Zero knowledge attribute storage and retrieval

• US 20080209205A1
• Filed: 02/27/2007
• Published: 08/28/2008
• Est. Priority Date: 02/27/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Rowley, Peter A.
• Granted Patent: US 8,108,918 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

Some embodiments of zero knowledge attribute storage and retrieval have been presented. In one embodiment, the content of a piece of data is encrypted at a client machine. Further, an identifier of the piece of data is hashed at the client machine. The encrypted content and the hashed identifier may be stored in a database maintained by a server without disclosing the content of the data to the server.

Claims

1. A method comprising:

encrypting content of a piece of data at a client machine;

hashing an identifier of the piece of data at the client machine; and

storing the encrypted content and the hashed identifier in a database maintained by a server without disclosing the content of the piece of data to the server.

2. The method of claim 1, wherein the piece of data comprises identity information of a user.

3. The method of claim 1, further comprising:

retrieving the encrypted content of the piece of data using the hashed identifier from the database; and

decrypting the encrypted content at the client machine.

4. The method of claim 1, further comprising:

the client machine requesting the piece of data from an authoritative party in response to a data request from a third party.

5. The method of claim 1, wherein hashing the identifier comprises:

modifying the identifier to disassociate the content of the piece of data from the modified identifier.

6. The method of claim 1, wherein the server is coupled to the client machine via a publicly accessible network.

7. The method of claim 1, wherein encrypting the content comprises encrypting the content using a private key, wherein the method further comprises withholding the private key from the server.

8. An apparatus comprising:

an encryption module to encrypt content of a piece of data; and

a hashing module coupled to the encryption module to hash an identifier of the piece of data such that the hashed identifier of the piece of data is disassociated from the content of the piece of data, wherein the encrypted content is stored in a storage device using the hashed identifier.

9. The apparatus of claim 8, wherein the encryption module is operable to encrypt the content using a private key, which is withheld from the storage device.

10. The apparatus of claim 8, further comprising:

a network adapter to send the encrypted content of the piece of data and the hashed identifier via a network to a server managing the storage device, wherein the server is operable to store the encrypted content in the storage device using the hashed identifier.

11. The apparatus of claim 8, further comprising the storage device.

12. The apparatus of claim 8, further comprising:

a database access module to retrieve the encrypted content of the piece of data using the hashed identifier; and

a decryption module to decrypt the encrypted content.

13. The apparatus of claim 8, further comprising:

a database access module to retrieve the encrypted content of the piece of data using the hashed identifier from the storage device in response to a data request from a third party.

14. The apparatus of claim 8, wherein the piece of data comprises identity information of a user.

15. A system, comprising the apparatus of claim 8, the system further comprising:

the storage device; and

a server coupled to the storage device, the server operable to manage the storage device.

16. A machine-readable medium that provides instructions that, if executed by a processor, will cause the processor to perform operations comprising:

encrypting content of a piece of data at a client machine;

hashing an identifier of the piece of data at the client machine; and

storing the encrypted content and the hashed identifier in a database maintained by a server without disclosing the content of the piece of data to the server.

17. The machine-readable medium of claim 16, wherein the piece of data comprises identity information of a user.

18. The machine-readable medium of claim 16, wherein the operations further comprise:

retrieving the encrypted content of the piece of data using the hashed identifier from the database; and

decrypting the encrypted content at the client machine.

19. The machine-readable medium of claim 16, wherein the operations further comprise:

the client machine requesting the piece of data from an authoritative party in response to a data request from a third party.

20. The machine-readable medium of claim 16, wherein hashing the identifier comprises:

modifying the identifier to disassociate the content of the piece of data from the modified identifier.

21. The machine-readable medium of claim 16, wherein the server is coupled to the client machine via a publicly accessible network.

22. The machine-readable medium of claim 16, wherein encrypting the content comprises encrypting the content using a private key, wherein the operations further comprise withholding the private key from the server.