Cross domain discovery

• US 20110099203A1
• Filed: 10/27/2009
• Published: 04/28/2011
• Est. Priority Date: 10/27/2009
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Fastring, Richard Arthur
• Granted Patent: US 8,874,929 B2
• Time in Patent Office: Days
• US Class Current: 707/783
• CPC Class Codes: G06F 16/289 Object oriented databases
• CPC Class Codes: G06F 16/5838 using colour
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Aspects of the disclosure provide methods and systems for cross domain discovery. According to the disclosure, an object can include multiple entities defined by an originator. The multiple entities have different scopes corresponding to different access restrictions. Further, the originator defines keywords for each of the multiple entities. A system for cross domain discovery stores the multiple entities in an object service component, and stores the keywords and access restrictions in a search service component. The search service component conducts a search based on the keywords and access restrictions in response to a search request from a user. An entity is provided to the user based on the user'"'"'s credential and the searching.

Claims

1. A method for searching, comprising:

storing first keywords in association with a first entity of an object, and second keywords in association with a second entity of the object by a search service component, the first entity having a first restriction level and the second entity having a second restriction level;

determining a search request having the first restriction level matching the first keywords by the search service component; and

responding to the searching request with the first entity.

2. The method of claim 1, wherein storing the first keywords in association with the first entity and the second keywords in association with the second entity by the search service further comprises:

storing the first keywords and the second keywords in a hash table.

3. The method of claim 1, further comprising:

determining the search request being authorized by a policy service component.

4. The method of claim 1, further comprising:

determining the search request having the first restriction level based on a credential of an originator of the search request.

5. The method of claim 1, wherein responding to the search request with the first entity further comprises:

creating a hit entry including a reference to the object stored in an object service component.

6. A method for searching, comprising:

storing an object having a first entity with a first restriction level and a second entity with a second restriction level in an object service component; and

transmitting first keywords in association with the first entity and second keywords in association with the second entity to a search service component, wherein the search service component stores the first keywords and the second keywords, determines a search request having the first restriction level matching the first keywords and creates a hit entry including a reference to the first entity stored in the object service component.

7. The method of claim 6, wherein storing the object having the first entity with the first restriction level and the second entity with the second restriction level in the object service component, further comprises:

encrypting the first entity using a first symmetric key;

storing the encrypted first entity in the object service component;

encrypting the second entity using a second symmetric key; and

storing the encrypted second entity in the object service component.

8. The method of claim 7, further comprising:

obtaining the first symmetric key and the second symmetric key in association with the object.

9. The method of claim 8, further comprising:

splitting the first symmetric key into a first key split and a second key split; and

splitting the second symmetric key into a third key split and a fourth key split.

10. The method of claim 9, further comprising:

encrypting the first key split and the third key split using a public key of a first asymmetric key pair belonging to the object service; and

encrypting the second key split and the fourth key split using a public key of a second asymmetric key pair belonging to the policy service.

11. The method of claim 10, further comprising:

transmitting the encrypted first key split, the encrypted second key split, the encrypted third key split and the encrypted fourth key split to the search service component; and

deleting the first key split, the second key split, the third key split and the fourth key split.

12. The method of claim 10, further comprising:

decrypting the encrypted first key split using a private key of the first asymmetric key pair belonging to the object service.

13. The method of claim 10, further comprising:

receiving a re-encrypted second key split, wherein the re-encrypted second key split is generated by decrypting the encrypted second key split using a private key of the second asymmetric key pair belonging to the policy service, and re-encrypting the second key split using the public key of the first asymmetric key pair belonging to the object service component; and

decrypting the re-encrypted second key split using a private key of the first asymmetric key pair belonging to the object service.

14. The method of claim 13, further comprising:

combining the decrypted first key split and the decrypted second key split to recover the first symmetric key; and

decrypting the encrypted first entity using the recovered first symmetric key.

15. A system for cross domain discovery, comprising:

an object service component configured to store an object having a first entity with a first restriction level and a second entity with a second restriction level; and

a search service component configured to store first keywords in association with the first entity, and second keywords in association with the second entity, determine a search request having the first restriction level matching the first keywords, and respond to the search request with the first entity stored in the object service component.

16. The system of claim 15, further comprising:

a policy service component configured to authorize the search request.

17. The system of claim 15, wherein the search service component further comprises:

a hash table configured to store at least one of the first keywords and the second keywords.

18. The system of claim 15, further comprising:

a user service component configured to receive the search request from a user, and associate a credential of the user with the search request.

19. The system of claim 16, further comprising:

a key service component configured to generate a first symmetric key and a second symmetric in association with the object, wherein

the object service component is further configured to

encrypt the first entity using the first symmetric key,

encrypt the second entity using a second symmetric key,

split the first symmetric key into a first key split and a second key split,

split the second symmetric key into a third key split and a fourth key split,

encrypt the first key split and the third key split using a public key of a first asymmetric key pair belonging to the object service, and

encrypt the second key split and the fourth key split using a public key of a second asymmetric key pair belonging to the policy service.

20. The system of claim 19, wherein the object service component is configured to

transmit the encrypted first key split, the encrypted second key split, the encrypted third key split and the encrypted fourth key split to the search service component;

and

delete the first key split, the second key split, the third key split and the fourth key split.

21. The system of claim 19, wherein the object service component is further configured to

decrypt the encrypted first key split using a private key of the first asymmetric key pair belonging to the object service,

receive a re-encrypted second key split, wherein the re-encrypted second key split is generated by decrypting the encrypted second key split using a private key of the second asymmetric key pair belonging to the policy service, and re-encrypting the second key split using the public key of the first asymmetric key pair belonging to the object service component,

decrypt the re-encrypted second key split using the private key of the first asymmetric key pair belonging to the object service,

combine the decrypted first key split and the decrypted second key split to recover the first symmetric key;

and

decrypt the encrypted first entity using the recovered first symmetric key.