TECHNIQUES FOR SECURING AND CONTROLLING ACCESS TO DATA

• US 20160285631A1
• Filed: 03/25/2015
• Published: 09/29/2016
• Est. Priority Date: 03/25/2015
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Ned M. Smith, William C. Deleeuw
• Inventors: DELEEUW, WILLIAM C., SMITH, NED M.
• Granted Patent: US 9,967,093 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 7/582 Pseudo-random number generators
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

Various embodiments are directed to techniques for controlling access to data in a decentralized manner. An apparatus includes an apportioning component to divide an item of data into multiple portions based on an organizational structure of the item of data; a tree component to generate a PRN tree including a multitude of nodes and a branching structure based on the organizational structure, the multitude including at least one branching node and multiple leaf nodes that correspond to the multiple portions; a PRN component to generate a PRN for each node of the multitude, the PRN component to use a PRN of a branching node of the PRN tree to generate a PRN for a leaf node that depends therefrom; and a communications component to transmit the multiple portions and multiple addresses based on PRNs of leaf nodes of the PRN tree to a server. Other embodiments are described and claimed.

Claims

1. An apparatus comprising:

logic, at least a portion of which is implemented in hardware, the logic to comprise;

an apportioning component to divide an item of data into multiple portions based on an organizational structure of the item of data;

a tree component to generate a first pseudo-random number (PRN) tree to comprise a first multitude of nodes and a branching structure based on the organizational structure of the item of data, the first multitude of nodes to comprise at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions;

a PRN component to generate a PRN for each node of the first multitude of nodes, the PRN component to use a PRN of a branching node of the first PRN tree to generate a PRN for a leaf node that depends from the branching node; and

a communications component to transmit the multiple portions and multiple addresses based on PRNs of leaf nodes of the first PRN tree to a server via a network to enable the server to store each portion at an address of the multiple addresses.

2. The apparatus of claim 1, the tree component to generate a top branching node of the at least one branching node at a top of the first PRN tree and to generate the leaf nodes to depend from the at least one branching node and extend towards a bottom of the first PRN tree, and the PRN component to generate a PRN for a branching node that depends from the top branching node using the PRN of the top branching node as a seed value.

3. The apparatus of claim 1, the PRN component to use a PRN of a leaf node as a seed to generate an encryption PRN for the leaf node, the apparatus comprising an encryption component to use the encryption PRN as an encryption key to encrypt the portion of the multiple portions that corresponds to the leaf node prior to transmitting the portion to the server.

4. The apparatus of claim 3, the PRN component to use the PRN of the leaf node as a seed to generate a verification PRN for the leaf node, the apparatus comprising a verification component to take a first cryptographic hash of the portion using the verification PRN as an input to a cryptographic hash function following encryption of the portion.

5. The apparatus of claim 4, the communications component to transmit a request to the server for access to the portion that corresponds to the leaf node, the verification component to take a second cryptographic hash of the portion as received from the server and compare the first and second cryptographic hashes to verify the integrity of the portion as received from the server, and the encryption component to use the encryption PRN to decrypt the portion following verification of the integrity of the portion.

6. The apparatus of claim 1, the communications component to transmit a first PRN of a branching node of the first PRN tree and an indication of the branching structure to a computing device to grant the computing device a first type of access to a portion of the multiple portions as stored by the server by enabling the computing device to use the first PRN as a seed to generate at least a PRN of the leaf node of the first PRN tree that corresponds to the portion for use by the computing device as an address in a request transmitted to the server for the first type of access to the portion, the branching structure of the first PRN tree and the selection of the branching node of the first PRN to cooperate to define a scope of the first type of access granted to the computing device.

7. The apparatus of claim 1, the logic to comprise a random number generator (RNG) coupled to the processor component and comprising circuitry to generate a seed value based on at least one of a quantum effect or a noise source, and the PRN component to trigger the RNG to generate the seed value, and the PRN component to generate a PRN for a top branching node at a top of the first PRN tree from the seed value.

8. A computer-implemented method comprising:

dividing an item of data into multiple portions based on an organizational structure of the item of data;

generating a first pseudo-random number (PRN) tree comprising a first multitude of nodes and a branching structure based on the organizational structure of the item of data, the first multitude of nodes comprising at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions;

generating a PRN for each node of the first multitude of nodes, the PRN of a branching node of the first PRN tree used as a seed to generate a PRN for a leaf node that depends from the branching node; and

transmitting the multiple portions and multiple addresses based on PRNs of leaf nodes of the first PRN tree to a server to enable the server to store each portion at an address of the multiple addresses.

9. The computer-implemented method of claim 8, the method comprising:

generating an encryption PRN for the leaf node using a PRN of a leaf node as a seed value; and

encrypting the portion of the multiple portions that corresponds to the leaf node using the encryption PRN as an encryption key prior to transmitting the portion to the server.

10. The computer-implemented method of claim 9, the method comprising:

generating a verification PRN for the leaf node using the PRN of the leaf node as a seed value;

taking a first cryptographic hash of the portion using the verification PRN as an input to a cryptographic hash function following encryption of the portion;

transmitting a request to the server for access to the portion that corresponds to the leaf node;

taking a second cryptographic hash of the portion as received from the server following decryption;

comparing the first and second cryptographic hashes to verify the integrity of the portion as received from the server; and

decrypting the portion using the encryption PRN following verification of the integrity of the portion.

11. The computer-implemented method of claim 8, the method comprising transmitting a first PRN of a branching node of the first PRN tree and an indication of the branching structure to a computing device to grant the computing device a first type of access to a portion of the multiple portions as stored by the server by enabling the computing device to use the first PRN as a seed to generate at least a PRN of the leaf node of the first PRN tree that corresponds to the portion for use by the computing device as an address in a request transmitted to the server for the first type of access to the portion, the branching structure of the first PRN tree and the selection of the branching node of the first PRN cooperating to define a scope of the first type of access granted to the computing device.

12. The computer-implemented method of claim 11, the method comprising:

generating a second PRN tree comprising a second multitude of nodes and the branching structure of the first PRN tree, the second multitude of nodes comprising at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions, the at least one branching node comprising a top branching node at a top of the second PRN tree and the leaf nodes depending from the at least one branching node and extending towards a bottom of the second PRN tree;

generating a PRN for each node of the second multitude of nodes, the PRN of a branching node of the second PRN tree used as a seed to generate a PRN for a leaf node that depends from the branching node; and

transmitting a PRN of the top branching node to the server to enable the server to use the PRN of the top branching node to generate at least a PRN of a leaf node of the second PRN tree that corresponds to the portion.

13. The computer-implemented method of claim 12, the method comprising transmitting to the computing device a second PRN of a branching node of the second PRN tree that corresponds to the branching node of the first PRN tree that corresponds to the first PRN to grant the computing device a second type of access to the portion by enabling the computing device to use the second PRN as a seed to generate at least a PRN of the leaf node of the second PRN tree that corresponds to the portion for use by the computing device to request the second type of access to the portion in addition to the first type of access.

14. At least one tangible machine-readable storage medium comprising instructions that when executed by a processor component, cause the processor component to:

divide an item of data into multiple portions based on an organizational structure of the item of data;

generate a first pseudo-random number (PRN) tree to comprise a first multitude of nodes and a branching structure based on the organizational structure of the item of data, the first multitude of nodes to comprise at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions;

generate a PRN for each node of the first multitude of nodes, the PRN of a branching node of the first PRN tree used as a seed to generate a PRN for a leaf node that depends from the branching node; and

transmit the multiple portions and multiple addresses based on PRNs of leaf nodes of the first PRN tree to a server to enable the server to store each portion at an address of the multiple addresses.

15. The at least one tangible machine-readable storage medium of claim 14, the processor component caused to:

generate an encryption PRN for the leaf node using a PRN of a leaf node as a seed value; and

encrypt the portion of the multiple portions that corresponds to the leaf node using the encryption PRN as an encryption key prior to transmitting the portion to the server.

16. The at least one tangible machine-readable storage medium of claim 14, the processor component caused to transmit a first PRN of a branching node of the first PRN tree and an indication of the branching structure to a computing device to grant the computing device a first type of access to a portion of the multiple portions as stored by the server by enabling the computing device to use the first PRN as a seed to generate at least a PRN of the leaf node of the first PRN tree that corresponds to the portion for use by the computing device as an address in a request transmitted to the server for the first type of access to the portion, the branching structure of the first PRN tree and the selection of the branching node of the first PRN to cooperate to define a scope of the first type of access granted to the computing device.

17. The at least one tangible machine-readable storage medium of claim 16, the processor component caused to:

generate a second PRN tree comprising a second multitude of nodes and the branching structure of the first PRN tree, the second multitude of nodes comprising at least one branching node at which branching occurs and multiple leaf nodes of which each leaf node corresponds to a portion of the multiple portions, the at least one branching node comprising a top branching node at a top of the second PRN tree and the leaf nodes depending from the at least one branching node and extending towards a bottom of the second PRN tree;

generate a PRN for each node of the second multitude of nodes, the PRN of a branching node of the second PRN tree used as a seed to generate a PRN for a leaf node that depends from the branching node; and

transmit a PRN of the top branching node to the server to enable the server to use the PRN of the top branching node to generate at least a PRN of a leaf node of the second PRN tree that corresponds to the portion.

18. The at least one tangible machine-readable storage medium of claim 17, the processor component caused to transmit to the computing device a second PRN of a branching node of the second PRN tree that corresponds to the branching node of the first PRN tree that corresponds to the first PRN to grant the computing device a second type of access to the portion by enabling the computing device to use the second PRN as a seed to generate at least a PRN of the leaf node of the second PRN tree that corresponds to the portion for use by the computing device to request the second type of access to the portion in addition to the first type of access.

19. The at least one tangible machine-readable storage medium of claim 18, the first type of access comprising read access and the second type of access comprising access to modify data.

20. The at least one tangible machine-readable storage medium of claim 14, the item of data comprising at least one of text, a table, a still image, a chart, a graph, motion video, audio, an equation, biometric data, a genetic sequence, financial data, statistical data, behavioral data, location data or spending data.

21. A computer-implemented method comprising:

determining, at a server, whether a request received from a computing device for access to a portion of data stored by the server identifies the portion with an address at which the portion is stored or with a combination of a first pseudo-random number (PRN) of a first leaf node of a first PRN tree and an indication of a location of a second leaf node within a branching structure of a second PRN tree, the request received via a network coupled to the server, and the first and second leaf nodes corresponding to the portion;

based on the determination, pseudo-randomly generating a second PRN of the second leaf node from a PRN of a top branching node of the second PRN tree and taking a hash of a combination of the first PRN and the second PRN to derive the address; and

accessing the portion at the address to satisfy the request for access.

22. The computer-implemented method of claim 21, the method comprising allowing write access to the portion at the address based on the determination.

23. The computer-implemented method of claim 22, the first PRN tree associated with read access, the second PRN tree associated with write access, and the method comprising allowing write access to the portion in response to the request identifying the portion with the address and disallowing write access to the portion in response to the request failing to identify the portion with the address.

24. The computer-implemented method of claim 21, the method comprising pseudo-randomly generating a chain of PRNs that follows a path through the branching structure of the second PRN tree to pseudo-randomly derive the second PRN, each PRN of the chain corresponding to a node of the second PRN tree, and the second PRN pseudo-randomly generated using the PRN of a branching node of the second PRN tree in the path from which the second leaf node depends as a seed.

25. The computer-implemented method of claim 21, the method comprising:

receiving the portion, the address and the PRN of the top branching node of the second PRN tree from another computing device via the network;

storing the portion within a storage location provided by a storage device coupled to the server; and

assigning the address to the storage location.