Methods for augmentation and interpretation of data objects

• US 8,832,466 B1
• Filed: 01/29/2007
• Issued: 09/09/2014
• Est. Priority Date: 01/27/2006
• Status: Active Grant

• Current Assignee: Sysxnet Ltd.
• Original Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Inventors: McGregor, John Patrick Jr., White, Matthew N.
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US11/668,462
• Time in Patent Office: 2,780 Days
• Field of Search: 713/193, 713/189, 726/13, 380/37
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Efficient methods for implementing security and manageability for stored data objects involve logical object reorganization, computation and injection of metadata, and specialized data access operations. Methods for utilization and incorporation of cryptographic key hierarchies and security functions for data objects are disclosed. Cryptographic keying and other data management operations may be performed for individual blocks within a data object rather than only for the entire data object in order to achieve performance objectives.

Claims

1. A method for managing a data object, the method comprising:

arranging a first data object into one or more data blocks each containing a number of bits corresponding to one or more processing lengths;

embedding, via a processor, into the first data object a data object header and one or more regions of data block metadata to generate a second data object, wherein each of the one or more regions of data block metadata corresponds to an adjacent data block and stores a cryptographic key associated with the adjacent data block;

storing the second data object in a non-volatile memory;

receiving a request to access the second data object; and

generating a response to the request to access the second data object, wherein first response data in the response is identical to second response data generated in response to a request to access the first data object, wherein the arranging results in the second data object having a plurality of data blocks and a plurality of regions of data block metadata, wherein at least one of the regions of data block metadata is adjacent at a first logical location of a first side of the one region of the data block metadata to a first one of the data blocks and is also adjacent at a second logical location of a second side of the one region of the data block metadata to a second one of the data blocks.

2. The method of claim 1, wherein a logical location of substantially every one of the regions of data block metadata is disposed immediately adjacent to a side of a first one of the data blocks and a side of a second one of the data blocks.

3. The method of claim 1, wherein regions of data block metadata are interleaved between the data blocks.

4. The method of claim 1, further comprising:

assigning to at least one of the first and second data objects one or more keys from the group consisting of a data object encryption key, a data object decryption key, and a data object hash key.

5. The method of claim 4, further comprising:

assigning to one or more of the data blocks one or more keys from the group consisting of a per-block encryption key, a per-block decryption key, and a per-block hash key.

6. The method of claim 5, wherein at least one of the regions of data block metadata is disposed between two of the data blocks.

7. The method of claim 5 wherein substantially every one of the data blocks is adjacent to two of the regions of data block metadata.

8. The method of claim 7 wherein at least one of the data blocks is not adjacent to two of the regions of data block metadata.

9. The method of claim 4, wherein a logical location of substantially every one of the regions of data block metadata is disposed immediately adjacent to a side of a first one of the data blocks and a side of a second one of the data blocks.

10. The method of claim 4, wherein the regions of data block metadata are interleaved between the data blocks.

11. The method of claim 5, further comprising:

assigning to each of the one or more data blocks one or more keys from the group consisting of a per-block encryption key, a per-block decryption key, and a per-block hash key.

12. The method of claim 5, further comprising:

performing one or more cryptographic operations on one or more of the data blocks using one or more keys from the group consisting of assigned per-block encryption keys, assigned per-block decryption keys, and assigned per-block hash keys.

13. The method of claim 5, further comprising:

encrypting or decrypting one or more of the one or more data blocks using a cipher and an assigned per-block encryption key or an assigned per-block decryption key, respectively.

14. The method of claim 5, further comprising:

hashing one or more of the one or more data blocks using an assigned per-block hash key and a hash function.

15. The method of claim 13, wherein the cipher comprises an algorithm from the group consisting of public-key encryption algorithms and symmetric-key encryption algorithms.

16. The method of claim 5, further comprising:

encrypting or decrypting one or more of the data blocks using a cipher and an assigned per-block encryption key or an assigned per-block decryption key, respectively.

17. The method of claim 5, further comprising:

hashing one or more of the one or more data blocks using an assigned per-block hash key and a hash function.

18. The method of claim 5, further comprising:

performing one or more cryptographic operations on one or more of the data blocks using one or more keys from the group consisting of assigned per-block encryption keys, assigned per-block decryption keys, and assigned per-block hash keys.

19. The method of claim 6, further comprising:

encrypting or decrypting each of the data blocks using a cipher and an assigned per-block encryption key or an assigned per-block decryption key, respectively.

20. The method of claim 6, further comprising:

hashing each of the data blocks using its assigned per-block hash key and a hashing function.

21. The method of claim 18, further comprising:

creating a hierarchical key tree having the data object encryption key and the data object decryption key disposed in a top node of the key tree and a having bottom row of nodes, each bottom row node containing one or more bottom row keys from the group consisting of one of the per-block encryption keys, one of the per-block decryption keys, and one of the per-block hash keys.

22. The method of claim 21, further comprising:

encrypting each of the bottom row keys with the data object encryption key.

23. The method of claim 22, further comprising:

storing each encrypted per-block decryption key in a region of per-block metadata associated with the data block to which the per-block decryption key was assigned.

24. The method of claim 22, further comprising:

storing each encrypted per-block hash key in a region of per-block metadata associated with the data block to which the per-block hash key was assigned.

25. The method of claim 22, further comprising:

storing each encrypted per-block hash key in a region of per-block metadata associated with the data block to which the per-block hash key was assigned.

26. The method of claim 25, further comprising:

defining a key path for each bottom row key leading from that bottom row key to the data object encryption key via one or more of the intermediate encryption keys.

27. The method of claim 18, further comprising:

creating a hierarchical key tree having the data object encryption key and the data object decryption key disposed in a top node of the key tree, at least one set of intermediate nodes wherein each intermediate node contains one or more keys selected from the group of an intermediate encryption key and an intermediate decryption key, and a bottom row of nodes, each bottom row node containing one or more bottom row keys from the group consisting of one of the per-block encryption keys, one of the per-block decryption keys, and one of the per-block hash keys.

28. The method of claim 18, further comprising:

encrypting each key on each key path except for the data object encryption key with the next key on that key path moving from the bottom row to the top node of the hierarchical key tree.

29. The method of claim 28, further comprising:

storing each encrypted key contained by a bottom row node in a region of per-block metadata associated with the data block to which the bottom row node was assigned.

30. The method of claim 13 wherein each encrypted data block contains a number of bits corresponding to one of the processing lengths.

31. The method of claim 5 wherein each of the per-block encryption keys is associated with only one of the data blocks.

32. The method of claim 5 wherein each of the per-block decryption keys is associated with only one of the data blocks.

33. The method of claim 5 wherein the per-block decryption key assigned to a data block is equivalent to the per-block encryption key assigned to a data block for all data blocks in the first data object.

34. The method of claim 5 wherein the decryption key assigned to the first data object is equivalent to the encryption key assigned to the first data object.

35. The method of claim 5 wherein each of the per-block hash keys is associated with only one of the data blocks.

36. The method of claim 13 wherein the cipher comprises a symmetric-key cipher.

37. The method of claim 13 wherein the cipher comprises a public-key cipher.

38. The method of claim 5 wherein each of the regions of data block metadata has a dimension selected from the group consisting of a fixed size, a size that varies over time and a size that varies between the data blocks.

39. The method of claim 5 wherein the data object header contains one or more items of data object metadata selected from the group consisting of a protected data object identifier, access right information, data object version information, time information, data object encoding information and data object cryptographic key information.

40. The method of claim 39 wherein the data object metadata has a dimension selected from the group consisting of a fixed size and a size that varies over time.

41. The method of claim 21 wherein the hierarchical key tree is stored in the data object header, is stored in one or more of the regions of data block metadata, or is stored in part in the data object header and in part in one or more of the regions of data block metadata.

42. The method of claim 25 wherein each of the intermediate keys is stored in one or more of the regions of data block metadata.

43. The method of claim 5 further comprising:

generating for each of the data blocks a per-block hash value or a per-block hash message authentication code (HMAC) using, as inputs to a hash function, one or more inputs from the group consisting of the data block'"'"'s per-block hash key, data contained in the data block in encrypted form, and data contained in the data block in plaintext form.

44. The method of claim 43 further comprising:

storing each of the per-block hash values or per-block HMACs in one or more regions of data block metadata.

45. The method of claim 43 further comprising:

generating a data object hash value for the first data object by computing a hash function over one or more of the per-block hash values and the per-block HMACs.

46. The method of claim 45 further comprising:

generating the data object hash value using a hierarchical hashing tree such as a Merkle tree.

47. The method of claim 45 further comprising:

generating a data object HMAC for the second data object using the data object hash key as a hash function input and one or more hash function inputs selected from the group consisting of the data object hash value, a data object version number and data object metadata.

48. The method of claim 1, wherein the object data header comprises one or more of the following:

a protected data object identifier;

access right information;

data object version information;

time information relating to the first data object;

data object encoding information; and

data object cryptographic key information.

49. A method as defined in claim 1, wherein the first data object is a first file including a first data block adjacent to a second data block, the second data object is a second file, and a region of data block metadata of the one or more regions of data block metadata is stored adjacent to the first data block and adjacent to the second data block in the second file.

50. A tangible computer readable storage disc or storage device including instructions that, when executed cause a machine to at least:

arrange a first data object into one or more data blocks each containing a number of bits corresponding to one or more processing lengths;

embed, via a processor, into the first data object a data object header and one or more regions of data block metadata to generate a second data object, wherein each of the one or more regions of data block metadata corresponds to an adjacent data block and stores a cryptographic key associated with the adjacent data block;

store the second data object in a non-volatile memory; and

receive a request to access the second data object; and

generate a response to the request to access the second data object, wherein first response data in the response is identical to second response data generated in response to a request to access the first data object, wherein the arranging results in the second data object having a plurality of data blocks and a plurality of regions of data block metadata, wherein at least one of the regions of data block metadata is adjacent at a first logical location of a first side of the one region of the data block metadata to a first one of the data blocks and is also adjacent at a second logical location of a second side of the one region of the data block metadata to a second one of the data blocks.