Permutation-based content encryption with manifests in a content centric network

• US 10,305,865 B2
• Filed: 06/21/2016
• Issued: 05/28/2019
• Est. Priority Date: 06/21/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wood, Christopher A.
• Primary Examiner(s): Abedin, Shanto
• Application Number:
  US15/188,477
• Publication Number:
  US 20170366515A1
• Time in Patent Office: 1,071 Days
• Field of Search: 713165, 713167, 713187, 713168, 380 28, 380 42
• CPC Class Codes: G06F 7/766 Generation of all possible permutations
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/64 Self-signed certificates
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

One embodiment provides a system that facilitates encryption of manifest content based on permutation. During operation, the system partitions, by a computer system, a collection of data into a first set of content objects, wherein a content object is a chunk comprised of a plurality of bytes. The system performs a first permutation function on the first set of content objects to obtain a first set of permuted content objects. The system creates a manifest based on the permuted content objects, wherein a manifest is a content object which indicates a second set of content objects, wherein a respective content object of the second set is a data object or another manifest. The system encodes the first permutation function and the permuted content objects in the manifest, thereby facilitating an authorized entity that receives the manifest to reassemble the manifest contents based on the permutation function.

Claims

1. A computer-implemented method for encoding content, comprising:

receiving, by a computer system, a request for a manifest from an authorized entity;

partitioning, by the computer system, a collection of data into a first set of content objects, wherein a content object of the first set of content objects is a chunk comprised of a plurality of bytes;

performing, by the computer system, a first permutation function on the first set of content objects to obtain a first set of permuted content objects;

creating, by the computer system, the manifest based on the permuted content objects, wherein the manifest is a content object which indicates a second set of content objects, wherein a respective content object of the second set is a data object or another manifest;

performing, by the computer system, a second permutation function on an order of child pointers which correspond to content objects indicated in the manifest;

encoding, by the computer system, the first permutation function, the second permutation function, and the permuted content objects in the manifest, thereby facilitating the authorized entity that receives the manifest to reassemble the manifest contents based on a permutation function, wherein encoding the first permutation function in the manifest includes indicating a secure channel over which to retrieve the first permutation function; and

providing, by the computer system, the manifest to the authorized entity.

2. The method of claim 1, wherein the first permutation function is performed on one or more of:

bytes comprising an ordered concatenation of the chunks of the first set of content objects;

bytes comprising each chunk of the first set of content objects; and

each chunk of the partitioned collection of data, wherein the bytes comprising a respective chunk are not permuted.

3. The method of claim 1, wherein the manifest indicates the second set of content objects based on a direct embedding of a respective content object or a child pointer to a respective content object.

4. The method of claim 1, wherein encoding the first permutation function in the manifest is based on an order of child pointers which correspond to each permuted content object of the first set of permuted content objects, and wherein encoding the permuted content objects in the manifest is based on a tree-like topology.

5. The method of claim 1, wherein the first permutation function is based on one or more of:

shuffling the bytes comprising the first set of content objects;

Lehmer codes;

a symmetric block cipher;

an encryption algorithm; and

a form of permutation encoding.

6. The method of claim 1, wherein encoding the first permutation function in the manifest is based on one or more of:

embedding in the manifest the first permutation function by including the first permutation function in decryption metadata associated with the manifest; and

including in the manifest a link to retrieve the first permutation function, wherein a successful retrieval of the first permutation function via the link involves a verification of authentication information.

7. The method of claim 1, further comprising:

receiving, by the computer system, a request for the first permutation function from the authorized entity; and

in response to the request for the first permutation function, providing the first permutation function to the authorized entity.

8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

receiving, by a computer system, a request for a manifest from an authorized entity;

partitioning, by the computer system, a collection of data into a first set of content objects, wherein a content object of the first set of content objects is a chunk comprised of a plurality of bytes;

performing, by the computer system, a first permutation function on the first set of content objects to obtain a first set of permuted content objects;

creating, by the computer system, the manifest based on the permuted content objects, wherein the manifest is a content object which indicates a second set of content objects, wherein a respective content object of the second set is a data object or another manifest;

performing, by the computer system, a second permutation function on an order of child pointers which correspond to content objects indicated in the manifest;

encoding, by the computer system, the first permutation function, the second permutation function, and the permuted content objects in the manifest, thereby facilitating the authorized entity that receives the manifest to reassemble the manifest contents based on a permutation function, wherein encoding the first permutation function in the manifest includes indicating a secure channel over which to retrieve the first permutation function; and

providing, by the computer system, the manifest to the authorized entity.

9. The storage medium of claim 8, wherein the first permutation function is performed on one or more of:

bytes comprising an ordered concatenation of the chunks of the first set of content objects;

bytes comprising each chunk of the first set of content objects; and

each chunk of the partitioned collection of data, wherein the bytes comprising a respective chunk are not permuted.

10. The storage medium of claim 8, wherein the manifest indicates the second set of content objects based on a direct embedding of a respective content object or a child pointer to a respective content object.

11. The storage medium of claim 8, wherein encoding the first permutation function in the manifest is based on an order of child pointers which correspond to each permuted content object of the first set of permuted content objects, and wherein encoding the permuted content objects in the manifest is based on a tree-like topology.

12. The storage medium of claim 8, wherein encoding the first permutation function in the manifest is based on one or more of:

embedding in the manifest the first permutation function by including the first permutation function in decryption metadata associated with the manifest; and

including in the manifest a link to retrieve the first permutation function, wherein a successful retrieval of the first permutation function via the link involves a verification of authentication information.

13. The storage medium of claim 8, wherein the first permutation function is based on one or more of:

shuffling the bytes comprising the first set of content objects;

Lehmer codes;

a symmetric block cipher;

an encryption algorithm; and

a form of permutation encoding.

20. The storage medium of claim 8, the method further comprising:

receiving, by the computer system, a request for the first permutation function from the authorized entity; and

in response to the request for the first permutation function, providing the first permutation function to the authorized entity.

14. A computer system for encoding content, the system comprising:

a processor;

a storage device coupled to the processor and storing instructions that when executed by a computer cause the computer to perform a method, the method comprising;

receiving, by a computer system, a request for a manifest from an authorized entity;

partitioning, by the computer system, a collection of data into a first set of content objects, wherein a content object of the first set of content objects is a chunk comprised of a plurality of bytes;

performing, by a computer system, a first permutation function on the first set of content objects to obtain a first set of permuted content objects;

creating, by a computer system, the manifest based on the permuted content objects, wherein the manifest is a content object which indicates a second set of content objects, wherein a respective content object of the second set is a data object or another manifest;

performing, by a computer system, a second permutation function on an order of child pointers which correspond to content objects indicated in the manifest;

encoding, by a computer system, the first permutation function, the second permutation function, and the permuted content objects in the manifest, thereby facilitating the authorized entity that receives the manifest to reassemble the manifest contents based on a permutation function, wherein encoding the first permutation function in the manifest includes indicating a secure channel over which to retrieve the first permutation function; and

providing, by the computer system, the manifest to the authorized entity.

15. The computer system of claim 14, wherein the first permutation function is performed on one or more of:

bytes comprising an ordered concatenation of the chunks of the first set of content objects;

bytes comprising each chunk of the first set of content objects; and

each chunk of the partitioned collection of data, wherein the bytes comprising a respective chunk are not permuted.

16. The computer system of claim 14, wherein the manifest indicates the second set of content objects based on a direct embedding of a respective content object or a child pointer to a respective content object.

17. The computer system of claim 14, wherein encoding the first permutation function in the manifest is based on an order of child pointers which correspond to each permuted content object of the first set of permuted content objects, and wherein encoding the permuted content objects in the manifest is based on a tree-like topology.

18. The computer system of claim 14, wherein the first permutation function is based on one or more of:

shuffling the bytes comprising the first set of content objects;

Lehmer codes;

a symmetric block cipher;

an encryption algorithm; and

a form of permutation encoding.

19. The computer system of claim 14, wherein encoding the first permutation function in the manifest is based on one or more of:

embedding in the manifest the first permutation function by including the first permutation function in decryption metadata associated with the manifest; and

including in the manifest a link to retrieve the first permutation function, wherein a successful retrieval of the first permutation function via the link involves a verification of authentication information.