Sap Se

Sap Ag

Matthias Buehl

Timm Falter

Gregor Tielsch

Igor Schukovets

Sylvia Scheu

Erich Schulzke

Boris Oliver Kneisel

Nils Hartmann

Roland Lucius

Juergen Denner

Anett Lippert

Methods, systems, and computer-readable storage media for receiving, by an AMS, a policy definition file defining policies to be enforced during execution of an instance of an application within the cloud platform, providing, by the AMS, an enhanced policy definition file indicating authorizations for roles for a policy of the policy definition file, providing an authentication bundle for execution of policy decisions at the instance, the authentication bundle provided based on the enhanced policy definition file, the authentication bundle distributed to application containers within the cloud platform, and during execution of the instance: transmitting, by the instance, an authorization request from the instance to an ADC, the ADC including an OPA and being executed within the container and executing policy decisions based on the authentication bundle, receiving, by the instance, a policy decision from the ADC and enforcing the policy based on the policy decision.

Unified authorization with data control language for cloud platforms

A system, method, and computer-readable medium, to receive a query specifying a result set of data from at least one database table; determine whether at least one column of the at least one database table is subject to a column-based authorization restriction; modify the query, in an instance it is determined that at least one column of the at least one database table is subject to a column-based authorization restriction, to restrict the result set of data in accordance with the column-based authorization restriction; and execute, in response to the modifying of the query, the modified query.

Column based data access controls

A system and method for encryption in a cloud computing platform with customer controlled keys is disclosed. A cloud-based encryption key is uploaded from a customer computing platform to a key store of the cloud computing platform, based on a customer-based encryption key. The cloud-based encryption key and customer-based encryption key is able to encrypt or decrypt customer data used by an application server running on the cloud computing platform. Next, the cloud-based encryption key is unlocked from the key store, and then stored in a secure store of a main memory associated with the customer computing platform. Then, according to encryption or decryption mechanism, the unlocked cloud-based encryption key is accessed to encrypt or decrypt customer data stored on a database of the main memory and used by the application server.

Encryption in the cloud with customer controlled keys

Various embodiments of systems and methods for pattern recognition of a distribution function are described herein. An influenced distribution function corresponding to an influenced attribute is compared with other distribution functions corresponding to other attributes. Based on the comparison, a correlation is determined between the influenced distribution function and an influencing distribution function from the other distribution functions. Based on the determination, a raw distribution function corresponding to an influenced attribute is extracted using the influenced distribution function and the influencing distribution function. The extracted raw distribution function and the influencing distribution function may be classified.

Pattern recognition of a distribution function

A method relates to access control of shared resources on computer systems that have diverse system policies for access rights to resources. The method includes, on a source computer system with which a target computer system shares a resource, preparing user-authorization data for the shared resource in a flat file format as data tuples, line records or tables. This format makes the user-authorization data usable in computer systems with diverse system policies for access rights to resources. The method further includes authorizing user access to the shared resource on the target computer system based on the user-authorization data prepared in flat file format by the source computer system.

Growing community of inventors

Heidelberg, Germany

Matthias Buehl