Data protection management system compliant identification handling
AssigneeSap SE
InventorsUdo Klein, Michael Kusber
Life of this patent
Estimating the term…
Abstract
An alias key is generated for each person identification (ID) in a database table. The alias key us used to lookup the corresponding person ID in the database table. In addition, for each alias key, a temporary alias key is generated that is used to lookup the corresponding alias key in the database table. A plurality of queries are received from at least one remote client that each specify at least one of the temporary alias keys. Data is later transmitted to the at least one remote client that is responsive to the queries. Related apparatus, systems, techniques and articles are also described.
Claims19
A method for protecting sensitive data in a database comprising:
- first generating, for each person identification (ID) in a database table, an alias key used to lookup the corresponding person ID in the database table by:
- inputting a different secure random number assigned to each alias key with a concatenation of padding and the corresponding alias key into an encryption function;
- second generating, for each alias key, a temporary alias key used to lookup the corresponding alias key in the database table;
- receiving, from at least one remote client, a plurality of queries that each specify at least one of the temporary alias keys;
- and
- transmitting data responsive to the plurality of queries to the at least one remote client;
- wherein the padding comprises a time stamp indicating a validity window for the corresponding temporary alias key.
A system for protecting sensitive data in a database comprising:
- at least one programmable data processor;
- and
- memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
- first generating, for each person identification (ID) in a database table, an alias key used to lookup the corresponding person ID in the database table by:
- inputting a different secure random number assigned to each alias key with a concatenation of padding and the corresponding alias key into an encryption function;
- second generating, for each alias key, a temporary alias key used to lookup the corresponding alias key in the database table;
- receiving, from at least one remote client, a plurality of queries that each specify at least one of the temporary alias keys;
- and
- transmitting data responsive to the plurality of queries to the at least one remote client;
- wherein the padding comprises a time stamp indicating a validity window for the corresponding temporary alias key.
A non-transitory computer program product storing instructions which, when executed by at least one programmable data processor forming part of at least one computing system, result in operations comprising:
- first generating, for each person identification (ID) in a database table, an alias key used to lookup the corresponding person ID in the database table by:
- inputting a different secure random number assigned to each alias key with a concatenation of padding and the corresponding alias key into an encryption function;
- second generating, for each alias key, a temporary alias key used to lookup the corresponding alias key in the database table;
- receiving, from at least one remote client, a plurality of queries that each specify at least one of the temporary alias keys;
- and
- transmitting data responsive to the plurality of queries to the at least one remote client;
- wherein the padding comprises a time stamp indicating a validity window for the corresponding temporary alias key.
Dependencies are inferred from the claim text.