Encryption in the cloud with customer controlled keys

• US 8,938,622 B2
• Filed: 09/21/2012
• Issued: 01/20/2015
• Est. Priority Date: 09/21/2012
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Buehl, Matthias
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US13/624,069
• Publication Number:
  US 20140089674A1
• Time in Patent Office: 851 Days
• Field of Search: 713/171, 713/189, 713/193, 380/277, 380/281, 726/2
• US Class Current: 713/189
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819

Abstract

A system and method for encryption in a cloud computing platform with customer controlled keys is disclosed. A cloud-based encryption key is uploaded from a customer computing platform to a key store of the cloud computing platform, based on a customer-based encryption key. The cloud-based encryption key and customer-based encryption key is able to encrypt or decrypt customer data used by an application server running on the cloud computing platform. Next, the cloud-based encryption key is unlocked from the key store, and then stored in a secure store of a main memory associated with the customer computing platform. Then, according to encryption or decryption mechanism, the unlocked cloud-based encryption key is accessed to encrypt or decrypt customer data stored on a database of the main memory and used by the application server.

Claims

1. A method for encryption in a cloud computing platform with customer controlled keys, the method comprising:

uploading, from a customer computing platform to a key store of the cloud computing platform, a cloud-based encryption key based on a customer-based encryption key, the cloud-based encryption key and customer-based encryption key being able to encrypt or decrypt customer data used by an application server running on the cloud computing platform;

retrieving the customer-based encryption key stored on the customer computing platform;

unlocking, by one or more processors executing a key unlocking mechanism using the customer-based encryption key, the cloud-based encryption key from the key store;

storing, by one or more processors, the unlocked cloud-based encryption key in a secure store of a main memory associated with the customer computing platform; and

accessing, by one or more processors executing an encryption or decryption mechanism, the unlocked cloud-based encryption key to encrypt or decrypt customer data stored on a database of the main memory and used by the application server.

2. The method in accordance with claim 1, wherein the unlocking the cloud-based encryption key further includes:

unlocking the cloud-based encryption key from the key store using the customer-based encryption key.

3. The method in accordance with claim 1, wherein the accessing the unlocked cloud-based encryption key to encrypt or decrypt customer data further includes:

determining a relationship of the customer data with the cloud-based encryption key.

4. The method in accordance with claim 3, wherein the accessing the unlocked cloud-based encryption key to encrypt or decrypt customer data further includes:

accessing the unlocked cloud-based encryption key according to the relationship.

5. A computer program product comprising a non-transitory machine-readable medium storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising:

uploading, from a customer computing platform to a key store of the cloud computing platform, a cloud-based encryption key based on a customer-based encryption key, the cloud-based encryption key and customer-based encryption key being able to encrypt or decrypt customer data used by an application server running on the cloud computing platform;

retrieving the customer-based encryption key stored on the customer computer platform;

unlocking, according to a key unlocking mechanism using the customer-based encryption key, the cloud-based encryption key from the key store;

storing the unlocked cloud-based encryption key in a secure store of a main memory associated with the customer computing platform; and

accessing, according to an encryption or decryption mechanism, the unlocked cloud-based encryption key to encrypt or decrypt customer data stored on a database of the main memory and used by the application server.

6. A system comprising:

at least one programmable processor; and

a machine-readable medium storing instructions that, when executed by the at least one processor, cause the at least one programmable processor to perform operations comprising;

uploading, from a customer computing platform to a key store of the cloud computing platform, a cloud-based encryption key based on a customer-based encryption key, the cloud-based encryption key and customer-based encryption key being able to encrypt or decrypt customer data used by an application server running on the cloud computing platform;

retrieving the customer-based encryption key stored on the customer computing platform;

unlocking, according to a key unlocking mechanism using the customer-based encryption key, the cloud-based encryption key from the key store;

storing the unlocked cloud-based encryption key in a secure store of a main memory associated with the customer computing platform; and

accessing, according to an encryption or decryption mechanism, the unlocked cloud-based encryption key to encrypt or decrypt customer data stored on a database of the main memory and used by the application server.

7. The system in accordance with claim 6, wherein the unlocking the cloud-based encryption key further includes:

unlocking the cloud-based encryption key from the key store using the customer-based encryption key.

8. The system in accordance with claim 6, wherein the accessing the unlocked cloud-based encryption key to encrypt or decrypt customer data further includes:

determining a relationship of the customer data with the cloud-based encryption key.

9. The system in accordance with claim 8, wherein the accessing the unlocked cloud-based encryption key to encrypt or decrypt customer data further includes:

accessing the unlocked cloud-based encryption key according to the relationship.