Oracle International Corporation

Srikant Krishnapuram Tirumalai

Amit Agarwal

Krishnakumar Sriramadhesikan

Jie Wang

Arun Theebaprakasam

Buddhika Kottahachchi

Himanshu Sharma

Ramaprakash Hosalli Sathyanarayan

Rohit Koul

Fannie Ho

Olaf Stullich

Xinnong Wang

Tuck Chang

Zhengming Zhang

An example method facilitates enabling Key Encryption Key (KEK) rotation for a running multi-tenant system without requiring system downtime or interruption. The example method facilitates decrypting a set of one or more DEKs using a preexisting KEK; using a new KEK to re-encode the DEKs using the new KEK, all while simultaneously enabling servicing of tenant requests. This is enabled in part, by strategic caching of tenant DEKs in a secure local memory, wherein the cached tenant DEKs are maintained in the clear and are readily accessible to running processes that are using the DEKs to decrypt and access tenant data, irrespective of the state of a background process used to implement the KEK rotation to the new KEK.

Key encryption key (KEK) rotation for multi-tenant (MT) system

A centralized framework for managing the data encryption of resources is disclosed. A data encryption service is disclosed that provides various services related to the management of the data encryption of resources. The services may include managing application policies, cryptographic policies, and encryption objects related to applications. The encryption objects may include encryption keys and certificates used to secure the resources. In an embodiment, the data encryption service may be included or implemented in a cloud computing environment and may provide a centralized framework for effectively managing the data encryption requirements of various applications hosted or provided by different customer systems. The disclosed data encryption service may provide monitoring and alert services related to encryption objects managed by the data encryption service and transmit the alerts related to the encryption objects via various communication channels.

Data encryption service

Techniques for brokering authorization between a user-facing service and a backend service are disclosed. A proxy service, operating independently of the user-facing service and the backend service, exposes an application programming interface (API) configured to receive requests from the user-facing services to perform functions of the plurality of backend services. The proxy service stores user authorization data that authorizes a user of a particular user-facing service to use a function of a backend service. The proxy service receives, via the API, a request to perform the function for an account associated with the user. Responsive to receiving to the request, the proxy service uses the user authorization data to access the backend service to perform the function for the account associated with the user.

Authorization proxy platform

Techniques are provided to manage security artifacts. Specifically, a security management system is disclosed for implementing security artifact archives to manage security artifacts. A security artifact archive may include information for managing one or more security artifacts that can be referenced or included in the security artifact archive. The security management system can create, edit, read, send, and perform other management operations for security artifact archives. Objects can be bundled in an object-specific security artifact archive. Security artifact archives may be named, versioned, tagged and/or labeled for identification. Security artifact archives may be transmitted to a destination (e.g., a service provider or a client system) that provides access to an object whose access is dependent on security artifacts. The destination may can manage access to the object using a security artifact archive that includes relevant and current security artifacts for the object.

Techniques for security artifacts management

Monitoring and alert services and data encryption management

Techniques for managing privileged accounts via a privileged access management service are provided. In some examples, the service may be configured with a plug-in framework for accessing secure resources. In some aspects, a log-in request that includes authentication information and corresponds to the service may be received. Session access to at least one secure resource may be provided when a user is authenticated. In some examples, a request to perform an action associated with the secure resource may be received during the session. Additionally, in some examples, the plug-in framework may be implemented to determine whether the user is allowed to perform the action. Further, performance of the action may be allowed or denied during the session based on the determination.

Privileged account plug-in framework&#x2014;usage policies

Data encryption service and customized encryption management

A keystore management system is provided that manages a keystore. The keystore management system creates a mapping of a plurality of keystore identity parameters to a plurality of keystore repository parameters. The keystore identity parameters identify the keystore. The keystore repository parameters identify a repository that stores the keystore. The keystore is a storage entity stored on the repository. The keystore management system further stores the mapping within a configuration file. The keystore management system further translates the keystore identity parameters into the keystore repository parameters based on the mapping stored within the configuration file.

Keystore management system

A keystore access system is provided that controls access to a keystore. The keystore access control system receives a request to access content of the keystore from a software application component. The keystore access control system applies a stored authorization policy to the request to determine whether access to the content of the keystore is granted. The keystore access system further grants the software application component access to the content of the keystore when it is determined that access to the content of the keystore is granted. The keystore access system further denies the software application component access to the content of the keystore when it is determined that access to the content of the keystore is not granted.

Growing community of inventors

Milpitas, CA, United States of America

Srikant Krishnapuram Tirumalai