Data isolation in distributed hash chains

Patent metadata

Field	Value
Publication number	US-10671709-B2
Application number	US-201815876629-A
Country	US
Kind code	B2
Filing date	Jan 22, 2018
Priority date	Jan 22, 2018
Publication date	Jun 2, 2020
Grant date	Jun 2, 2020

Abstract

Certain aspects of the present disclosure provide techniques for managing data in a plurality of nodes of a distributed system. Embodiments include storing, by a node of the plurality of nodes, sensitive data in a block of a hash chain. Embodiments further include determining, by the node, that the sensitive data should not be distributed to other nodes of the plurality of nodes. Embodiments further include distributing, by the node, a limited version of the block to the other nodes. The limited version of the block may comprise a hash and a pointer to a previous block of the hash chain, and the limited version of the block may not contain the sensitive data.

First claim

What is claimed is:

1. A computer-implemented method for managing data in a plurality of nodes of a distributed system, comprising:
storing, by a node of the plurality of nodes, sensitive data in a block of a hash chain;
determining, by the node, that the sensitive data should not be distributed to other nodes of the plurality of nodes;
distributing, by the node, a limited version of the block to the other nodes, wherein the limited version of the block comprises a hash and a pointer to a previous block of the hash chain, and wherein the limited version of the block does not contain the sensitive data;
receiving, by the node, a request for validation of the block from a remote node of the plurality of nodes;
validating, by the node, the block; and
sending, by the node, a validation confirmation for the block to the remote node.

2. The computer-implemented method of claim 1 , further comprising: distributing, by the node, permission information for the block to the plurality of nodes, wherein the permission information defines permissions to access the sensitive data.

3. The computer-implemented method of claim 2 , the permission information defines an administrative domain.

4. The computer-implemented method of claim 2 , further comprising:
receiving, by the node, a request for the block from a remote node of the plurality of nodes;
determining, by the node and based on the permission information, whether the remote node has permission to access the sensitive data; and
upon determining, by the node, that the remote node has permission to access the sensitive data, sending, by the node, the block to the remote node.

5. The computer-implemented method of claim 1 , wherein validating the block comprises:
calculating a new hash based on the sensitive data; and
comparing the new hash to a hash included in the request for validation.

6. The computer-implemented method of claim 1 , further comprising:
receiving, by the node, a request for validation of the hash chain from a remote node of the plurality of nodes;
validating, by the node, the hash chain; and
sending, by the node, a validation confirmation for the hash chain to the remote node.

7. A system comprising:
a processor; and
a non-transitory computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform an operation for managing data in a plurality of nodes of a distributed system, the operation comprising:
storing, by a node of the plurality of nodes, sensitive data in a block of a hash chain;
determining, by the node, that the sensitive data should not be distributed to other nodes of the plurality of nodes;
distributing, by the node, a limited version of the block to the other nodes, wherein the limited version of the block comprises a hash and a pointer to a previous block of the hash chain, and wherein the limited version of the block does not contain the sensitive data;
receiving, by the node, a request for validation of the hash chain from a remote node of the plurality of nodes;
validating, by the node, the hash chain; and
sending, by the node, a validation confirmation for the hash chain to the remote node.

8. The system of claim 7 , wherein the operation further comprises: distributing, by the node, permission information for the block to the plurality of nodes, wherein the permission information defines permissions to access the sensitive data.

9. The system of claim 8 , wherein the permission information defines an administrative domain.

10. The system of claim 8 , wherein the operation further comprises:
receiving, by the node, a request for the block from a remote node of the plurality of nodes;
determining, by the node and based on the permission information, whether the remote node has permission to access the sensitive data; and
upon determining, by the node, that the remote node has permission to access the sensitive data, sending, by the node, the block to the remote node.

11. The system of claim 7 , wherein the operation further comprises:
receiving, by the node, a request for validation of the block from a remote node of the plurality of nodes;
validating, by the node, the block; and
sending, by the node, a validation confirmation for the block to the remote node.

12. The system of claim 11 , wherein validating the block comprises:
calculating a new hash based on the sensitive data; and
comparing the new hash to a hash included in the request for validation.

13. A non-transitory computer-readable medium storing instructions that, when executed by a processor of a computing system, cause the computing system to perform an operation for managing data in a plurality of nodes of a distributed system, the operation comprising:
storing, by a node of the plurality of nodes, sensitive data in a block of a hash chain;
determining, by the node, that the sensitive data should not be distributed to other nodes of the plurality of nodes;
distributing, by the node, a limited version of the block to the other nodes, wherein the limited version of the block comprises a hash and a pointer to a previous block of the hash chain, and wherein the limited version of the block does not contain the sensitive data;
receiving, by the node, a request for validation of the hash chain from a remote node of the plurality of nodes;
validating, by the node, the hash chain; and
sending, by the node, a validation confirmation for the hash chain to the remote node.

14. The non-transitory computer-readable medium of claim 13 , wherein the operation further comprises: distributing, by the node, permission information for the block to the plurality of nodes, wherein the permission information defines permissions to access the sensitive data.

15. The non-transitory computer-readable medium of claim 14 , wherein the permission information defines an administrative domain.

16. The non-transitory computer-readable medium of claim 14 , wherein the operation further comprises:
receiving, by the node, a request for the block from a remote node of the plurality of nodes;
determining, by the node and based on the permission information, whether the remote node has permission to access the sensitive data; and
upon determining, by the node, that the remote node has permission to access the sensitive data, sending, by the node, the block to the remote node.

17. The non-transitory computer-readable medium of claim 13 , wherein the operation further comprises:
receiving, by the node, a request for validation of the block from a remote node of the plurality of nodes;
validating, by the node, the block; and
sending, by the node, a validation confirmation for the block to the remote node.

18. The non-transitory computer-readable medium of claim 17 , wherein validating the block comprises:
calculating a new hash based on the sensitive data; and
comparing the new hash to a hash included in the request for validation.

Assignees

• Intuit Inc

Inventors

• Gabriel Michael R
• Scott Glenn

Classifications

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• G06F21/10 Primary

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• H04L67/104

  Peer-to-peer [P2P] networks · CPC title

• H04L9/0637

  Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM] · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title