Method and System for Securing Data

• US 20170230352A1
• Filed: 02/06/2016
• Published: 08/10/2017
• Est. Priority Date: 02/06/2016
• Status: Abandoned Application

• Current Assignee: Xiaoqing Chen
• Original Assignee: Xiaoqing Chen
• Inventors: Chen, Xiaoqing
• Application Number:
  US15/017,629
• Publication Number:
  US 20170230352A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method and system for securing user data, or data, possessed by a data owner, are disclosed. In one aspect data is concealed and encrypted to ensure data confidentiality, and may also be signed to ensure data integrity and authenticity. In another aspect accesses to data are controlled by the data owner through a distributed access control system. In another aspect the public keys of users are distributed automatically in a distributed manner, and are controlled by the users owning the corresponding public and private key pairs.

Claims

1. A method for securing user data, or data, possessed by a data owner, comprising:

a. devising a concealing mechanism;

b. concealing, according to said concealing mechanism, and encrypting, using a data encryption key, said data to generate secure data and metadata, such that said data can be reconstructed by using said secure data, said metadata and said data encryption key in accordance with said concealing mechanism;

c. encrypting said metadata with another encryption key to generate encrypted metadata;

d. saving said secure data and said encrypted metadata to a data store, and associating a unique data identifier with said secure data and said encrypted metadata in said data store, such that said secure data and said encrypted metadata are uniquely identifiable in said data store.

2. The method of claim 1, wherein said another encryption key is the same as said data encryption key.

3. The method of claim 2, further comprising:

a. generating a data access object, wherein said data access object comprises said data encryption key;

b. obtaining one or more recipient encryption keys;

c. encrypting said data access object by using said one or more recipient encryption keys to generate a data access token;

d. saving said data access token to said data store, and associating said data access token with said unique data identifier.

4. The method of claim 3, wherein said data access object further comprises one or more access permissions corresponding respectively to said one or more recipient encryption keys, wherein each of said one or more access permissions comprises a permission role assigned by said data owner.

5. The method of claim 4, wherein said permission role comprises a reader role and a writer role, wherein said reader role allows read-only access to data, and said writer role allows read-write access to data.

6. The method of claim 5, wherein said data access object further comprises a creation time and a valid period, indicating when said data access object is created and how long said data access object remains valid.

7. The method of claim 5, further comprising:

making the public key of a public and private key pair accessible to said data owner by a recipient owning said public and private key pair.

8. The method of claim 7, wherein said obtaining one or more recipient encryption keys, comprising:

a. selecting one or more recipients;

b. retrieving the public keys of said one or more recipients and the public key of said data owner as said recipient encryption keys;

thereby said data access token can only be decrypted by using one of the private keys corresponding to said public keys, respectively.

9. The method of claim 8, wherein each of said access permissions, further comprising:

the identifier or Id of the recipient encryption key corresponding to each of said access permissions.

10. The method of claim 9, wherein said data store is configured to allow said data owner to store data, share data with said one or more recipients, and grant said one or more recipients read-only or read-write access to data in said data store, further comprising:

at sharing side, said data owner

a. sharing said data access token with said one or more recipients, and granting said one or more recipients read-only access to said data access token, such that said one or more recipients can only read but not alter said data access token stored in said data store; and

b. sharing said secure data and said encrypted metadata with said one or more recipients, and granting each of said one or more recipients, read-only access if the permission role of the access permission corresponding to the recipient encryption key of the recipient is reader, or read-write access if the permission role of the access permission corresponding to the recipient encryption key of the recipient is writer, such that said one or more recipients have proper accesses to said secure data and said encrypted metadata stored in said data store;

at receiving side, a recipient

a. retrieving said data access token from said data store, and decrypting said data access token by using the private key corresponding to the public key of said recipient to obtain said data access object;

b. retrieving said encrypted metadata from said data store, and decrypting said encrypted metadata by using said data encryption key obtained from said data access object;

c. retrieving said secure data from said data store, and reconstructing said data by using said secure data retrieved from said data store, the decrypted metadata and the data encryption key obtained from said data access object in accordance with said concealing mechanism;

thereby said recipient receives said data in a secure manner.

11. The method of claim 10, at receiving side, further comprising:

a. retrieving the permission role corresponding to said recipient from the decrypted data access object;

thereby a computer program, running on a client computer of said recipient, can enforce said permission role granted to said recipient.

12. The method of claim 10, wherein making the public key of a public and private key pair accessible to said data owner by a recipient owning said public and private key pair, comprising:

a. uploading, by said recipient, said public key to said data store;

b. sharing said public key in said data store, by said recipient, with said data owner;

c. granting said data owner, by said recipient, read-only access to said public key in said data store;

thereby said public key owned by said recipient is accessible to said data owner.

13. The method of claim 12, wherein said retrieving the public keys of said one or more recipients, if the public key of a recipient is not available to said data owner, comprising:

a. generating a temporary public and private key pair;

b. using the public key of said temporary public and private key pair as said recipient encryption key of said recipient;

c. making said temporary public and private key pair accessible to said recipient;

thereby said recipient can decrypt, by using the private key of said temporary public and private key pair, said data access token to gain access to said data encryption key, thus gain access to data.

14. The method of claim 13, wherein making said temporary public and private key pair accessible to said recipient, comprising:

a. uploading said temporary public and private key pair to said data store;

b. sharing said temporary public and private key pair with said recipient.

15. A system for securing user data or data, possessed by a data owner, comprising:

a data store configured to allow said data owner to store data;

a client computer having at least one processor, a network interface, and a machine-readable medium storing instructions that, when executed by said at least one processor, cause said at least one processor to perform operations, on behalf of said data owner, comprising;

a. generating a data encryption key;

b. concealing, according to a concealing mechanism, and encrypting, using said data encryption key, said data to generate secure data and metadata, such that said data can be reconstructed by using said secure data, said metadata and said data encryption key in accordance with said concealing mechanism;

c. encrypting said metadata with said data encryption key to generate encrypted metadata;

d. generating a unique data identifier;

e. saving said secure data and said encrypted metadata to said data store, and associating said unique data identifier with said secure data and said encrypted metadata in said data store, such that said secure data and said encrypted metadata are uniquely identifiable in said data store.

16. The system of claim 15, wherein said client computer further comprising a user interface, and said machine-readable medium storing additional instructions that, when executed by said at least one processor, cause said at least one processor to perform operations, on behalf of said data owner, comprising:

a. selecting, by said data owner using said user interface, one or more recipients, each having a public and private key pair and having made the public key of said key pair accessible to said data owner;

b. retrieving the public keys of said one or more recipients, respectively, and the public key of said data owner, as recipient encryption keys;

c. generating a data access object, comprising said data encryption key, and one or more access permissions corresponding respectively to said one or more recipients, wherein each of said one or more access permissions comprises a permission role assigned by said data owner using said user interface, wherein said permission role comprises a reader role and a writer role, wherein said reader role allows read-only access to data, and said writer role allows read-write access to data;

d. encrypting said data access object by using said recipient encryption keys to generate a data access token;

e. saving said data access token to said data store, and associating said data access token with said unique data identifier.

17. The system of claim 16, wherein said data store is a server, configured to allow said data owner to store data, share data with said one or more recipients and grant said one or more recipients read-only or read-write access to data in said data store, having:

a. at least one processor;

b. a network interface configured to receive requests from said network interface on said client computer; and

c. a machine-readable medium storing instructions that, when requested by said client computer, are executed by said at least one processor on said server, and cause said at least one processor on said server to perform the operations requested by said client computer.

18. The system of claim 17, wherein said machine-readable medium on said client computer storing additional instructions that, when executed by said at least one processor on said client computer, cause said at least one processor on said client computer to perform operations, including sending requests to said server when necessary, on behalf of said data owner, comprising:

a. sharing said data access token with said one or more recipients, and granting said one or more recipients read-only access to said data access token, such that said one or more recipients can only read but not alter said data access token stored in said data store; and

b. sharing said secure data and said encrypted metadata with said one or more recipients, and granting each of said one or more recipients, read-only access if the permission role of the access permission corresponding to the recipient encryption key of the recipient is reader, or read-write access if the permission role of the access permission corresponding to the recipient encryption key of the recipient is writer, such that said one or more recipients have proper accesses to said secure data and said encrypted metadata stored in said data store.

19. The system of claim 18, further comprising:

a second client computer having at least one processor;

a network interface; and

a machine-readable medium storing instructions that, when executed by said at least one processor on said second client computer, cause said at least one processor on said second client computer to perform operations, including sending requests to said server when necessary, on behalf of a recipient, comprising;

a. retrieving said data access token from said data store, and decrypting said data access token by using the private key corresponding to the public key of said recipient to obtain said data access object;

b. retrieving said encrypted metadata from said data store, and decrypting said encrypted metadata by using said data encryption key obtained from said data access object;

c. retrieving said secure data from said data store, and reconstructing said data by using said secure data retrieved from said data store, the decrypted metadata and the data encryption key obtained from said data access object in accordance with said concealing mechanism.

20. A system for distributing public keys to enable secure data sharing in a distributed manner, comprising:

a client computer having at least one processor, a network interface, a user interface, and a machine-readable medium;

a server, configured to allow users of said server to store data, share data with other users and grant said other users read-only access to data in said server, having;

a. at least one processor;

b. a network interface configured to receive requests from said network interface on said client computer; and

c. a machine-readable medium storing instructions that, when requested by said client computer, are executed by said at least one processor on said server, and cause said at least one processor on said server to perform the operations requested by said client computer;

wherein said machine-readable medium on said client computer storing instructions that, when executed by said at least one processor on said client computer, cause said at least one processor on said client computer to perform operations, including sending requests to said server when necessary, on behalf of a user, comprising;

a. uploading the public key of a public and private key pair owned by said user to said server;

b. selecting one or more users by said user using said user interface on said client computer;

c. sharing said public key, stored on said server, with said one or more users, and granting said one or more users read-only access to said public key;

thereby said public key is made accessible to said one or more users; and

said user controls who are allowed to access said public key, thus controls who are allowed to share data securely with said user.