Federated data management between partner systems

Patent metadata

Field	Value
Publication number	US-11201747-B2
Application number	US-201916511281-A
Country	US
Kind code	B2
Filing date	Jul 15, 2019
Priority date	Jul 15, 2019
Publication date	Dec 14, 2021
Grant date	Dec 14, 2021

Abstract

Methods, systems, and computer-readable storage media for federated data management between partner systems is provided. A hash structure is generated for a first data object and includes a first root hash value. The hash structure maps properties of the first data object with corresponding visibility levels for the first data object. The first root hash value is notarized to store the first root hash value in a blockchain network. A request is received to share data for the first data object from a first partner system to a second partner system. The first partner system determines the data to be shared with the second partner system based on a visibility criteria defined in relation to the first data object and the second partner system. The data and a hash proof for the data for verification of authenticity of the data is shared with the second partner system.

First claim

What is claimed is:

1. A computer implemented method for federated data management between partner systems in a set of partner systems, the method being executed by one or more processors and comprising:
generating a hash structure for a first data object, the hash structure including a first root hash value, the hash structure mapping one or more sets of properties of the first data object with corresponding one or more visibility levels for the first data object;
notarizing the first root hash value to store the first root hash value in a blockchain network, the first root hash value being notarized in response to a transaction request received from a first partner system of the set of partner systems;
receiving a request, at the first partner system, to share data for the first data object to a second partner system;
determining, by the first partner system, the data to be shared with the second partner system based on a visibility criteria defined in relation to the first data object and the second partner system, wherein the data includes a set of key-value pair objects associated with a first visibility level of the one or more visibility levels of the first data object; and
sharing the data and a hash proof for the data for verification of authenticity of the data as compared to content of the first data object, the hash proof being generated by the first partner system based on the set of key-value pair objects.

2. The method of claim 1 , wherein the hash proof is a Merkle proof that defines a minimum set of hash values from the hash structure for the first data object to be used to calculate a root hash value and verify authenticity of the data by comparing with the first root hash value.

3. The method of claim 1 , wherein the set of key-value pair objects associated with the first visibility level of the first data object are associated with a subset of properties of the first data object.

4. The method of claim 1 , further comprising:
transforming a map defined the one or more visibility levels for key-value pair objects into hash values to generate the hash structure, the key-value pairs objects comprising properties and property values of the first data objects,
wherein the hash structure is a Merkle tree hash structure, the first root hash value is a Merkle tree root hash value, and the hash proof is a Merkle proof.

5. The method of claim 4 , wherein the map defines the one or more sets of the properties of the first data objects, wherein a first set of properties from the one or more sets of properties is associated with the set of key-value pair objects of the first visibility level, and wherein a second set of the properties of the first data object is associated with a second visibility level, the first set of the properties being different from the second set of the properties.

6. The method of claim 1 , further comprising:
calculating, at the second partner system, the root hash value based on the hash proof for the first data object, the hash proof being a Merkle proof and the root hash value being a Merkle tree root hash value; and
evaluating the root hash value to determine whether the root hash value corresponds to the first root hash value to verify authenticity of the data being shared.

7. The method of claim 4 , further comprising:
in response to determining that the root hash value correspond to the first root hash value, determining whether the first root hash value is pointed by another root hash value in a stored chain of notarized root hash values at the blockchain network; and
when the first root hash value is a leaf node of the stored chain, determining the first data object as a current version of a document associated with the first data object.

8. The method of claim 1 , wherein one property of the properties of the first data object is associated with a plurality of key-value pair objects correspondingly associated with different partner systems of the set of partner systems, and wherein a set of key-value pair objects are associated with a visibility level associated with a plurality of partner systems.

9. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for federated data management between partner systems in a set of partner systems, the operations comprising:
generating a hash structure for a first data object, the hash structure including a first root hash value, the hash structure mapping one or more sets of properties of the first data object with corresponding one or more visibility levels for the first data object;
notarizing the first root hash value to store the first root hash value in a blockchain network, the first root hash value being notarized in response to a transaction request received from a first partner system of the set of partner systems;
receiving a request, at the first partner system, to share data for the first data object to a second partner system;
determining, by the first partner system, the data to be shared with the second partner system based on a visibility criteria defined in relation to the first data object and the second partner system, wherein the data includes a set of key-value pair objects associated with a first visibility level of the one or more visibility levels of the first data object; and
sharing the data and a hash proof for the data for verification of authenticity of the data as compared to content of the first data object, the hash proof being generated by the first partner system based on the set of key-value pair objects.

10. The computer-readable medium of claim 9 , wherein the hash proof is a Merkle proof that defines a minimum set of hash values from the hash structure for the first data object to be used to calculate a root hash value and verify authenticity of the data by comparing with the first root hash value, and wherein the set of key-value pair objects associated with the first visibility level of the first data object are associated with a subset of properties of the first data object.

11. The computer-readable medium of claim 9 , further comprising instructions, which when executed causes the one or more processors to perform operations comprising:
transforming a map defined the one or more visibility levels for key-value pair objects into hash values to generate the hash structure, the key-value pairs objects comprising properties and property values of the first data objects,
wherein the hash structure is a Merkle tree hash structure, the first root hash value is a Merkle tree root hash value, and the hash proof is a Merkle proof.

12. The computer-readable medium of claim 11 , wherein the map defines the one or more sets of the properties of the first data objects, wherein a first set of properties from the one or more sets of properties is associated with the set of key-value pair objects of the first visibility level, and wherein a second set of the properties of the first data object is associated with a second visibility level, the first set of the properties being different from the second set of the properties.

13. The computer-readable medium of claim 9 , further comprising instructions, which when executed causes the one or more processors to perform operations comprising:
calculating, at the second partner system, the root hash value based on the hash proof for the first data object, the hash proof being a Merkle proof and the root hash value being a Merkle tree root hash value; and
evaluating the root hash value to determine whether the root hash v

Assignees

• Sap Se

Inventors

• Scherrer Arne
• Bethge Ricarda
• Held Mathias
• Shakeri Mehran
• Rauch David

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/3218

  using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs · CPC title

• H04L9/3242 Primary

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/3239 Primary

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title