Method and apparatus for providing a scalable service platform using a network cache

• US 9,992,015 B2
• Filed: 04/30/2013
• Issued: 06/05/2018
• Est. Priority Date: 06/30/2009
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Fu, Yan, Vepsalainen, Ari M., Aarnio, Ari Antero, Vimpari, Markku Kalevi, Laitinen, Pekka Johannes
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US13/874,154
• Publication Number:
  US 20130254529A1
• Time in Patent Office: 1,862 Days
• Field of Search: 726 26, 726 12
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0822 using key encryption key

Abstract

An approach is provided for building a scalable service platform by initiating transmission of encrypted data from a public network cache. An access control server platform determines a first authorization key for a user and a second authorization key for a resource, and then encrypts the resource with the second authorization key, and encrypts the second authorization key with the first authorization key. The access control server platform initiates distribution of the encrypted second authorization key with the encrypted resource over a network. The access control server platform further initiates caching the encrypted second authorization key with the encrypted resource that meets a predefined threshold value (e.g., a data size, an access frequency, a modification frequency, or an auditing requirement) in a cache in the network, and initiates transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity.

Claims

1. A method comprising:

encrypting, utilizing at least one processor, a resource with a second authorization key,

wherein the resource is encrypted with the second authorization key through an access control service platform to include information specifying a user entity is permitted to decrypt the encrypted resource,

wherein the second authorization key is not specific to the user identity,

wherein the second authorization key includes a protocol specific hash associated with the resource,

wherein the resource is identified with the user identity through the user entity uploading the resource to the access control service platform,

wherein information identifying the user entity is included in a header of a packet including the encrypted resource;

encrypting data known to the user entity with the second authorization key;

determining a first authorization key for the user entity through the access control service platform;

encrypting, utilizing the at least one processor, the second authorization key with the first authorization key,

wherein the first authorization key is configured to be utilized by the user entity,

wherein the first authorization key is generated based on a previous registration of the user entity with the access control service platform;

initiating a distribution, to the user entity, of the encrypted resource with the encrypted second authorization key,

wherein the distribution further includes the encrypted data, the encrypted second authorization key is decrypted with the first authorization key, the encrypted data is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted data matches with the data known to the user entity; and

initiating a caching of the encrypted second authorization key with the encrypted resource in a network cache located, remote from an origin point of the distribution, on a network path.

2. The method according to claim 1,

wherein the hash is specific to the MD5 protocol,

wherein the network path is a path data travels during the distribution.

3. The method according to claim 1,

wherein at least one of the network cache and the network path are on a public network.

4. The method according to claim 1, wherein the user entity is an owner of the resource, a contact of the owner, or a social group of the owner and wherein members of the social group share an identical first authorization key specific for the social group.

5. The method according to claim 1, further comprising:

determining a third authorization key for a second user entity, wherein the encrypted second authorization key is further configured to be decrypted with the third authorization key and the information further indicates the second user entity.

6. The method according to claim 1, wherein the distribution is to at least a server, the method further comprising:

initiating caching of the encrypted second authorization key with the encrypted resource in a cache of the server; and

initiating transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity.

7. The method according to claim 6, further comprising:

initiating a distribution of an access rights filter (ARF) to the server, the ARF being configured to determine access rights of the at least one authorized entity according to one or more authorization keys, wherein the server determines access rights of the at least one authorized entity based on the ARF.

8. An apparatus comprising:

at least one processor; and

at least one memory including computer program code,

wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following;

encrypt a resource with a second authorization key,

wherein the resource is encrypted with the second authorization key through an access control service platform to include information specifying a user entity is permitted to decrypt the encrypted resource,

wherein the second authorization key is not specific to the user identity,

wherein the second authorization key includes a protocol specific hash associated with the resource,

wherein the resource is identified with the user identity through the user entity uploading the resource to the access control service platform,

wherein information identifying the user entity is included in a header of a packet including the encrypted resource,

encrypt data known to the user entity with the second authorization key,

determine a first authorization key for the user entity through the access control service platform,

encrypt the second authorization key with the first authorization key,

wherein the first authorization key is configured to be utilized by the user entity,

wherein the first authorization key is generated based on a previous registration of the user entity with the access control service platform,

initiate a distribution, to the user entity, of the encrypted resource with the encrypted second authorization key,

wherein the distribution further includes the encrypted data, the encrypted second authorization key is decrypted with the first authorization key, the encrypted data is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted data matches with the data known to the user entity, and

initiate a caching of the encrypted second authorization key with the encrypted resource in a network cache located, remote from an origin point of the distribution, on a network path.

9. The apparatus of claim 8,

wherein the hash is specific to the MD5 protocol,

wherein the network path is a path data travels during the distribution.

10. The apparatus of claim 8,

wherein at least one of the network cache and the network path are on a public network.

11. The apparatus of claim 8, wherein the user entity is an owner of the resource, a contact of the owner, or a social group of the owner and wherein members of the social group share an identical first authorization key specific for the social group.

12. The apparatus of claim 8, wherein the apparatus is further caused to:

determine a third authorization key for a second user entity, wherein the encrypted second authorization key is further configured to be decrypted with the third authorization key and the information further indicates the second user entity.

13. The apparatus of claim 8, wherein the distribution is to at least a server and the apparatus is further caused to:

initiate caching of the encrypted second authorization key with the encrypted resource in a cache of the server, and

initiate transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity.

14. The apparatus of claim 13, wherein the apparatus is further caused to:

initiate a distribution of an access rights filter (ARF) to the server, the ARF being configured to determine access rights of the at least one authorized entity according to one or more authorization keys, wherein the server determines access rights of the at least one authorized entity based on the ARF.

15. A non-transitory computer-readable storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to perform at least the following:

encrypting, utilizing at least one processor, a resource with a second authorization key,

wherein the resource is encrypted with the second authorization key through an access control service platform to include information specifying a user entity is permitted to decrypt the encrypted resource,

wherein the second authorization key is not specific to the user identity,

wherein the second authorization key includes a protocol specific hash associated with the resource,

wherein the resource is identified with the user identity through the user entity uploading the resource to the access control service platform,

wherein information identifying the user entity is included in a header of a packet including the encrypted resource;

encrypting data known to the user entity with the second authorization key

determining a first authorization key for the user entity through the access control service platform;

encrypting, utilizing the at least one processor, the second authorization key with a first authorization key,

wherein the first authorization key is configured to be utilized by the user entity,

wherein the first authorization key is generated based on a previous registration of the user entity with the access control service platform;

initiating a distribution, to the user entity, of the encrypted resource with the encrypted second authorization key,

wherein the distribution further includes the encrypted data, the encrypted second authorization key is decrypted with the first authorization key, the encrypted data is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted data matches with the data known to the user entity; and

initiating a caching of the encrypted second authorization key with the encrypted resource in a network cache located, remote from an origin point of the distribution, on a network path.

16. The non-transitory computer-readable storage medium of claim 15,

wherein information identifying the user entity is included in a header of a packet including the encrypted resource,

wherein the resource is identified with the user identity through the user entity uploading the resource to the access control service platform

wherein the hash is specific to the MD5 protocol,

wherein the network path is a path data travels during the distribution.

17. The non-transitory computer-readable storage medium of claim 15,

wherein at least one of the network cache and the network path are on a public network.

18. The non-transitory computer-readable storage medium of claim 15, wherein the user entity is an owner of the resource, a contact of the owner, or a social group of the owner and wherein members of the social group share an identical first authorization key specific for the social group.

19. The non-transitory computer-readable storage medium of claim 15, wherein the apparatus is caused to further perform:

determining a third authorization key for a second user entity, wherein the encrypted second authorization key is further configured to be decrypted with the third authorization key and the information further indicates the second user entity.

20. The non-transitory computer-readable storage medium of claim 15, wherein the distribution is to at least a server and the apparatus is caused to further perform:

initiating caching of the encrypted second authorization key with the encrypted resource in a cache of the server; and

initiating transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity; and

initiating a distribution of an access rights filter (ARF) to the server, the ARF being configured to determine access rights of the at least one authorized entity according to one or more authorization keys, wherein the server determines access rights of the at least one authorized entity based on the ARF.