COMPUTER IMPLEMENTED METHOD FOR PERFORMING CLOUD COMPUTING ON DATA BEING STORED PSEUDONYMOUSLY IN A DATABASE

• US 20110179286A1
• Filed: 12/15/2010
• Published: 07/21/2011
• Est. Priority Date: 12/18/2009
• Status: Active Grant

• Current Assignee: Adrian Spalka, CompuGroup Medical SE
• Original Assignee: Compugroup Medical AG (CompuGroup Medical SE & Co. KGaA)
• Inventors: Spalka, Adrian, Gotthardt, Frank, Lehnhardt, Jan
• Granted Patent: US 8,661,247 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

The invention relates to a computer implemented method for performing cloud computing on data of a first user employing cloud components, the cloud components comprising a first database and a data processing component, wherein an asymmetric cryptographic key pair is associated with the first user, said asymmetric cryptographic key pair comprising a public key and a private key, the data being stored pseudonymously non-encrypted in the first database with the data being assigned to an identifier, wherein the identifier comprises the public key, the method comprising retrieving the data from the first database by the data processing component, wherein retrieving the data from the first database comprises receiving the identifier and retrieving the data assigned to the identifier from the first database, wherein the method further comprises processing the retrieved data by the data processing component and providing a result of the analysis.

Claims

1. A computer implemented method for performing cloud computing on data of a first user employing cloud components, the cloud components comprising a first database and a data processing component, wherein an asymmetric cryptographic key pair is associated with the first user, said asymmetric cryptographic key pair comprising a public key and a private key, the data being stored pseudonymously non-encrypted in the first database with the data being assigned to an identifier, wherein the identifier comprises the public key, the method comprising retrieving the data from the first database by the data processing component, wherein retrieving the data from the first database comprises receiving the identifier and retrieving the data assigned to the identifier from the first database, wherein the method further comprises processing the retrieved data by the data processing component and providing a result of the analysis.

2. The method of claim 1, wherein the cloud components further comprise a second database, wherein initially the data is only stored encrypted with the public key in the second database, wherein the method further comprises retrieving the data from the second database, decrypting it and storing the unencrypted data pseudonymously in the first database assigned to the identifier, wherein after said storage of the data in the first database the data is retrieved from the first data-base by the data processing component, wherein the data processing is only performed on said data retrieved from the first database .

3. The method of claim 2, further comprising storing a result of the data processing step in the first database assigned to the identifier.

4. The method of claim 3, further comprising retrieving the result of the data from the first database, storing said retrieved data encrypted with the public key in the second database and deleting the result of the data processing from the first database.

5. The method of claim 2, further comprising sending the result of the data processing step to the first user with the recipient address to which the result is sent comprising the public key .

6. The method of claim 5, wherein said result is sent encrypted with the public key to the first user.

7. The method of claim 6, wherein said result is sent from a second user of the data processing component, wherein a second user asymmetric cryptographic key pair is associated with the second user, said key pair comprising a public sender key and a private sender key, the method further comprising generating a signature of the result using the private sender key and sending the signature to said first user as well as the second user'"'"'s public key for signature verification.

8. The method of claim 1, wherein the identifier corresponds to the public key of the first user.

9. The method of claim 1, wherein the identifier is a pseudonym of the first user and/or wherein the identifier is an access key to the data in the first database .

10. The method of claim 1, wherein processing the retrieved data comprises:

receiving a set of rules, the set of rules describing data processing steps,

analyzing the retrieved data by applying the set of rules,

providing a result of the analysis.

11. The method of claim 10, wherein the data processing component comprises an inference engine.

15. A computer implemented method for generating a public key and a private key for being used in the method according to claim 1, the public key being the public key of the first or the second user and the private key being the private key of the first or the second user, the method comprising:

entering a user-selected secret,

storing the user-selected secret in memory,

computing the private key by applying an embedding and randomizing function onto the secret,

storing the private key in memory,

computing the public key using the private key, the public key and the private key forming the asymmetric cryptographic key pair,

erasing the secret and the private key from the memory as well as any temporary intermediate result,

outputting the public key.

16. The method of claim 15, wherein the embedding and randomizing function comprises:

applying a first one-way function on the secret to provide a first value,

providing a random number,

embedding the random number and the first value by combining them to provide a combination,

applying a second one-way function on the combination to provide a second value, wherein the second value constitutes the private key .

17. The method of claim 15, wherein the computation of the public key is performed by ECC cryptography.

18. A computer program product comprising computer executable instructions to perform the method steps in claim 1.

12. A computer implemented method for receiving a result from a second user of a data processing component of a network cloud by a first user, wherein an asymmetric cryptographic key pair is associated with the first user, said key pair comprising a public key and a private key, the method comprising receiving the result by said first user with the recipient address at which the result is received comprising the public key.

13. A computer implemented method for storing data of a first user in a first or a second database of a network cloud, the first user having a private key, the method comprising:

calculating a set of public keys, wherein the private key and each public key of the set of public keys form an asymmetric cryptographic key pair,

storing the data encrypted with one of the public keys and assigned to the first user in the second database or

storing the data pseudonymously in the first database with the data being assigned to an identifier, wherein the identifier comprises one of the public keys.

14. The method of claim 13 further comprising directly receiving the private key or generating the private key, wherein generating the private key comprises receiving an input value and applying a cryptographic one-way function to the input value for generation of the private key, wherein the cryptographic one-way function is an injective function.

19. A cloud network for performing cloud computing on data of a first user, the cloud comprising cloud components, the cloud components comprising a first database and a data processing component, wherein an asymmetric cryptographic key pair is associated with the first user, said asymmetric cryptographic key pair comprising a public key and a private key, the data being stored pseudonymously non-encrypted in the first database with the data being assigned to an identifier, wherein the identifier comprises the public key, wherein the data processing component is adapted for retrieving the data from the first database, wherein retrieving the data from the first database comprises receiving the identifier and retrieving the data assigned to the identifier from the first database, wherein the data processing component is further adapted for processing the retrieved data and providing a result of the analysis.

20. A computer system for receiving a result from a second user of a network cloud by a first user, wherein an asymmetric cryptographic key pair is associated with the first user, said key pair comprising a public key and a private key, the system comprising means for receiving the result by said first user with the recipient address at which the result is received comprising the public key.

21. A computer system for storing data of a first user in a first or a second database of a network cloud, the first user having a private key, the system comprising:

processor means for calculating a set of public keys, wherein the private key and each public key of the set of public keys form an asymmetric cryptographic key pair,

means for storing the data encrypted with one of the public keys and assigned to the first user in the second database or

means for storing the data pseudonymously in the first database with the data being assigned to an identifier, wherein the identifier comprises one