# US 2021/0240867 A1 · NUTS: eNcrypted Userdata Transit and Storage > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240867 A1 - Document ID: US20210240867A1 - Status: Published application - Kind: A1 - Application number: 17/232,903 - Filed: 2021-04-16 - Published: 2021-08-05 - Earliest claimed: 2016-09-15 - Assignees: Nuts Holdings, LLC - Applicants: Nuts Holdings, LLC - Inventors: Yoon Ho Auh - Web page: https://patentgrep.com/patent/US20210240867A1 ## CPC - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F 16/258: {Data format conversion from or to a database} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/3247: {involving digital signatures} - H04L 63/0281: {Proxies} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A lock node for storing data and a protected storage unit. The lock node includes an input section which provides a plurality of key maps, each corresponding to one of a plurality of primary keys, respectively, applied to the input section, each key map including at least one main key, a variable lock section producing a derived key from a logical operation on the main keys corresponding to the primary keys applied to the input section, and an output section producing the data in response to the derived key. ## Claims ### Claim 1 A method of processing data comprising: at least one processor controlling an access to data using at least one input key; the at least one input key each revealing a corresponding at least one access key configured to enable at least one operation on the data; and each revealed corresponding at least one access key combining in a logical operation with other revealed corresponding at least one access keys to form a union of all the defined operations permitted on the data. ### Claim 2 A system for accessing data comprising: at least one memory; at least one input key configured to control access to data; the at least one input key each configured to reveal a corresponding at least one access key configured to enable at least one operation on the data; and each revealed corresponding at least one access key combining in a logical operation with other revealed corresponding at least one access keys to form a union of all the defined operations permitted on the data. ### Claim 3 A method of processing data comprising: at least one processor accessing a data storage unit, the data storage unit providing the identity of at least one application that will operate on the data in the data storage unit; the at least one processor retrieving the at least one application from a collection of applications; and the at least one processor using the at least one application to operate on the data in the data storage unit. ### Claim 4 (depends on 3) The method of claim 3, wherein the at least one application reads the data in the data storage unit. ### Claim 5 (depends on 3) The method of claim 3, wherein the at least one application writes the data to the data storage unit or to a different data storage unit. ### Claim 6 (depends on 3) The method of claim 3, wherein the at least one application causes the data to be displayed. ### Claim 7 (depends on 3) The method of claim 3, wherein the at least one application converts the data from one version to another version. ### Claim 8 (depends on 3) The method of claim 3, wherein the at least one application operates on the information associated with the data in the data storage unit. ### Claim 9 (depends on 3) The method of claim 3, wherein the at least one application transmits over a network to another at least one processor at least one of: the data in the data storage unit; a subset of the data in the data storage unit; a derivative of the data in the data storage unit; metadata of the data in the data storage unit; and metadata of the data storage unit. ### Claim 10 (depends on 3) The method of claim 3, wherein the data is another at least one application. ### Claim 11 (depends on 3) The method of claim 3, wherein the data storage unit comprises: at least one memory; and a plurality of lock nodes stored in the at least one memory, each of the lock nodes comprising: an input section including a plurality of key maps, each of the key maps being encrypted with a corresponding one of a plurality of primary keys, respectively, the key maps including a plurality of main keys; a variable lock section including an encrypted derived key, the encrypted derived key configured to be decrypted with a key derived from a logical operation on the plurality of main keys corresponding to the plurality of primary keys applied to the input section; and an output section including encrypted data, the encrypted data configured to be decrypted with the derived key; at least one keyhole lock node of the plurality of lock nodes including a key map for each of the primary keys including at least one access attribute key, the at least one access attribute key configured to provide role based access control based on the corresponding primary key within the protected data storage unit; and at least one of the lock nodes providing an output key which is a primary key for another of the lock nodes; wherein each key map includes at least one access attribute key, the input section further including at least one encrypted access role key, the at least one encrypted access role key configured to be decrypted by the at least one access attribute key, the at least one access role key configured to enable at least one operation on the data, wherein the at least one access role key is based on permissions associated with the designated primary key resulting in the particular key map. ### Claim 12 (depends on 11) The method of claim 11, further comprising combining the at least one access role key in a logical operation with other provided at least one access role keys to form a union of all the defined operations permitted on the data. ### Claim 13 (depends on 11) The method of claim 11, wherein the input section of one of the lock nodes provides at least one access key for another of the lock nodes. ### Claim 14 (depends on 11) The method of claim 11, wherein at least one key map for one of the lock nodes includes at least one stratum key, the at least one stratum key decrypting a different key map for at least one lock node different from the one lock node. ### Claim 15 (depends on 14) The method of claim 14, wherein the at least one stratum key and the input sections of the lock nodes in the storage unit control which lock nodes within the storage unit are accessible for the particular designated primary key. ### Claim 16 (depends on 11) The method of claim 11, wherein the output section of at least one lock node of the storage unit stores at least one log section storing data related to accesses of the protected data storage unit across a plurality of different applications. ### Claim 17 (depends on 16) The method of claim 16, wherein the at least one log is stored in encrypted form. ### Claim 18 (depends on 16) The method of claim 16, wherein at least one parameter stored in the protected data storage unit controls what is logged and what is not logged. ### Claim 19 (depends on 16) The method of claim 16, wherein at least one parameter stored in the protected data storage unit controls a level of detail in the at least one log. ### Claim 20 (depends on 16) The method of claim 16, wherein at least one parameter stored in the protected data storage unit controls a type of log to produce. ### Claim 21 (depends on 16) The method of claim 16, wherein at least one parameter stored in the protected data storage unit controls a method of producing a log entry. ### Claim 22 (depends on 20) The method of claim 20, wherein the type of log comprises log entries involving processing events involving the protected data storage unit. ### Claim 23 (depends on 20) The method of claim 20, wherein the type of log comprises historical revision entries involving the data in the protected data storage unit.