Techniques for securing and controlling access to data

• US 9,967,093 B2
• Filed: 03/25/2015
• Issued: 05/08/2018
• Est. Priority Date: 03/25/2015
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Deleeuw, William C., Smith, Ned M.
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US14/668,634
• Publication Number:
  US 20160285631A1
• Time in Patent Office: 1,140 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 7/582 Pseudo-random number generators
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

Various embodiments are directed to techniques for controlling access to data in a decentralized manner. An apparatus includes an apportioning component to divide an item of data into multiple portions based on an organizational structure of the item of data; a tree component to generate a PRN tree including a multitude of nodes and a branching structure based on the organizational structure, the multitude including at least one branching node and multiple leaf nodes that correspond to the multiple portions; a PRN component to generate a PRN for each node of the multitude, the PRN component to use a PRN of a branching node of the PRN tree to generate a PRN for a leaf node that depends therefrom; and a communications component to transmit the multiple portions and multiple addresses based on PRNs of leaf nodes of the PRN tree to a server. Other embodiments are described and claimed.

Claims

1. An apparatus comprising:

processing circuitry; and

a memory, comprising instructions executable by the processing circuitry, the instructions to cause the processing circuitry to;

divide an item of data into multiple portions based on an organizational structure of the item of data;

generate a first pseudo-random number (PRN) tree to comprise a first multitude of nodes and a branching structure based on the organizational structure of the item of data, the first multitude of nodes to comprise at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions, the at least one branching node to include a top branching node at a top of the first PRN tree, the multiple leaf nodes to depend from the at least one branching node and extend towards a bottom of the first PRN tree;

generate a PRN for each node of the first multitude of nodes, wherein a PRN of the top branching node is used as a seed value to generate a PRN for a branching node that depends from the top branching node; and

transmit the multiple portions and multiple addresses based on PRNs of leaf nodes of the first PRN tree to a server via a network to enable the server to store each portion at an address of the multiple addresses.

2. The apparatus of claim 1, the memory comprising instructions to cause the processing circuitry to:

use a PRN of a leaf node as a seed to generate an encryption PRN for the leaf node, and

use the encryption PRN as an encryption key to encrypt the portion of the multiple portions that corresponds to the leaf node prior to transmitting the portion to the server.

3. The apparatus of claim 2, the memory comprising instructions to cause the processing circuitry to:

use the PRN of the leaf node as a seed to generate a verification PRN for the leaf node, and

take a first cryptographic hash of the portion using the verification PRN as an input to a cryptographic hash function following encryption of the portion.

4. The apparatus of claim 3, the memory comprising instructions to cause the processing circuitry to:

transmit a request to the server for access to the portion that corresponds to the leaf node,

take a second cryptographic hash of the portion as received from the server,

compare the first and second cryptographic hashes to verify an integrity of the portion as received from the server, and

use the encryption PRN to decrypt the portion following verification of the integrity of the portion.

5. The apparatus of claim 1, the memory comprising instructions to cause the processing circuitry to transmit a first PRN of a branching node of the first PRN tree and an indication of the branching structure to a computing device to grant the computing device a first type of access to a portion of the multiple portions as stored by the server by enabling the computing device to use the first PRN as a seed to generate at least a PRN of the leaf node of the first PRN tree that corresponds to the portion for use by the computing device as an address in a request transmitted to the server for the first type of access to the portion, the branching structure of the first PRN tree and the selection of the branching node of the first PRN to cooperate to define a scope of the first type of access granted to the computing device.

6. The apparatus of claim 1, comprising a random number generator (RNG) coupled to the processing circuitry and comprising circuitry to generate a seed value based on at least one of a quantum effect or a noise source, and the memory comprising instructions to cause the processing circuitry to trigger the RNG to generate the seed value, and generate the PRN for the top branching node at the top of the first PRN tree from the seed value.

7. A computer-implemented method comprising:

dividing an item of data into multiple portions based on an organizational structure of the item of data;

generating a first pseudo-random number (PRN) tree comprising a first multitude of nodes and a branching structure based on the organizational structure of the item of data, the first multitude of nodes comprising at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions, the at least one branching node including a top branching node at a top of the first PRN tree, the multiple leaf nodes depending from the at least one branching node and extending towards a bottom of the first PRN tree;

generating a PRN for each node of the first multitude of nodes, the PRN of the top branching node of the first PRN tree used as a seed to generate a PRN for a branching node that depends from the top branching node; and

transmitting the multiple portions and multiple addresses based on PRNs of leaf nodes of the first PRN tree to a server to enable the server to store each portion at an address of the multiple addresses.

8. The computer-implemented method of claim 7, the method comprising:

generating an encryption PRN for the leaf node using a PRN of a leaf node as a seed value; and

encrypting the portion of the multiple portions that corresponds to the leaf node using the encryption PRN as an encryption key prior to transmitting the portion to the server.

9. The computer-implemented method of claim 8, the method comprising:

generating a verification PRN for the leaf node using the PRN of the leaf node as a seed value;

taking a first cryptographic hash of the portion using the verification PRN as an input to a cryptographic hash function following encryption of the portion;

transmitting a request to the server for access to the portion that corresponds to the leaf node;

taking a second cryptographic hash of the portion as received from the server;

comparing the first and second cryptographic hashes to verify the integrity of the portion as received from the server; and

decrypting the portion using the encryption PRN following verification of the integrity of the portion.

10. The computer-implemented method of claim 7, the method comprising transmitting a first PRN of a branching node of the first PRN tree and an indication of the branching structure to a computing device to grant the computing device a first type of access to a portion of the multiple portions as stored by the server by enabling the computing device to use the first PRN as a seed to generate at least a PRN of the leaf node of the first PRN tree that corresponds to the portion for use by the computing device as an address in a request transmitted to the server for the first type of access to the portion, the branching structure of the first PRN tree and the selection of the branching node of the first PRN cooperating to define a scope of the first type of access granted to the computing device.

11. The computer-implemented method of claim 10, the method comprising:

generating a second PRN tree comprising a second multitude of nodes and the branching structure of the first PRN tree, the second multitude of nodes comprising at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions, the at least one branching node comprising a top branching node at a top of the second PRN tree and the leaf nodes depending from the at least one branching node and extending towards a bottom of the second PRN tree;

generating a PRN for each node of the second multitude of nodes, the PRN of a branching node of the second PRN tree used as a seed to generate a PRN for a leaf node that depends from the branching node; and

transmitting a PRN of the top branching node to the server to enable the server to use the PRN of the top branching node to generate at least a PRN of a leaf node of the second PRN tree that corresponds to the portion.

12. The computer-implemented method of claim 11, the method comprising transmitting to the computing device a second PRN of a branching node of the second PRN tree that corresponds to the branching node of the first PRN tree that corresponds to the first PRN to grant the computing device a second type of access to the portion by enabling the computing device to use the second PRN as a seed to generate at least a PRN of the leaf node of the second PRN tree that corresponds to the portion for use by the computing device to request the second type of access to the portion in addition to the first type of access.

13. At least one tangible machine-readable storage medium comprising instructions that when executed by a processor component, cause the processor component to:

divide an item of data into multiple portions based on an organizational structure of the item of data;

generate a first pseudo-random number (PRN) tree to comprise a first multitude of nodes and a branching structure based on the organizational structure of the item of data, the first multitude of nodes to comprise at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions, the at least one branching node to include a top branching node at a top of the first PRN tree, the multiple leaf nodes to depend from the at least one branching node and extend towards a bottom of the first PRN tree;

generate a PRN for each node of the first multitude of nodes, the PRN of the top branching node of the first PRN tree used as a seed to generate a PRN for a branching node that depends from the top branching node; and

transmit the multiple portions and multiple addresses based on PRNs of leaf nodes of the first PRN tree to a server to enable the server to store each portion at an address of the multiple addresses.

14. The at least one tangible non-transitory machine-readable storage medium of claim 13, the processor component caused to:

generate an encryption PRN for the leaf node using a PRN of a leaf node as a seed value; and

encrypt the portion of the multiple portions that corresponds to the leaf node using the encryption PRN as an encryption key prior to transmitting the portion to the server.

15. The at least one tangible non-transitory machine-readable storage medium of claim 13, the processor component caused to transmit a first PRN of a branching node of the first PRN tree and an indication of the branching structure to a computing device to grant the computing device a first type of access to a portion of the multiple portions as stored by the server by enabling the computing device to use the first PRN as a seed to generate at least a PRN of the leaf node of the first PRN tree that corresponds to the portion for use by the computing device as an address in a request transmitted to the server for the first type of access to the portion, the branching structure of the first PRN tree and the selection of the branching node of the first PRN to cooperate to define a scope of the first type of access granted to the computing device.

16. The at least one tangible non-transitory machine-readable storage medium of claim 15, the processor component caused to:

generate a second PRN tree comprising a second multitude of nodes and the branching structure of the first PRN tree, the second multitude of nodes comprising at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions, the at least one branching node comprising a top branching node at a top of the second PRN tree and the leaf nodes depending from the at least one branching node and extending towards a bottom of the second PRN tree;

generate a PRN for each node of the second multitude of nodes, the PRN of a branching node of the second PRN tree used as a seed to generate a PRN for a leaf node that depends from the branching node; and

transmit a PRN of the top branching node to the server to enable the server to use the PRN of the top branching node to generate at least a PRN of a leaf node of the second PRN tree that corresponds to the portion.

17. The at least one tangible non-transitory machine-readable storage medium of claim 16, the processor component caused to transmit to the computing device a second PRN of a branching node of the second PRN tree that corresponds to the branching node of the first PRN tree that corresponds to the first PRN to grant the computing device a second type of access to the portion by enabling the computing device to use the second PRN as a seed to generate at least a PRN of the leaf node of the second PRN tree that corresponds to the portion for use by the computing device to request the second type of access to the portion in addition to the first type of access.

18. The at least one tangible non-transitory machine-readable storage medium of claim 17, the first type of access comprising read access and the second type of access comprising access to modify data.

19. The at least one tangible non-transitory machine-readable storage medium of claim 13, the item of data comprising at least one of text, a table, a still image, a chart, a graph, motion video, audio, an equation, biometric data, a genetic sequence, financial data, statistical data, behavioral data, location data or spending data.