Encryption Scheme in a Shared Data Store
AssigneeSap SE
InventorsJuergen Kremp, Klaus Kiefer, Uwe Bauer
Life of this patent
Estimating the term…
Abstract
An improved key encryption system is provided for encrypting sensitive data on a shared data store. Various embodiments contemplate a system where a plurality of data clients are connected to one or more shared data stores. A secure data storage facility is provided on one or more of the shared data stores by using an encryption scheme. Encryption keys for decrypting the sensitive data are stored on the same data store as sensitive data, which may be decrypted using the encryption keys. To provide another layer of security, the data encryption keys are themselves encrypted using a key encryption key (“KEK”), which is generated by, and stored in a local data store associated with the data clients.
Claims22
A method comprising:
- receiving a password at a first client instance of a plurality of client instances configured to access secure data stored on a shared data store;
- generating or receiving at the first client instance an encryption key for encrypting and decrypting the secure data;
- calculating a key encryption key (“KEK”) used to encrypt the encryption key, the KEK calculated based at least in part on the password;
- encrypting the encryption key with the KEK;
- generating a key element comprising the encrypted encryption key;
- transmitting the key element to the shared data store for storage thereon;
- and
- storing the KEK on a local data store of the first client instance.
A system comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium having computer instructions stored thereon, which when executed by the processor, causes the processor to perform operations comprising:
- receiving a password at a first client instance of a plurality of client instances configured to access secure data stored on a shared data store;
- generating or receiving at the first client instance an encryption key for encrypting and decrypting the secure data;
- calculating a key encryption key (“KEK”) used to encrypt the encryption key, the KEK calculated based at least in part on the password;
- encrypting the encryption key with the KEK;
- generating a key element comprising the encrypted encryption key;
- transmitting the key element to the shared data store for storage thereon;
- and
- storing the KEK on a local data store of the first client instance.
A non-transitory computer-readable storage medium having computer code stored thereon, which when executed by a computer, cause the computer to perform operations comprising:
- receiving a password at a client instance of a plurality of client instances configured to access secure data stored on a shared data store;
- generating or receiving at the client instance an encryption key for encrypting and decrypting the secure data;
- calculating a key encryption key (“KEK”) used to encrypt the encryption key, the KEK calculated based at least in part on the password;
- encrypting the encryption key with the KEK;
- generating a key element comprising the encrypted encryption key;
- transmitting the key element to the shared data store for storage thereon;
- and
- storing the KEK on a local data store of the client instance.
Dependencies are inferred from the claim text.