Method and apparatus for providing a scalable service platform using a network cache

• US 8,458,799 B2
• Filed: 06/30/2009
• Issued: 06/04/2013
• Est. Priority Date: 06/30/2009
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Fu, Yan, Vepslinen, Ari, Aarnio, Ari Antero, Vimpari, Markku Kalevi, Laitinen, Pekka
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US12/495,071
• Publication Number:
  US 20100332834A1
• Time in Patent Office: 1,435 Days
• Field of Search: 726/26, 380/278, 380/281
• US Class Current: 726/26
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0822 using key encryption key

Abstract

An approach is provided for building a scalable service platform by initiating transmission of encrypted data from a public network cache. An access control server platform determines a first authorization key for a user and a second authorization key for a resource, and then encrypts the resource with the second authorization key, and encrypts the second authorization key with the first authorization key. The access control server platform initiates distribution of the encrypted second authorization key with the encrypted resource over a network. The access control server platform further initiates caching the encrypted second authorization key with the encrypted resource that meets a predefined threshold value (e.g., a data size, an access frequency, a modification frequency, or an auditing requirement) in a cache in the network, and initiates transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity.

Claims

1. A method comprising:

determining a first authorization key for a user and a second authorization key for a resource;

encrypting the resource with the second authorization key;

encrypting the second authorization key with the first authorization key;

encrypting a text known to at least one authorized entity with the second authorization key;

initiating distribution of the encrypted text with the encrypted second authorization key and the encrypted resource over a network;

initiating caching of the encrypted text with the encrypted second authorization key and the encrypted resource in a cache in the network; and

initiating transmission of the cached and encrypted text with the cached and encrypted second authorization key and the cached and encrypted resource from the cache to the authorized entity, wherein the encrypted second authorization key is decrypted with the first authorization key, the encrypted text is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted text matches with the text known to the authorized entity.

2. A method according to claim 1, further comprising:

decrypting the encrypted second authorization key with the first authorization key; and

decrypting the encrypted resource with the decrypted second authorization key.

3. A method according to claim 1, wherein the at least one authorized entity is associated with the first authorization key, and wherein the at least one entity includes at least one of an owner of the resource, a contact of the owner, or a social group the owner belongs to.

4. A method according to claim 1, further comprising:

categorizing a plurality of resources by at least one of a data size, an access frequency, a modification frequency, an auditing requirement, or a combination thereof; and

determining a threshold value within each category for the caching step to apply to the resources,

wherein the caching step is applied to resources that meet the threshold values within the respective category, and

the encrypted second authorization key with the encrypted resource remain cached when the resources remain meeting the threshold value in the respective category.

5. A method according to claim 3, further comprising:

removing one authorized entity to prevent subsequent transmission of the cached and encrypted second authorization key as well as the cached and encrypted resource from the cache.

6. A method according to claim 3, wherein members of the social group share an identical first authorization key specific for the social group.

7. An apparatus comprising:

at least one processor; and

at least one memory including computer program code,

wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following;

determine a first authorization key for a user and a second authorization key for a resource;

encrypt the resource with the second authorization key;

encrypt the second authorization key with the first authorization key;

encrypt a text known to at least one authorized entity with the second authorization key;

initiate distribution of the encrypted text with the encrypted second authorization key and the encrypted resource over a network;

initiate caching of the encrypted text with the encrypted second authorization key and the encrypted resource in a cache in the network; and

initiate transmission of the cached and encrypted text with the cached and encrypted second authorization key and the cached and encrypted resource from the cache to the authorized entity, wherein the encrypted second authorization key is decrypted with the first authorization key, the encrypted text is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted text matches with the text known to the authorized entity.

8. An apparatus of claim 7, wherein the apparatus is further caused to:

decrypt the encrypted second authorization key with the first authorization key; and

decrypt the encrypted resource with the decrypted second authorization key.

9. An apparatus of claim 7, wherein the at least one authorized entity is associated with the first authorization key, and wherein the at least one entity includes at least one of an owner of the resource, a contact of the owner, or a social group the owner belongs to.

10. An apparatus of claim 7, wherein the apparatus is further caused to:

categorize a plurality of resources by at least one of a data size, an access frequency, a modification frequency, an auditing requirement, or a combination thereof;

determine threshold values within each category for the caching step to apply to the resources; and

cache resources that meet the threshold values in the respective category,

wherein the encrypted second authorization key with the encrypted resource remain cached when the resources remain meeting the threshold values in the respective category.

11. An apparatus of claim 9, wherein the apparatus is further caused to:

remove one authorized entity to prevent subsequent transmission of the cached and encrypted second authorization key as well as the cached and encrypted resource from the cache.

12. An apparatus of claim 9, wherein members of the social group share an identical first authorization key specific for the social group.

13. A non-transitory computer-readable storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to perform at least the following:

determining a first authorization key for a user and a second authorization key for a resource;

encrypting the resource with the second authorization key;

encrypting the second authorization key with the first authorization key;

encrypting a text known to at least one authorized entity with the second authorization key;

initiating distribution of the encrypted text with the encrypted second authorization key and the encrypted resource over a network;

initiating caching of the encrypted text with the encrypted second authorization key and the encrypted resource in a cache in the network; and

initiating transmission of the cached and encrypted text with the cached and encrypted second authorization key and the cached and encrypted resource from the cache to the authorized entity, wherein the encrypted second authorization key is decrypted with the first authorization key, the encrypted text is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted text matches with the text known to the authorized entity.

14. A non-transitory computer-readable storage medium of claim 13, wherein the apparatus is caused to further perform:

decrypting the encrypted second authorization key with the first authorization key; and

decrypting the encrypted resource with the decrypted second authorization key.

15. A non-transitory computer-readable storage medium of claim 13, wherein the at least one authorized entity is associated with the first authorization key, and wherein the at least one entity includes at least one of an owner of the resource, a contact of the owner, or a social group the owner belongs to.

16. A non-transitory computer-readable storage medium of claim 13, wherein the apparatus is caused to further perform:

categorizing a plurality of resources by at least one of a data size, an access frequency, a modification frequency, an auditing requirement, or a combination thereof;

determining a threshold value within each category for the caching step to apply to the resources; and

caching resources that meet the threshold value in the respective category,

wherein the encrypted second authorization key with the encrypted resource remain cached when the resources remain meeting the threshold value in the respective category.

17. A non-transitory computer-readable storage medium of claim 15, wherein the apparatus is caused to further perform:

removing one authorized entity to prevent subsequent transmission of the cached and encrypted second authorization key as well as the cached and encrypted resource from the cache.