Method and apparatus for providing identity based encryption in distributed computations

• US 9,960,918 B2
• Filed: 08/31/2015
• Issued: 05/01/2018
• Est. Priority Date: 10/31/2011
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Luukkala, Vesa-Veikko, Sovio, Sampo Juhani, Kaaja, Jari-Jukka Harald, Boldyrev, Sergey
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US14/840,931
• Publication Number:
  US 20150372819A1
• Time in Patent Office: 974 Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2109 Game systems
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

An approach is provided for providing identity based encryption in distributed computations. An identity based encryption platform causes, at least in part, a segmentation of a computation closure into at least a first part and one or more second parts. The identity based encryption platform also causes, at least in part, an encryption of the one or more second parts using the first part as a public key of an identity-based encryption.

Claims

1. A method comprising:

segmenting an executable computation closure into at least a first part and one or more second parts, wherein the computation closure comprises a computation procedure, wherein the computation procedure is executable in a distributed fashion in a computational architecture comprising a plurality of architectural levels, wherein the architectural levels comprise a device level, an infrastructure level, and a cloud computing level, together with process relations and process communications among various processes; and

encrypting one or more second parts using the first part as a public key of an identity-based encryption.

2. The method of claim 1, further comprising:

determining (a) one or more criteria for executing the computation closure, the one or more second parts, or a combination thereof;

(b) one or more processes for determining the one or more criteria;

or (c) a combination thereof; and

causing, at least in part, an inclusion of the one or more criteria, the one or more processes, or a combination in the first part.

3. The method of claim 2, further comprising:

causing, at least in part, a publication of the first part, the encrypted one or more second parts, or a combination for access by one or more subscribing devices.

4. The method of claim 3, further comprising:

determining capability information of the one or more subscribing devices; and

processing the capability information associated with the one or more subscribing devices to determine whether the one or more subscribing devices are capable of decrypting the one or more encrypted second parts for execution.

5. The method of claim 4, wherein the capability information is based, at least in part, on energy consumption information, security enforcement information, one or more privacy policies, computational resource information, bandwidth availability information, or a combination thereof.

6. The method according to claim 1, further comprising:

determining one or more anonymization policies associated with the identity-based encryption, the computation closure, the first part, the one or more second parts, or a combination thereof,

wherein the encryption is based, at least in part, on the one or more anonymization policies.

7. The method of claim 6, wherein the one or more subscribing devices include, at least in part, one or more components of one or more levels of a computational architecture.

8. The method of claim 7, further comprising:

determining the one or more anonymization policies based, at least in part, on a concatenation of the one or more level-specific anonymization policies associated with the one or more levels of the computational architecture.

9. The method according to claim 1, wherein the segmentation, the encryption, or a combination thereof of the computation closure is based, at least in part, on one or more cost functions, one or more functional flow maps, or a combination thereof associated with the computation closure.

10. The method according to claim 1, wherein encryption of the one or more second parts is further based, at least in part, on one or more private keys.

11. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following;

segmenting an executable computation closure into at least a first part and one or more second parts, wherein the computation closure comprises a computation procedure, wherein the computation procedure is executable in a distributed fashion in a computational architecture comprising a plurality of architectural levels, wherein the architectural levels comprise a device level, an infrastructure level, and a cloud computing level, together with process relations and process communications among various processes; and

encrypting the one or more second parts using the first part as a public key of an identity-based encryption.

12. The apparatus of claim 11, wherein the apparatus is further caused to:

determine (a) one or more criteria for executing the computation closure, the one or more second parts, or a combination thereof;

(b) one or more processes for determining the one or more criteria;

or (c) a combination thereof; and

cause, at least in part, an inclusion of the one or more criteria, the one or more processes, or a combination in the first part.

13. The apparatus of claim 12, wherein the apparatus is further caused to:

cause, at least in part, a publication of the first part, the encrypted one or more second parts, or a combination for access by one or more subscribing devices.

14. The apparatus of claim 13, wherein the apparatus is further caused to:

process capability information associated with the one or more subscribing devices to determine whether the one or more subscribing devices can decrypt the one or more encrypted second parts for execution.

15. The apparatus of claim 14, wherein the capability information is based, at least in part, on energy consumption information, security enforcement information, one or more privacy policies, computational resource information, bandwidth availability information, or a combination thereof.

16. The apparatus according to claim 11, wherein the apparatus is further caused to:

determine one or more anonymization policies associated with the identity-based encryption, the computation closure, the first part, the one or more second parts, or a combination thereof,

wherein the encryption is based, at least in part, on the one or more anonymization policies.

17. The apparatus of claim 16, wherein the one or more subscribing devices include, at least in part, one or more components of one or more levels of a computational architecture.

18. The apparatus of claim 17, wherein the apparatus is further caused to:

determine the one or more anonymization policies based, at least in part, on a concatenation of the one or more level-specific anonymization policies associated with the one or more levels of the computational architecture.

19. The apparatus according to claim 11, wherein the segmentation, the encryption, or a combination thereof of the computation closure is based, at least in part, on one or more cost functions, one or more functional flow maps, or a combination thereof associated with the computation closure.

20. The apparatus according to claim 11, wherein the encryption is further based, at least in part, on one or more private keys.

21. The apparatus according to claim 11, wherein the apparatus is a mobile phone further comprising:

user interface circuitry and user interface software configured to facilitate user control of at least some functions of the mobile phone through use of a display and configured to respond to user input; and

a display and display circuitry configured to display at least a portion of a user interface of the mobile phone, the display and display circuitry configured to facilitate user control of at least some functions of the mobile phone.

22. A computer program product including a non-transitory computer-readable storage medium and one or more sequences of one or more instructions stored by the computer-readable storage medium, wherein the one or more instructions, when executed by one or more processors, cause an apparatus to at least perform:

segmenting an executable computation closure into at least a first part and one or more second parts, wherein the computation closure comprises a computation procedure, wherein the computation procedure is executable in a distributed fashion in a computational architecture comprising a plurality of architectural levels, wherein the architectural levels comprise a device level, an infrastructure level, and a cloud computing level, together with process relations and process communications among various processes; and

encrypting the one or more second parts using the first part as a public key of an identity-based encryption.