Workday, Inc.

Jasmine Teresa Schladen

Bjorn Brook Hamel

Amol Anant Deshmukh

Miguel Leonardo Chinchilla Cartagena

Marcus Anthony Sanchez

Karina Si-Woon Chan

Subha Gopalakrishnan

Atlee Glen Lyden

Devaki Ajinkya Tarkunde

Michael Clarke

Louis James LaTouche

Aswani Kaushik Chimthapalli

Harrison Yu

Ken Pugsley

Kathy Hansen

Jonathan Walsh

The present application discloses a method, system, and computer system for managing data using keys. The method includes receiving a request to access data, wherein the data is encrypted based on a tenant service encryption key (TSEK) corresponding to the tenant database, determining a wrapper key used in connection with encrypting the TSEK based on a TSEK metadata, determining a top-level key used in connection with encrypting the wrapper key based on wrapper key metadata stored in association with the encrypted version of the wrapper key, obtaining the data stored within the tenant database, comprising decrypting at least part of the data based on (i) the TSEK, (ii) the wrapper key, and (iii) the top-level key, and providing the data in response to the request. The TSEK metadata is stored in the tenant database. An encrypted version of the wrapper key is stored in a key management service.

Enabling using external tenant master keys

The present application discloses a method, system, and computer system for managing data using keys. The method includes receiving a request to access data stored within a tenant database associated with a tenant, wherein the data is encrypted based at least in part on a tenant service encryption key (TSEK) corresponding to the tenant database, determining a wrapper key used in connection with encrypting the TSEK based at least in part on a TSEK metadata stored in association with the TSEK, determining a top-level key used in connection with encrypting the wrapper key based at least in part on wrapper key metadata stored in association with the encrypted version of the wrapper key, obtaining the data stored within the tenant database, comprising decrypting at least part of the data based at least in part on (i) the TSEK, (ii) the wrapper key, and (iii) the top-level key, and providing the data in response to the request. The TSEK metadata is stored in the tenant database. An encrypted version of the wrapper key is stored in a key management service that is in communication with the tenant database.

A system for selective purging includes an interface and a processor. The interface is to receive a selection of one or more data types for selective purging. The processor is to walk through a data audit memory; and to selectively remove data based at least in part on the one or more data types.

Selective purging of data attributes

Growing community of inventors

Dublin, CA, United States of America

Jasmine Teresa Schladen