Back to results
US 11,537,733 B2Granted
Database access control service in networks
AssigneeHuawei Technologies Co., Ltd.
InventorsHang Zhang, Bidi Ying
Life of this patent
Estimating the term…
Abstract
A system supporting a networked database service includes a controller configured to receive one or more data request and authenticate the one or more data request. A gateway (GW) in communication with the controller, is configured to receive at least one of the one or more data request from the controller, perform data classification on data received in the request, and generate a cryptographic key based on the data classification, a hardware-protected key of the GW, and a second (encryption) key. The cryptographic key is for accessing a database. The controller and the GW are operated by different parties.
Claims18
A system for providing a networked database service, the system comprising:
- a controller configured to:
- receive one or more data requests;
- and
- authenticate the one or more data requests;
- and
- an ingress gateway (GW) in communication with the controller for processing a data upload request;
- and
- an egress GW in communication with the controller for processing a data access request from a data requester;
- wherein
- the ingress GW stores an ingress GW hardware-protected key and is configured to:
- receive, from the controller, a response corresponding to at least one of the one or more data requests wherein the one or more data requests includes a data upload request;
- receive a data provider key from a data provider;
- receive encrypted data from the data provider;
- and
- perform data classification on the encrypted data according to the response to obtain a classification result;
- generate a cryptographic key for accessing a database, the cryptographic key using the classification result, the ingress GW hardware-protected key, and the data provider key;
- and
- process the encrypted data using the cryptographic key to obtain the second encrypted data, and send the second encrypted data to a database for storage according to the data upload request;
- and
- the egress GW stores an egress GW hardware-protected key and is configured to:
- receive a data indication from the controller;
- perform data classification on the data indication to obtain a second classification result
- receive the second encrypted data from the database;
- and
- generate a decryption key using the second classification result, the hardware-protected key of the egress GW, and the data provider key;
- and
- decrypt the second encrypted data based on the decryption key, and provide the decrypted data to the data requester;
- wherein the controller and the database are operated by different parties.
25 more elements
An ingress gateway (GW) apparatus comprising:
- a processor;
- at least one network interface;
- non-transitory machine readable memory storing machine readable instructions which
- when executed by the processor, configures the ingress GW to:
- store an ingress GW hardware-protected key;
- receive data upload request from a data provider;
- receive a data provider key from the data provider;
- send the data upload request to a controller;
- receive a response corresponding to the data request from the controller;
- receive encrypted data from the data provider;
- perform data classification on the received encrypted data according to the response to obtain a classification result;
- generate a cryptographic key using the classification result, the ingress GW hardware-protected key, and the data provider key from the data provider;
- encrypt the encrypted data using the cryptographic key to obtain a second encrypted data;
- and
- send the second encrypted data to the database for storage;
- wherein the database and the GW are operated by different parties.
13 more elements
An egress gateway (GW) apparatus comprising:
- a processor;
- at least one network interface;
- non-transitory machine readable memory storing machine readable instructions which
- when executed by the processor, configures the egress GW to:
- store an egress GW hardware-protected key;
- receive a data access request from a data requester for data associated with a data provider;
- receive a data provider key from the data provider;
- send the data access request to a controller for authentication and authorization;
- receive a data indication from the controller;
- perform data classification on the received data indication to obtain a second classification result;
- receive second encrypted data from the database associated with the data access request;
- and
- generate a decryption key using the second classification result, the egress GW hardware-protected key, and the data provider key;
- and
- decrypt the second encrypted data based on the decryption key to obtain decrypted data, and provide the decrypted data to the data requester;
- wherein the database and the GW are operated by different parties.
13 more elements
Dependencies are inferred from the claim text.