End-to-end caching of secure content via trusted elements

Patent metadata

Field	Value
Publication number	US-10581804-B2
Application number	US-201615246144-A
Country	US
Kind code	B2
Filing date	Aug 24, 2016
Priority date	Aug 24, 2016
Publication date	Mar 3, 2020
Grant date	Mar 3, 2020

Abstract

The present disclosure relates to caching content at a device in a group of co-located devices whose owners share social network connections. In one embodiment, a method generally includes electing the device as a leader device based, at least in part, on shared social network connections associated with owners of each device in the group. The device receives a data request from a first user device and searches a cache for the data. If the data exists in the cache, the data is encrypted using an encryption key associated with an owner of the first user device transmitted to the first user device. Otherwise, the device requests the data from the content provider, receives an encrypted copy of the data, decrypts the data, and uses the encryption key associated with the owner of the first device to generate and transmit an encrypted message including the data to the first device.

First claim

What is claimed is:

1. A method for caching secure content at a device in a group of co-located devices, comprising:
electing the device as a leader device in the group of co-located devices based, at least in part, on shared social network connections associated with owners of each device in the group of co-located devices;
receiving, from a first user device in the group of co-located devices, a first request for first data available from a content provider;
upon finding the first data in a cache at the device:
encrypting the first data using an encryption key associated with an owner of the first user device; and
transmitting the encrypted first data to the first user device;

receiving, from the first user device, a second request for second data available from the content provider; and
upon determining that the second data is not available in the cache:
generating an encrypted request to obtain the second data from the content provider, wherein the encrypted request comprises an aggregated request;
transmitting the encrypted request to the content provider;
receiving a response from the content provider, the response including a plurality of content items and a list of destination devices associated with each of the plurality of content items;
decrypting the response; and
using the encryption key associated with the owner of the first user device, generating an encrypted message including the second data, wherein generating the encrypted message comprises:
generating a response message intended for the first user device;
upon determining that the first user device is included in the list of destination devices associated with the second data, appending the second data to the response message;
encrypting the response message using the encryption key associated with the owner of the first user device; and

transmitting the encrypted message to the first user device.

2. The method of claim 1 , further comprising:
upon electing the device as the leader device, requesting encryption keys from each device in the group of co-located devices.

3. The method of claim 1 , wherein the encryption key associated with the owner of the first user device comprises at least one of: a public key associated with the owner of the first user device or a shared encryption key established for the group of co-located devices.

4. The method of claim 1 , further comprising:
upon decrypting the second data in the response, storing the second data in the cache at the device.

5. The method of claim 4 , wherein storing the second data in the cache further comprises associating an expiration time with the second data, the expiration time indicating a time at which the device deletes the second data from the cache.

6. The method of claim 1 , wherein the device transmits the encrypted request to the content provider using a first network connection and transmits content to one or more devices in the group of co-located devices using a second network connection.

7. An apparatus, comprising:
a processor; and
a memory having instructions which, when executed by the processor, performs an operation for caching secure content at a device in a group of co-located devices, the operation comprising:
electing the device as a leader device in the group of co-located devices based, at least in part, on shared social network connections associated with owners of each device in the group of co-located devices;
receiving, from a first user device in the group of co-located devices, a first request for first data available from a content provider;
upon finding the first data in the cache at the device:
encrypting the first data using an encryption key associated with an owner of the first user device; and
transmitting the encrypted first data to the first user device;

receiving, from the first user device, a second request for second data available from the content provider; and
upon determining that the second data is not available in the cache:
generating an encrypted request to obtain the second data from the content provider, wherein the encrypted request comprises an aggregated request;
transmitting the encrypted request to the content provider;
receiving a response from the content provider, the response including a plurality of content items and a list of destination devices associated with each of the plurality of content items;
decrypting the response; and
using the encryption key associated with the owner of the first user device, generating an encrypted message including the second data, wherein generating the encrypted message comprises:
generating a response message intended for the first user device;
upon determining that the first user device is included in the list of destination devices associated with the second data, appending the second data to the response message; and
encrypting the response message using the encryption key associated with the owner of the first user device; and

transmitting the encrypted message to the first user device.

8. The apparatus of claim 7 , wherein the encryption key associated with the owner of the first user device comprises at least one of: a public key associated with the owner of the first user device or a shared encryption key established for the group of co-located devices.

9. The apparatus of claim 7 , wherein the operation further comprises:
upon decrypting the the second data in the response, storing the second data in the cache at the device.

10. The apparatus of claim 7 , wherein the device transmits the encrypted request to the content provider using a first network connection and transmits content to one or more devices in the group of co-located devices using a second network connection.

11. A non-transitory computer-readable storage medium comprising instructions which, when executed by a processor, performs an operation for caching secure content at a device in a group of co-located devices, the operation comprising:
electing the device as a leader device in the group of co-located devices based, at least in part, on shared social network connections associated with owners of each device in the group of co-located devices;
receiving, from a first user device in the group of co-located devices, a first request for first data available from a content provider;
upon finding the first data in a cache at the device:
encrypting the first data using an encryption key associated with an owner of the first user device; and
transmitting the encrypted first data to the first user device;

receiving, from the first user device, a second request for second data available from the content provider; and
upon determining that the second data is not available in the cache:
generating an encrypted request to obtain the second data from the content provider, wherein the encrypted request comprises an aggregated request;
transmitting the encrypted request to the content provider;
receiving a response from the content provider, the response including a plurality of content items and a list of destination devices associated with each of the plurality of content items;
decrypting the response; and
using the encryption key associated with the owner of the first user device,
generating an encrypted message including the second data, wherein generating the encrypted message:
generating a response message intended for the first user device;
upon determining that the first user device is included in the list of destination devices associated with the second data, appending the second data to the response message; and
encrypting the response message using the encryption key associated with the owner of the first user device;

Assignees

• IBM

Inventors

• Liu Su
• Rozner Eric J
• Sze Chin Ngai
• Wei Yaoguang

Classifications

• H04L63/0464

  using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L67/568

  Storing data temporarily at an intermediate stage, e.g. caching · CPC title