Key management configurations

A method, a system, and a computer program product for performing key management configurations. One or more encryption keys for encrypting one or more data payloads for accessing one or more databases are received. The received encryption keys are compared to a plurality of encryption keys associated with the databases. Based on the comparison, a configuration of at least one database is changed using the received encryption keys. The changed configuration is stored.

TECHNICAL FIELD

This disclosure relates generally to data processing and, in particular, to key management configurations, e.g., use of SQL commands for management of such configurations.

BACKGROUND

Security of software and/or hardware of a particular computing system is vital to operation of a company. Such security is typically managed through various applications, software and/or hardware system configurations, monitoring, command execution, cryptographic keys, services, etc. Such management may include key management systems (KMS) and/or hardware security management modules (HSM). Keys are used to encrypt data payloads during communications and need to be managed to ensure reliability, security, and effective uninterrupted operation of computing systems.

SUMMARY

In some implementations, the current subject matter relates to a computer-implemented method for performing key management configurations. The method may include receiving one or more encryption keys for encrypting one or more data payloads for accessing one or more databases, comparing the one or more received encryption keys to a plurality of encryption keys associated with the one or more databases, changing, based on the comparing, a configuration of at least one database in the one or more databases using the received one or more encryption keys, and storing the changed configuration.

In some implementations, the current subject matter may include one or more of the following optional features. Configuration change may include adding one or more received encryption keys to the plurality of encryption keys. The addition may include storing one or more key-value settings associated with the received encryption keys.

In some implementations, configuration change may include deleting one or more received encryption keys from the plurality of encryption keys. Configuration change may also include updating one or more encryption keys in the plurality of encryption keys using the received encryption keys. In this case, update may include updating one or more stored key-value settings associated with the updated encryption key.

In some implementations, at least one of the received encryption keys and the plurality of encryption keys may be associated with at least one of: a hardware security management system, a key management service, and a combination thereof.

In some implementations, the method may also include monitoring usage of the received encryption keys for encrypting one or more data payloads for accessing one or more databases, and executing the changing based on the monitoring.

DETAILED DESCRIPTION

To address these and potentially other deficiencies of currently available solutions, one or more implementations of the current subject matter relate to methods, systems, articles of manufacture, and the like that may, in some implementations, provide an ability to use SQL commands to manage key management configurations.

Key management service is typically used to generate, distribute, and/or manage cryptographic keys in a computing systems, which includes generation, exchange, storage, use, crypto-shredding (destruction) and replacement of keys. As of KMS, cryptographic protocol design, key servers, user procedures, and/or protocols, may be implemented. KMS may be implemented between users and/or systems. Symmetric keys and/or asymmetric keys may be used as part of KMS. Symmetric keys may be identical for both encrypting and decrypting a particular message. Asymmetric keys or public keys may include two distinct linked keys (as part of public key infrastructure (PKI)).

In some cases, a hardware security module (HSM) may be a physical computing device that protects/manages digital keys for strong authentication and performs crypto-processing. A typical HSM can be a plug-in card, an external device that can be attached to a computer, a network server, etc., and/or any other device.

In some implementations, the current subject matter may be configured to perform management of key management configurations. The management may include performing at least one or more of the following functions: addition of keys, dropping or removal of keys, updating of keys, activation of keys, monitoring of key usages, enabling/disabling key configuration settings (e.g., for external HSM and/or KMS services), encryption of data payloads using keys, etc. and/or any other functions, and/or any combinations thereof. In some exemplary implementations, such management functions may be performed using one or more SQL commands that may be submitted through a server. The SQL commands may be used to allow switching over from a default local secure store (LSS) installation to, for example, using HSM and/or KMS, and/or vice versa. The SQL commands may be submitted to a server by a user, an application, a computing system, and/or any other entity. In some exemplary, non-limiting implementations, the key configuration management may be performed using one or more in-memory database systems, such as a High Performance Analytic Appliance (“HANA”) system as developed by SAP SE, Walldorf, Germany.

FIG. 1illustrates an exemplary key management system100, according to some implementations of the current subject matter. The system100may include a user102, a server104(e.g., a database index server (“hdbindexserver”)), a memory106(e.g., a HANA memory appliance), a local secure store component108, an external network116, and a key storage component118. The user102may be any user, which may include an individual user, a software application, a computing system, and/or any other entity. The user102may be configured to generate one or more of the commands (e.g., SQL commands) relating to key management configurations that may be used for encryption of data payloads. The commands may include adding a key configuration, updating a key configuration, dropping or deleting a key configuration, activating a key configuration (e.g., added key configuration, updated key configuration, etc.), and/or any other commands and/or any combinations thereof. The user102may be also configured to perform enablement of one or more settings for the external key management services and/or hardware security management systems, which may be part of the external network116. Further, the user102may also be configured to perform monitoring of key usages using one or more interfaces that may be generated as a result of execution of any of the above commands.

The server104and/or the memory106may be configured to store various information related to data for which key configurations may be used to encrypt data payload. Additionally, the data backups, redo logs, traces, and/or any other information may be stored and/or may be accessed by the server104and/or memory106.

The local secure store component108may include a local secure store (LSS) server110and one or more storage components that may persist external key management (e.g., for KMS/HSM) information, configuration information for KMS/HSM, and/or any other key management configuration information in an encrypted configuration database (DB)112(hereinafter, referred to as “configuration database” or “encrypted configuration database” or “configuration DB” or “encrypted configuration DB”). The LSS server110may also store encrypted payload data in a payload database (DB)114. Using the LSS component108, one or more key configurations may be added, updated, dropped, activated, monitored, etc.

The external network116may be operated independently of the remainder of the system100and may be configured to store one or more keys in a key storage118. It may also store one or more RSA private keys for encryption purposes. The information relating to key configuration stored by the network116and/or key storage118may be used for payload decryption purposes. Data payload encryption/decryption may also be possible if the KMS/HSM services are enabled, otherwise, keys might not be retrieved and encryption/decryption might not be possible. The KMS/HSM services may be configured to generate new (or update existing ones, delete existing ones, etc.) encryption keys that may be stored in the key storage database118.

FIG. 2illustrates an exemplary key management configuration process200that may be performed by the system100shown inFIG. 1, according to some implementations of the current subject matter. At202, the user102may wish to add a new key management configuration. This process may be initiated by the user102transmitting an SQL command to the server104. The configuration may then be transmitted to LSS server110, which may perform a test of the added key management configuration, at204. The test may determine whether or not the added key management configuration is working and/or usable, at206. The LSS server110may be configured to check with the configuration database112to determine workability and/or usability of the added key management configuration. If the test is successful, the added key management configuration may be activated, at214.

If the added key management configuration is not workable/usable (e.g., having incorrect or wrong credentials for an external system), then an error may be generated and reported, at207. Then, the LSS server110may be configured to perform an update of the key management configuration using the information related to the added key management configuration, at208. The LSS server110may also test the updated key management configuration, at210. If the test is not successful (e.g., updated configuration is not workable/usable), at212, an error may be generated, at222. Otherwise, the updated key management configuration may be activated, at214, for use to encrypt data payloads.

The activated key management configuration may be persisted, at216. The configuration database112may be configured to persist the activated key management configuration. The activated key management configuration may be used to encrypt data payloads, at218, where the encrypted data payloads may be stored in the encrypted payload database114.

In some implementations, the LSS server110may be configured to generate a view that may be used to monitor usage of the activated key management configuration (or any other configurations), at220. The user102and/or any other computing component may be configured to perform monitoring of the activated key management configurations.

The LSS server110may be further configured to delete (or drop) a particular key management configuration. This may be performed to remove a particular configuration that is not being used (as, for example, determined as a result of monitoring), may be generating an error, may have been comprised, and/or for any other reason.

In some exemplary implementations, the above key management configurations may be executed as a SQL commands. For security purposes, such SQL commands may also require encryption root key administrator and/or the database administrator privileges. The SQL commands may be used to provide a general process for setting up HSM and/or KMS to ensure that vendor-specific, parameters and certificates are provided accordingly. For example, the SQL commands may be used, as part of HSM setup, for customer databases in cloud scenarios. Additionally, the SQL statements may be used to setup HSM usage for the SystemDB, tenant database (DB), etc.

In some exemplary, non-limiting implementations, the following SQL commands may be used from the SystemDB to control a tenant DB. The SQL commands for controlling the SystemDB may include “ALTER SYSTEM” (e.g., instead of “ALTER DATABASE <database_name>”).

To add a key management configuration, the following SQL exemplary, non-limiting commands may be used

The database name can be a name of the tenant database. The key management configuration name may include simple names in various formats (e.g., uppercase letters, e.g., ‘EXTERNAL_CLOUD_HSM’, where use of ‘DEFAULT’ may be forbidden). The settings may include a JSON-document with key-value settings, whereby a list of keys and their supported values may depend on the selected HSM and/or KMS. Using the above SQL command, a new key management configuration can be added and then tested. If the test is successful (i.e., the key management configuration name, specified settings, etc. are valid), the new key management configuration for a tenant may be stored in the LSS configuration database112(as shown inFIG. 1). The test might not be successful if the new key management configuration name is already in use, the specified settings do not work, and/or for any other reasons.

In order to remove a particular key management configurations, the following exemplary, non-limiting SQL command may be used.

As with the add SQL command above, key management configuration name may include any kind of name (e.g., a simple name, uppercase letters only, such as ‘EXTERNAL_CLOUD_HSM’, and/or name ‘DEFAULT’ may be forbidden). Using this SQL command, a key management configuration may be deleted from the LSS108(specifically, configuration database112). However, the above drop SQL command may fail if the key management configuration exists and is currently active. The command may succeed if the configuration does not exist (e.g., idempotent) or exists but is not active.

To switch between key management configurations, the following SQL commands may be used.

Similarly to the add and drop SQL commands above, any names for the key management configurations may be used (e.g., simple names, uppercase letters, such as, ‘EXTERNAL_CLOUD_HSM’, however, in this case, ‘DEFAULT’ name may be used). The above SQL command may fail (thereby leaving everything unchanged), if the new key management configuration does not work.

To modify or alter key management configurations, the following SQL commands may be used.

The <database_name> may include a name of a database, such as a systemDB and/or a tenantDB. Key management configuration name may again be any name, such as a simple name, e.g., uppercase letters, such as, ‘EXTERNAL_CLOUD_HSM’, however, use of ‘DEFAULT’ may be prohibited. A JSON-document with new key-value settings may be included in the <updates>. As with the add command, this document may include a list of keys and their supported values that may depend on the selected HSM and/or KMS. Only the updates to the existing key management configurations listed in this document will be affected, whereas the remaining settings that are not listed in the updates will remain unchanged. A <null> value may be used to reset a particular value corresponding to a specific key management configuration.

Similar to the add SQL command, the key management configurations included in the update SQL command may be tested and if testing is successful, the updated key management configuration for a tenant DB may be stored in the configuration database112of the LSS108. The update command test may fail if the updated settings cannot be implemented.

In some implementations, as stated above, the content of the ‘<settings>’ parameter in the add SQL command may be a JSON document. The document may include the following sections: “setup”, “service”, “properties”, and “credentials”. The “setup” section may include optional information that may be handed over during the setup call execution that may be transmitted from the user (e.g., it may be handed over to LSS client). The setup section might not be stored in the configuration database112. The “service” section may include information that may be analyzed by the LSS server110. As part of the analysis, the LSS server110may evaluate “type,” “client_version”, “vendor”, and “version”. The “type” may be used to identify an executable for LSS client. The “client_version”, “vendor” and “version” may be used to determine supported driver(s) information in a CommonDB database, which may then be forwarded to the LSS client. This information may also be viewed during monitoring that may be performed by the LSS server. The “properties” section may include various key identifiers and may be provided to the LSS client. The “credentials” section may include user credentials, such, as user ID and password, and might not be shown in the monitoring view (e.g., for security purposes). Further, the above sections of the <settings> JSON document may be stored in the configuration database112. Below is an exemplary <settings> JSON document:

Referring back toFIG. 1, the configuration database112may include various information that may be related to the network hardware security management (network HSM) and/or key management service information. The network HSM may be accessed using a locally installed proprietary driver, whereby access control and authentication may be HSM vendor-specific. The configuration database112may store settings (‘<settings>’) parameters that may be used for the purposes of accessing the network HSM. These may be stored under key management configuration name (config_name) and may include “service”, “properties”, and “credentials” (which may be similar to the ones discussed above). In an exemplary, non-limiting implementation, the config_name parameter may be expressed as follows:

In some implementations, the configuration database112may also store a public encryption key. The public encryption key may be used for encryption purposes without need for the HSM.

In some implementations, the configuration database112may also store information for accessing KMS (that may be vendor-specific and, hence, different for various KMS). An asymmetric key may be stored for encryption of body-encryption-key of the payload database114. The KMS may be accessed for the purposes of encryption/decryption of the body-encryption-key of the payload.

In some implementations, once a particular key management configuration has been added, updated, etc., its usage may be monitored. Monitoring may be performed using a monitoring view that may be generated using system100. For example, a monitoring view KEY_MANAGEMENT_CONFIGURATIONS in a schema SYS_DATABASES may be added to the SystemDB that lists stored key management configurations for all databases, and maybe a subset of their settings. The credentials object (e.g., user IDs, passwords, etc.) may be removed from the settings. A status column may indicate for HSMs if a particular key in the HSM is already backed up. Further, a similar view, without the column DATABASE_NAME, may be added to all tenants and the SystemDB as “SYS”. “KEY_MANAGEMENT_CONFIGURATIONS”. In some implementations, use of the view KEY_MANAGEMENT_CONFIGURATIONS in a schema SYS_DATABASES (in SystemDB) may require a database administrator privilege. Further, use of the view KEY_MANAGEMENT_CONFIGURATIONS in a schema SYS may require encryption root key administrator privilege.

FIG. 3illustrates an exemplary table300for monitoring key management configurations, according to some implementations of the current subject matter. The table300may include a column302that may include column name, e.g., “database_name”, “configuration_name”, “is_active”, “type”, “client_version”, “properties”. Each column name may have a corresponding datatype as shown in column304. For example, the “database_name” may have a datatype of nvarchar(256) and may describe a database name (as shown in column306). The “configuration_name” may have a datatype varchar(20) and may describe a name of a key management configuration. The “is_active” name may have a datatype varchar(5) [“TRUE”/“FALSE”] and may describe whether a particular key management configuration is used by the LSS108to define access to specific computing components (e.g., in HANA system). The “type” may have a datatype varchar(20) and may describe a type of an external key management. The “client_version” may have a datatype varchar(12) and may describe a version of a driver software for which a specific key management configuration is being generated/used/etc. The “properties” may have a datatype nclob and may refer to a reduced version of the JSON settings (as discussed above) object that might not include “credentials” object in the JSON document.

In some exemplary implementations, the values of the above parameters may be set to a default value, corresponding to a no configuration in the LSS and may be expressed as follows:

With a change in configuration, e.g., an external cloud HSM, the above configuration may be changed as follows:

In some implementations, the current subject matter may be implemented in various in-memory database systems, such as a High Performance Analytic Appliance (“HANA”) system as developed by SAP SE, Walldorf, Germany. Various systems, such as, enterprise resource planning (“ERP”) system, supply chain management system (“SCM”) system, supplier relationship management (“SRM”) system, customer relationship management (“CRM”) system, and/or others, may interact with the in-memory system for the purposes of accessing data, for example. Other systems and/or combinations of systems may be used for implementations of the current subject matter. The following is a discussion of an exemplary in-memory system.

FIG. 4illustrates an exemplary system400in which a computing system402, which may include one or more programmable processors that may be collocated, linked over one or more networks, etc., executes one or more modules, software components, or the like of a data storage application404, according to some implementations of the current subject matter. The data storage application404may include one or more of a database, an enterprise resource program, a distributed storage system (e.g. NetApp Filer available from NetApp of Sunnyvale, Calif.), or the like.

The one or more modules, software components, or the like may be accessible to local users of the computing system402as well as to remote users accessing the computing system402from one or more client machines406over a network connection410. One or more user interface screens produced by the one or more first modules may be displayed to a user, either via a local display or via a display associated with one of the client machines406. Data units of the data storage application404may be transiently stored in a persistence layer412(e.g., a page buffer or other type of temporary persistency layer), which may write the data, in the form of storage pages, to one or more storages414, for example via an input/output component416. The one or more storages414may include one or more physical storage media or devices (e.g. hard disk drives, persistent flash memory, random access memory, optical media, magnetic media, and the like) configured for writing data for longer term storage. It should be noted that the storage414and the input/output component416may be included in the computing system402despite their being shown as external to the computing system402inFIG. 4.

Data retained at the longer term storage414may be organized in pages, each of which has allocated to it a defined amount of storage space. In some implementations, the amount of storage space allocated to each page may be constant and fixed. However, other implementations in which the amount of storage space allocated to each page may vary are also within the scope of the current subject matter.

FIG. 5illustrates exemplary software architecture500, according to some implementations of the current subject matter. A data storage application404, which may be implemented in one or more of hardware and software, may include one or more of a database application, a network-attached storage system, or the like. According to at least some implementations of the current subject matter, such a data storage application404may include or otherwise interface with a persistence layer412or other type of memory buffer, for example via a persistence interface502. A page buffer504within the persistence layer412may store one or more logical pages506, and optionally may include shadow pages, active pages, and the like. The logical pages506retained in the persistence layer412may be written to a storage (e.g. a longer term storage, etc.)414via an input/output component416, which may be a software module, a sub-system implemented in one or more of software and hardware, or the like. The storage414may include one or more data volumes510where stored pages512are allocated at physical memory blocks.

In some implementations, the data storage application404may include or be otherwise in communication with a page manager514and/or a savepoint manager516. The page manager514may communicate with a page management module520at the persistence layer412that may include a free block manager522that monitors page status information524, for example the status of physical pages within the storage414and logical pages in the persistence layer412(and optionally in the page buffer504). The savepoint manager516may communicate with a savepoint coordinator526at the persistence layer412to handle savepoints, which are used to create a consistent persistent state of the database for restart after a possible crash.

In some implementations of a data storage application404, the page management module of the persistence layer412may implement a shadow paging. The free block manager522within the page management module520may maintain the status of physical pages. The page buffer504may include a fixed page status buffer that operates as discussed herein. A converter component540, which may be part of or in communication with the page management module520, may be responsible for mapping between logical and physical pages written to the storage414. The converter540may maintain the current mapping of logical pages to the corresponding physical pages in a converter table542. The converter540may maintain a current mapping of logical pages506to the corresponding physical pages in one or more converter tables542. When a logical page506is read from storage414, the storage page to be loaded may be looked up from the one or more converter tables542using the converter540. When a logical page is written to storage414the first time after a savepoint, a new free physical page is assigned to the logical page. The free block manager522marks the new physical page as “used” and the new mapping is stored in the one or more converter tables542.

The persistence layer412may ensure that changes made in the data storage application404are durable and that the data storage application404may be restored to a most recent committed state after a restart. Writing data to the storage414need not be synchronized with the end of the writing transaction. As such, uncommitted changes may be written to disk and committed changes may not yet be written to disk when a writing transaction is finished. After a system crash, changes made by transactions that were not finished may be rolled back. Changes occurring by already committed transactions should not be lost in this process. A logger component544may also be included to store the changes made to the data of the data storage application in a linear log. The logger component544may be used during recovery to replay operations since a last savepoint to ensure that all operations are applied to the data and that transactions with a logged “commit” record are committed before rolling back still-open transactions at the end of a recovery process.

With some data storage applications, writing data to a disk is not necessarily synchronized with the end of the writing transaction. Situations may occur in which uncommitted changes are written to disk and while, at the same time, committed changes are not yet written to disk when the writing transaction is finished. After a system crash, changes made by transactions that were not finished must be rolled back and changes by committed transaction must not be lost.

To ensure that committed changes are not lost, redo log information may be written by the logger component544whenever a change is made. This information may be written to disk at latest when the transaction ends. The log entries may be persisted in separate log volumes while normal data is written to data volumes. With a redo log, committed changes may be restored even if the corresponding data pages were not written to disk. For undoing uncommitted changes, the persistence layer412may use a combination of undo log entries (from one or more logs) and shadow paging.

The persistence interface502may handle read and write requests of stores (e.g., in-memory stores, etc.). The persistence interface502may also provide write methods for writing data both with logging and without logging. If the logged write operations are used, the persistence interface502invokes the logger544. In addition, the logger544provides an interface that allows stores (e.g., in-memory stores, etc.) to directly add log entries into a log queue. The logger interface also provides methods to request that log entries in the in-memory log queue are flushed to disk.

Log entries contain a log sequence number, the type of the log entry and the identifier of the transaction. Depending on the operation type additional information is logged by the logger544. For an entry of type “update”, for example, this would be the identification of the affected record and the after image of the modified data.

When the data application404is restarted, the log entries need to be processed. To speed up this process the redo log is not always processed from the beginning. Instead, as stated above, savepoints may be periodically performed that write all changes to disk that were made (e.g., in memory, etc.) since the last savepoint. When starting up the system, only the logs created after the last savepoint need to be processed. After the next backup operation the old log entries before the savepoint position may be removed.

When the logger544is invoked for writing log entries, it does not immediately write to disk. Instead it may put the log entries into a log queue in memory. The entries in the log queue may be written to disk at the latest when the corresponding transaction is finished (committed or aborted). To guarantee that the committed changes are not lost, the commit operation is not successfully finished before the corresponding log entries are flushed to disk. Writing log queue entries to disk may also be triggered by other events, for example when log queue pages are full or when a savepoint is performed.

With the current subject matter, the logger544may write a database log (or simply referred to herein as a “log”) sequentially into a memory buffer in natural order (e.g., sequential order, etc.). If several physical hard disks/storage devices are used to store log data, several log partitions may be defined. Thereafter, the logger544(which as stated above acts to generate and organize log data) may load-balance writing to log buffers over all available log partitions. In some cases, the load-balancing is according to a round-robin distributions scheme in which various writing operations are directed to log buffers in a sequential and continuous manner. With this arrangement, log buffers written to a single log segment of a particular partition of a multi-partition log are not consecutive. However, the log buffers may be reordered from log segments of all partitions during recovery to the proper order.

As stated above, the data storage application404may use shadow paging so that the savepoint manager516may write a transactionally-consistent savepoint. With such an arrangement, a data backup comprises a copy of all data pages contained in a particular savepoint, which was done as the first step of the data backup process. The current subject matter may be also applied to other types of data page storage.

In some implementations, the current subject matter may be configured to be implemented in a system600, as shown inFIG. 6. The system600may include a processor610, a memory620, a storage device630, and an input/output device640. Each of the components610,620,630and640may be interconnected using a system bus650. The processor610may be configured to process instructions for execution within the system600. In some implementations, the processor610may be a single-threaded processor. In alternate implementations, the processor610may be a multi-threaded processor. The processor610may be further configured to process instructions stored in the memory620or on the storage device630, including receiving or sending information through the input/output device640. The memory620may store information within the system600. In some implementations, the memory620may be a computer-readable medium. In alternate implementations, the memory620may be a volatile memory unit. In yet some implementations, the memory620may be a non-volatile memory unit. The storage device630may be capable of providing mass storage for the system600. In some implementations, the storage device630may be a computer-readable medium. In alternate implementations, the storage device630may be a floppy disk device, a hard disk device, an optical disk device, a tape device, non-volatile solid state memory, or any other type of storage device. The input/output device640may be configured to provide input/output operations for the system600. In some implementations, the input/output device640may include a keyboard and/or pointing device. In alternate implementations, the input/output device640may include a display unit for displaying graphical user interfaces.

FIG. 7illustrates an exemplary method700for performing key management configurations, according to some implementations of the current subject matter. At702, one or more encryption keys for encrypting one or more data payloads for accessing one or more databases may be received. These may be received in a form of one or more SQL commands. At704, the received encryption keys may be compared to a plurality of encryption keys associated with the databases. This may involve testing the received key configurations to determine whether they are valid or not, may be in use, etc. At706, a configuration of at least one database may be changed (e.g., configurations may be added, updated, dropped, updated, etc.) using the received encryption keys. At708, the changed configuration may be stored (e.g., in the configuration database112).

In some implementations, the current subject matter may include one or more of the following optional features. Configuration change may include adding one or more received encryption keys to the plurality of encryption keys. The addition may include storing one or more key-value settings associated with the received encryption keys.

In some implementations, configuration change may include deleting one or more received encryption keys from the plurality of encryption keys. Configuration change may also include updating one or more encryption keys in the plurality of encryption keys using the received encryption keys. In this case, update may include updating one or more stored key-value settings associated with the updated encryption key.

In some implementations, at least one of the received encryption keys and the plurality of encryption keys may be associated with at least one of: a hardware security management system, a key management service, and a combination thereof.

In some implementations, the method may also include monitoring usage of the received encryption keys for encrypting one or more data payloads for accessing one or more databases, and executing the changing based on the monitoring.