US 12,719,832 B2Granted

Cloud comment storage using per-artifact key

AssigneeSap SE

InventorsSiddiq Ahmed Koona, Bharani Lingamaneni, Sahana Durgam Udaya

Life of this patent

Estimating the term…

Loading patent…

Abstract

Confidentiality and privacy of user comments are preserved by encryption of comments stored on the cloud. A migration engine and a crypto server including an encryption engine, are positioned behind a firewall from the cloud storage. In response to a comment migration instruction (e.g., •onboarding, •offboarding, or •key rotation), the migration engine performs batch processing across the firewall to retrieve a comment and comment metadata from the cloud storage. The migration engine forwards the comment/comment metadata behind the firewall to the crypto server. Based upon the comment metadata, the encryption engine uses a key for encrypting or decrypting the comment. Once encrypted or decrypted, the comment is returned to the migration engine for forwarding across the firewall and storage on the cloud. Encrypting or decrypting comments using a key determined from comment metadata, can impart flexibility to comment migration (e.g., allowing an administrator to selectively rotate compromised or expired keys).

Claims18

Dependent claims

A method performed by one or more computer systems located behind a network firewall, the method comprising:

receiving, from a user, a first instruction for performing a comment encryption onboarding operation, the comment encryption onboarding operation being configured to turn on encryption of comments created or provided by the user with respect to one or more software applications;
and
executing the comment encryption onboarding operation by:
determining a number of existing unencrypted comments created or provided by the user that are stored in unencrypted form in a database of a commenting service, the commenting service being located outside of the network firewall;
dividing the plurality of existing unencrypted comments into a first plurality of batches based on the determined number;
and
for each batch in the first plurality of batches:
requesting the batch from the commenting service, the batch including a subset of the existing unencrypted comments and associated metadata;
receiving the batch from the commenting service;
for each existing unencrypted comment in the batch:
generating a key based on the metadata associated with the existing unencrypted comment;
and
encrypting the existing unencrypted comment using the generated key, resulting in an encrypted comment;
and
transmitting the encrypted comments for the batch to the commenting service for storage in the database in encrypted form,
wherein after execution of the comment encryption onboarding operation is complete, all future comments created or provided by the user are encrypted prior to being sent to the commenting service for storage in the database.

13 more elements

A non-transitory computer readable storage medium embodying a computer program for performing, by one or more computer systems located behind a network firewall, a method comprising:

receiving, from a user, a first instruction for performing a comment encryption onboarding operation, the comment encryption onboarding operation being configured to turn on encryption of comments created or provided by the user with respect to one or more software applications;
and
executing the comment encryption onboarding operation by:
determining a number of existing unencrypted comments created or provided by the user that are stored in unencrypted form in a database of a commenting service, the commenting service being located outside of the network firewall;
dividing the plurality of existing unencrypted comments into a first plurality of batches based on the determined number;
and
for each batch in the first plurality of batches:
requesting the batch from the commenting service, the batch including a subset of the existing unencrypted comments and associated metadata;
receiving the batch from the commenting service;
for each existing unencrypted comment in the batch:
generating a key based on the metadata associated with the existing unencrypted comment;
and
encrypting the existing unencrypted comment using the generated key, resulting in an encrypted comment;
and
transmitting the encrypted comments for the batch to the commenting service for storage in the database in encrypted form,
wherein after execution of the comment encryption onboarding operation is complete, all future comments created or provided by the user are encrypted prior to being sent to the commenting service for storage in the database.

13 more elements

A computer system comprising:

one or more processors;
and
a software program executable on said computer system, the software program being configured to cause a processor of the one or more processors to:
receive, from a user, a first instruction for performing a comment encryption onboarding operation, the comment encryption onboarding operation being configured to turn on encryption of comments created or provided by the user with respect to one or more software applications;
and
execute the comment encryption onboarding operation by:
determining a number of existing unencrypted comments created or provided by the user that are stored in unencrypted form in a database of a commenting service, the commenting service being separated from the computer system by a network firewall;
dividing the plurality of existing unencrypted comments into a first plurality of batches based on the determined number;
and
for each batch in the first plurality of batches:
requesting the batch from the commenting service, the batch including a subset of the existing unencrypted comments and associated metadata;
receiving the batch from the commenting service;
for each existing unencrypted comment in the batch:
generating a key based on the metadata associated with the existing unencrypted comment;
and
encrypting the existing unencrypted comment using the generated key, resulting in an encrypted comment;
and
transmitting the encrypted comments for the batch to the commenting service for storage in the database in encrypted form,
wherein after execution of the comment encryption onboarding operation is complete, all future comments created or provided by the user are encrypted prior to being sent to the commenting service for storage in the database.

16 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/850,323Filed 27 Jun 2022
Published: US 2023/0421537 A128 Dec 2023
Granted: 25 Aug 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/0254
Filtering policies: stateful filtering
H04L 9/0894
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: escrow, recovery or storing of secret…
H04L 9/14
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using a plurality of keys…
H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…