Sap Se

Sap Ag

Juergen Kremp

Uwe Bauer

Klaus Kiefer

Andreas Riehl

Ralf Miko

Michael Belenki

The present disclosure involves systems, software, and computer implemented methods for access control delegation. One example method includes identifying creation of a derived entity from an originating entity. A definition of the derived entity is modified to include an association to the originating entity. A derived access control definition is created based on an originating access control definition. Access control condition(s) in the derived access control definition are identified. Modified access control condition(s) are created by modifying column reference(s) to include a reference to the association to the originating entity. A query is received for the derived entity. A modified query is created by including, in the received query, the modified access control condition(s) and unfolding the association to the originating entity. The modified query is executed, including evaluation of the modified access control condition(s) to determine records of the derived entity that are accessible to a query user.

Association-based access control delegation

Techniques of validating access controls within an application are disclosed. A validation test is performed by receiving test data comprising one or more privilege elements selected from a set of privilege elements representing a privilege scheme defined in an application. The test data and a data set are accessed. The application is executed using the data set according to the one or more privilege elements. A set of interaction indicators is generated representing interactions of the application with a portion of the data set. The set of interaction indicators is presented at a display device of a computing device.

Programmatic access control validation

Methods, systems, and computer-readable storage media for storing event data in an audit log file. Implementations include actions of receiving event data, determining a first signature based on the event data and an end marker, and appending the event data and the first signature to the audit log file, the first signature comprising at least a portion of a signature chain associated with the audit log file.

Integrity for security audit logs

An improved key encryption system is provided for encrypting sensitive data on a shared data store. Various embodiments contemplate a system where a plurality of data clients are connected to one or more shared data stores. A secure data storage facility is provided on one or more of the shared data stores by using an encryption scheme. Encryption keys for decrypting the sensitive data are stored on the same data store as sensitive data, which may be decrypted using the encryption keys. To provide another layer of security, the data encryption keys are themselves encrypted using a key encryption key ('KEK'), which is generated by, and stored in a local data store associated with the data clients.

Encryption scheme in a shared data store

An improved key encryption system is provided for encrypting sensitive data on a shared data store. Various embodiments contemplate a system where a plurality of data clients are connected to one or more shared data stores. A secure data storage facility is provided on one or more of the shared data stores by using an encryption scheme. Encryption keys for decrypting the sensitive data are stored on the same data store as sensitive data which may be decrypted using the encryption keys in question. To provide another layer of protection, the data encryption keys are themselves encrypted using a key encryption key (KEK), which is generated by, and stored in a local persistent data store associated with the data clients.

Shared encrypted storage

A cryptographic key for a client is generated at a server. The cryptographic key has a key identification and a corresponding key value. The key identification and the corresponding key value are presented to the client. A query of a portion less than the key value for the client is generated after the key identification and the corresponding key value are presented to the client. Entries from the client are received in response to the query. The cryptographic key is activated after the entries are validated.

Growing community of inventors

Walldorf, Germany

Juergen Kremp