0065] In one embodiment, encryption technique 604 is a list of supported encryption techniques. Numerous encryption techniques can be used. For example, the Advanced Encryption Standard (AES) technique can be used. AES is commonly used and is very efficient in its 128-bit form (e.g., it requires little computation). However, AES also uses 192-bit and 256-bit keys for more demanding encryption purposes. AES is generally considered virtually immune to all attacks except brute-force attacks and has become more commonly used as a flagship standard for data encryption.

[0066] Triple DES is a successor to the original Data Encryption Standard (DES) algorithm, created in response to identified vulnerabilities in DES. Triple DES is a symmetric encryption method that has been very commonly used, but is becoming less so. Triple DES applies the DES algorithm three times to each data block and is commonly used for a variety of purposes, including encrypting UNIX® passwords and ATM PINs.

[0067] Blowfish is another cryptographic technique designed to replace DES. Blowfish is a symmetric tool that divides a message into multiple 64-bit blocks and encrypts them individually. Blowfish has established a reputation for speed, flexibility, and being virtually unbreakable. Blowfish is commonly found in e-commerce platforms, payment security, and password management tools.

[0068] TwoFish is a symmetric encryption technique that decrypts 128-bit data blocks. Furthermore, TwoFish encrypts data in 16 rounds, regardless of key size. TwoFish fits well into many software and hardware environments and is considered one of the fastest and most efficient techniques of its type. Many file and folder encryption software solutions today use this method.

[0069] Rivest-Shamir-Adleman (RSA) is an asymmetric encryption algorithm that utilizes the factorization of the product of two large prime numbers. Only a user who knows these two numbers can successfully decode the message. While digital signatures commonly use RSA, this algorithm generally slows down when encrypting large volumes of data. In one embodiment, a data encryption service may make a selection for each requested element between AES, Triple DES, Blowfish, Twofish, RSA, or any other suitable encryption technique.

[0070] In one embodiment, the element classification ML model 610 generates pairs 620 of data elements and encryption algorithms. The element classification ML model can use any suitable ML model, including decision trees, deep learning models, neural networks, or any other suitable ML model. In one embodiment, the element classification ML model 610 is a supervised ML model trained with suitable training data that reflects the data elements and corresponding encryption techniques. The element classification ML model 610 is discussed further with respect to Figure 6B.

[0071] Figure 6B further illustrates flow 650 for training and using an ML model to classify requirement elements for hierarchical encryption for data storage, according to one embodiment. In one embodiment, flow 650 illustrates one technique for using an ML model to classify requirement elements. This is merely an example, and any suitable technique can be used.

[0072] In block 654, the element classifier (for example, the element classifier 114 shown in Figures 1 and 2) receives one or more cryptographic techniques 604. The element classifier performs type vectorization on the cryptographic techniques 604, thereby generating one or more feature vectors that describe the algorithms. These feature vectors can be used by the ML model to infer pairs 620 of data elements and cryptographic techniques.

[0073] In block 656, the element classifier transforms the vector (e.g., the vector generated in block 654) using a default security matrix (e.g., the security matrix shown below in Figure 6C). In block 658, the element classifier classifies spatially adjacent vectors into several groups. In block 664, the element classifier uses the data element 602 and the cryptographic context 606 to map the most similar group (e.g., the cryptographic technique group) to the target data element 602. In block 670, the element classifier refines the groups by modifying the customized security matrix 668. In block 672, the element classifier evaluates the modeling of data element (DE) and cryptographic technique pairs and generates data element and cryptographic technique pairs 620.

[0074] Figure 6C shows a security matrix 680 for hierarchical encryption of data storage according to one embodiment. In one embodiment, each column item is associated with a corresponding security level (e.g., a numerical security level). The security levels can be used to identify appropriate encryption techniques. For example, a lower security level (e.g., "1" for the "Password" column) may indicate highly sensitive data suitable for a strong, computationally expensive level of encryption. A higher security level (e.g., "6" for the "Employment Date" column) may indicate less sensitive data suitable for a weaker, computationally inexpensive level of encryption, or even no encryption at all.

[0075] Figure 7 is a flowchart 700 illustrating encryption for hierarchical encryption of data storage according to one embodiment. In block 704, an element classifier (e.g., element classifier 114 shown in Figures 1 and 2) receives a request 702 (e.g., a DML storage request). In one embodiment, the element classifier provides the classified elements 706 to a data encryption service (e.g., a data encryption service 122 shown in Figures 1 and 2).

[0076] In block 708, the data encryption service matches the classified elements to encryption techniques (for example, as discussed earlier with respect to Figures 6A to 6C). Furthermore, in one embodiment, the data encryption service stores the encryption techniques corresponding to each element in a security catalog. The security catalog can be any suitable repository, including a database table, a remote storage location, or any other suitable repository. In one embodiment, the security catalog can be used during decryption to identify the encryption technique corresponding to each element. This will be discussed further below with respect to block 808 in Figure 8.

[0077] In block 710, the data encryption service determines whether the identified encryption technique is a symmetric key technique. If yes, the flow proceeds to block 712. In block 712, the data encryption service identifies the encryption key (e.g., a symmetric encryption key). If no, the flow proceeds to block 714. In block 714, the data encryption service identifies the secret encryption key. In both scenarios, the flow proceeds to block 716.

[0078] In block 716, the data encryption service encrypts the data. For example, the data encryption service can encrypt the data identified in 702 using the key generated in block 712 or 714 and the encryption technique identified in block 708, thereby generating ciphertext. In block 718, the data encryption service stores the ciphertext (for example, in response to request 702).

[0079] Figure 8 is a flowchart 800 illustrating decryption for hierarchical encryption over data storage according to one embodiment. In block 804, a request parser (e.g., request parser 112 shown in Figures 1 and 2) receives a query 802 (e.g., a DML query to retrieve previously encrypted data). The request parser generates a parsed query 806 (e.g., as discussed earlier for Figures 4A and 4B).

[0080] In block 808, the data decryption service (for example, data decryption service 124 shown in Figures 1 and 2) identifies the encryption technique for the parsed query. For example, as discussed earlier regarding block 708 in Figure 7, it is possible to store the technique corresponding to each element in a security catalog during encryption. The data decryption service can use this security catalog to identify the encryption technique corresponding to each element. For example, the security catalog may be a database table, and the data decryption service can retrieve the encryption technique for each element from the database table.

[0081] In block 810, the data decryption service matches the key with the encryption technique. For example, the data decryption service can identify the encryption key to be used to decrypt the data stored about the element. That key could be a public key, a symmetric key, or any other suitable encryption key. In block 812, the data decryption service decrypts the data (for example, the data identified in query 802) and generates plaintext 814.

[0082] The descriptions of various embodiments of the present invention are presented for illustrative purposes only and are not intended to be comprehensive or limitless to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the embodiments described. The terminology used herein has been selected to best describe the principles of the embodiments, the practical applications of the technology found in the market, or technical improvements thereto, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

[0083] The embodiments presented in this disclosure have been mentioned above. However, the scope of this disclosure is not limited to the specific embodiments described. Rather, any combination of features and elements, whether related to a different embodiment or not, is intended to implement and practice the intended embodiments. Furthermore, while the embodiments disclosed herein may achieve advantages over other possible solutions or over the prior art, whether or not a particular advantage is achieved by a given embodiment does not limit the scope of this disclosure. Therefore, the aspects, features, embodiments, and advantages discussed herein are merely illustrative and shall not be considered elements or limitations of the appended claims unless expressly stated in the claims. Similarly, the phrase “the present invention” shall not be construed as generalizing any of the subject matter disclosed herein and shall not be considered elements or limitations of the appended claims unless expressly stated in the claims.

[0084] All aspects of the present invention may take the form of a hardware-based embodiment, a software-based embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which may be generally referred to herein as “circuits,” “modules,” or “systems.”

[0085] The present invention may be a system, method, or computer program product, or a combination thereof, integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium (or a plurality of computer-readable storage media) having computer-readable program instructions for causing a processor to perform an aspect of the present invention.

[0086] A computer-readable storage medium can be a tangible device capable of holding and storing instructions used by an instruction execution device. A computer-readable storage medium may be, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exclusive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital multipurpose disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or grooved structures on which instructions are recorded, and any suitable combination of the above. In this specification, computer-readable storage media themselves are not considered to be radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or transient signals such as electrical signals transmitted through wires.

[0087] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device, or they may be downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives computer-readable program instructions from the network and transfers the computer-readable program instructions for storage in a computer-readable storage medium within each computing / processing device.

[0088] The computer-readable program instructions that perform the operation of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk® or C++, and procedural programming languages ​​such as the C programming language or similar programming languages. The computer-readable program instructions can run as a standalone software package in whole on the user's computer, in part on the user's computer, in part on the user's computer and in part on a remote computer, or in whole on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be to an external computer (for example, via the Internet using an Internet service provider). In some embodiments, for example, an electronic circuit including a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA) can be personalized by executing computer-readable program instructions using state information of computer-readable program instructions in order to perform an aspect of the present invention.

[0089] Aspects of the present invention are described herein with reference to flowcharts or block diagrams, or both, of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It will be understood that each block in a flowchart or block diagram, or both, and combinations of blocks in a flowchart or block diagram, or both, can be implemented by computer-readable program instructions.

[0090] These computer-readable program instructions may be provided to a computer processor or other programmable data processing device for generating a machine, thereby creating means for instructions executed via the computer processor or other programmable data processing device to implement functions / operations specified in one or more blocks in a flowchart or block diagram or a combination thereof. These computer-readable program instructions may also be stored in a computer-readable storage medium capable of instructing a computer, programmable data processing device, or other device, or a combination thereof, to function in a specific manner, thereby providing a product in which the computer-readable storage medium storing the instructions has instructions that implement modes of function / operations specified in one or more blocks of a flowchart or block diagram, or both.

[0091] Furthermore, computer-readable program instructions can also be loaded into a computer, other programmable data processing device, or other device to create a computer implementation process by executing a series of operational steps on the computer, other programmable device, or other device, thereby enabling the instructions executed on the computer, other programmable device, or other device to implement functions / operations specified in one or more blocks of a flowchart or block diagram, or both.

[0092] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions described in a block may be performed in an order different from the order shown in the drawing. For example, two blocks shown consecutively may actually be implemented as a single step, executed simultaneously, substantially simultaneously, partially or entirely in overlapping time, or these blocks may, depending on the functions involved, be executed in reverse order. It should also be noted that each block in a block diagram or flowchart, or both, and any combination of blocks in a block diagram or flowchart, or both, may be implemented by an application-specific hardware-based system that performs a specified function or operation, or a combination of application-specific hardware and computer instructions.

[0093] While this disclosure includes a detailed description of cloud computing, it should be understood that the implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment currently known or to be developed in the future.

[0094] Cloud computing is a service delivery model that enables convenient on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and deployed with minimal management effort or interaction with service providers. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0095] The following are its characteristics.

[0096] On-demand self-service: Cloud consumers can unilaterally provision computing power, such as server time and network storage, automatically as needed, without requiring human interaction with service providers.

[0097] Broad network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0098] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with dynamic allocation and reallocation of various physical and virtual resources according to demand. Consumers generally do not have control over, or knowledge of, the exact location of the resources provided, although they may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center), thus exhibiting location independence.

[0099] Rapid scalability: Capabilities can be provisioned quickly and flexibly, sometimes automatically, allowing for instant scaling out or rapid release and instant scaling in. For consumers, it often feels like there's unlimited capacity available for provisioning, and they can purchase any amount at any time.

[0100] Measuring Services: Cloud systems automatically control and optimize resource usage by leveraging metric capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage is monitored, controlled, and reported, thereby providing transparency to both service providers and consumers.

[0101] The following is the service model.

[0102] Software as a Service (SaaS): The capability offered to consumers is the use of a provider's applications running on cloud infrastructure. These applications are accessible from various client devices through thin client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities. However, limited user-specific application configuration settings may be an exception.

[0103] Platform as a Service (PaaS): The capability offered to consumers is the ability to deploy applications they have created or acquired, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they can control the deployed applications and, in some cases, the configuration of the application hosting environment.

[0104] Infrastructure as a Service (IaaS): The ability provided to consumers is the provisioning of processing, storage, networking, and other fundamental computing resources, allowing consumers to deploy and run any software, including operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but they can control the operating system, storage, and deployed applications, and in some cases, have limited control over selected networking components (e.g., host firewalls).

[0105] The deployment model is as follows:

[0106] Private Cloud: A cloud infrastructure operated exclusively for one organization. It can be managed by the organization or a third party and can reside on-premises or off-premises.

[0107] Community Cloud: A cloud infrastructure shared by several organizations to support a specific community with common interests (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can reside on-premises or off-premises.

[0108] Public cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0109] Hybrid cloud: A cloud infrastructure that combines two or more clouds (private, community, or public) where these clouds remain distinct entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing across clouds).

[0110] Cloud computing environments are service-oriented, emphasizing statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing lies an infrastructure that includes a network of interconnected nodes.

[0111] Referring now to Figure 9, an exemplary cloud computing environment 950 is shown. As shown in the figure, the cloud computing environment 950 includes one or more cloud computing nodes 910 that can communicate with local computing devices used by cloud consumers (e.g., a personal digital assistant (PDA) or cellular phone 954A, a desktop computer 954B, a laptop computer 954C, or an automotive computer system 954N, or a combination thereof). The nodes 910 can communicate with each other. They can be physically or virtually grouped (not shown) within one or more networks, such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above. This makes it possible for the cloud computing environment 950 to provide infrastructure, platform, or software, or both, as a service, without requiring cloud consumers to maintain resources on their local computing devices for that service. The types of computing devices 954A through 954N shown in Figure 9 are for illustrative purposes only, and it should be understood that the computing node 910 and the cloud computing environment 950 can communicate with any type of computerized device via any type of network, a network addressable connection, or both (for example, using a web browser).

[0112] Referring now to Figure 10, a set of functional abstraction layers provided by the cloud computing environment 950 (Figure 9) is shown. It should be understood that the components, layers, and functionalities shown in Figure 10 are for illustrative purposes only, and embodiments of the present invention are not limited thereto. As illustrated, the following layers and corresponding functionalities are provided:

[0113] The hardware and software layer 1060 includes hardware and software components. Examples of hardware components include a mainframe 1061; a RISC (Reduced Instruction Set Computer) architecture-based server 1062; a server 1063; a blade server 1064; a storage device 1065; and network and networking components 1066. In some embodiments, the software components include network application server software 1067 and database software 1068.

[0114] The virtualization layer 1070 provides an abstraction layer. From the abstraction layer, examples of the following virtual entities may be provided: virtual servers 1071; virtual storage 1072; virtual networks including virtual private networks 1073; virtual applications and operating systems 1074; and virtual clients 1075.

[0115] In one example, the management layer 1080 may provide the following functions: Resource provisioning 1081 dynamically procures computing and other resources used to perform tasks within the cloud computing environment. Measurement and pricing 1082 tracks costs as resources are used within the cloud computing environment and generates or sends invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security involves identity verification of cloud consumers and tasks, as well as protection of data and other resources. The user portal 1083 provides consumers and system administrators with access to the cloud computing environment. Service level management 1084 allocates and manages cloud computing resources to ensure that the required service levels are met. Service level agreement (SLA) formulation and execution 1085 pre-arranges and procures cloud computing resources that are expected to be needed in the future in accordance with the SLA.

[0116] The workload layer 1090 provides several functional examples. Cloud computing environments can be used for these functionalities. Examples of workloads and functionalities that can be provided from this layer include mapping and navigation 1091; software development and lifecycle management 1092; virtual classroom education provision 1093; data analysis processing 1094; transaction processing 1095; and hierarchical encryption 1096 (for example, implementing one or more aspects of the hierarchical encryption controller 110 shown in Figure 2, including any or all of the request parser 112, element classifier 114, data encryption service 122, and data decryption service 124).

[0117] While the foregoing description applies to embodiments of the present invention, other embodiments and further embodiments of the present invention can be conceived without departing from its basic scope, the scope of which is determined by the following claims.

[0118] While the foregoing description applies to embodiments of the present invention, other embodiments and further embodiments of the present invention can be conceived without departing from its basic scope, the scope of which is determined by the following claims.

Claims

1. A method performed by a computer, comprising the step of parsing a storage request to an electronic database based on the syntax of the storage request to the electronic database to identify a plurality of elements of the request; A step of determining one or more protection needs associated with the plurality of elements of the request using one or more trained machine learning (ML) models; A step of identifying each encryption technique for each of the multiple elements of the requirement based on the one or more protection requirements; The step of encrypting the data associated with the storage request to the electronic database using each of the identified encryption techniques; and The step of storing the encrypted data and one or more associated encryption keys in the electronic database using the storage request to the electronic database. A method for providing this.

2. The step of identifying each encryption technique for each of the multiple elements of the requirement based on one or more protection requirements, A step of determining one or more groups of encryption technologies comprising multiple available encryption technologies, wherein each group of encryption technologies includes one or more available encryption technologies having spatially adjacent feature vectors. The steps include mapping each of the multiple elements of the request to the corresponding encryption technology group based on the encryption context data, A step of evaluating each element and the corresponding encryption technology within the group of encryption technologies, The step of generating the aforementioned evaluated pair, The method according to claim 1, further comprising the step of selecting from the generated pairs each encryption technique for each of the multiple elements of the request.

3. The method according to claim 1, wherein the step of identifying each encryption technique comprises the step of identifying a plurality of different encryption techniques based on using one or more trained ML models to identify a plurality of different protection requirements corresponding to a plurality of elements of the requirement.

4. A method performed by a computer, comprising the steps of parsing a storage request to an electronic database based on the syntax of the storage request to the electronic database to identify a plurality of elements of the request; A step of determining one or more protection needs associated with the plurality of elements of the request using one or more trained machine learning (ML) models; A step of identifying one or more encryption techniques for multiple elements of the requirement based on the one or more protection requirements; The step of encrypting the data associated with the storage request to the electronic database using one or more of the identified encryption techniques; and A method comprising the step of storing the encrypted data and one or more associated encryption keys in the electronic database using a storage request to the electronic database, The step of determining one or more protection needs associated with the plurality of elements of the request using one or more trained machine learning (ML) models is: The step of selecting an ML model for each element of the requirement from a plurality of different ML models based on the characteristics of each element of the requirement; and A method comprising the step of determining the degree of protection required for each element of the requirement, based on analyzing each element of the requirement using each of the selected ML models.

5. The step of identifying a plurality of different encryption techniques for a storage request to the electronic database based on the degree of protection required for each element of the determined request, wherein the step of encrypting the data uses the plurality of different encryption techniques identified. The method according to claim 4.

6. The step of identifying each encryption technique is The method according to claim 1, further comprising the step of determining a pair of a data element in a storage request to the electronic database and an encryption technique based on providing one or more of the elements of the request to the one or more trained ML models.

7. The storage request to the electronic database includes a Data Manipulation Language (DML) statement, and the step of parsing the storage request to the electronic database is The step of constructing a syntax tree from the storage request to the aforementioned electronic database; and The method according to claim 1, further comprising the step of identifying a plurality of elements of the request using the syntax tree.

8. The step of identifying each encryption technique is The method according to claim 1, further comprising the step of determining each encryption technique based on analyzing one or more of the determined protection requirements using one or more second ML models.

9. The step of identifying each encryption technique is The method according to claim 1, further comprising the step of determining each encryption technique based on searching for one or more determined protection requirements in a lookup table.

10. The stage of parsing an electronic database query to identify multiple query elements; A step of determining one or more decoding techniques associated with the plurality of query elements; The step of retrieving data from the electronic database using the aforementioned electronic database query; and The step of decoding the data using one or more of the aforementioned decoding techniques. The method according to any one of claims 1 to 9, further comprising:

11. The step of determining one or more decoding techniques associated with the plurality of query elements is, The method according to claim 10, further comprising the step of retrieving one or more decoding techniques from an electronic catalog.

12. memory; and A processor that is communicatively coupled to the aforementioned memory. A system comprising, the processor, Parsing a storage request to an electronic database based on the syntax of the storage request to the electronic database, and identifying multiple elements of the request; Using one or more trained machine learning (ML) models, determine one or more protection needs associated with multiple elements of the request; Identifying each encryption technique for each of the multiple elements of the requirement based on the one or more protection requirements; Encrypting the data associated with the storage request to the electronic database using each of the identified encryption techniques; and Using the storage request to the electronic database, the encrypted data and one or more associated encryption keys are stored in the electronic database. A system configured to perform operations that include the following.

13. Identifying each encryption technique for each of the multiple elements of the requirement based on one or more protection requirements is: The determination of one or more groups of encryption technologies comprising multiple available encryption technologies, wherein each group of encryption technologies includes one or more available encryption technologies having spatially adjacent feature vectors. Based on the encryption context data, each element of the request is mapped to the corresponding encryption technology group. Evaluate each element and the corresponding encryption technology within the group of encryption technologies mentioned above, To generate the aforementioned evaluated pair, The system according to claim 12, further comprising selecting from the generated pairs each encryption technique for each of the multiple elements of the request.

14. The system according to claim 12, wherein identifying each encryption technique includes identifying a plurality of different encryption techniques based on using one or more trained ML models to identify a plurality of different protection requirements corresponding to a plurality of elements of the requirement.

15. Memory; and A processor that is communicatively coupled to the aforementioned memory. A system comprising, the processor, Parsing a storage request to an electronic database based on the syntax of the storage request to the electronic database, and identifying multiple elements of the request; Using one or more trained machine learning (ML) models, determine one or more protection needs associated with multiple elements of the request; Identifying one or more cryptographic techniques for multiple elements of the requirement based on the one or more protection requirements; Encrypting the data associated with the storage request to the electronic database using one or more of the identified encryption techniques; and A system configured to perform an operation that includes storing the encrypted data and one or more associated encryption keys in the electronic database using a storage request to the electronic database, Using one or more trained machine learning (ML) models to determine one or more protection needs associated with multiple elements of the request is: Selecting an ML model for each element of the requirement from a plurality of different ML models based on the characteristics of each element of the requirement; and A system comprising determining the level of protection required for each element of a requirement, based on analyzing each element of the requirement using each selected ML model.

16. The aforementioned operation, The system according to claim 15, further comprising identifying a plurality of different encryption techniques for a storage request to the electronic database based on the degree of protection required for each element of the request determined, and encrypting the data using the plurality of different encryption techniques identified.

17. Each encryption technology is specified as described above. The system according to any one of claims 12 to 14 and 16, comprising determining a pair of a data element and an encryption technique in a storage request to the electronic database based on providing one or more of the elements of the request to the one or more trained ML models.

18. One or more computer processors, Parsing a storage request to an electronic database based on the syntax of the storage request to the electronic database, and identifying multiple elements of the request; Using one or more trained machine learning (ML) models, determine one or more protection needs associated with multiple elements of the request; Identifying each encryption technique for each of the multiple elements of the requirement based on the one or more protection requirements; Encrypting the data associated with the storage request to the electronic database using each of the identified encryption techniques; and A computer program for causing a computer program to perform an operation that includes storing the encrypted data and one or more associated encryption keys in the electronic database using a storage request to the electronic database.

19. Identifying each encryption technique for each of the multiple elements of the requirement based on one or more protection requirements is: The determination of one or more groups of encryption technologies comprising multiple available encryption technologies, wherein each group of encryption technologies includes one or more available encryption technologies having spatially adjacent feature vectors. Based on the encryption context data, each element of the request is mapped to the corresponding encryption technology group. Evaluate each element and the corresponding encryption technology within the group of encryption technologies mentioned above, To generate the aforementioned evaluated pair, The computer program according to claim 18, further comprising selecting from the generated pairs each encryption technique for each of the multiple elements of the request.

20. The computer program according to claim 18, wherein identifying each encryption technique includes identifying a plurality of different encryption techniques based on using one or more trained ML models to identify a plurality of different protection requirements corresponding to a plurality of elements of the requirement.

21. One or more computer processors, Parsing a storage request to an electronic database based on the syntax of the storage request to the electronic database, and identifying multiple elements of the request; Using one or more trained machine learning (ML) models, determine one or more protection needs associated with multiple elements of the request; Identifying one or more cryptographic techniques for multiple elements of the requirement based on the one or more protection requirements; Encrypting the data associated with the storage request to the electronic database using one or more of the identified encryption techniques; and A computer program for causing an operation to be performed that includes storing the encrypted data and one or more associated encryption keys in the electronic database using a storage request to the electronic database, Using one or more trained machine learning (ML) models to determine one or more protection needs associated with multiple elements of the request is: Selecting an ML model for each element of the requirement from a plurality of different ML models based on the characteristics of each element of the requirement; and A computer program that includes determining the level of protection required for each element of the requirement, based on analyzing each element of the requirement using each selected ML model.

22. The aforementioned operation, The computer program according to claim 21, further comprising identifying a plurality of different encryption techniques for a storage request to the electronic database based on the degree of protection required for each element of the request determined, and encrypting the data using the plurality of different encryption techniques identified.

23. Each encryption technology is specified as described above. A computer program according to any one of claims 18 to 20 and 22, comprising determining a pair of a data element and an encryption technique in a storage request to the electronic database based on providing one or more of the elements of the request to the one or more trained ML models.

Images