Orthogonal access control for groups via multi-hop transform encryption
AssigneeIronCore Labs, Inc.
InventorsRobert L. Wall, Patrick Joseph Walsh
Life of this patent
Estimating the term…
Abstract
Disclosed is an orthogonal access control system based on cryptographic operations provided by multi-hop proxy re-encryption (PRE) that strictly enforces only authorized access to data by groups of users, scalable to large numbers of users. Scalable delegation of decryption authority can be shared with a plurality of members of a group whether those members be users or devices, and members of a group can further create sub groups and delegate decryption authority to those members, whether users or devices. Members are granted access via generation of transform keys, and membership or access can be revoked merely be deleting the transform key—no elimination of the encrypted data, regardless of its storage location, is needed.
Claims19
A method of applying transform cryptography for protecting personal data when the data has been copied and is accessible to one or more members of a first group, the method comprising:
- encrypting a first person's data with a public key for the first person;
- the first person creating a transform key from the first person to the first group including the one or more members;
- providing access to the first person's data for the first group using the transform key and a transform cryptography;
- an administrator of the first group adding and removing ones of the one or more members other than the first person of the first group by computing or deleting, respectively, transform keys from the first group to the one or more members without using the public or a private key of the first person;
- the first person granting access to the first person's data to members of a second group by creating a second transform key from the first person to the second group;
- and
- the first person revoking the access to the first person's data for the first group, and thereby revoking the access of the one or more members of the first group to the first person's data, by removing the transform key from the first person to the first group, while not affecting the second group's access to the first person's data.
A method of protecting a first user's personal data and enabling a selective right to be forgotten even when the data has been copied to multiple un-controlled locations and is accessible to one or more additional users, the method comprising:
- a. generating at a first device of a first user a public key and a private key for the first user;
- b. creating a first group of users by computing first transform keys from the first group to users of the first group without using the public or private keys of the first user;
- c. creating a second transform key from the first user to the first group of users and using the second transform key to provide the first group of users access to data of the first user;
- d. creating a third transform key from the first user to a second group of users and using the third transform key to provide the second group of users access to the data of the first user;
- and
- e. revoking the first group's access to the first user's data by deleting the second transform key, while not affecting the second group's access to the first user's data.
Dependencies are inferred from the claim text.