US 9,754,118 B2 · Performing an operation on a data storage

Abstract

A method of performing an operation on a data storage for storing data being encrypted with a key KD associated with an owner of the data is provided. The method includes deriving, for each authorized client Cj, a first key KCj and a second key KTj, providing the client Cj with the first key KCj, and providing a Trusted Third Party (TTP) with the second key KTj. The method further includes, at a Policy Enforcement Point, receiving a request for performing the operation on the data storage from a client Ck of the authorized clients, acquiring a first key KCk from the client Ck, acquiring a second key KTk from the TTP, deriving the key KD from the first key KCk and the second key KTk, and performing the operation on the data storage using the derived key KD. The disclosed trust model uses two-part secret sharing.

Claims33

Dependent claims

A method of performing an operation on a data storage for storing data being encrypted with a key KD associated with an owner of the data, the method comprising:

for a client Ck of one or more clients which are authorized to perform operations on the data storage:
deriving a first key KCk and a second key KTk such that the key KD can be derived from the first key KCk and the second key KTk,
providing the client Ck with the first key KCk, and
providing a Trusted Third Party, TTP, with the second key KTk, and
at a Policy Enforcement Point, PEP:
receiving a request to perform the operation on the data storage at the PEP from the client Ck of the one or more clients,
acquiring the first key KCk at the PEP from the client Ck, wherein the PEP and the client Ck are different entities,
acquiring the second key KTk at the PEP from the TTP, wherein the PEP and the TPP are different entities, and wherein the client Ck and the TPP are different entities,
deriving at the PEP the key KD from the first key KCk and the second key KTk, and
performing at the PEP the operation on the data storage using the derived key KD, wherein the PEP and the data storage are different entities.

7 more elements

A method of performing an operation on a data storage for storing data being encrypted with a key KD associated with an owner of the data, the method being performed by a Policy Enforcement Point, PEP, the method comprising:

receiving a request for performing the operation on the data storage at the PEP from a client Ck of one or more clients which are authorized to perform operations on the data storage,
acquiring a first key KCk at the PEP from the client Ck, wherein the PEP and the client Ck are different entities,
acquiring a second key KTk at the PEP from a Trusted Third Party, TTP, wherein the PEP and the TTP are different entities, and wherein the client Ck and the TPP are different entities,
deriving at the PEP the key KD from the first key KCk and the second key KTk, and
performing at the PEP the operation on the data storage using the derived key KD, wherein the PEP and the data storage are different entities.

2 more elements

A Policy Enforcement Point, PEP, for performing an operation on a data storage for storing data being encrypted with a key KD associated with an owner of the data, the PEP comprising at least one processor adapted to:

receive a request at the PEP to perform the operation on the data storage from a client Ck of one or more clients which are authorized to perform operations on the data storage,
acquire a first key KCk at the PEP from the client Ck, wherein the PEP and the client Ck are different entities,
acquire a second key KTk at the PEP from a Trusted Third Party, TTP, wherein the PEP and the TTP are different entities, and wherein the client Ck and the TPP are different entities,
derive at the PEP the key KD from the first key KCk and the second key KTk, and
perform at the PEP the operation on the data storage using the derived key KD, wherein the PEP and the data storage are different entities.

2 more elements

Dependencies are inferred from the claim text.

Performing an operation on a data storage

Life of this patent

Performing an operation on a data storage

Life of this patent

Abstract

Claims33