US 11,899,811 B2Granted

Processing data pages under group-level encryption

AssigneeSap SE

InventorDirk Thomsen

Life of this patent

Estimating the term…

Loading patent…

Abstract

Computer-readable media, methods, and systems are disclosed for encrypting and decrypting data pages in connection with a database employing group-level encryption. A request to load a group-level encrypted logical data page into main memory is received, the data page being identified by a logical page number. A block of group-level encrypted data is loaded into the main memory of the database system from an address corresponding to the physical block number. A block of group-level encrypted data is loaded into the main memory of the database system. A header associated with the block of group-level encrypted data is decrypted using a data-volume encryption key, and an encryption-group identifier is accessed from the decrypted header. A group-level encryption key is retrieved from a key manager, and the remainder of the block of group-level encrypted data is decrypted using the group-level encryption key.

Claims20

Dependent claims

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method for processing group-level encrypted logical data pages stored on a data volume in connection with a database employing group-level encryption, the method comprising:

based on a database operation requiring access to persisted database data, receiving a request to load a group-level encrypted logical data page into main memory of a database system, the group-level encrypted logical data page being identified by a logical page number;
obtaining a physical block number from a converter based on the logical page number, the converter comprising converter metadata having a value corresponding to an encryption group that the group-level encrypted logical data page belongs to,
wherein said group-level encrypted logical data pages stored in the data volume are associated with a plurality of tenants,
wherein each group-level encrypted logical data page comprises a page header and tenant data,
wherein the page header is encrypted with a data volume encryption key associated with the data volume,
wherein each tenant of the plurality of tenants is associated with a particular encryption group, and wherein the tenant data is encrypted with a group-level encryption key associated with the particular encryption group;
in response to obtaining the physical block number from the converter based on the logical page number, loading the group-level encrypted logical data page into the main memory of the database system, the group-level encrypted logical data page stored at a physical address corresponding to the physical block number within the data volume;
reading, by a data container, the group-level encrypted logical data page associated with the data container, wherein the data container is assigned to a particular encryption group and provides an encryption group identifier;
decrypting, using the data volume encryption key, the page header, wherein database internal operations are performed using the decrypted page header;
and
decrypting, using the encryption group identifier and the group-level encryption key, the group-level encrypted logical data page.

8 more elements

A method for processing group-level encrypted logical data pages stored on a data volume in connection with a database employing group-level encryption, the method comprising:

based on a database operation requiring access to persisted database data, receiving a request to load a group-level encrypted logical data page into main memory of a database system, the group-level encrypted logical data page being identified by a logical page number;
obtaining a physical block number from a converter based on the logical page number, the converter comprising converter metadata having a value corresponding to an encryption group that the group-level encrypted logical data page belongs to,
wherein said group-level encrypted logical data pages stored in the data volume are associated with a plurality of tenants,
wherein each group-level encrypted logical data page comprises a page header and tenant data,
wherein the page header is encrypted with a data volume encryption key associated with the data volume,
wherein each tenant of the plurality of tenants is associated with a particular encryption group, and wherein the tenant data is encrypted with a group-level encryption key associated with the particular encryption group;
in response to obtaining the physical block number from the converter based on the logical page number, loading the group-level encrypted logical data page into the main memory of the database system, the group-level encrypted logical data page stored at a physical address corresponding to the physical block number within the data volume;
reading, by a data container, the group-level encrypted logical data page associated with the data container, wherein the data container is assigned to a particular encryption group and provides an encryption group identifier;
decrypting, using the data volume encryption key, the page header, wherein database internal operations are performed using the decrypted page header;
and
decrypting, using the encryption group identifier and the group-level encryption key, the group-level encrypted logical data page.

8 more elements

A system comprising at least one processor and at least one non-transitory memory storing computer executable instructions that when executed by the processor cause the system to carry out actions for processing group-level encrypted logical data pages stored on a data volume in connection with a database employing group-level encryption comprising:

based on a database operation requiring access to persisted database data, receiving a request to load a group-level encrypted logical data page into main memory of a database system, the group-level encrypted logical data page being identified by a logical page number;
obtaining a physical block number from a converter based on the logical page number, the converter comprising converter metadata having a value corresponding to an encryption group that the group-level encrypted logical data page belongs to,
wherein said group-level encrypted logical data pages stored in the data volume are associated with a plurality of tenants,
wherein each group-level encrypted logical data page comprises a page header and tenant data,
wherein the page header is encrypted with a data volume encryption key associated with the data volume,
wherein each tenant of the plurality of tenants is associated with a particular encryption group, and wherein the tenant data is encrypted with a group-level encryption key associated with the particular encryption group;
in response to obtaining the physical block number from the converter based on the logical page number, loading the group-level encrypted logical data page into the main memory of the database system, the group-level encrypted logical data page stored at a physical address corresponding to the physical block number within the data volume;
reading, by a data container, the group-level encrypted logical data page associated with the data container, wherein the data container is assigned to a particular encryption group and provides an encryption group identifier;
decrypting, using the data volume encryption key, the page header, wherein database internal operations are performed using the decrypted page header;
and
decrypting, using the encryption group identifier and the group-level encryption key, the group-level encrypted logical data page.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/333,578Filed 28 May 2021
Published: US 2022/0382898 A11 Dec 2022
Granted: 13 Feb 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/6227
To a system of files or objects, e.g. local or distributed file system or database: where protection concerns the structure of data, e.g. records,…
G06F 12/08
Addressing or allocation; Relocation: in hierarchically structured memory systems, e.g. virtual memory systems
G06F 12/1408
Protection against unauthorised use of memory or access to memory: by using cryptography
G06F 12/1425
By checking the object accessibility, e.g. type of access defined by the memory independently of subject rights: the protection being physical,…