NUTS

• US 20180075262A1
• Filed: 08/31/2017
• Published: 03/15/2018
• Est. Priority Date: 09/15/2016
• Status: Active Grant

• Current Assignee: Nuts Holdings, LLC
• Original Assignee: Nuts Holdings, LLC
• Inventors: Auh, Yoon Ho
• Granted Patent: US 10,671,764 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/258 Data format conversion from or to a database
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A lock node for storing data and a protected storage unit. The lock node includes an input section which provides a plurality of key maps, each corresponding to one of a plurality of primary keys, respectively, applied to the input section, each key map including at least one main key, a variable lock section producing a derived key from a logical operation on the main keys corresponding to the primary keys applied to the input section, and an output section producing the data in response to the derived key.

Claims

1. A lock node for storing data comprising:

an input section which provides a plurality of key maps, each corresponding to one of a plurality of primary keys, respectively, applied to the input section, each key map including at least one main key;

a variable lock section producing a derived key from a logical operation on the main keys corresponding to the primary keys applied to the input section; and

an output section producing the data in response to the derived key.

2. The lock node of claim 1, wherein each key map includes at least one access attribute key, the input section further utilizing the at least one access attribute key to provide at least one access role key which defines operational permissions on the data, wherein the at least one access role key is based on permissions associated with the designated primary key resulting in the particular key map.

3. The lock node of claim 2, further comprising combining the at least one access role key in a logical operation with other provided at least one access role keys to form a union of all the defined operational permissions on the data.

4. A protected data storage unit comprising:

a plurality of lock nodes for storing data, each of the lock nodes comprising;

an input section which provides a plurality of key maps, each corresponding to one of a plurality of primary keys, respectively, applied to the input section, each key map including at least one main key;

a variable lock section producing a derived key from a logical operation on the main keys corresponding to the primary keys applied to the input section; and

an output section producing the data in response to the derived key;

a keyhole lock node of the plurality of lock nodes having a key map for each of the designated primary keys which further may include at least one access attribute key, the access attribute key providing role based access control based on the corresponding primary key within the protected data storage unit; and

at least one of the lock nodes providing an output key which may act as a designated primary key for another of the lock nodes.

5. The lock node of claim 4, wherein the input section also provides at least one access key for another lock node.

6. The storage unit of claim 4, wherein at least one key map includes at least one stratum key, the input section of at least one lock node different from the lock node including the key map enabling the at least one stratum key to provide a different key map for the at least one different lock node.

7. The storage unit of claim 6, wherein the at least one stratum key and the input sections of the lock nodes in the storage unit control which lock nodes within the storage unit are accessible for the particular designated primary key.

8. The storage unit of claim 4, wherein the storage unit stores at least one log involving the storage unit.

9. The storage unit of claim 8, wherein the at least one log is stored in encrypted form.

10. The storage unit of claim 8, wherein parameters control what is logged and what is not logged.

11. The storage unit of claim 8, wherein parameters control a level of detail in the at least one log.

12. The storage unit of claim 8, wherein parameters control a type of log to produce.

13. The storage unit of claim 8, wherein parameters control a method of producing a log entry.

14. The storage unit of claim 12, wherein the type of log comprises log entries involving processing events involving the storage unit.

15. The storage unit of claim 12, wherein the type of log comprises comprises historical revision entries involving the data in the data storage unit.

16. A plurality of protected data storage units each comprising:

a data storage section constructed and arranged to store data; and

at least one log section involving that individual storage unit across applications accessing that individual storage unit.

17. The storage units of claim 16, wherein the at least one log section is stored in encrypted form.

18. The storage units of claim 16, wherein parameters control what is logged and what is not logged.

19. The storage units of claim 16, wherein parameters control a level of detail in the at least one log section.

20. The storage units of claim 16, wherein parameters control a type of log to produce.

21. The storage units of claim 16, wherein parameters control a method of producing a log entry.

22. The storage units of claim 20, wherein the type of log comprises log entries involving processing events involving that individual storage unit.

23. The storage units of claim 20, wherein the type of log comprises historical revision entries involving the data in that individual data storage unit.

24. A method of processing data comprising:

at least one processor accessing a data storage unit, the data storage unit providing the identity of at least one application that will operate on the data in the data storage unit;

the at least one processor retrieving the at least one application from a collection of applications; and

the at least one processor using the at least one application to operate on the data in the data storage unit.

25. The method of claim 24, wherein the at least one application reads the data in the data storage unit.

26. The method of claim 24, wherein the at least one application writes the data to the data storage unit or to a different data storage unit.

27. The method of claim 24, wherein the at least one application causes the data to be displayed.

28. The method of claim 24, wherein the at least one application converts the data from one version to another version.

29. The method of claim 24, wherein the at least one application operates on the information associated with the data in the data storage unit.