公开(公告)号：US20250124051A1

公开(公告)日：2025-04-17

申请号：US18487347

申请日：2023-10-16

Applicant: SAP SE

Inventor： Benny Rolle ,  Matthias Vogel

IPC: G06F16/27

Abstract: The present disclosure involves systems, software, and computer implemented methods for data privacy. One example method includes providing an end-of-purpose query to applications in a landscape that requests an application to determine whether the application is able to block an object. Votes are received from applications that are either a can-block vote that indicates that the application can block the object or a veto vote that indicates that the application cannot block the object. At least one relevant-application veto model is identified that models which applications can raise a relevant veto vote with respect to another application. Received end-of-purpose votes and the relevant-application veto models are evaluated to determine whether any applications should be block instruction recipients. If any block instructions recipients have been identified, a block instruction for the object is set to each block instruction recipient.

公开(公告)号：US12189813B2

公开(公告)日：2025-01-07

申请号：US18073164

申请日：2022-12-01

Applicant: SAP SE

Inventor： Benny Rolle ,  Matthias Vogel

IPC: G06F21/62

Abstract: The present disclosure involves systems, software, and computer implemented methods for using multiple synonymous identifiers in data privacy integration protocols. One example method includes identifying a request to initiate a protocol in a multiple-application landscape for an object with an identifier. A determination is made that at least one context-using application participant of the protocol relies on a context-providing application participant of the protocol for resolving the identifier to a local identifier local to a context of the context-providing application participant. A resolution request is sent to context-providing application participants that can provide resolution for an identifier for at least one context-using application. A local identifier corresponding to the identifier that is local to the context of the context-providing application participant is received from each context-providing application participant. A protocol work package that includes a resolved local identifier to is sent to each context-using application participant.

公开(公告)号：US12147567B2

公开(公告)日：2024-11-19

申请号：US17718770

申请日：2022-04-12

Applicant: SAP SE

Inventor： Benny Rolle ,  Matthias Vogel ,  Iwona Luthor ,  Girish Sainath

IPC: G06F21/62 ,  G06F16/23 ,  G06F21/64

Abstract: The present disclosure involves systems, software, and computer implemented methods for integrated data privacy services. An example method includes providing ticket details for a data privacy integration protocol to each application in a multiple-application landscape. Each application has a relevant object type list and is included in a particular voting responder group for providing votes for the data privacy integration protocol. A first voting work package is created that includes a first subset of object identifiers included in the ticket. A work package object list is generated for each application based on the first subset of object identifiers. Object identifiers are removed from the work package object list for an application that have an associated object type that is not included in the relevant object type list for the application. Votes for the protocol are received from the first set of applications for a second subset of object identifiers.

公开(公告)号：US12086279B2

公开(公告)日：2024-09-10

申请号：US17457824

申请日：2021-12-06

Applicant: SAP SE

Inventor： Matthias Vogel ,  Benny Rolle ,  Ufuoma Ighoroje

IPC: G06F21/62 ,  G06F16/2453

CPC classification number: G06F21/6218

Abstract: The present disclosure involves systems, software, and computer implemented methods for integrated data privacy services. An example method includes receiving a request to initiate an aligned purpose disassociation protocol for a purpose for an object instance. Aligned purpose disassociation applications are identified that are each configured to indicate whether the application can disassociate the purpose from the object instance. Other applications are identified that area each configured to indicate whether the application can block the object instance. A can-disassociate query is sent to each of the aligned purpose disassociation applications. A can-block query is sent to each of the other applications. Can-disassociate responses are received from the aligned purpose disassociation applications. Can-block responses are received from the other applications. An aligned purpose disassociation decision is determined based on the can-disassociate responses and the can-block responses.

公开(公告)号：US20240193298A1

公开(公告)日：2024-06-13

申请号：US18077493

申请日：2022-12-08

Applicant: SAP SE

Inventor： Benny Rolle ,  Matthias Vogel

IPC: G06F21/62 ,  G06F9/54

CPC classification number: G06F21/6236 ,  G06F9/546

Abstract: The present disclosure involves systems, software, and computer implemented methods for integrating data privacy integration protocols across system landscapes. One example method includes receiving, at a first tenant of a kernel service, a message from a first application in a first landscape. Data from the message is provided to a core component of the kernel service that communicates with multiple tenants of the kernel service. The core component stores data from the message in a core storage area accessible by multiple tenants of the kernel service. The first tenant performs, in the first landscape, a first processing of the message using data in the core storage area for which the first tenant is authorized. The core component initiates a second processing of the message by a second tenant of the kernel service in a second landscape using data in the core storage area for which the second tenant is authorized.

公开(公告)号：US20240134917A1

公开(公告)日：2024-04-25

申请号：US18049063

申请日：2022-10-23

Applicant: SAP SE

Inventor： Stefan Hesse ,  Matthias Vogel

IPC: G06F16/93 ,  G06F21/33

CPC classification number: G06F16/93 ,  G06F21/33

Abstract: In an implementation, a request for one or more attachments stored in an application document store is received from a requestor and by an application agent associated with an application. For each attachment identified in the request, the application agent: 1) requests the attachment from a data privacy integration (DPI) kernel service; 2) receives a download link to an attachment in the application document store; 3) downloads, using the download link, the attachment from the application document store; 4) informs the DPI kernel service that a download of the attachment is complete; and 5) receives a message from the DPI kernel service that the download link has been deactivated. The application agent returns the one or more attachments to the requestor.

公开(公告)号：US20230247034A1

公开(公告)日：2023-08-03

申请号：US17590145

申请日：2022-02-01

Applicant: SAP SE

Inventor： Matthias Vogel ,  Nathalie Stephanie Bergstroem

IPC: H04L9/40

CPC classification number: H04L63/1425 ,  H04L63/0435 ,  H04L63/062

Abstract: Applications create log entries comprising data regarding operations performed by the applications. The log entries are provided to an audit-log service to allow auditing of the log entries. An audit-log sidecar for each application is used to send log entries to the audit-log service. The audit-log service may experience downtime. If the audit-log service is unavailable, the log entries are sent to one or more other audit-log sidecars for storage. When the audit-log service again becomes available, all audit-log sidecars send their stored log entries to the audit-log service. In this way, the audit-log service is enabled to determine if there is a discrepancy between log entries reported by an application and log entries reported for the application by other audit-log sidecars. As a result, an attack on an application will not go undetected, even if the attack occurs while the audit-log service is unavailable.

公开(公告)号：US20230177194A1

公开(公告)日：2023-06-08

申请号：US17702013

申请日：2022-03-23

Applicant: SAP SE

Inventor： Benny Rolle ,  Ufuoma Ighoroje ,  Matthias Vogel

IPC: G06F21/62 ,  G06F16/903

CPC classification number: G06F21/6218 ,  G06F16/90335

Abstract: The present disclosure involves systems, software, and computer implemented methods for integrated data privacy services. An example method includes determining to initiate an integrated end of purpose protocol for an object. An end-of-purpose query is provided to multiple applications that requests each application to determine whether the application is able to block the object. End-of-purpose statuses are received, in response to the end-of-purpose query, that each indicate whether a respective application is able to block the object. The end-of-purpose statuses are evaluated to determine whether an aligned end of purpose has been reached for the object. In response to determining that the aligned end of purpose has been reached for the object, a block command is provided to each application that instructs the application to locally block the object in the application.

公开(公告)号：US11042654B2

公开(公告)日：2021-06-22

申请号：US16216400

申请日：2018-12-11

Applicant: SAP SE

Inventor： Kathrin Nos ,  Michael Engler ,  Matthias Vogel

IPC: G06F21/60 ,  G06F21/62 ,  H04L29/06 ,  G06F16/907

Abstract: Metadata describing access control capabilities of a database technology resource is received from an access control system. Access restrictions for accessing data of the database resource by users of an application that have a role are received from an application developer. A role maintenance user interface is generated, using the metadata, for assigning the role to users of the application. Attribute values for creating an instance of the role for a user are received, using the role maintenance user interface. The instance of the role is created for the user based on the received attribute values and the access restrictions. A request from the application for the user to access the database resource is received by the access control system when the user is logged into the application. The access restrictions are applied by the access control system in the database resource when the database resource is accessed.

公开(公告)号：US20250124160A1

公开(公告)日：2025-04-17

申请号：US18487293

申请日：2023-10-16

Applicant: SAP SE

Inventor： Benny Rolle ,  Stefan Hesse ,  Matthias Vogel ,  Carsten Pluder

IPC: G06F21/62 ,  H04L41/5074

Abstract: The present disclosure involves systems, software, and computer implemented methods for automating handling of data subject requests for data privacy integration protocols. One example method includes receiving a ticket for performing a data privacy integration protocol for a data subject. A work package that includes a work package parameter that is based on a ticket parameter is provided to responder applications. Processing of the work package by responder applications includes determining, for at least one object associated with the data subject, purposes associated with the object. The responder application determines, for each purpose, a purpose setting that corresponds to the work package parameter. The responder application processes the work package based on the work package parameter and the purpose settings and provides feedback to a data privacy integration service, which processes the feedback, to continue the data privacy integration protocol for the ticket.