Method and system for managing encrypted data of devices
AssigneeNEC Corporation
InventorsMischa Schmidt, Jens-Matthias Bohli
Life of this patent
Estimating the term…
Abstract
A method for managing data of devices using one or more computing entities includes encrypting, by one or more encrypting entities, the data based on encryption policies using encryption keys; storing the encrypted data as ciphertext at a storing entity; requesting decryption keys to decrypt the stored ciphertext by one or more clients; computing restricted decryption keys based on access right policies for the requesting clients by a security management entity; and providing the generated decryption keys to the requesting clients for decrypting the stored ciphertext.
Claims14
A method for managing data of devices using one or more computing entities, the method comprising:
- computing a first key based on a master key and a second key based on the master key,
- computing a first hash chain of keys using the first key and a second hash chain of keys using the second key,
- generating a plurality of encryption keys using an exclusive or of the first hash chain of keys and the second hash chain of keys,
- encrypting, by one or more encrypting entities, the data based on encryption policies using the plurality of encryption keys,
- storing the encrypted data as ciphertext,
- receiving a request for decryption keys to decrypt the stored ciphertext by one or more clients,
- requesting the decryption keys from a security management entity, wherein the security management entity computes the two restricted decryption keys based on access right policies for the requesting clients and the two hash chains of keys,
- providing the two restricted decryption keys to the requesting clients for decrypting the stored ciphertext, and
- wherein the two restricted decryption keys enable the requesting clients to calculate keys for decrypting the ciphertext by generating a hash chain for each of the two restricted decryption keys and using an exclusive or on pairs of entries of the hash chains created from the two restricted decryption keys.
A system for managing data of devices comprising one or more processors which, alone or in combination, are configured to provide for performance of the following steps:
- computing a first key based on a master key and a second key based on the master key,
- computing a first hash chain of keys using the first key and a second hash chain of keys using the second key,
- generating a plurality of encryption keys using an exclusive or of the first hash chain of keys and the second hash chain of keys,
- encrypting the data based on encryption policies using the plurality of encryption keys,
- storing the encrypted data as ciphertext,
- receiving a request for decryption keys to decrypt the stored ciphertext by one or more clients,
- requesting the decryption keys from a security management entity, wherein the security management entity computes the two restricted decryption keys based on access right policies for the requesting clients and the two hash chains of keys,
- providing the two restricted decryption keys to the requesting clients for decrypting the stored ciphertext, and
- wherein the two restricted decryption keys enable the requesting clients to calculate keys for decrypting the ciphertext by generating a hash chain for each of the two restricted decryption keys and using an exclusive or on pairs of entries of the hash chains created from the two restricted decryption keys.
Dependencies are inferred from the claim text.