Sap Se

Sap Ag

Andreas Schaad

Florian Kerschbaum

Martin Haerterich

Axel Schroepfer

Mathias Kohler

Walter Tighzert

Isabelle Hang

Patrick Grofig

Mohammad Ashiqur Rahaman

Henrik Plate

Florian Hahn

Pascal T C Spadone

Yves Roudier

Methods, systems, and computer-readable storage media for optimizing query processing in encrypted databases. In some implementations, actions include receiving a query that is to be used to query an encrypted database, generating a plurality of query plans based on the query, each query plan including a local query and one or more remote queries, the local query being executable at a client-side and the one or more remote queries being executable at a server-side, selecting an optimal query plan from the plurality of query plans, providing one or more remote queries of the optimal query plan to the server-side for execution, receiving one or more remote results, and processing a local query of the optimal query plan and the one or more remote results to provide a final query result.

Local versus remote optimization in encrypted query processing

Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for predicting resource consumption in cloud infrastructures. Implementations include actions of receiving event data from one or more enterprise data sources, determining that an event associated with the event data is a known event, retrieving resource consumption information associated with the event, and providing a resource consumption schedule to a cloud infrastructure, the resource consumption schedule indicating resources expected to be consumed during execution of the event.

Enterprise data-driven system for predictive resource provisioning in cloud environments

Methods, systems, and computer-readable storage media for selecting columns for re-encryption in join operations. In some implementations, actions include determining a first column and a second column to be joined, receiving a first key corresponding to the first column and a second key corresponding to the second column, receiving a first rank associated with the first key and a second rank associated with the second key, selecting the second column for re-encryption based on the first rank and the second rank, and providing the first column, the second column, and the first key for performing a join operation, the second column being re-encrypted based on the first key.

Optimal re-encryption strategy for joins in encrypted databases

Methods, systems, and computer-readable storage media for enforcing access control in encrypted query processing. Implementations include actions of obtaining a set of user groups based on the user credential and a user group mapping, obtaining a set of relations based on the query, obtaining a set of virtual relations based on the set of user groups and the set of relations, receiving a first rewritten query based on the set of virtual relations and a query rewriting operation, encrypting the first rewritten query to provide an encrypted query, and transmitting the encrypted query to at least one server computing device over a network for execution of the encrypted query over access controlled, encrypted data.

Access control for encrypted query processing

Methods, systems, and computer-readable storage media for proxy re-encryption of encrypted data stored in a first database of a first server and a second database of a second server. Implementations include actions of receiving a first token at the first server from a client-side computing device, providing a first intermediate re-encrypted value based on a first encrypted value and the first token, transmitting the first intermediate re-encrypted value to the second server, receiving a second intermediate re-encrypted value from the second server, the second intermediate re-encrypted value having been provided by encrypting the first encrypted value at the second server based on a second token, providing the first encrypted value as a first re-encrypted value based on the first intermediate re-encrypted value and the second intermediate re-encrypted value, and storing the first re-encrypted value in the first database.

Adjustable proxy re-encryption

Methods, systems, and computer-readable storage media for secure storage of and selective access to encrypted audit data. Implementations include actions of receiving a set of audit data in response to occurrence of an incident, determining a set of static audit data and a set of dynamic audit data based on the set of audit data, encrypting items in the set of static audit data using a first attribute-based encryption scheme to provide a set of encrypted static audit data, and items in the set of dynamic audit data using a second attribute-based encryption scheme to provide a set of encrypted dynamic audit data, and transmitting the set of encrypted static audit data and the set of encrypted dynamic audit data to an off-premise database for storage and selective access.

Automatically generate attributes and access policies for securely processing outsourced audit data using attribute-based encryption

Methods, systems, and computer-readable storage media for selecting columns for selecting encryption to perform an operator during execution of a database query. Implementations include actions of determining a current encryption type of a column that is to be acted on during execution of the database query, the column storing encrypted data, determining a minimum encryption type for performance of the operator on the column, selecting a selected encryption type based on the current encryption type, the minimum encryption type, and a budget associated with the column, and performing the operator based on the selected encryption type.

Searchable encryption for infrequent queries in adjustable encrypted databases

Embodiments relate to processing encrypted data, and in particular to identifying an appropriate layer of encryption useful for processing a query. Such identification (also known as the onion selection problem) is achieved utilizing an adjustable onion encryption procedure. Based upon defined requirements of policy configuration, alternative resolution, and conflict resolution, the adjustable onion encryption procedure entails translating a query comprising an expression in a database language (e.g. SQL) into an equivalent query on encrypted data. The onion may be configured in almost arbitrary ways directing the onion selection. An execution function introduces an execution split to allow local (e.g. client-side) query fulfillment that may otherwise not be possible in a secure manner on the server-side. A searchable encryption function may also be employed, and embodiments accommodate aggregation via homomorphic encryption. Embodiments may be implemented as an in-memory column store database system.

Encrypted in-memory column-store

Embodiments provide ideal security, order-preserving encryption (OPE) of data of average complexity, thereby allowing processing of the encrypted data (e.g. at a database server in response to received queries). Particular embodiments achieve high encryption efficiency by processing plaintext in the order preserved by an existing compression dictionary already available to a database. Encryption is based upon use of a binary search tree of n nodes, to construct an order-preserving encryption scheme having &#x3a9;(n) complexity and even O(n), in the average case. A probability of computationally intensive updating (which renders conventional OPE impractical for ideal security) is substantially reduced by leveraging the demonstrated tendency of a height of the binary search tree to be tightly centered around O(log n). An embodiment utilizing such an encryption scheme is described in the context of a column-store, in-memory database architecture comprising n elements. OPE according to embodiments is compatible with adjustable encryption approaches.

Average-complexity ideal-security order-preserving encryption

A system to manage a workflow includes a workflow model having a version, the version being executable by an execution engine as a specific workflow instance. The system includes a workflow data monitor to receive and associate audit information with an object processed by an execution engine in terms of the specific instance of the workflow model.

Decentralised audit system in collaborative workflow environment

A method to implement controls with respect to a collaborative workflow, the method including mapping a private task of a private workflow of a first entity to a public task of a public collaborative workflow, and defining a public control relating to the public task, the public task and the public control to be published to a second entity with which the first entity collaborates utilizing the public collaborative workflow.

Controls in collaborative workflow environment

The present disclosure is directed to comparing a first structured data document to a second structured data document, including receiving the first and second structured data documents as first and second encrypted documents, respectively, comparing nodes of the first encrypted document to nodes of the second encrypted document, a content and a location of each of the nodes remaining confidential during the comparing, generating matched pairs of nodes based on the comparing, and storing the matched pairs in computer memory, each matched pair comprising a node of the first encrypted document and a corresponding node of the second encrypted document, determining one or more edit operations based on the matched pairs, and generating an edit script comprising the one or more edit operations, the edit script being executable to transform the first encrypted document to provide a transformed encrypted document that is isomorphic to the second encrypted document.

Comparing encrypted documents having structured data

Document collaboration may be implemented by executing an access interest specification phase. The access interest specification phase may include receiving access requests from collaboration participants for access to a document instance, the access requests specified using a document schema of the document instance and referencing at least one schema portion for access to a corresponding document instance portion based thereon, determining a common access interest group of the collaboration participants, based on the access requests, access credentials of the collaboration participants, and on an access control policy specified in terms of the access credentials, and providing a control data block to the participants of the common access interest group including information for generating a common secret key that is common to the participants of the common access interest group. The document collaboration may further be implemented by executing a collaboration phase. The collaboration phase execution may include encrypting the document instance portion using the access control policy, and providing access to the document instance for access to the document instance portion by an accessing participant of the common access interest group, the access including decryption of the document instance portion using the common secret key.

Distributed access control for document centric collaborations

A method to revoke a task includes receiving task data, the task data including information regarding a task to be performed. The method further includes receiving delegation data, the delegation data including information identifying a delegator of the task and a delegatee to perform the task. The method further includes receiving revocation task data, with the revocation task data having as its object at least aspects of the task.

Growing community of inventors

Karlsruhe, Germany

Andreas Schaad