US7761704B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for expiring encrypted data
Assignee: Oracle International Corp
•
Filing: 2005-03-17
•
Granted: 2010-07-20
•
Expires: 2025-03-17
Abstract
Abstract One embodiment of the present invention provides a system that can expire encrypted-data. During operation, the system receives an expiry-request that includes object-identifying information, which can be used to identify a set of database objects that contain the encrypted-data, wherein a database object can be a table, a partition, a row, or a column in a row. Furthermore, a database object can have an expiration time, and it can be stored in an archive, which is typically used to store large amounts of data for long periods using a slower, but cheaper storage medium than the storage medium used by the database. The system then identifies a set of keys for the encrypted-data using the object-identifying information. Next, the system deletes the set of keys, thereby expiring the encrypted-data. Note that, deleting the set of keys ensures that the secure key repository does not contain any stale keys associated with expired encrypted-data.
Inventors
- 👤 Min-Hank Ho
- 👤 Daniel Manhung Wong
- 👤 Chon Hei Lei
- 👤 Thomas Keefe
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 22:18
CPC Classifications
H; H04; H04N; H04N21/00; H04N21/40; H04N21/43; H04N21/433; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/0819; H04L9/083; H04N21/45; H04N21/462; H04N21/4627; H04N21/60; H04N21/65; H04N21/654; H04N21/6543; H04N21/80; H04N21/83; H04N21/835; H04N21/8355; H04N5/00; H04N5/76; H04N5/91; H04N5/913; H04N7/00; H04N7/16; H04N7/162; H04N7/165; H04L2209/00; H04L2209/56; H04N2005/91357; H04N2005/91364; Y; Y10; Y10S; Y10S707/00; Y10S707/99941; Y10S707/99944
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
189 words
A method for accessing a database object in an encrypted database system, the method comprising: receiving an access-request to access the database object's state at time T which occurred in the past, wherein the database object was encrypted using different keys at different times in the past, wherein the different keys are stored and associated with timestamps to indicate which key was used for encrypting the database object at any given time, and wherein each key is associated with a key-identifier, the key-identifier comprising: a unique random number, a transaction-identifier which uniquely identifies a transaction and which is used to determine an order in which the database object needs to be expired, wherein the database object is created as part of the transaction, and a global database identifier which identifies a database among a collection of databases in a distributed database system; determining a key which was used to encrypt the database object at time T, wherein a timestamp associated with the key indicates that the key was used to encrypt the database object at time T; and decrypting the database object's state at time T using the key.
Claim 2
Independent Claim
189 words
A method for accessing a database object in an encrypted database system, the method comprising: receiving an access-request to access the database object's state at time T which occurred in the past, wherein the database object was encrypted using different keys at different times in the past, wherein the different keys are stored and associated with timestamps to indicate which key was used for encrypting the database object at any given time, and wherein each key is associated with a key-identifier, the key-identifier comprising: a unique random number, a transaction-identifier which uniquely identifies a transaction and which is used to determine an order in which the database object needs to be expired, wherein the database object is created as part of the transaction, and a global database identifier which identifies a database among a collection of databases in a distributed database system; determining a key which was used to encrypt the database object at time T, wherein a timestamp associated with the key indicates that the key was used to encrypt the database object at time T; and decrypting the database object's state at time T using the key.
Claim 3
Dependent Claim
49 words
The method of claim 1 , wherein the method comprises: receiving an expiration-request for expiring the database object's state at time T; determining the key which was used to encrypt the database object at time T; and deleting the key, thereby expiring the database object's state at time T.
Claim 4
Dependent Claim
29 words
The method of claim 2 , wherein deleting the key includes sending a delete-request to a secure key repository, wherein the delete-request includes the key-identifier associated with the key.
Claim 5
Dependent Claim
36 words
The method of claim 1 , wherein prior to receiving the access-request, the method comprises: receiving object-identifying information, wherein the object-identifying information identifies the database object; and identifying the database object by utilizing the object-identifying information.
Claim 6
Dependent Claim
41 words
The method of claim 4 , wherein the object-identifying information includes one of: a monotonically increasing counter which is used to determine an order in which transactions are received by the encrypted database system; a user identifier; or an object identifier.
Claim 7
Dependent Claim
206 words
A computer-readable storage medium storing instructions that when executed by an encrypted database system cause the encrypted database system to perform a method for accessing a database object in the encrypted database system, the method comprising: receiving an access-request to access the database object's state at time T which occurred in the past, wherein the database object was encrypted using different keys at different times in the past, wherein keys are associated with timestamps to indicate which key was used for encrypting the database object at any given time, and wherein each key is associated with a key-identifier, the key-identifier comprising: a unique random number, a transaction-identifier which uniquely identifies a transaction and which is used to determine an order in which the database object needs to be expired, wherein the database object is created as part of the transaction, and a global database identifier which identifies a database among a collection of databases in a distributed database system; determining a key which was used to encrypt the database object at time T, wherein a timestamp associated with the key indicates that the key was used to encrypt the database object at time T; and decrypting the database object's state at time T using the key.
Claim 8
Dependent Claim
206 words
A computer-readable storage medium storing instructions that when executed by an encrypted database system cause the encrypted database system to perform a method for accessing a database object in the encrypted database system, the method comprising: receiving an access-request to access the database object's state at time T which occurred in the past, wherein the database object was encrypted using different keys at different times in the past, wherein keys are associated with timestamps to indicate which key was used for encrypting the database object at any given time, and wherein each key is associated with a key-identifier, the key-identifier comprising: a unique random number, a transaction-identifier which uniquely identifies a transaction and which is used to determine an order in which the database object needs to be expired, wherein the database object is created as part of the transaction, and a global database identifier which identifies a database among a collection of databases in a distributed database system; determining a key which was used to encrypt the database object at time T, wherein a timestamp associated with the key indicates that the key was used to encrypt the database object at time T; and decrypting the database object's state at time T using the key.
Claim 9
Dependent Claim
51 words
The computer-readable storage medium of claim 6 , wherein the method comprises: receiving an expiration-request for expiring the database object's state at time T; determining the key which was used to encrypt the database object at time T; and deleting the key, thereby expiring the database object's state at time T.
Claim 10
Dependent Claim
31 words
The computer-readable storage medium of claim 6 , wherein deleting the key includes sending a delete-request to a secure key repository, wherein the delete-request includes the key-identifier associated with the key.
Claim 11
Dependent Claim
38 words
The computer-readable storage medium of claim 6 , wherein prior to receiving the access-request, the method comprises: receiving object-identifying information, wherein the object-identifying information identifies the database object; and identifying the database object by utilizing the object-identifying information.
Claim 12
Dependent Claim
43 words
The computer-readable storage medium of claim 9 , wherein the object-identifying information includes one of: a monotonically increasing counter which is used to determine an order in which transactions are received by the encrypted database system; a user identifier; or an object identifier.
Claim 13
Independent Claim
195 words
A method for expiring database objects, the method comprising: receiving a transaction-request to perform the transaction in a database system, wherein the transaction is associated with a transaction-identifier which uniquely identifies the transaction and which is used to determine an order in which database objects that need to be expired, wherein the database objects are created as part of processing the transaction; creating a key to encrypt the database objects associated with the transaction; associating the key with a key-identifier, wherein the key identifier comprises a unique random number, the transaction-identifier, and a global database identifier which identifies a database among a collection of databases in a distributed database system; encrypting the database objects using the key; storing the key in a secure key repository; receiving an expiry-request that comprises an object identifier associated with the database objects, wherein the expiry-request indicates that the database objects need to be expired; responsive to receiving the expiry-request, deleting the key from the secure key repository, thereby expiring the database objects which were created as part of processing the transaction and ensuring that the secure key repository does not store stale keys associated with the expired database objects.
Claim 14
Independent Claim
195 words
A method for expiring database objects, the method comprising: receiving a transaction-request to perform the transaction in a database system, wherein the transaction is associated with a transaction-identifier which uniquely identifies the transaction and which is used to determine an order in which database objects that need to be expired, wherein the database objects are created as part of processing the transaction; creating a key to encrypt the database objects associated with the transaction; associating the key with a key-identifier, wherein the key identifier comprises a unique random number, the transaction-identifier, and a global database identifier which identifies a database among a collection of databases in a distributed database system; encrypting the database objects using the key; storing the key in a secure key repository; receiving an expiry-request that comprises an object identifier associated with the database objects, wherein the expiry-request indicates that the database objects need to be expired; responsive to receiving the expiry-request, deleting the key from the secure key repository, thereby expiring the database objects which were created as part of processing the transaction and ensuring that the secure key repository does not store stale keys associated with the expired database objects.
Claim 15
Dependent Claim
25 words
The method of claim 11 , wherein deleting the key includes sending a delete-request to the secure key repository, wherein the delete-request includes the key-identifier.
Claim 16
Dependent Claim
23 words
The method of claim 11 , wherein the transaction-identifier includes: a system change number (SCN) which uniquely identifies transactions within the database system.
Claim 17
Dependent Claim
27 words
The method of claim 11 , wherein the database objects are one or more of: a table; a partition; a column; and a row in a column.
Claim 18
Dependent Claim
212 words
A computer-readable storage medium storing instructions that when executed by a database system cause the database system to perform a method for expiring database, the method comprising: receiving a transaction-request to perform the transaction in the database system, wherein the transaction is associated with a transaction-identifier which uniquely identifies the transaction and which is used to determine an order in which database objects need to be expired, wherein the database objects are created as part of processing the transaction; creating a key to encrypt the database objects associated with the transaction; associating the key with a key-identifier, wherein the key identifier comprises a unique random number, the transaction-identifier, and a global database identifier which identifies a database among a collection of databases in a distributed database system; encrypting the database objects using the key; storing the key in a secure key repository; receiving an expiry-request that comprises an object identifier associated with the database objects, wherein the expiry-requests indicates that the database objects need to be expired; responsive to receiving the expiry-request, deleting the key from the secure key repository, thereby expiring the database objects which were created as part of processing the transaction and ensuring that the secure key repository does not store stale keys associated with the expired database objects.
Claim 19
Dependent Claim
212 words
A computer-readable storage medium storing instructions that when executed by a database system cause the database system to perform a method for expiring database, the method comprising: receiving a transaction-request to perform the transaction in the database system, wherein the transaction is associated with a transaction-identifier which uniquely identifies the transaction and which is used to determine an order in which database objects need to be expired, wherein the database objects are created as part of processing the transaction; creating a key to encrypt the database objects associated with the transaction; associating the key with a key-identifier, wherein the key identifier comprises a unique random number, the transaction-identifier, and a global database identifier which identifies a database among a collection of databases in a distributed database system; encrypting the database objects using the key; storing the key in a secure key repository; receiving an expiry-request that comprises an object identifier associated with the database objects, wherein the expiry-requests indicates that the database objects need to be expired; responsive to receiving the expiry-request, deleting the key from the secure key repository, thereby expiring the database objects which were created as part of processing the transaction and ensuring that the secure key repository does not store stale keys associated with the expired database objects.
Claim 20
Dependent Claim
27 words
The computer-readable storage medium of claim 15 , wherein deleting the key includes sending a delete-request to the secure key repository, wherein the delete-request includes the key-identifier.
Claim 21
Dependent Claim
25 words
The computer-readable storage medium of claim 15 , wherein the transaction-identifier includes: a system change number (SCN) which uniquely identifies transactions within the database system.
Claim 22
Dependent Claim
29 words
The computer-readable storage medium of claim 15 , wherein the database objects are one or more of: a table; a partition; a column; and a row in a column.
Claim 23
Dependent Claim
47 words
The method of claim 11 , further comprising: receiving an abort-request to abort the transaction, wherein the abort-request is received before the transaction is completed; and in response to receiving the abort-request, using the transaction-identifier to determine the key which was used to encrypt the database object.
Claim 24
Dependent Claim
52 words
The computer-readable storage medium of claim 15 , wherein the method further comprises: receiving an abort-request to abort the transaction, wherein the abort-request is received before the transaction is completed; and in response to receiving the abort-request, using the transaction-identifier to determine the key which was used to encrypt the database object.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2013-07-19 | 2014-01-18 | 2014-07-20 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2017-07-19 | 2018-01-18 | 2018-07-20 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2021-07-19 | 2022-01-18 | 2022-07-20 | $7700.00 | Window Closed / Lapsed |