Abstract: A rollover system is provided to facilitate transitioning of client devices in a shared account network environment, from an old password to a new replacement password. The switching of passwords may take place gradually during a rollout period for client devices without required downtime and reducing a risk of lockouts. During the rollover period, a prior salt is temporarily carried over to a new verifier for the replacement password. Two new verifiers are generated: a temporary new verifier using the old salt for verification during the rollover period and another new verifier using a different new salt for verification after the rollover period had expired. During the rollover period, authentication involves the use of the temporary new verifier with the old salt or by the old verifier and old salt of the prior password. After the rollover period, authentication is based on the new verifier with a new salt.

Abstract: Embodiments afford secure transfer of security key type(s) between different database servers having different key hierarchies. For example, a key transfer may occur from a source server to a target server during a database migration process. Particular embodiments comprise a SQL transfer command statement (e.g., TRANSFER ENCRYPTION KEY) recognized by an engine. Syntax of the SQL transfer command includes a password and a filename for a security key. Upon receiving the SQL transfer command, the engine references an information repository to identify a relevant key hierarchy and key type, encrypts the security key with a key derived from password, and stores (exports) the encrypted security key in a file for consumption (import) at the target server. The SQL transfer command may further comprise a direction component determining flow of key information, and an override function to deal with error messages arising from any already-existing security key having the same name.

Abstract: A rollover system is provided to facilitate transitioning of client devices in a shared account network environment, from an old password to a new replacement password. The switching of passwords may take place gradually during a rollout period for client devices without required downtime and reducing a risk of lockouts. During the rollover period, a prior salt is temporarily carried over to a new verifier for the replacement password. Two new verifiers are generated: a temporary new verifier using the old salt for verification during the rollover period and another new verifier using a different new salt for verification after the rollover period had expired. During the rollover period, authentication involves the use of the temporary new verifier with the old salt or by the old verifier and old salt of the prior password. After the rollover period, authentication is based on the new verifier with a new salt.

Abstract: A rollover system is provided to facilitate transitioning of client devices in a shared account network environment, from an old password to a new replacement password. The switching of passwords may take place gradually during a rollout period for client devices without required downtime and reducing a risk of lockouts. During the rollover period, a prior salt is temporarily carried over to a new verifier for the replacement password. Two new verifiers are generated: a temporary new verifier using the old salt for verification during the rollover period and another new verifier using a different new salt for verification after the rollover period had expired. During the rollover period, authentication involves the use of the temporary new verifier with the old salt or by the old verifier and old salt of the prior password. After the rollover period, authentication is based on the new verifier with a new salt.

Abstract: Embodiments afford secure transfer of security key type(s) between different database servers having different key hierarchies. For example, a key transfer may occur from a source server to a target server during a database migration process. Particular embodiments comprise a SQL transfer command statement (e.g., TRANSFER ENCRYPTION KEY) recognized by an engine. Syntax of the SQL transfer command includes a password and a filename for a security key. Upon receiving the SQL transfer command, the engine references an information repository to identify a relevant key hierarchy and key type, encrypts the security key with a key derived from password, and stores (exports) the encrypted security key in a file for consumption (import) at the target server. The SQL transfer command may further comprise a direction component determining flow of key information, and an override function to deal with error messages arising from any already-existing security key having the same name.

Abstract: Disclosed herein are system, method, and computer program product embodiments for database modification and processing functionality. An embodiment operates by providing a batch of values stored in rows corresponding to a particular column responsive to a request to encrypt the values of the particular column. Encrypted values corresponding the batch of values are received and stored in a hidden column. A status of the rows corresponding to batch of values of the hidden column is updated to indicate in which rows of the hidden column the received encrypted values have been stored. Updated encrypted values are received and stored in the hidden column. The particular column is replaced with the hidden column.

Abstract: Methods, systems and computer-readable storage mediums encoded with computer programs executed by one or more processors for conditional role activation in a database are disclosed. In an embodiment, a request to activate a role for a user of a database system is received, and a predicate for conditional activation of the role is determined. The conditions of the predicate are evaluated, and if the conditions of the predicate are satisfied, the role is activated for the user. If, however, one or more of the conditions of the predicate are not satisfied, the role is not activated for the user.

Abstract: Methods, systems and computer-readable storage mediums encoded with computer programs executed by one or more processors for conditional role activation in a database are disclosed. In an embodiment, a request to activate a role for a user of a database system is received, and a predicate for conditional activation of the role is determined. The conditions of the predicate are evaluated, and if the conditions of the predicate are satisfied, the role is activated for the user. If, however, one or more of the conditions of the predicate are not satisfied, the role is not activated for the user.

Abstract: A database system providing encrypted column data support with decrypt default functionality. In a database system, a method providing automated encryption support for column data comprises steps of: defining Structured Query Language (SQL) extensions for creating and managing column encryption keys and database tables with encrypted column data; receiving an SQL statement specifying creation of a column encryption key; receiving an SQL statement specifying creation of a database table having particular column data encrypted with the column encryption key; receiving an SQL statement specifying a default value to be provided in response to requests for the column data without decrypt permission; in response to a subsequent database operation requesting encrypted column data from a user with decrypt permission, automatically decrypting the column data; and in response to a subsequent database operation requesting the encrypted column data from a user without decrypt permission, returning the default value.

Abstract: A database system providing SQL extensions for automated encryption and decryption of column data is described. In one embodiment, for example, in a database system, a method is described for providing automated encryption support for column data, the method comprises steps of: defining Structured Query Language (SQL) extensions for creating and managing column encryption keys, and for creating and managing database tables with encrypted column data; receiving an SQL statement specifying creation of a particular column encryption key; receiving an SQL statement specifying creation of a database table having particular column data encrypted with the particular column encryption key; and in response to a subsequent database operation that requires the particular column data that has been encrypted, automatically decrypting the particular column data for use by the database operation.