Protocol for Verifying Integrity of Remote Data

• US 20090290714A1
• Filed: 05/20/2008
• Published: 11/26/2009
• Est. Priority Date: 05/20/2008
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mityagin, Anton, Lauter, Kristin E., Charles, Denis X.
• Application Number:
  US12/123,688
• Publication Number:
  US 20090290714A1
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An exemplary method for verifying the integrity of remotely stored data includes providing a key; providing a fingerprint, the fingerprint generated using the key in a keyed cryptographic hash function as applied to data of known integrity; sending the key to a remote storage location that stores a copy of the data of known integrity; receiving a fingerprint from the remote storage location, the fingerprint generated using the key in a keyed cryptographic hash function as applied to the remotely stored copy of the data; and verifying the integrity of the remotely stored copy of the data based at least in part on comparing the provided fingerprint to the received fingerprint. Other exemplary methods, systems, etc., are also disclosed.

Claims

1. A method for verifying the integrity of remotely stored data, the method comprising:

providing a key;

providing a fingerprint, the fingerprint generated using the key in a keyed cryptographic hash function as applied to data of known integrity;

sending the key to a remote storage location that stores a copy of the data of known integrity;

receiving a fingerprint from the remote storage location, the fingerprint generated using the key in a keyed cryptographic hash function as applied to the remotely stored copy of the data; and

verifying the integrity of the remotely stored copy of the data based at least in part on comparing the provided fingerprint to the received fingerprint.

2. The method of claim 1 wherein the key comprises a bit string.

3. The method of claim 1 wherein the key comprises a randomly generated key.

4. The method of claim 1 wherein the key comprises one of a series of keys that correspond to the data of known integrity.

5. The method of claim 1 wherein the key comprises one of a series of keys generated by applying a pseudorandom number generator to a master key.

6. The method of claim 1 wherein the provided fingerprint comprises one of a series of fingerprints that correspond to the data of known integrity.

7. The method of claim 1 wherein the provided key and the provided fingerprint are provided as a pair.

8. The method of claim 1 wherein an owner of the data of known integrity provide the key and the fingerprint.

9. The method of claim 1 wherein the sending occurs according to a schedule.

10. The method of claim 1 further comprising providing more than one key and providing more than one fingerprint wherein each provided fingerprint corresponds to one of the provided keys.

11. The method of claim 1 wherein the verifying occurs at a computing device that is provided the key, that is provided the fingerprint, that sends the key to the remote storage location, and that receives the fingerprint from the remote storage location.

12. The method of claim 1 wherein the computing device performs the verifying without receiving a copy of the remotely stored copy of the data.

13. A computing device comprising:

one or more processors;

memory to store a key and a fingerprint generated using the key in a keyed cryptographic hash function as applied to data of known integrity; and

components comprising instructions to send the key to a remote storage location that stores a copy of the data of known integrity;

to receive a fingerprint from the remote storage location, the fingerprint generated using the key in a keyed cryptographic hash function as applied to the remotely stored copy of the data; and

to verify the integrity of the remotely stored copy of the data based at least in part on comparing the provided fingerprint to the received fingerprint.

14. The computing device of claim 13 further comprising storage to store the data of known integrity and to generate the fingerprint using the key in a keyed cryptographic hash function as applied to the data of known integrity.

15. The computing device of claim 13 further comprising storage to remotely store data owned by another.

16. A peer-to-peer system comprising:

a computing device configured to;

store data locally wherein the locally stored data comprises data owned by a local owner and a copy of data owned by a remote owner;

to receive a key associated with the copy of data owned by the remote owner;

to generate a fingerprint using the key in a keyed cryptographic hash function as applied to the copy of data owned by the remote owner; and

to send the fingerprint to another computing device in the peer-to-peer system for verifying the integrity of the copy of data owned by the remote owner.

17. The peer-to-peer system of claim 16 wherein the other computing device is configured to receive the fingerprint and to compare the fingerprint to a fingerprint generated using the key in a keyed cryptographic hash function as applied to data of known integrity owned by the remote owner.

18. The peer-to-peer system of claim 16 wherein the copy of data owned by the remote owner comprises a backup copy.

19. The peer-to-peer system of claim 16 comprising a computing device configured to generate a key and to generate a fingerprint using the key in a keyed cryptographic hash function as applied to data of known integrity.

20. The peer-to-peer system of claim 19 wherein the computing device is further configured to send the key and the fingerprint to one or more other computing devices in the peer-to-peer system.

21. The peer-to-peer system of claim 16 further comprising a schedule to schedule sending a key to one or more computing devices in the peer-to-peer system.

22. A method, implemented at least in part by a computing device, comprising:

scheduling issuance of challenges to check integrity of data stored by one or more parties wherein an issued challenge requires a challenged party to apply a keyed cryptographic hash function and wherein the challenged party acts to remotely store the data for a data owner; and

adjusting an issuance frequency for a party based at least in part on the party'"'"'s ability to meet one or more issued challenges.

23. The method of claim 22 further comprising obtaining challenge information from one or more owners of stored data.

24. The method of claim 23 wherein the obtaining occurs periodically and wherein the challenge information comprises new challenge information.