Enabling access to data

• US 10,133,872 B2
• Filed: 02/18/2016
• Issued: 11/20/2018
• Est. Priority Date: 08/19/2013
• Status: Active Grant

• Current Assignee: Visa Europe Limited (Visa, Inc.)
• Original Assignee: Visa Europe Limited (Visa, Inc.)
• Inventors: Taratine, Boris, Lewis, Malcolm
• Primary Examiner(s): Do, Khang
• Application Number:
  US15/047,496
• Publication Number:
  US 20160171224A1
• Time in Patent Office: 1,006 Days
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/25 Integrating or interfacing systems involving database management systems
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Methods, systems, apparatus and computer programs for enabling access to data by a requesting party. A plurality of sets of data are generated. A one one-way function is then used to generate a plurality of keys each associated with a respective one of the plurality of sets. Information associated with the data in a given set is used as an input to the one-way function when generating the key for that set. The keys are distributed to requesting parties. Subsequently, a requesting party may make a data access request using the received key. Upon receipt of a key, access may be enabled to the data. The requesting party may then generate validation data from information associated with at least a part of the received data and validating the received data by comparing the validation data to data derived from the received key.

Claims

1. A method of enabling access to data, the method comprising:

generating a plurality of sets of data, each set of data identifying one or more data portions and at least one data portion being identified in two or more sets of data;

using a one-way function to generate a plurality of keys each associated with a respective one of the plurality of sets, wherein information associated with a particular set of data from said plurality sets of data is used as an input to the one-way function when generating a key associated with the particular set, wherein generating the key associated with the particular set includes generating first, second and third keys, the third key being related to a combination of at least the first and second keys, and associating the third key with the particular set;

arranging for the keys including the first and second keys to be available for distribution to one or more requesting parties, wherein the distribution of the keys is controlled to restrict access to the plurality of sets of data;

receiving a data access request comprising at least one key from a requesting party; and

enabling access to data in the particular set for the requesting party, based on the received key, wherein access to the particular set is granted in dependence on receipt of either a combination of the first and second keys or the third key.

2. The method of claim 1, wherein the information associated with a set of data identifies the content of the set of data.

3. The method of claim 1, wherein the information associated with a set of data comprises at least a part of the content of the set of data.

4. The method of claim 1, comprising using one or more salt values as inputs to the one-way function.

5. The method of claim 4, comprising storing a salt value used to generate a given key as data in a set accessible using the given key.

6. The method of claim 1, wherein the one-way function comprises one or more of:

a hash function;

a cryptographic signing function;

a random number generator; and

a pseudo-random number generator.

7. The method of claim 1, wherein the keys have high entropy.

8. The method of claim 1, wherein access is enabled for a limited number of requests comprising a given key.

9. The method of claim 8 comprising generating a plurality of keys associated with a given set.

10. The method of claim 8, comprising generating a second key associated with a given set in response to receiving a request comprising a first key associated with a given set.

11. The method of claim 1, comprising:

associating a plurality of keys with a said set;

arranging for the plurality of keys to be available for distribution; and

enabling access to the said set of data in dependence on a predetermined criterion being satisfied, said predetermined criterion being dependent on receipt of two or more of the plurality of keys.

12. The method of claim 1, comprising associating the first and second keys with respective further sets.

13. The method of claim 1, comprising storing the keys and information identifying the sets in a lookup table.

14. The method of claim 13, comprising identifying data in a set associated with the received key in the lookup table.

15. The method of claim 1, comprising transmitting the keys using a first protocol whereby to make the keys available for distribution, and wherein at least a part of the data in a set is suitable for communication via a second, different, protocol.

16. The method of claim 15, comprising enabling access to the data using a second protocol.

19. The method of claim 1, further comprising:

receiving a second data access request comprising said key in the data access request, the second data access request being received from an unauthorized requester to request access to the data in said set; and

refusing the unauthorized requester from accessing the data in said set.

20. The method of claim 1, wherein the plurality of keys includes at least two different keys that are generated for different requesting parties for the same set of data.

17. Apparatus for enabling access to data, the apparatus configured to:

generate a plurality of sets of data, each set identifying one or more data portions and at least one data portion being identified in two or more sets;

use a one-way function to generate a plurality of keys each associated with a respective one of the plurality of sets, wherein information associated with a particular set of data from said plurality sets of data is used as an input to the one-way function when generating a key associated with the particular set, wherein generating the key associated with the particular set includes generating first, second and third keys, the third key being related to a combination of at least the first and second keys, and associating the third key with the particular set;

arrange for the keys including the first and second keys to be available for distribution to one or more requesting parties, wherein the distribution of the keys is controlled to restrict access to the plurality of sets of data;

receive a data access request comprising at least one key from a requesting party; and

enable access to data in the particular set for the requesting party, based on the received key, wherein access to the particular set is granted in dependence on receipt of either a combination of the first and second keys or the third key.

18. A non-transitory computer-readable medium comprising computer-executable instructions which, when executed by a processor, cause a computing device to perform a method of enabling access to data, the method comprising:

generating a plurality of sets of data, each set identifying one or more data portions and at least one data portion being identified in two or more sets;

using a one-way function to generate a plurality of keys each associated with a respective one of the plurality of sets, wherein information associated with a particular set of data from said plurality sets of data is used as an input to the one-way function when generating a key associated with the particular set, wherein generating the key associated with the particular set includes generating first, second and third keys, the third key being related to a combination of at least the first and second keys, and associating the third key with the particular set;

arranging for the keys including the first and second keys to be available for distribution to one or more requesting parties, wherein the distribution of the keys is controlled to restrict access to the plurality of sets of data;

receiving a data access request comprising at least one key from a said requesting party; and

enabling access-to data in the particular set for the requesting party, based on the received key, wherein access to the particular set is granted in dependence on receipt of either a combination of the first and second keys or the third key.