Systems and methods for providing a secure data exchange

• US 9,197,408 B2
• Filed: 05/10/2013
• Issued: 11/24/2015
• Est. Priority Date: 05/10/2013
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Amato, Riccardo Franco
• Primary Examiner(s): Lanier, Benjamin
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US13/892,030
• Publication Number:
  US 20140337628A1
• Time in Patent Office: 928 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A system, a method, and a computer program product for a data exchange are provided. A first application generates a first key for exchange of data between the first application and a second application. The first application stores the first key in a first memory location. The second application obtains the first key from the memory location. The second application generates a second key for exchange of data between the first application and the second application. The second application creates a data request that contains the second key and is encrypted using the first key. The encrypted request is provided to the first application. The first application provides the data identified in the data request to the second application. The data is encrypted by the first application using the second key prior to being provided to the second application. The second application decrypts the data using the second key.

Claims

1. A computer-implemented method, comprising:

generating, using a first application, a first key for exchange of data between the first application and a second application;

storing, using the first application, the first key in a first memory location, wherein the first memory location is accessed by the second application to obtain the first key;

generating, using the second application, a second key for exchange of data between the first application and the second application;

creating, using the second application, a data request, the data request containing the second key and being encrypted using the first key, and providing the encrypted request to the first application; and

providing, using the first application, the data identified in the data request to the second application, wherein the data is encrypted by the first application using the second key prior to being provided to the second application and the second application decrypts the data using the second key;

wherein the first application stores the encrypted data created in response to the data request in a second memory location, wherein the second memory location is created by the second application for exchanging data with the first application;

wherein the data request further comprises an identification information of the second memory location;

wherein the at least one of the generating the first key, storing, the generating the second key, the creating and the providing is performed on at least one processor.

2. The method according to claim 1, wherein the first key is a first public encryption key.

3. The method according to claim 2, wherein the first application decrypts the data request using a first private decryption key.

4. The method according to claim 1, wherein the first application provides the encrypted data created in response to the data request directly to the second application.

5. The method according to claim 2, wherein the second key is a second public encryption key.

6. The method according to claim 5, wherein the second application decrypts the data using a second private decryption key.

7. The method according to claim 6, further comprising

storing, using the first application, the first public encryption key in the first memory location;

and

storing, using the second application, the second public encryption key in a second memory location, wherein the second memory location is accessed by the first application to obtain the second public encryption key.

8. The method according to claim 7, further comprising

creating, using the second application, a third memory location accessible by the first application and the second application;

storing, using the first application, data created in response to the data request, the data being encrypted using the second public encryption key and stored in the third memory location;

obtaining, using the second application, the encrypted data from the third memory location and decrypting the obtained data using the second private decryption key; and

deleting, using the second application, the third memory location.

9. The method according to claim 7, further comprising

providing, using the first application, the data created in response to the data request directly to the second application, wherein the data being encrypted by the first application using the second public encryption key and, upon receipt by the second application from the first application, being decrypted by the second application using second private decryption key.

10. The method according to claim 1, further comprising

deleting, using the first or second application, the first key from the first memory location.

11. A computer program product comprising a non-transitory machine-readable medium storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising:

generating, using a first application, a first key for exchange of data between the first application and a second application;

storing, using the first application, the first key in a first memory location, wherein the first memory location is accessed by the second application to obtain the first key;

generating, using the second application, a second key for exchange of data between the first application and the second application;

creating, using the second application, a data request, the data request containing the second key and being encrypted using the first key, and providing the encrypted request to the first application; and

providing, using the first application, the data identified in the data request to the second application, wherein the data is encrypted by the first application using the second key prior to being provided to the second application and the second application decrypts the data using the second key;

wherein the first application stores the encrypted data created in response to the data request in a second memory location, wherein the second memory location is created by the second application for exchanging data with the first application;

wherein the data request further comprises an identification information of the second memory location.

12. The computer program product according to claim 11, wherein the first key is a first public encryption key, wherein the first application decrypts the data request using a first private decryption key.

13. The computer program product according to claim 11, wherein the first application provides the encrypted data created in response to the data request directly to the second application.

14. The computer program product according to claim 12, wherein the operations further comprise

storing, using the first application, the first public encryption key in the first memory location;

and

storing, using the second application, a second public encryption key in a second memory location, wherein the second memory location is accessed by the first application to obtain the second public encryption key.

15. The computer program product according to claim 14, wherein the operations further comprise

creating, using the second application, a third memory location accessible by the first application and the second application;

storing, using the first application, data created in response to the data request, the data being encrypted using the second public encryption key and stored in the third memory location;

obtaining, using the second application, the encrypted data from the third memory location and decrypting the obtained data using the second private decryption key; and

deleting, using the second application, the third memory location.

16. The computer program product according to claim 14, wherein the operations further comprise

providing, using the first application, the data created in response to the data request directly to the second application, wherein the data being encrypted by the first application using the second public encryption key and, upon receipt by the second application from the first application, being decrypted by the second application using second private decryption key.

17. A system comprising:

at least one programmable processor; and

a machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform operations comprising;

generating, using a first application, a first key for exchange of data between the first application and a second application;

storing, using the first application, the first key in a first memory location, wherein the first memory location is accessed by the second application to obtain the first key;

generating, using the second application, a second key for exchange of data between the first application and the second application;

creating, using the second application, a data request, the data request containing the second key and being encrypted using the first key, and providing the encrypted request to the first application; and

providing, using the first application, the data identified in the data request to the second application, wherein the data is encrypted by the first application using the second key prior to being provided to the second application and the second application decrypts the data using the second key;

wherein the first application stores the encrypted data created in response to the data request in a second memory location, wherein the second memory location is created by the second application for exchanging data with the first application;

wherein the data request further comprises an identification information of the second memory location.