US 7,069,450 B2 · Systems and methods for compression of key sets having multiple keys

Abstract

Systems, methods and modulated data signals are described herein that provide an efficient way to derive a single key from which a user can extract virtually any number of data encryption keys. A database is logically divided into segments and a small prime number is associated with each segment. An encryption key is derived for each segment in the database and a key set is determined for distributing a data subset to a user. Each segment is encrypted with the corresponding encryption key. A single key is derived using the prime numbers associated with the data segments and the single key, the encrypted database, and a small amount of public information is provided to the user. The user utilizes this information to extract the encryption key set from the single key. One implementation utilizes a tree structure to significantly reduce the number of modular exponentiations that must be calculated when extracting the encryption keys. This, in turn, dramatically decreases the processing overhead that must be allocated to the processing associated with deriving the encryption keys.

Claims9

Dependent claims

A method for providing a single database to multiple users so that each user can only access a data subset of the database that is unique to the user, the method comprising:

logically dividing the database into segments;
encrypting each segment of the database;
distributing the encrypted database to multiple users;
formulating a single key for each user, wherein each user can extract a set of data keys from the single key;
and
wherein each user can utilize the extracted set of data keys to access a unique data subset of the database to which the user has permission to access,
formulating the single key for a first user further comprises:
determining a first complement prime set that includes the prime numbers in a prime set that are not associated with any segments in a first data subset;
and
raising the random value, modulo the modulus, to a power of the product of the first complement prime set;
formulating the single key for a second user further comprises:
determining a second complement prime set that includes the prime numbers in the prime set that are not associated with any segments in a second data subset;
and
raising the random value, modulo the modulus, to a power of the product of the second complement prime set.

11 more elements

A method for distributing a first data subset of a database to a first user and a second data subset of a database to a second user, the first user being excluded from accessing the second data subset and the second user being excluded from accessing the first data subset, the method comprising:

logically dividing the database into multiple segments, the first user being entitled to a plurality of segments that make up the first data subset, the second user being entitled to a plurality of segments that make up the second data subset;
encrypting each segment of the database to derive an encrypted database;
deriving a first key from which the first user can derive a set of segment keys, each segment key being uniquely associated with one segment in the first data subset;
deriving a second key from which the second user can derive a set of segment keys, each segment key being uniquely associated with one segment in the second data subset;
distributing the encrypted database and the first key to the first user;
distributing the encrypted database and the second key to the second user;
and
wherein the first user can gain access to the first data subset from the first key but cannot access any segment that is not included in the first data subset, and the second user can gain access to the second data subset from the second key but cannot access any segment that is not included in the second data subset,
deriving the first key further comprises:
determining a first complement prime set that includes the prime numbers in a prime set that are not associated with any segments in the first data subset;
and
raising the random value, modulo the modulus, to a power of the product of the first complement prime set;
deriving the second key further comprises:
determining a second complement prime set that includes the prime numbers in the prime set that are not associated with any segments in the second data subset;
and
raising the random value, modulo the modulus, to a power of the product of the second complement prime set.

13 more elements

Dependencies are inferred from the claim text.

Systems and methods for compression of key sets having multiple keys

Life of this patent

Systems and methods for compression of key sets having multiple keys

Life of this patent

Abstract

Claims9