# US 2023/0409731 A1 · Native multi-tenant encryption for database system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0409731 A1
- Document ID: US20230409731A1
- Status: Published application
- Kind: A1
- Application number: 17/968,136
- Filed: 2022-10-18
- Published: 2023-12-21
- Earliest claimed: 2022-06-16
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Patrick VOELKER; Holger MACK; Meinolf BLOCK; Thorsten GLEBE; Mihnea ANDREI; Yong Sik KWON; Dirk THOMSEN; Martin SCHINDEWOLF; Martin KITTEL; Myung Sun PARK; Beomsoo KIM; Martin HEIDEL; Christian BENSBERG; Fabian GARAGNON; Michael MUEHLE; Sergej HARDOCK; Johannes BEIGEL; Sascha ZORN; Christoph HOHNER; Andreas HARTEL
- Web page: https://patentgrep.com/patent/US20230409731A1

## CPC

- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 9/0822: {using key encryption key}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A database system includes a persistent storage system, a memory storing metadata defining a tenant object and a plurality of database artifacts, a first instance of the tenant object, the first instance associated with a first plurality of the database artifacts including first data associated with the first instance of the tenant object, and a second instance of the tenant object, the second instance associated with a second plurality of the database artifacts including second data associated with the second instance of the tenant object. A processing unit is to execute program code of a database instance to cause the database system to encrypt the first data associated with the first instance of the tenant object using a first public encryption key and store the encrypted first data in the persistent storage system, and encrypt the second data associated with the second instance of the tenant object using a second public encryption key and store the encrypted second data in the persistent storage system.

## Claims

### Claim 1

A database system comprising:
a persistent storage system;
a memory storing:
metadata defining a tenant object and a plurality of database artifacts;
a first instance of the tenant object, the first instance associated with a first plurality of the database artifacts including first data associated with the first instance of the tenant object; and
a second instance of the tenant object, the second instance associated with a second plurality of the database artifacts including second data associated with the second instance of the tenant object; and
a processing unit to execute program code of a database instance to cause the database system to:
encrypt the first data associated with the first instance of the tenant object using a first public encryption key and store the encrypted first data in the persistent storage system; and
encrypt the second data associated with the second instance of the tenant object using a second public encryption key and store the encrypted second data in the persistent storage system.

### Claim 2 (depends on 1)

A system according to claim 1, the program code executable to cause the database system to:
encrypt the metadata using a third public encryption key and store the encrypted metadata in the persistent storage system.

### Claim 3 (depends on 2)

A system according to claim 2, the program code executable to cause the database system to:
encrypt third data not associated with the first instance of the tenant object or the second instance of the tenant object using the third public encryption key and store the encrypted third data in the persistent storage system.

### Claim 4 (depends on 1)

A system according to claim 1, wherein encryption of the first data comprises encrypting data payloads of data pages of the first data and not encrypting header data of the data pages,
wherein the header data of the data pages includes an identifier associated with the first instance of the tenant object.

### Claim 5 (depends on 4)

A system according to claim 4, further comprising:
a key management system storing a first customer public key, a first customer private key corresponding to the first customer public key, a second customer public key and a second customer private key corresponding to the second customer public key; and
a secure store storing the first public encryption key, the second public encryption key, a first encrypted private encryption key corresponding to the first public encryption key and encrypted by the first customer public key, and a second encrypted private encryption key corresponding to the second public encryption key and encrypted by the second customer public key,
the program code executable to cause the database system to:
identify a plurality of the data pages of the stored encrypted first data;
determine the first private encryption key based on the identifier included in the header data of the plurality of the data pages; and
request the first private encryption key from the secure store,
wherein, in response to the request, the secure store transmits the first encrypted private encryption key to the key management system, the key management system decrypts the first encrypted private encryption key using the first customer private key and transmits the first private encryption key to the secure store, and the database instance decrypts a portion of the stored encrypted first data using the first private encryption key.

### Claim 6 (depends on 4)

A system according to claim 4, the program code executable to cause the database system to:
determine that the first customer private key has been revoked; and
in response to the determination, delete the data pages of the first data.

### Claim 7 (depends on 1)

A system according to claim 1, further comprising:
a key management system storing a first customer public key, a first customer private key corresponding to the first customer public key, a second customer public key and a second customer private key corresponding to the second customer public key; and
a secure store storing the first public encryption key, the second public encryption key, a first encrypted private encryption key corresponding to the first public encryption key and encrypted by the first customer public key, and a second encrypted private encryption key corresponding to the second public encryption key and encrypted by the second customer public key,
wherein, in response to a request from the database instance for the first private encryption key, the secure store transmits the first encrypted private encryption key to the key management system, the key management system decrypts the first encrypted private encryption key using the first customer private key and transmits the first private encryption key to the secure store, and the database instance decrypts a portion of the stored encrypted first data using the first private encryption key.

### Claim 8

A method comprising:
storing, in a memory:
metadata defining a tenant object and a plurality of database artifacts;
a first instance of the tenant object;
a first plurality of the database artifacts associated with the first instance and including first data associated with the first instance of the tenant object;
a second instance of the tenant object; and
a second plurality of the database artifacts associated with the second instance and including second data associated with the second instance of the tenant object; and
encrypting the first data associated with the first instance of the tenant object using a first public encryption key and storing the encrypted first data in a persistent storage system; and
encrypting the second data associated with the second instance of the tenant object using a second public encryption key and store the encrypted second data in the persistent storage system.

### Claim 9 (depends on 8)

A method according to claim 8, further comprising:
encrypting the metadata using a third public encryption key and storing the encrypted metadata in the persistent storage system.

### Claim 10 (depends on 9)

A method according to claim 9, further comprising:
encrypting third data not associated with the first instance of the tenant object or the second instance of the tenant object using the third public encryption key and storing the encrypted third data in the persistent storage system.

### Claim 11 (depends on 8)

A method according to claim 8, wherein encrypting the first data comprises encrypting data payloads of data pages of the first data and not encrypting header data of the data pages,
wherein the header data of the data pages includes an identifier associated with the first instance of the tenant object.

### Claim 12 (depends on 11)

A method according to claim 11, further comprising:
identifying a plurality of the data pages of the stored encrypted first data;
determining a first private encryption key based on the identifier included in the header data of the plurality of the data pages;
requesting the first private encryption key from a secure store,
transmitting, from the secure store, the first encrypted private encryption key to a key management system;
decrypting, by the key management system, the first encrypted private encryption key using a first customer private key stored by the key management system and transmitting the decrypted first private encryption key to the secure store; and
decrypting a portion of the stored encrypted first data using the first private encryption key.

### Claim 13 (depends on 11)

A method according to claim 11, further comprising:
determining that the first customer private key has been revoked; and
in response to the determination, deleting the data pages of the first data.

### Claim 14 (depends on 8)

A method according to claim 8, further comprising:
receiving a request for a plurality of the data pages of the stored encrypted first data;
determining a first private encryption key associated with the plurality of the data pages;
requesting the first private encryption key from a secure store,
transmitting, from the secure store, the first encrypted private encryption key to a key management system;
decrypting, by the key management system, the first encrypted private encryption key using a first customer private key stored by the key management system and transmitting the decrypted first private encryption key to the secure store; and
decrypting the plurality of the data pages of the stored encrypted first data using the first private encryption key.

### Claim 15

A non-transitory computer-readable medium storing program code executable by one or more processing units to cause a computing system to:
store, in a memory:
metadata defining a tenant object and a plurality of database artifacts;
a first instance of the tenant object;
a first plurality of the database artifacts associated with the first instance and including first data associated with the first instance of the tenant object;
a second instance of the tenant object; and
a second plurality of the database artifacts associated with the second instance and including second data associated with the second instance of the tenant object; and
encrypt the first data associated with the first instance of the tenant object using a first public encryption key and storing the encrypted first data in a persistent storage system; and
encrypt the second data associated with the second instance of the tenant object using a second public encryption key and store the encrypted second data in the persistent storage system.

### Claim 16 (depends on 15)

A medium according to claim 15, the program code executable by one or more processing units to cause a computing system to:
encrypt the metadata using a third public encryption key and store the encrypted metadata in the persistent storage system.

### Claim 17 (depends on 16)

A medium according to claim 16, the program code executable by one or more processing units to cause a computing system to:
encrypt third data not associated with the first instance of the tenant object or the second instance of the tenant object using the third public encryption key and store the encrypted third data in the persistent storage system.

### Claim 18 (depends on 15)

A medium according to claim 15, wherein encryption of the first data comprises encrypting data payloads of data pages of the first data and not encrypting header data of the data pages,
wherein the header data of the data pages includes an identifier associated with the first instance of the tenant object.

### Claim 19 (depends on 18)

A medium according to claim 18, the program code executable by one or more processing units to cause a computing system to:
identify a plurality of the data pages of the stored encrypted first data;
determine a first private encryption key based on the identifier included in the header data of the plurality of the data pages;
request the first private encryption key from a secure store,
transmit, from the secure store, the first encrypted private encryption key to a key management system;
decrypt, by the key management system, the first encrypted private encryption key using a first customer private key stored by the key management system and transmitting the decrypted first private encryption key to the secure store; and
decrypt a portion of the stored encrypted first data using the first private encryption key.

### Claim 20 (depends on 15)

A medium according to claim 15, the program code executable by one or more processing units to cause a computing system to:
receive a request for a plurality of the data pages of the stored encrypted first data;
determine a first private encryption key associated with the plurality of the data pages;
request the first private encryption key from a secure store,
transmit, from the secure store, the first encrypted private encryption key to a key management system;
decrypt, by the key management system, the first encrypted private encryption key using a first customer private key stored by the key management system and transmitting the decrypted first private encryption key to the secure store; and
decrypt the plurality of the data pages of the stored encrypted first data using the first private encryption key.