Systems and methods for securing data using encryption
Some embodiments of the present invention include an apparatus for securing data and include a processor, and one or more stored sequences of instructions which, when executed by the processor, cause the processor to set a data download threshold, encrypt data to be downloaded by a user based on detecting size of the data violating the download threshold such that the user receives encrypted downloaded data, and manage a decryption key used to decrypt the encrypted downloaded data. The decryption key may be deconstructed into “N” key fragments and may be reconstructed using “K” key fragments where “N” is equal to “2K−1”.
1. A computer-implemented method for securing data in an on-demand database system, the method comprising:
setting, by the database system, a data download threshold, the data download threshold enumerating a minimum size of data for which encryption is required;
determining, by the database system, a size of data requested to be downloaded by a user;
activating, by the database system, a data protection mode based on a determination that the size of the requested data violates the download threshold, the activation of the data protection mode including intercepting the data before the download starts, encrypting the intercepted data, and enabling the user to download the encrypted intercepted data;
managing, by the database system, a decryption key used to decrypt the encrypted downloaded data, the decryption key being: i) deconstructed into a plurality of unique key fragments and stored in distributed storage devices of a plurality of key holders, and ii) reconstructed from the plurality of key fragments; and
enabling, by the database system, the user to download the unencrypted data based on a determination that the size of the requested data does not violate the download threshold.
2. The method of claim 1 , wherein managing the decryption key further comprises:
providing, by the database system, the reconstructed decryption key based on verifying that the user is authorized to have access to a decrypted version of the downloaded data.
3. The method of claim 1 , wherein
reconstructing, the decryption key comprises using a subset of the key fragments from a subset of the key holders, wherein the subset of key fragments used to reconstruct the decryption key is less than the plurality of key fragments.
4. The method of claim 3 , where the plurality of key fragments is one less than twice the subset of key fragments.
5. The method of claim 4 , wherein the decryption key is reconstructed based on a first set of the subset of key fragments or based on a second set of the subset of key fragments.
6. The method of claim 5 , wherein all of the key fragments in the first set of the subset of key fragments are not similar to all of the key fragments in the second set of the subset of key fragments.
7. An apparatus for securing data in a multi-tenant database environment, the apparatus comprising:
a hardware processor; and
one or more stored sequences of instructions which, when executed by the processor, cause the processor to:
set a data download threshold, the data download threshold enumerating a minimum size of data for which encryption is required;
determine a size of data requested to be downloaded by a user;
activate a data protection mode based on a determination that the size of the data violates the download threshold, the activation of the data protection mode including intercepting the data before the download starts, encrypting the intercepted data, and enabling the user to download the encrypted intercepted data;
manage a decryption key used to decrypt the encrypted downloaded data, the decryption key being: i) deconstructed into a plurality of unique key fragments and stored in distributed storage devices of a plurality of key holders, and ii) reconstructed from the plurality of key fragments; and
enable the user to download the unencrypted data based on a determination that the size of the data does not violate the download threshold.
8. The apparatus of claim 7 , wherein managing the decryption key further comprises:
providing, by the database system, the reconstructed decryption key based on verifying that the user is authorized to have access to a decrypted version of the downloaded data.
9. The apparatus of claim 7 , wherein
reconstructing the decryption key comprises using a subset of the key fragments from a subset of the key holders, wherein the subset of key fragments used to reconstruct the decryption key is less than the plurality of key fragments.
10. The apparatus of claim 9 , where the plurality of key fragments is one less than twice the subset of key fragments.
11. The apparatus of claim 10 , wherein the decryption key is reconstructed based on a first set of the subset of key fragments or based on a second set of the subset of key fragments.
12. The apparatus of claim 11 , wherein all of the key fragments in the first set of the subset of key fragments are not similar to all of the key fragments in the second set of the subset of key fragments.
13. A computer program product comprising computer-readable program code to be executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code including instructions to:
set a data download threshold, the data download threshold enumerating a minimum size of data for which encryption is required;
determine a size of data requested to be downloaded by a user;
activate a data protection mode based on a determination that the size of the data violates the download threshold, the activation of the data protection mode including intercepting the data before the download starts, encrypting the intercepted data, and enabling the user to download the encrypted intercepted data;
manage a decryption key used to decrypt the encrypted downloaded data, the decryption key being: i) deconstructed into a plurality of unique key fragments and stored in distributed storage devices of a plurality of key holders, and ii) reconstructed from the plurality of key fragments; and
enable the user to download the unencrypted data based on a determination that the size of the data does not violate the download threshold.
14. The computer program product of claim 13 , wherein managing the decryption key further comprises:
providing, by the database system, the reconstructed decryption key based on verifying that the user is authorized to have access to a decrypted version of the downloaded data.
15. The computer program product of claim 13 , wherein
reconstructing, the decryption key comprises using a subset of the key fragments from a subset of the key holders, wherein the subset of key fragments used to reconstruct the decryption key is less than the plurality of key fragments.
16. The computer program product of claim 13 , where the plurality of key fragments is one less than twice the subset of key fragments.
17. The computer program product of claim 16 , wherein the decryption key is reconstructed based on a first set of the subset of key fragments or based on a second set of the subset of key fragments.
18. The computer program product of claim 17 , wherein all of the key fragments in the first set of the subset of key fragments are not similar to all of the key fragments in the second set of the subset of key fragments.