Sap Se

Sap Ag

Sascha Zorn

Meinolf Block

Martin Schindewolf

Christian Mohr

Bjoern Friedmann

Christoph Hohner

Boris Gruschko

Martin Strenge

Florian Foebel

Martin Kittel

Holger Mack

Christian Bensberg

Mihnea Andrei

Dirk Thomsen

Thorsten Glebe

Yong Sik Kwon

Michael Muehle

Martin Heidel

Beomsoo Kim

Myung Sun Park

Patrick Voelker

Johannes Beigel

Fabian Garagnon

Christoph Höhner

Sergej Hardock

Andreas Hartel

The present disclosure relates to computer-implemented methods, software, and systems for the replication of secret keys between server nodes. Keys for encryption and decryption are persisted in a log file on a first database hosted on a primary server. The log file comprises data for executed database transactions at the first database and key management operations at a first key store. In response to triggering a synchronization between the primary server and a secondary server, a set of sequential entries of the log file are replayed at the secondary server from the first database. An execution of a transaction is replicated at a secondary database at the secondary server based on data for an entry at the log file and a key management operation associated with a key at the first key store that is persisted in another entry of the log file is replicated.

Synchronization of secret keys between multiple server instances

A database system includes a persistent storage system, a memory storing metadata defining a tenant object and a plurality of database artifacts, a first instance of the tenant object, the first instance associated with a first plurality of the database artifacts including first data associated with the first instance of the tenant object, and a second instance of the tenant object, the second instance associated with a second plurality of the database artifacts including second data associated with the second instance of the tenant object. A processing unit is to execute program code of a database instance to cause the database system to encrypt the first data associated with the first instance of the tenant object using a first public encryption key and store the encrypted first data in the persistent storage system, and encrypt the second data associated with the second instance of the tenant object using a second public encryption key and store the encrypted second data in the persistent storage system.

Native multi-tenant encryption for database system

The present disclosure involves systems, software, and computer implemented methods for database integration with an external key management system. One example method includes receiving, by a database system, a key encryption key from an external key management system external to the database system that is used to encrypt a data encryption key used to encrypt database data. The data encryption key is obtained, by the database system, using the key encryption key. Encrypted database data is decrypted, by the database system and using the data encryption key, to obtain decrypted database data before performing an operation on the decrypted database data. The database system determines that the external key management system has performed an operation on the key encryption key. In response to determining that the external key management system has performed the operation on the key encryption key, the database system modifies operation of the database system.

Database integration with an external key management system

The system described herein provides for storing the databases and encryption keys for decrypting the data in the databases into two separate partitions. In an embodiment, the first partition includes the databases while the second partition includes a configuration database and a payload database. The payload database stores a data encryption key for decrypting the data stored in the databases. The payload database is encrypted and may be decrypted using a body encryption key. The body encryption key itself is encrypted twice. In the first instance a key encryption key is generated and in the second instance a second access key is generated. The key encryption key or the second access key may be used to decrypt the body encryption key. The second access key is stored in a secure location, to be retrieved in situations when the key encryption key is inaccessible.

System and method for unlocking an encryption key chain without compromising security

A method, a system, and a computer program product for performing key management configurations. One or more encryption keys for encrypting one or more data payloads for accessing one or more databases are received. The received encryption keys are compared to a plurality of encryption keys associated with the databases. Based on the comparison, a configuration of at least one database is changed using the received encryption keys. The changed configuration is stored.

Key management configurations

Embodiments manage access to cryptography keys for database data, within a secure key store of a local key server owned by a new (security) operating system (OS) user separate from an original default OS user. Existing principles governing distinct OS user access privileges engrained within the OS itself, are leveraged to preclude the default OS user from accessing files of the new security OS user. Embodiments thus segregate the right to read secure cryptography keys of a secure key store, from the right to administer database installation on the OS level. While the original default OS user retains access to the encrypted data, the new security OS user now owns the cryptography key necessary to decrypt that database data. Thus, the default OS user is denied enough information to unlock the database data, enhancing its security. Embodiments are particularly useful for promoting data security in cloud setups and multi-tenant databases.

Secure database featuring separate operating system user

A system includes reception of a request to modify the data of a database, the request including first data, execution of processing to fulfill the request, determination, during execution of the processing, that a validation exit is associated with a current state of the processing, storage of the first data in a local temporary table in response to the determination, passage of the local temporary table to the validation exit, and execution of the validation exit to validate the first data based on the local temporary table and on the data of the database.

Validation of web-based database updates

Methods, systems, and apparatus, including computer program products, are provided for configuring access controls to a database. In one aspect there is provided a method. The method may include receiving, from a first user, a table declaration for creating a database table in a database; generating, based on the table declaration, the database table; receiving, from the first user, a specification of one or more access mechanisms that have a privilege to access the database table; receiving a designation of at least one column in the database table as a protected column and one or more users who have a privilege to access the content of the protected column; and providing control over access to the content of the protected column based at least in part on the specification of the one or more access mechanisms and the designation of the at least one column and the second user.

Column protection

A system includes acquisition of executable code of a database job, generation of a definition of the database job in a database repository, the definition of the database job comprising metadata specifying the executable code of the database job and a schedule for executing the executable code, association of a user with the database job, and activation of the database job.

Database job description and scheduling

A system for managing user-controlled security keys in cloud-based scenarios is provided. In some implementations, the system performs operations comprising receiving an information request from a user device via a network, and generating a database query based at least in part upon the information request. The operations can comprise generating a request for a secret key for decrypting encrypted data when the database query requests the encrypted data and/or generating a request for a secret key for encrypting data when the database query requests to encrypt data. The operations can also comprise providing the request to a security key management entity via a network, receiving secret key information from the security key management entity via the network, and using the secret key information to form decrypted data or encrypted data. Related systems, methods, and articles of manufacture are also described.

Managing user-controlled security keys in cloud-based scenarios

A system includes activation of an OData service exposing a parameterized database view, the OData service exposing a Parameter Entity Type and a Result Entity Type, wherein the Parameter Entity Type specifies one or more input parameters of the database view as properties of the Parameter Entity Type, and defines a Parameter Entity Type key formed by each of the one or more input parameters, and wherein the Result Entity Type specifies the one or more input parameters and one or more output of the database view as properties of the Result Entity Type, and defines a Result Entity Type key formed by each of the one or more input parameters and at least one of the one or more output parameters. Also included is reception of an OData request comprising a Uniform Resource Indicator, the Uniform Resource Indicator including the OData service, the Result Entity Type, and a value for each of one or more input parameters of the database view and for at least one of the one or more output parameters of the database view, and execution, in response to the request, of the OData service to return a single entity associated with the values.

Accessing single entities in OData entity sets

A system includes reception, from a first user, of a first web-protocol request to establish a first database server session, establishment of the first database server session in response to the first request, reception, from a second user, of a second web-protocol request to establish a second database server session and to communicate with the second database server session via a non-transient connection, establishment of the second database server session in response to the second request, reception, from the second user, of a third web-protocol request to attach the second database server session to the first database server session, attachment of the second database server session to the first database server session, and transmission of debugging information of the first database server session to the second user via the non-transient connection.

Web-based debugging of database sessions

A system includes reception of an instruction to commit a design-time artifact of a database server application to a repository of a database server, storage of the design-time artifact in the repository of the database server in association with an inactive flag, reception of a request from a user to access the design-time artifact associated with the inactive flag, and, in response to the request, generation of a private runtime representation of the design-time artifact associated with the inactive flag, and deployment of the private runtime representation of the design-time artifact for exclusive use by the user.

Testing of inactive design-time artifacts

A system includes reception of authorization information associated with one or more database server sessions of a first user, the authorization information associating the first user, a second user, and an authorization period, establishment of a first database server session of the first user, establishment of a second database server session of the second user, reception, from the second user, of a request to debug the first database server session, determination, based on the authorization information, that the second user is authorized to debug the first database server session, and, in response to the determination, attachment of the second database server session to the first database server session, and transmission of debugging information of the first database server session to the second user.

Security for debugging of database sessions

Techniques are described for providing sign-on within a trusted environment across multiple application servers. For example, a method can be provided for a single sign-on within a trusted environment across application servers. The method comprises, by a first application operating within the trusted environment, connecting to a first application server via a first access channel, and retrieving an authentication token from the first application server via the first access channel. The method further comprises, by a second application operating within the trusted environment, connecting to a second application server via a second access channel, and authenticating with the second application server with the authentication token.

Growing community of inventors

Schwetzingen, Germany

Sascha Zorn