ABSTRACT
Abstract
Various aspects of this disclosure provide a method of encrypting data in a network system. The method may include generating within a trusted network of the network system an associated private key based on an attribute associated with an user, a homomorphically encrypted associated private key based on the associated private key via homomorphic encryption, and a homomorphic key pair. The method may also include transmitting the homomorphically encrypted associated private key from the trusted network to a non-trusted network of the network system. The method may further include generating within the trusted network encrypted data based on said data, and a homomorphically and attribute based encrypted control key. The method may further include transmitting the encrypted data, and the homomorphically and attribute based encrypted control key, from the trusted network to the non-trusted network.
Description
CROSS-REFERENCE TO RELATED APPLICATION
This patent application is a U.S. National Phase Application under 35 U.S.C. § 371 of International Application No. PCT/SG2016/050215, filed on 6 May 2016, entitled NETWORK SYSTEM, AND METHODS OF ENCRYPTING DATA, DECRYPTING ENCRYPTED DATA IN THE SAME, which claims the benefit of priority of Singapore application No. 10201503778W filed on 13 May 2015, the contents of which were incorporated by reference in the entirety for all purposes.
TECHNICAL FIELD
Various aspects of this disclosure relate to network systems, and methods of encrypting data, decrypting encrypted data in the same.
BACKGROUND
Cloud computing has gained a significant adoption in enterprises and small-to-medium businesses (SMB) in the recent years. The adoption of cloud computing in enterprises and SMBs range from cloud watchers, beginners, explorers, to cloud focused. FIG. 1A is a schematic 100 a based on a report by RightScale in 2014 indicating the proportion of organizations using cloud computing. As shown in FIG. 1A , 94% of the organizations sampled use the cloud. However, only 18% of the enterprises sampled and 26% of SMB sampled are cloud focused, which means that these organizations have most of their info-communication technology (IT) workloads outsourced on the cloud. The others are cloud watches, beginners, or explorers. The primary reason why organizations do not fully adopt the cloud in their IT infrastructure is because of lack of security. FIG. 1B is a table 100 b based on the report by RightScale highlighting the major challenges faced by organizations. As indicated by FIG. 1B , the major challenges for cloud computing are security and compliance.
A case study has been carried out on the financial institutions (FIs). The FI industry has been a first mover in looking at cloud services (Top 10 Gartner Client Inquiries in Cloud Computing). According to IBM Global CIO Study 2009, the FI industry adopted cloud computing faster than any other industries. Chief Information Officers (CIOs) from different industries, including FI industry, have tremendously increased their focus on cloud computing. According to IBM Financial Service Survey Whitepaper 2010, 75% of FI respondents agree that the primary barrier to public cloud adoption is security. The Gartner report indicates that the FI industry has been proactively on security.
Key concerns from FIs include identity and access management (existing enterprise auth2Ã framework may not extend to the cloud), data protection (making sure data is controlled and secure, solving inherent data isolation problems in multi-tenancy environments), meeting federal regulations and compliance (complying with straight privacy laws against the ability to audit encryption, security controls, and geo-locations), and trust (cloud service providers (CSPs) are required to deploy data management tools that provide visibility across the cloud to ensure the policies are being enforced, making sure that the CSPs can provide a secure architecture, e.g. secure application program interfaces (APIs) and establishing root of trust).
In summary, one of the security concerns of organizations is the management of the cryptographic keys of encrypted data when uploading to the cloud for either processing or storage. Organizations face a dilemma of keeping the cryptographic keys within the organization's control but not been able to process the data on the compute nodes of the cloud, or to trust the cloud service provider to keep the cryptographic keys safe within the service provider's infrastructure.
SUMMARY
Various aspects of this disclosure provide a method of encrypting data in a network system. The method may include generating within a trusted network of the network system an associated private key based on an attribute associated with an user. The method may further include generating within the trusted network a homomorphically encrypted associated private key based on the associated private key via homomorphic encryption. The method may additionally include generating within the trusted network a homomorphic key pair including a public key and a corresponding private key paired with the public key. The method may also include transmitting the homomorphically encrypted associated private key from the trusted network to a non-trusted network of the network system. The method may further include generating within the trusted network encrypted data based on said data, and generating within the trusted network a control key. The method may also include generating within the trusted network an attribute based encrypted control key based on the control key, via attribute based encryption based on the attribute associated with the user. The method may additionally include generating within the trusted network a homomorphically and attribute based encrypted control key based on the attribute based encrypted control key, via homomorphic encryption. The method may further include transmitting the encrypted data, and the homomorphically and attribute based encrypted control key, from the trusted network to the non-trusted network. The encrypted data may be configured to be decrypted based on the control key. Based on a request from the user, the control key may be generated within the non-trusted network based on the homomorphically encrypted associated private key, the homomorphically encrypted and attribute based encrypted control key, and the corresponding private key of the homomorphic key pair.
Various aspects of this disclosure provide a method of decrypting encrypted data in a network system. The method may include generating a control key within a non-trusted network based on a homomorphically encrypted associated private key, a homomorphically encrypted and attribute based encrypted control key, and a corresponding private key of a homomorphic key pair. The method may also include decrypting encrypted data based on the control key. The homomorphically encrypted associated private key may be generated within a trusted network of the network system based on an associated private key via homomorphic encryption, the associated private key generated based on an attribute associated with an user. The homomorphic key pair including a public key and the corresponding private key may be generated by the trusted network. The homomorphically encrypted associated private key may be transmitted from the trusted network to the non-trusted network of the network system. The encrypted data may be generated within the trusted network based on said data. The homomorphically encrypted and attribute based encrypted control key may be generated based on an attribute based encrypted control key via homomorphic encryption, the attribute based encrypted control key is generated based on a control key generated within the trusted network, via the attribute associated with the user. The encrypted data, and the homomorphically and attribute based encrypted control key, may be transmitted from the trusted network to the non-trusted network.
Various aspects of this disclosure provide a network system. The network system may include a trusted network. The network system may further include a non-trusted network system. The trusted network may be configured to generate an associated private key based on an attribute associated with an user. The trusted network may be configured to generate a homomorphically encrypted associated private key based on the associated private key via homomorphic encryption. The trusted network may be further configured to generate a homomorphic key pair including a public key and a corresponding private key paired with the public key. The trusted network may be configured to transmit the homomorphically encrypted associated private key to the non-trusted network. The trusted network may be configured to generate encrypted data based on said data. The trusted network maybe configured to generate a control key. The trusted network may be configured to generate within the trusted network an attribute based encrypted control key, based on the control key via attribute based encryption, based on the attribute associated with the user. The trusted network may be configured to generate a homomorphically and attribute based encrypted control key, based on the attribute based encrypted control key, via homomorphic encryption. The trusted network may be configured to transmit the encrypted data, and the homomorphically and attribute based encrypted control key, to the non-trusted network. The encrypted data may be configured to be decrypted based on the control key. Based on a request from the user, the non-trusted network may be configured to generate the control key based on the homomorphically encrypted associated private key, the homomorphically encrypted and attribute based encrypted control key, and the corresponding private key of the homomorphic key pair.
BRIEF DESCRIPTION OF THE DRAWINGS
The invention will be better understood with reference to the detailed description when considered in conjunction with the non-limiting examples and the accompanying drawings, in which:
FIG. 1A is a schematic based on a report by RightScale in 2014 indicating the proportion of organizations using cloud computing.
FIG. 1B is a table based on the report by RightScale highlighting the major challenges faced by organizations.
FIG. 1C is an illustration of some of the commercial companies offering data security solutions for cloud computing.
FIG. 2A is a schematic illustrating a network system according to various embodiments.
FIG. 2B is a schematic illustrating an initialization process of the network system according to various embodiments.
FIG. 2C is a schematic illustrating an encryption process of the network system according to various embodiments.
FIG. 2D is a schematic illustrating a decryption process of the network system according to various embodiments.
FIG. 2E is a schematic illustrating a secure key change process of the network system according to various embodiments.
FIG. 3 is a schematic illustrating a method of encrypting data in a network system according to various embodiments.
FIG. 4 is a schematic illustrating a method of decrypting encrypted data in a network system according to various embodiments.
FIG. 5 is a schematic illustrating a method of changing keys according to various embodiments.
FIG. 6 is a schematic illustrating a method of revoking a key according to various embodiments.
FIG. 7 is a schematic illustrating a network system according to various embodiments.
DETAILED DESCRIPTION
The following detailed description refers to the accompanying drawings that show, by way of illustration, specific details and embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. Other embodiments may be utilized and structural, and logical changes may be made without departing from the scope of the invention. The various embodiments are not necessarily mutually exclusive, as some embodiments can be combined with one or more other embodiments to form new embodiments.
There is a need to protect sensitive information against unauthorized access when storing data on public cloud. Compliance requirements may be met even if data is stored on the public cloud through application of the best encryption methods to protect sensitive data. However, encryption may not be a fool-proof method because encryption keys are vulnerable to data breaches. It may be important to manage encryption keys robustly and securely. Insider attacks, multiple-tenancy, proper accounts indexing, availability, weak pass-phrases are some of the challenges when outsourcing key management functions in the cloud.
An existing security solution for having data in the cloud is in-house key management, which provides local data encryption before uploading data on the cloud storage service, However, enterprise or organization level policies and sharing is hard to implement because the keys are kept on the client or user side. Another solution is using in-cloud key management, i.e. provide data encryption on the cloud storage service provider (CSP) side. However, there is a risk that the CSP's key management nodes may be breached. Other threats include curious CSPs or inside threats within the CSPs when entrusting key management to the CSPs. A further solution may be using hosted key management, i.e. provide data encryption on trusted third party. However, putting trust on a trusted third party (TTP) or having a decreased security level on a third part is not a good solution because similar to using CSPs' services, there are threats such as curious TTPs or insider threats inside the TTPs.
Reasons why the key manager may be in the untrusted cloud may include expensive software license, operational overhead, and taking advantage of cloud computing features. An in-use key broker may be on an untrusted site to safely keep the encryption at all times, even if the keys are in use in the cloud. Protection may be provided by cryptography agnostic key management (CAKM).
Decryption or attribute based decryption may happen at the trusted platform. Alternatively, computing and decryption may be moved to the cloud, which may require the cryptographic keys to be transferred to a running instance securely, as disclosure of key may occur at this point. Another solution may be to allow a semi-trusted third party to perform decryption on the cloud instead of using the cloud instances to perform attribute based decryption.
Existing key management systems may include traditional key management systems such as RSA, Safenet, etc, or computational agnostic key management systems such as Portico. FIG. 1C is an illustration 100 c of some of the commercial companies offering data security solutions for cloud computing. For in-house key management, Bitcasa, Wuala, Tresorit, etc. all provide local data encryption before uploading data on ther cloud storage service. For on-cloud key management, Amazon's CloudHSM, Gazzang, CipherCloud etc are providing data encryption on the cloud storage service provider side. For hosted key management, Trendmicro's SecureCloud and Porticor provide software as a service (Saas) that may perform key management solutions.
Various embodiments may seek to address or mitigate the various issues highlighted. Various embodiments may address or mitigate the dilemma of keeping the cryptographic keys within the organization's control but not been able to process the data on the compute nodes of the cloud, or to trust the cloud service provider to keep the cryptographic keys safe within the service provider's infrastructure.
Various embodiments may seek to create a secure and robust key management system that may be outsourced in the untrusted public cloud. Various embodiments may seek to provide an organization-level or enterprise-grade access control to data stored in the cloud. Various embodiments may seek to ensure that the keys that are stored in the cloud remain secure from curious CSPs, insider attacks, and/or other malicious users.
The network system referred to herein may refer to the info-communication technology (IT) in
CROSS-REFERENCE TO RELATED APPLICATION
This patent application is a U.S. National Phase Application under 35 U.S.C. § 371 of International Application No. PCT/SG2016/050215, filed on 6 May 2016, entitled NETWORK SYSTEM, AND METHODS OF ENCRYPTING DATA, DECRYPTING ENCRYPTED DATA IN THE SAME, which claims the benefit of priority of Singapore application No. 10201503778W filed on 13 May 2015, the contents of which were incorporated by reference in the entirety for all purposes.
TECHNICAL FIELD
Various aspects of this disclosure relate to network systems, and methods of encrypting data, decrypting encrypted data in the same.
BACKGROUND
Cloud computing has gained a significant adoption in enterprises and small-to-medium businesses (SMB) in the recent years. The adoption of cloud computing in enterprises and SMBs range from cloud watchers, beginners, explorers, to cloud focused. FIG. 1A is a schematic 100 a based on a report by RightScale in 2014 indicating the proportion of organizations using cloud computing. As shown in FIG. 1A , 94% of the organizations sampled use the cloud. However, only 18% of the enterprises sampled and 26% of SMB sampled are cloud focused, which means that these organizations have most of their info-communication technology (IT) workloads outsourced on the cloud. The others are cloud watches, beginners, or explorers. The primary reason why organizations do not fully adopt the cloud in their IT infrastructure is because of lack of security. FIG. 1B is a table 100 b based on the report by RightScale highlighting the major challenges faced by organizations. As indicated by FIG. 1B , the major challenges for cloud computing are security and compliance.
A case study has been carried out on the financial institutions (FIs). The FI industry has been a first mover in looking at cloud services (Top 10 Gartner Client Inquiries in Cloud Computing). According to IBM Global CIO Study 2009, the FI industry adopted cloud computing faster than any other industries. Chief Information Officers (CIOs) from different industries, including FI industry, have tremendously increased their focus on cloud computing. According to IBM Financial Service Survey Whitepaper 2010, 75% of FI respondents agree that the primary barrier to public cloud adoption is security. The Gartner report indicates that the FI industry has been proactively on security.
Key concerns from FIs include identity and access management (existing enterprise auth2Ã framework may not extend to the cloud), data protection (making sure data is controlled and secure, solving inherent data isolation problems in multi-tenancy environments), meeting federal regulations and compliance (complying with straight privacy laws against the ability to audit encryption, security controls, and geo-locations), and trust (cloud service providers (CSPs) are required to deploy data management tools that provide visibility across the cloud to ensure the policies are being enforced, making sure that the CSPs can provide a secure architecture, e.g. secure application program interfaces (APIs) and establishing root of trust).
In summary, one of the security concerns of organizations is the management of the cryptographic keys of encrypted data when uploading to the cloud for either processing or storage. Organizations face a dilemma of keeping the cryptographic keys within the organization's control but not been able to process the data on the compute nodes of the cloud, or to trust the cloud service provider to keep the cryptographic keys safe within the service provider's infrastructure.
SUMMARY
Various aspects of this disclosure provide a method of encrypting data in a network system. The method may include generating within a trusted network of the network system an associated private key based on an attribute associated with an user. The method may further include generating within the trusted network a homomorphically encrypted associated private key based on the associated private key via homomorphic encryption. The method may additionally include generating within the trusted network a homomorphic key pair including a public key and a corresponding private key paired with the public key. The method may also include transmitting the homomorphically encrypted associated private key from the trusted network to a non-trusted network of the network system. The method may further include generating within the trusted network encrypted data based on said data, and generating within the trusted network a control key. The method may also include generating within the trusted network an attribute based encrypted control key based on the control key, via attribute based encryption based on the attribute associated with the user. The method may additionally include generating within the trusted network a homomorphically and attribute based encrypted control key based on the attribute based encrypted control key, via homomorphic encryption. The method may further include transmitting the encrypted data, and the homomorphically and attribute based encrypted control key, from the trusted network to the non-trusted network. The encrypted data may be configured to be decrypted based on the control key. Based on a request from the user, the control key may be generated within the non-trusted network based on the homomorphically encrypted associated private key, the homomorphically encrypted and attribute based encrypted control key, and the corresponding private key of the homomorphic key pair.
Various aspects of this disclosure provide a method of decrypting encrypted data in a network system. The method may include generating a control key within a non-trusted network based on a homomorphically encrypted associated private key, a homomorphically encrypted and attribute based encrypted control key, and a corresponding private key of a homomorphic key pair. The method may also include decrypting encrypted data based on the control key. The homomorphically encrypted associated private key may be generated within a trusted network of the network system based on an associated private key via homomorphic encryption, the associated private key generated based on an attribute associated with an user. The homomorphic key pair including a public key and the corresponding private key may be generated by the trusted network. The homomorphically encrypted associated private key may be transmitted from the trusted network to the non-trusted network of the network system. The encrypted data may be generated within the trusted network based on said data. The homomorphically encrypted and attribute based encrypted control key may be generated based on an attribute based encrypted control key via homomorphic encryption, the attribute based encrypted control key is generated based on a control key generated within the trusted network, via the attribute associated with the user. The encrypted data, and the homomorphically and attribute based encrypted control key, may be transmitted from the trusted network to the non-trusted network.
Various aspects of this disclosure provide a network system. The network system may include a trusted network. The network system may further include a non-trusted network system. The trusted network may be configured to generate an associated private key based on an attribute associated with an user. The trusted network may be configured to generate a homomorphically encrypted associated private key based on the associated private key via homomorphic encryption. The trusted network may be further configured to generate a homomorphic key pair including a public key and a corresponding private key paired with the public key. The trusted network may be configured to transmit the homomorphically encrypted associated private key to the non-trusted network. The trusted network may be configured to generate encrypted data based on said data. The trusted network maybe configured to generate a control key. The trusted network may be configured to generate within the trusted network an attribute based encrypted control key, based on the control key via attribute based encryption, based on the attribute associated with the user. The trusted network may be configured to generate a homomorphically and attribute based encrypted control key, based on the attribute based encrypted control key, via homomorphic encryption. The trusted network may be configured to transmit the encrypted data, and the homomorphically and attribute based encrypted control key, to the non-trusted network. The encrypted data may be configured to be decrypted based on the control key. Based on a request from the user, the non-trusted network may be configured to generate the control key based on the homomorphically encrypted associated private key, the homomorphically encrypted and attribute based encrypted control key, and the corresponding private key of the homomorphic key pair.
BRIEF DESCRIPTION OF THE DRAWINGS
The invention will be better understood with reference to the detailed description when considered in conjunction with the non-limiting examples and the accompanying drawings, in which:
FIG. 1A is a schematic based on a report by RightScale in 2014 indicating the proportion of organizations using cloud computing.
FIG. 1B is a table based on the report by RightScale highlighting the major challenges faced by organizations.
FIG. 1C is an illustration of some of the commercial companies offering data security solutions for cloud computing.
FIG. 2A is a schematic illustrating a network system according to various embodiments.
FIG. 2B is a schematic illustrating an initialization process of the network system according to various embodiments.
FIG. 2C is a schematic illustrating an encryption process of the network system according to various embodiments.
FIG. 2D is a schematic illustrating a decryption process of the network system according to various embodiments.
FIG. 2E is a schematic illustrating a secure key change process of the network system according to various embodiments.
FIG. 3 is a schematic illustrating a method of encrypting data in a network system according to various embodiments.
FIG. 4 is a schematic illustrating a method of decrypting encrypted data in a network system according to various embodiments.
FIG. 5 is a schematic illustrating a method of changing keys according to various embodiments.
FIG. 6 is a schematic illustrating a method of revoking a key according to various embodiments.
FIG. 7 is a schematic illustrating a network system according to various embodiments.
DETAILED DESCRIPTION
The following detailed description refers to the accompanying drawings that show, by way of illustration, specific details and embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. Other embodiments may be utilized and structural, and logical changes may be made without departing from the scope of the invention. The various embodiments are not necessarily mutually exclusive, as some embodiments can be combined with one or more other embodiments to form new embodiments.
There is a need to protect sensitive information against unauthorized access when storing data on public cloud. Compliance requirements may be met even if data is stored on the public cloud through application of the best encryption methods to protect sensitive data. However, encryption may not be a fool-proof method because encryption keys are vulnerable to data breaches. It may be important to manage encryption keys robustly and securely. Insider attacks, multiple-tenancy, proper accounts indexing, availability, weak pass-phrases are some of the challenges when outsourcing key management functions in the cloud.
An existing security solution for having data in the cloud is in-house key management, which provides local data encryption before uploading data on the cloud storage service, However, enterprise or organization level policies and sharing is hard to implement because the keys are kept on the client or user side. Another solution is using in-cloud key management, i.e. provide data encryption on the cloud storage service provider (CSP) side. However, there is a risk that the CSP's key management nodes may be breached. Other threats include curious CSPs or inside threats within the CSPs when entrusting key management to the CSPs. A further solution may be using hosted key management, i.e. provide data encryption on trusted third party. However, putting trust on a trusted third party (TTP) or having a decreased security level on a third part is not a good solution because similar to using CSPs' services, there are threats such as curious TTPs or insider threats inside the TTPs.
Reasons why the key manager may be in the untrusted cloud may include expensive software license, operational overhead, and taking advantage of cloud computing features. An in-use key broker may be on an untrusted site to safely keep the encryption at all times, even if the keys are in use in the cloud. Protection may be provided by cryptography agnostic key management (CAKM).
Decryption or attribute based decryption may happen at the trusted platform. Alternatively, computing and decryption may be moved to the cloud, which may require the cryptographic keys to be transferred to a running instance securely, as disclosure of key may occur at this point. Another solution may be to allow a semi-trusted third party to perform decryption on the cloud instead of using the cloud instances to perform attribute based decryption.
Existing key management systems may include traditional key management systems such as RSA, Safenet, etc, or computational agnostic key management systems such as Portico. FIG. 1C is an illustration 100 c of some of the commercial companies offering data security solutions for cloud computing. For in-house key management, Bitcasa, Wuala, Tresorit, etc. all provide local data encryption before uploading data on ther cloud storage service. For on-cloud key management, Amazon's CloudHSM, Gazzang, CipherCloud etc are providing data encryption on the cloud storage service provider side. For hosted key management, Trendmicro's SecureCloud and Porticor provide software as a service (Saas) that may perform key management solutions.
Various embodiments may seek to address or mitigate the various issues highlighted. Various embodiments may address or mitigate the dilemma of keeping the cryptographic keys within the organization's control but not been able to process the data on the compute nodes of the cloud, or to trust the cloud service provider to keep the cryptographic keys safe within the service provider's infrastructure.
Various embodiments may seek to create a secure and robust key management system that may be outsourced in the untrusted public cloud. Various embodiments may seek to provide an organization-level or enterprise-grade access control to data stored in the cloud. Various embodiments may seek to ensure that the keys that are stored in the cloud remain secure from curious CSPs, insider attacks, and/or other malicious users.
The network system referred to herein may refer to the info-communication technology (IT) infrastructure of an organization, such as an enterprise or a SMB. The network system may include a trusted network, which may alternatively be referred to as a trusted region or a trusted site. The network system may include a non-trusted network, which may alternatively be referred to as a non-trusted region or a non-trusted site.
The trusted network is a part of the network system within control by the organization, and may include infrastructure security nodes, such as firewalls, intrusion detection systems, and intrusion prevention systems. The untrusted network is a part of the network system outside of the trusted network, and may include cloud and/or other web-based service. The untrusted network may be hosted by a CSP or a TTP.
The trusted network may be connected to the non-trusted network via one or more wired connections, such as fiber optics cables, and/or telephone lines, or wireless connections, such as Wi-Fi, or a combination of wired and wireless connections.
The trusted network may include one or more computing devices. The non-trusted network may include one or more further computing devices. A computing device in the current context may refer to a server, a desktop computer, a workstation, a laptop, or any other suitable machines. When there are a plurality of computing devices within the trusted network and/or a plurality of computing devices within the non-trusted network, there may be one or more connections connected between devices in the trusted network and devices in the non-trusted network.
Attribute-based encryption is a type of public-key encryption in which the secret key of a user and the ciphertext may be dependent upon attributes (e.g. the name of the user, the position held by the user in the organization, the control access granted to the user etc.). In such a system, the decryption of a ciphertext may be possible only if the set of attributes of the user key matches the attributes of the ciphertext. In other words, attribute-based Encryption is a type of public-key encryption where the encryption of the plaintext may be dependent upon a set of attributes and rules. The decryption of the ciphertext may be based on a secret key generated based on some set of attributes that comply with the rules used to encrypt the ciphertext.
Homomorphic encryption is a form of encryption that may allow computations to be carried out on ciphertext, thus generating an encrypted result which, when decrypted, matches the result of operations performed on the plaintext. In other words, homomorphic encryption is a form of encryption which may allow computation to be done on ciphertexts, generating an encrypted result. The result, when decrypted, may reveal the result of the operations which matches the operations done on the original plaintext.
The trusted network may include two major components running in the trusted site: the Cryptography Agnostic Key Management (CAKM) Administrator and the Data Owner. The CAKM Administrator may be a software component responsible for initializing the components running on the cloud and generating the private keys for users in the system. The Data Owner may be a software component that users/applications use to upload data into the public storage systems.
The untrusted network may include three components that are working together using the public cloud: the CAKM Broker, the Compute Node, and the Data Store. The Data Store may be any public cloud object/file storage service offering. The Data Store may be the data storage of the cloud service provider that can be accessed by the Compute Node or the user. The Compute Node may be the running instance (virtual machine) in the public cloud of the application that processes the data the Data Owner uploads, and/or process/distribute the data to the users. The CAKM Broker may serve as the critical key storage and distribution node that is deployed in the cloud. The CAKM Broker may be responsible for key distribution and storage in the cloud.
FIG. 2A is a schematic illustrating a network system 200 according to various embodiments. The network 200 may include a trusted site or a trusted network 202 , and a untrusted network or a public cloud 204 connected to the trusted site or trusted network 202 . The trusted site 202 may include a CAKM Administrator 202 a , and a data owner 202 b . The CAKM Administrator 202 a may generate private keys for one or more compute nodes or one or more users. The data owner 202 b may be an application on the trusted site 202 that an user used to upload data to the public cloud storage. The untrusted site 204 may include a CAKM broker 204 a , a compute node 204 b , and a data store 204 c . The CAKM broker 204 a may be responsible for key distribution and storage in the cloud. The compute node 204 b may be a virtual machine that hosts application that processes or distributes the data to end users. The data store 204 c may be a data storage of the cloud service provider that can be accessed by the compute node or user.
The CAKM Administrator 202 a and the data owner 202 b may be implemented on different computing devices or on a single computing device. The CAKM broker 204 a , a compute node 204 b , and a data store 204 c may be implemented on different computing devices or on a single computing device. The computing devices may be connected to one another via a suitable connection, such as a wired connection, or a wireless connection or a combination of wired and wireless connections. When there is a plurality of computing devices within a trusted network or within a non-trusted network, the plurality of computing devices within the trusted network or the non-trusted network may be connected to on another via one or more suitable connections, such as wired connections, wireless connections, or a combination of wired and wireless connections.
There may be four major activities in CAKM, namely: Initialization, Data Encryption, Data Decryption, and Secure Key Change and Revocation. The Initialization process may be used to generate private keys of the users or application. The Data Encryption process may relate to encrypting and uploading the data from the trusted site onto the public cloud services. The Data Decryption process may describe the procedures to extract the data for processing on the Compute Nodes in the public cloud. The Secure Key Change and Revocation may describe the process of changing the keys.
FIG. 2B is a schematic illustrating an initialization process of the network system 200 according to various embodiments. In the Initialization part, the CAKM 202 a may provide private keys for every user in the cloud application. These private keys may be used by the CAKM to provide access control to the users of the application in running in the compute node.
The CAKM Admin component 202 a may include or may use the CAKM Admin Tool 202 c , Ciphertext Policy Attribute-Based Encryption (CP-ABE) library 202 d , and Homomorphic Encryption (HE) library 202 e . The system administrator (admin) may first trigger the initialization process of the CAKM 202 a through the CAKM Admin Tool 202 c . Once triggered, the CAKM Admin Tool 202 c may generate a Master Key by accessing the APIs of the CP- ABE library 202 d , which may be used as a base for the future user keys that are generated by the trusted network 202 . As indicated in 206 a , the trusted network 202 or CAKM Admin Tool 202 c may send a request to the CP- ABE library 202 d , which may then in response to the request, generate the master key, and transmit the master key to the CAKM Admin tool 202 c.
The trusted network 202 or CAKM Admin Tool 202 c may generate individual private keys for each user. The private key may be referred herein as K abe . These individual private keys may be assigned by the CAKM Admin Tool 202 c to the users of the system, and may be based on the roles and attributes of each particular user. As indicated in 206 b , the CAKM Admin Tool 202 c may transmit a request to the CP- ABE library 202 d , which may in response to the request, generate a private key for a particular user or each user. The CP-ABE library may then transmit the private key or keys to the CAKM Admin Tool 202 c.
The trusted network 202 or CAKM Admin Tool 202 c may generate a homomorphic public key pair (K pub , K priv ). K abe and K priv may be unrelated keys. K abe may be a key assigned to an user, while K priv may be part of the key pair (K pub , K priv ) used to encrypt (K abe ) before sending to the CAKM broker 204 a (as described later). As shown in 206 c the CAKM Admin Tool 202 c may transmit a request to the Homomorphic Encryption Tool 202 e , which may in response to the request, generate the homomorphic public key pair (K pub , K priv ). The Homomorphic Encryption Tool 202 e may then transmit the homomorphic public key pair (K pub , K priv ) to the CAKM Admin Tool 202 c.
The trusted network 202 or CAKM Admin Tool 202 c may conduct homomorphic encryption of the individual private keys that was generated in 206 b . The trusted network 202 may use the public key that was generated in 202 c to encrypt the private keys HE Kpub (K abe ). For avoidance of doubt, using a key to encrypt content may refer to encrypting the content so that the encrypted content may subsequently be decrypted by the key. K abe may be encrypted to make sure that there is no leak of the user's private keys (K abe ) that may happen when K abe is subsequently sent to the CAKM Broker on the non-trusted network 204 (as described later). The homomorphic key (HE kpub ) may be used to encrypt the user's private key (K abe ), so K abe may be distributed to the compute node 204 b for subsequently decrypting the user's data (as described later). As shown in 206 d , the CAKM Admin Tool 202 d may transmit a request to the Homomorphic Encryption Tool 202 e . The public key K pub and the private key K abe may be transmitted with the request. The Homomorphic Encryption Tool 202 e may, in response to the request, generate the homomorphically encrypted private key HE Kpub (K abe ), and may transmit the homomorphically encrypted private key HE Kpub (K abe ) to the CAKM Admin Tool 202 d.
The trusted network 202 or CAKM Admin Tool 202 c may, in 206 e , send the homomorphically encrypted keys, e.g. through a secure communications channel, to the CAKM Broker 204 a of the public cloud 204 for storage and distribution. The secure communications channel may be created using a well-established Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocol.
The trusted network 202 or CAKM Admin Tool 202 c may, in 206 f , send the homomorphic public key pair to the Compute Node 204 b (where the application may be running), e.g. through a secure communications channel. 206 e may occur before, concurrently with, or after 206 f . Another option for this step is to have public cloud 204 create the Compute Node 204 b with pre-installed public key pair, that is identical to (K pub , K priv ), which may be used for homomorphic decryption.
FIG. 2C is a schematic illustrating an encryption process of the network system 200 according to various embodiments.
The Data Encryption process is where the content/data owner may decide to share his content to the cloud for processing.
The process of Data Encryption may make use of the Data Owner component 202 b of the Trusted Site 202 . The Data Owner component may make use of the same CP- ABE module 202 d , and HE module 202 e , used in the Initialization process and any secure symmetric encryption algorithm 202 g (AES-256 being the latest secure and efficient symmetric encryption algorithm). The first process 208 a that the system may conduct is to generate two randomly generated keys, the data key and the control key (K d , K c ).
Using symmetric encryption algorithm 202 g , the data or content may be encrypted using the data key K d in 208 b . The notation E Kd (Data) may be used for the encrypted data. As indicated by 208 b , the Data Owner Tool 202 f may transmit a request to the Symmetric Encryption Module 202 g with the data or content and data key K d , and the Symmetric Encryption Module 202 g may, in response to the request, transmit the encrypted data E Kd (Data) back to the Data Owner Tool 202 f.
Using symmetric encryption algorithm 202 g , the data key may be encrypted using the control key K c in 208 c . The notation E Kc (K d ) may be used for the encrypted data key. As indicated by 208 c , the Data Owner Tool 202 f may transmit a request to the Symmetric Encryption Module 202 g with the data key K d and the control key K c , and the Symmetric Encryption Module 202 g may, in response to the request, transmit the encrypted data key E Kc (K d ) back to the Data Owner Tool 202 f.
Using CP- ABE 202 d , the control key may be encrypted with the attributes the data owner wants on who would be able to process/use the data that has been encrypted in 208 b . The encrypted control key may be homomorphically encrypted with the HE public key used in 206 d of Initialization. The attribute based and homographic encryption is denoted by 208 d . The output of this step may be denoted by HE Kpub (ABE(K c )). The Data Owner Tool 202 f may transmit a request to the CP- ABE module 202 d with the control key, and the CP-ABE module may, in response to the request, generate an attribute based encrypted control key. In various embodiments, the attribute based encrypted control key may be transmitted directly to the homomorphic encryption module 202 e for homographic encryption to generate HE Kpub (ABE(K c )), which may then be transmitted back to the Data Owner Tool 201 f . The public key required for the homographic encryption may be transmitted separately from the Data Owner Tool 202 f or may be already residing in homomorphic encryption module 202 e . In various other embodiments, the attribute based encrypted control key may be transmitted from the CP- ABE module 202 d to the Data Owner Tool 201 f . When the attribute based encrypted control key is transmitted back to the Data Owner Tool 202 f , the Data Owner Tool 202 f may transmit another request with the attribute based encrypted control key to the homomorphic encryption module 202 e . The public key may be transmitted together with the attribute based encrypted control key or may already reside in the homomorphic encryption module 202 e . The homomorphic encryption module 202 e may, in response to the request, generate HE Kpub (ABE(K c )) and transmit HE Kpub (ABE(K c )) to the Data Owner Tool 202 f.
The encrypted data E kd (Data) and encrypted data key E Kc (K d ) may be uploaded by the Data Owner Tool 202 f to the outsourced data storage 204 c in the cloud 204 using a secure communication channel in 208 e . The encrypted data may be denoted as âEncrypted Dataâ and the encrypted datakey may be denoted as âEncrypted Datakeyâ.
The encrypted control key HE Kpub (ABE(K c )) may be uploaded by the Data Owner Tool 202 f to the CAKM Broker 204 a running in the cloud 204 using a secure communication channel in 208 f . The encrypted control key HE Kpub (ABE(K c )) may be stored in the CAKM Broker 204 a , and may be subsequently used by the CAKM Broker 204 a to provide access control to the encrypted data. The encrypted control key HE Kpub (ABE(K c )) may be denoted as KeyEncKey Keysâ. The CAKM Broker 204 a may already include key HE Kpub (K abe ) 204 d (denoted as âPrivate Keysâ), which may be stored in the initialization process. 208 e may occur before, concurrently with, or after 208 f.
FIG. 2D is a schematic illustrating a decryption process of the network system 200 according to various embodiments.
The Data Decryption process may allow Compute Node 204 b in the public cloud 204 to process the data shared by the content owners. This may allow the CAKM Broker 204 a to distribute the keys to the intended users or applications to process the encrypted data. This solution may allow for scalable key distribution because of the flexibility offered by cloud computing.
As mentioned previously, the untrusted site 204 in this system 200 may include the CAKM Broker 204 a , Compute Node 204 b , and Data Store 204 c . The applications may run on the Compute Node 204 b and may be triggered by users who need to process the data shared on the cloud 204 . As shown in 210 a , The Compute Node 204 b may first get the encrypted data E Kd (Data) 204 e and encrypted data key E Kc (K d ) 204 f from the Data Store 204 c . The Compute Node 204 b may transmit a request and the Data Store 204 c may, in response to the request, transmit the encrypted data E Kd (Data) 204 e and encrypted data key E Kc (K d ) 204 f
The Compute Node 204 b may then in 210 b , request for the homomorphically encrypted control key HE Kpub (K c ) from the CAKM Broker 204 a . The Compute Node 204 b may submit K pub and predetermined authentication credentials along with the request. However, the CAKM Broker 204 a may only keep the homomorphically encrypted attribute-based encrypted control key HE Kpub (ABE(K c )) 204 h on its encrypted key store database 204 g.
The <figure-callout id
CLAIMS
Claims ( 20 )
What is claimed is:
1. A method of encrypting data in a network system, the method comprising:
generating within a trusted network of the network system an associated private key based on an attribute associated with an user;
generating within the trusted network a homomorphically encrypted associated private key based on the associated private key via homomorphic encryption;
generating within the trusted network a homomorphic key pair comprising a public key and a corresponding private key paired with the public key;
transmitting the homomorphically encrypted associated private key from the trusted network to a non-trusted network of the network system;
generating within the trusted network encrypted data based on said data;
generating within the trusted network a control key;
generating within the trusted network an attribute based encrypted control key based on the control key, via attribute based encryption based on the attribute associated with the user;
generating within the trusted network a homomorphically and attribute based encrypted control key based on the attribute based encrypted control key, via homomorphic encryption; and
transmitting the encrypted data, and the homomorphically and attribute based encrypted control key, from the trusted network to the non-trusted network;
wherein the encrypted data is configured to be decrypted based on the control key; and
wherein based on a request from the user, the control key is generated within the non-trusted network based on the homomorphically encrypted associated private key, the homomorphically encrypted and attribute based encrypted control key, and the corresponding private key of the homomorphic key pair.
2. The method according to claim 1 , further comprising:
generating within the trusted network a data key; and
generating within the trusted network an encrypted data key, the encrypted data key configured to be decrypted by the control key;
wherein the encrypted data is configured to be decrypted by the data key so that the encrypted data is configured to be indirectly decrypted based on the control key.
3. The method according to claim 2 , further comprising:
transmitting the encrypted data key from the trusted network to the non-trusted network.
4. The method according to claim 1 ,
wherein the homomorphic encryption is a fully homomorphic encryption.
5. The method according to claim 1 ,
wherein the non-trusted network, upon request from a data owner, is configured to delete the homomorphically and attribute based encrypted control key.
6. The method according to claim 2 ,
wherein the trusted network, upon request from a data owner, is configured to obtain the homomorphically and attribute based encrypted control key, and encrypted data key, from the non-trusted network.
7. The method according to claim 6 ,
wherein the trusted network is further configured to decrypt the control key based on the homomorphically and attribute based encrypted control key; and further configured to decrypt the data key based on the encrypted data key, via the control key.
8. The method according to claim 7 ,
wherein the trusted network is further configured to generate a new control key different from the control key; and further configured to generate a new encrypted data key, the new encrypted data key configured to be decrypted by the new control key.
9. The method according to claim 8 ,
wherein the trusted network is further configured to generate a new attribute based encrypted control key based on the new control key, via attribute based encryption based on the attribute associated with the user;
wherein the trusted network is further configured to generate a new homomorphically and attribute based encrypted control key, based on the new attribute based encrypted control key, via homomorphic encryption.
10. The method according to claim 9 ,
wherein the trusted network is further configured to transmit the new homomorphically and attribute based encrypted control key, and the new encrypted data key, to the non-trusted network.
11. A method of decrypting encrypted data in a network system, the method comprising:
generating a control key within a non-trusted network based on a homomorphically encrypted associated private key, a homomorphically encrypted and attribute based encrypted control key, and a corresponding private key of a homomorphic key pair; and
decrypting encrypted data based on the control key;
wherein the homomorphically encrypted associated private key is generated within a trusted network of the network system based on an associated private key via homomorphic encryption, the associated private key generated based on an attribute associated with an user;
wherein the homomorphic key pair comprising a public key and the corresponding private key is generated by the trusted network;
wherein the homomorphically encrypted associated private key is transmitted from the trusted network to the non-trusted network of the network system;
wherein the encrypted data is generated within the trusted network based on data;
wherein the homomorphically encrypted and attribute based encrypted control key is generated based on an attribute based encrypted control key via homomorphic encryption, the attribute based encrypted control key is generated based on a control key generated within the trusted network, via the attribute associated with the user;
wherein the encrypted data, and the homomorphically and attribute based encrypted control key, are transmitted from the trusted network to the non-trusted network.
12. A network system comprising:
a trusted network; and
a non-trusted network connected to the trusted network;
wherein the trusted network is configured to generate an associated private key based on an attribute associated with an user;
wherein the trusted network is configured to generate a homomorphically encrypted associated private key based on the associated private key via homomorphic encryption;
wherein the trusted network is further configured to generate a homomorphic key pair comprising a public key and a corresponding private key paired with the public key;
wherein the trusted network is configured to transmit the homomorphically encrypted associated private key to the non-trusted network;
wherein the trusted network is configured to generate encrypted data based on data;
wherein the trusted network is configured to generate a control key;
wherein the trusted network is configured to generate within the trusted network an attribute based encrypted control key, based on the control key via attribute based encryption, based on the attribute associated with the user;
wherein the trusted network is configured to generate a homomorphically and attribute based encrypted control key, based on the attribute based encrypted control key, via homomorphic encryption;
wherein the trusted network is configured to transmit the encrypted data, and the homomorphically and attribute based encrypted control key, to the non-trusted network;
wherein the encrypted data is configured to be decrypted based on the control key; and
wherein based on a request from the user, the non-trusted network is configured to generate the control key based on the homomorphically encrypted associated private key, the homomorphically encrypted and attribute based encrypted control key, and the corresponding private key of the homomorphic key pair.
13. The network system according to claim 12 ,
wherein the trusted network system is configured to generate a data key;
wherein the trusted network system is configured to generate an encrypted data key, the encrypted data key configured to be decrypted by the control key;
wherein the encrypted data is configured to be decrypted by the data key so that the encrypted data is configured to be indirectly decrypted based on the control key; and
wherein the network system is configured to transmit the encrypted data key from the trusted network to the non-trusted network.
14. The network system according to claim 12 ,
wherein the trusted network comprises:
a cryptography agnostic key management (CAKM) administration tool module;
a ciphertext policy attribute-based encryption (CP-ABE) library module;
a homographic encryption (HE) module; and
a data owner tool module.
15. The network system according to claim 14 ,
wherein the ciphertext policy attribute-based encryption library module is configured to, on a request from the cryptography agnostic key management administration tool module, generate the associated private key based on the attribute associated with the user; and
wherein the ciphertext policy attribute-based encryption library module is configured to, on a request from the data owner tool module, generate the attribute based encrypted control key based on the control key, via attribute based encryption based on the attribute associated with the user.
16. The network system according to claim 14 ,
wherein the homographic encryption module of the trusted network is configured to, on a request from the cryptography agnostic key management administration tool module, configured to generate the homomorphic key pair;
wherein the homographic encryption module of the trusted network is configured to, on a further request from the cryptography agnostic key management administration tool module, configured to generate the homomorphically encrypted associated private key, based on the first private key, via homomorphic encryption; and
wherein the homographic encryption module of the trusted network is configured to, on a request from the data owner tool module, generate the homomorphically and attribute based encrypted control key, based on the attribute based encrypted control key, via homomorphic encryption.
17. The network system according to claim 12 ,
wherein the non-trusted network comprises:
a cryptography agnostic key management (CAKM) broker module;
a compute node module;
a data store module;
a homographic encryption module; and
an encrypted key store module.
18. The network system according to claim 17 ,
wherein the homomorphically encrypted associated private key is transmitted to the cryptography agnostic key management broker module, and the homomorphic key pair is transmitted to the compute node module.
19. The network system according to claim 17 ,
wherein the encrypted data is transmitted to the data store module, and the homomorphically and attribute based encrypted control key is transmitted to the cryptography agnostic key management broker module.
20. The network system according to claim 17 ,
wherein based on the request from the user, the homomorphic encryption module of the non-trusted network is configured to generate a homomorphically encrypted control key based on the homomorphically encrypted associated private key, and the homomorphically encrypted and attribute based encrypted control key; and
wherein the compute node is further configured to generate the control key based on the homomorphically encrypted control key generated by the homomorphic encryption module of the non-trusted network and the corresponding private key of the homomorphic key pair.
US15/573,833
2015-05-13
2016-05-06
Network system, and methods of encrypting data, decrypting encrypted data in the same
Active
2036-10-04
US10546141B2
( en )
Applications Claiming Priority (4)
Application Number
Priority Date
Filing Date
Title
SG10201503778Q
2015-05-13
SG10201503778W
2015-05-13
SG10201503778W
2015-05-13
PCT/SG2016/050215
WO2016182509A1
( en )
2015-05-13
2016-05-06
Network system, and methods of encrypting data, decrypting encrypted data in the same
Publications (2)
Publication Number
Publication Date
US20180260576A1
US20180260576A1 ( en )
2018-09-13
US10546141B2
true
US10546141B2 ( en )
2020-01-28
Family
ID=57249252
Family Applications (1)
Application Number
Title
Priority Date
Filing Date
US15/573,833
Active
2036-10-04
US10546141B2
( en )
2015-05-13
2016-05-06
Network system, and methods of encrypting data, decrypting encrypted data in the same
Country Status (3)
Country
Link
US
( 1 )
US10546141B2
( en )
SG
( 1 )
SG11201708750TA
( en )
WO
( 1 )
WO2016182509A1
( en )
Cited By (7)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US11418327B2
( en )
*
2019-11-14
2022-08-16
International Business Machines Corporation
Automatic provisioning of key material rotation information to services
US11496287B2
( en )
2020-08-18
2022-11-08
Seagate Technology Llc
Privacy preserving fully homomorphic encryption with circuit verification
US11575501B2
( en )
2020-09-24
2023-02-07
Seagate Technology Llc
Preserving aggregation using homomorphic encryption and trusted execution environment, secure against malicious aggregator
US20230418956A1
( en )
*
2020-09-07
2023-12-28
The Toronto-Dominion Bank
Application of trained artificial intelligence processes to encrypted data within a distributed computing environment
US20240160423A1
( en )
*
2022-11-11
2024-05-16
Electronics And Telecommunications Research Institute
Program conversion apparatus and method
TWI865290B
( en )
*
2023-02-13
2024-12-01
ç¾åè¬ååæ¥æ©å¨å ¬å¸
Method, computer program product, and apparatus for attribute based encryption key based third party data access authorization
US12542650B2
( en )
2023-10-03
2026-02-03
Bank Of America Corporation
Artificial intelligence (AI) based cloud architecture segmentation leveraging homomorphic encryption
Families Citing this family (23)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US10397002B2
( en )
*
2017-02-10
2019-08-27
International Business Machines Corporation
Signature scheme for homomorphic message encoding functions
US10687212B2
( en )
*
2017-04-07
2020-06-16
At&T Mobility Ii Llc
Mobile network core component for managing security keys
US11050724B2
( en )
*
2018-03-22
2021-06-29
Cisco Technology, Inc.
IaaS-aided access control for information centric networking with Internet-of-Things
JP7178811B2
( en )
*
2018-06-27
2022-11-28
æ ªå¼ä¼ç¤¾æ¥ç«è£½ä½æ
Service support system and service support method
CN109214201B
( en )
*
2018-08-31
2024-03-19
å¹³å®ç§æï¼æ·±å³ï¼æéå ¬å¸
A data sharing method, terminal equipment and computer-readable storage medium
CN109151715B
( en )
*
2018-09-05
2020-07-14
éåºç工大å¦
Position proximity detection privacy protection method based on polygon range
US11935003B2
( en )
2019-05-23
2024-03-19
Capital One Services, Llc
Jailed environment restricting programmatic access to multi-tenant data
US11539517B2
( en )
*
2019-09-09
2022-12-27
Cisco Technology, Inc.
Private association of customer information across subscribers
US12099997B1
( en )
2020-01-31
2024-09-24
Steven Mark Hoffberg
Tokenized fungible liabilities
US11582020B2
( en )
*
2020-12-02
2023-02-14
Verizon Patent And Licensing Inc.
Homomorphic encryption offload for lightweight devices
CN113328850A
( en )
*
2021-02-24
2021-08-31
çµåç§æ大å¦
Efficient traceable and revocable attribute-based encryption method
CN113127536B
( en )
*
2021-04-14
2023-07-28
ä¸æµ·åæä¿¡æ¯ç§ææéè´£ä»»å ¬å¸
An Offline Fuzzy Matching System Based on Homomorphic Configuration Encryption
CN112926078B
( en )
*
2021-04-23
2022-12-27
çµåç§æ大å¦
Compact multi-target attribute-based addition homomorphic encryption method
CN113392427A
( en )
*
2021-05-07
2021-09-14
åå°æºè(æ¦æ±)ç 究é¢æéå ¬å¸
Data storage method and device, electronic equipment and storage medium
US20230102111A1
( en )
*
2021-09-30
2023-03-30
Lenovo Global Technology (United States) Inc.
Securing customer sensitive information on private cloud platforms
CN114095160A
( en )
*
2021-11-12
2022-02-25
çµåç§æ大å¦
Unlimited revocable attribute-based encryption method
CN114117521B
( en )
*
2021-11-19
2024-11-15
ä¸å大å¦
Distributed aggregation game method and system based on network communication homomorphic encryption
CN114338229B
( en )
*
2022-01-27
2022-10-04
åä¸å¸è大å¦
Lightweight dynamic broadcast agent re-encryption and cloud data sharing method
CN116318647B
( en )
*
2022-12-15
2023-12-29
æå·åéåå¯ç ç§ææéå ¬å¸
A CP-ABE outsourcing decryption method and device with homomorphic characteristics
CN116346459A
( en )
*
2023-03-27
2023-06-27
åååä¸å¤§å¦
A non-secure channel key policy attribute-based encryption method and device
US20250165649A1
( en )
*
2023-11-16
2025-05-22
Ntt Research, Inc.
Attribute-based encryption for selective document content protection
WO2026092907A1
( en )
*
2024-10-29
2026-05-07
Koninklijke Kpn N.V.
Network system to obtain a network-encrypted data item and wireless device
CN119670142B
( en )
*
2024-11-29
2025-07-25
æ°å大ç建设è¿è¥æéå ¬å¸
Wearable equipment data processing method based on cloud computing
Citations (9)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20060085651A1
( en )
*
2004-10-19
2006-04-20
Staddon Jessica N
System and method for providing private inference control
US20130247230A1
( en )
2011-11-28
2013-09-19
Porticor Ltd.
Methods and devices for trusted protocols for a non-secured, distributed environment with applications to virtualization and cloud-computing security and management
US20130254558A1
( en )
2012-03-26
2013-09-26
Symantec Corporation
Systems and methods for secure third-party data storage
US20130339722A1
( en )
*
2011-11-07
2013-12-19
Parallels IP Holdings GmbH
Method for protecting data used in cloud computing with homomorphic encryption
US20140079221A1
( en )
2012-09-14
2014-03-20
Red Hat, Inc.
Managing encrypted data and encryption keys
US20140233731A1
( en )
*
2011-05-09
2014-08-21
Campagnie Industrielle Et Financiere D'Ingenierie "Ingenico"
Device and Method for Generating Keys with Enhanced Security for Fully Homomorphic Encryption Algorithm
US20140270178A1
( en )
2012-10-17
2014-09-18
Box, Inc.
Remote key management in a cloud-based environment
US20160119119A1
( en )
*
2014-05-15
2016-04-28
Xeror Corporation
Compact fuzzy private matching using a fully-homomorphic encryption scheme
US20170019248A1
( en )
*
2014-09-30
2017-01-19
Kabushiki Kaisha Toshiba
Homomorphic Based Method For Distributing Data From One or More Metering Devices To Two or More Third Parties
2016
2016-05-06
SG
SG11201708750TA
patent/SG11201708750TA/en
unknown
2016-05-06
US
US15/573,833
patent/US10546141B2/en
active
Active
2016-05-06
WO
PCT/SG2016/050215
patent/WO2016182509A1/en
not_active
Ceased
Patent Citations (9)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20060085651A1
( en )
*
2004-10-19
2006-04-20
Staddon Jessica N
System and method for providing private inference control
US20140233731A1
( en )
*
2011-05-09
2014-08-21
Campagnie Industrielle Et Financiere D'Ingenierie "Ingenico"
Device and Method for Generating Keys with Enhanced Security for Fully Homomorphic Encryption Algorithm
US20130339722A1
( en )
*
2011-11-07
2013-12-19
Parallels IP Holdings GmbH
Method for protecting data used in cloud computing with homomorphic encryption
US20130247230A1
( en )
2011-11-28
2013-09-19
Porticor Ltd.
Methods and devices for trusted protocols for a non-secured, distributed environment with applications to virtualization and cloud-computing security and management
US20130254558A1
( en )
2012-03-26
2013-09-26
Symantec Corporation
Systems and methods for secure third-party data storage
US20140079221A1
( en )
2012-09-14
2014-03-20
Red Hat, Inc.
Managing encrypted data and encryption keys
US20140270178A1
( en )
2012-10-17
2014-09-18
Box, Inc.
Remote key management in a cloud-based environment
US20160119119A1
( en )
*
2014-05-15
2016-04-28
Xeror Corporation
Compact fuzzy private matching using a fully-homomorphic encryption scheme
US20170019248A1
( en )
*
2014-09-30
2017-01-19
Kabushiki Kaisha Toshiba
Homomorphic Based Method For Distributing Data From One or More Metering Devices To Two or More Third Parties
Non-Patent Citations (8)
* Cited by examiner, â Cited by third party
Title
" Homomorphic encryption-Wikipedia ", 9 pages, printed Jun. 10, 2019. (Year: 2019).
*
" Homomorphic encryptionâWikipedia ", 9 pages, printed Jun. 10, 2019. (Year: 2019).
*
Elaine Barker, et al., " A Framework for Designing Cryptographic Key Management Systems, " NIST Special Publication 800-130, pp. 1-112 (Aug. 31, 2013).
Mark D. Ryan, " Cloud computing security: The scientific challenge, and a survey of solutions, " The Journal of Systems and Software, vol. 86, No. 9, pp. 2263-2268 (Feb. 18, 2013).
PCT International Preliminary Report on Patentability for PCT Application No. PCT/SG2016/050215, 8 pgs. (dated Feb. 26, 2017).
PCT International Search Report for PCT Counterpart Application No. PCT/SG2016/050215, 4 pgs. (dated Jul. 11, 2016).
PCT Written Opinion for PCT Counterpart Application No. PCT/SG2016/050215, 5 pgs. (dated Jul. 11, 2016).
Yang et al, " An Efficient Secret Key Homomorphic Encryption Used in Image Processing Service ", 12 pages, published: May 14, 2017. (Year: 2017).
*
Cited By (10)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US11418327B2
( en )
*
2019-11-14
2022-08-16
International Business Machines Corporation
Automatic provisioning of key material rotation information to services
US11496287B2
( en )
2020-08-18
2022-11-08
Seagate Technology Llc
Privacy preserving fully homomorphic encryption with circuit verification
US20230418956A1
( en )
*
2020-09-07
2023-12-28
The Toronto-Dominion Bank
Application of trained artificial intelligence processes to encrypted data within a distributed computing environment
US12079351B2
( en )
*
2020-09-07
2024-09-03
The Toronto-Dominion Bank
Application of trained artificial intelligence processes to encrypted data within a distributed computing environment
US11575501B2
( en )
2020-09-24
2023-02-07
Seagate Technology Llc
Preserving aggregation using homomorphic encryption and trusted execution environment, secure against malicious aggregator
US20240160423A1
( en )
*
2022-11-11
2024-05-16
Electronics And Telecommunications Research Institute
Program conversion apparatus and method
US12585444B2
( en )
*
2022-11-11
2026-03-24
Electronics And Telecommunications Research Institute
Program conversion apparatus and method to convert program into a homomorphic encryption program
TWI865290B
( en )
*
2023-02-13
2024-12-01
ç¾åè¬ååæ¥æ©å¨å ¬å¸
Method, computer program product, and apparatus for attribute based encryption key based third party data access authorization
US12250314B2
( en )
2023-02-13
2025-03-11
International Business Machines Corporation
Attribute based encryption key based third party data access authorization
US12542650B2
( en )
2023-10-03
2026-02-03
Bank Of America Corporation
Artificial intelligence (AI) based cloud architecture segmentation leveraging homomorphic encryption
Also Published As
Publication number
Publication date
US20180260576A1
( en )
2018-09-13
SG11201708750TA
( en )
2017-11-29
WO2016182509A1
( en )
2016-11-17
Similar Documents
Publication
Publication Date
Title
US20180260576A1
( en )
2018-09-13
Network system, and methods of encrypting data, decrypting encrypted data in the same
Seth et al.
2022
Integrating encryption techniques for secure data storage in the cloud
Zhao et al.
2010
Trusted data sharing over untrusted cloud storage providers
US9380037B2
( en )
2016-06-28
Methods and devices for trusted protocols for a non-secured, distributed environment with applications to virtualization and cloud-computing security and management
Sanka et al.
2010
Secure data access in cloud computing
US9461821B1
( en )
2016-10-04
System and method for key material protection on devices using a secret sharing scheme
US8745394B1
( en )
2014-06-03
Methods and systems for secure electronic communication
Saroj et al.
2015
Threshold cryptography based data security in cloud computing
US20130013921A1
( en )
2013-01-10
Methods and apparatus for secure data sharing
TW201814496A
( en )
2018-04-16
Data storage method, data acquisition method, device and system wherein security of both the data key and the data ciphertext is ensured because the data key shared by the first device and the second device is protected under the storage root key of the respective trusted platform modules
US10887085B2
( en )
2021-01-05
System and method for controlling usage of cryptographic keys
Sugumaran et al.
2014
An architecture for data security in cloud computing
US11483136B2
( en )
2022-10-25
Wrapped keys with access control predicates
US10250385B2
( en )
2019-04-02
Customer call logging data privacy in cloud infrastructure
CN113360886B
( en )
2023-02-28
A method, device, device and readable medium for encrypted data sharing
US11075753B2
( en )
2021-07-27
System and method for cryptographic key fragments management
US11683159B2
( en )
2023-06-20
Hybrid content protection architecture
Bhandari et al.
2016
A framework for data security and storage in cloud computing
JP2026505009A
( en )
2026-02-10
Non-custodial technology for data encryption and decryption
Yadav et al.
2016
Mobile cloud computing issues and solution framework
Ramachandran et al.
2019
Secure and efficient data forwarding in untrusted cloud environment
US20210288798A1
( en )
2021-09-16
Jigsaw key encryption/decryption
Indu et al.
2016
Secure file sharing mechanism and key management for mobile cloud computing environment
Anitha et al.
2019
Data storage lock algorithm with cryptographic techniques
Chavan et al.
2013
Secure CRM cloud service using RC5 algorithm
Legal Events
Date
Code
Title
Description
2017-11-13
FEPP
Fee payment procedure
Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY
2018-06-15
STPP
Information on status: patent application and granting procedure in general
Free format text : DOCKETED NEW CASE - READY FOR EXAMINATION
2019-06-01
AS
Assignment
Owner name : AGENCY FOR SCIENCE, TECHNOLOGY AND RESEARCH, SINGA
Free format text : ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MIGUEL, RODEL;AUNG, KHIN MI MI;SUNDARAM, SIVARAMAN;AND OTHERS;SIGNING DATES FROM 20180219 TO 20181203;REEL/FRAME:049340/0217
Owner name : AGENCY FOR SCIENCE, TECHNOLOGY AND RESEARCH, SINGAPORE
Free format text : ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MIGUEL, RODEL;AUNG, KHIN MI MI;SUNDARAM, SIVARAMAN;AND OTHERS;SIGNING DATES FROM 20180219 TO 20181203;REEL/FRAME:049340/0217
2019-06-11
STPP
Information on status: patent application and granting procedure in general
Free format text : NON FINAL ACTION MAILED
2019-09-16
STPP
Information on status: patent application and granting procedure in general
Free format text : NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS
2020-01-08
STCF
Information on status: patent grant
Free format text : PATENTED CASE
2023-07-17
MAFP
Maintenance fee payment
Free format text : PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY
Year of fee payment : 4