Creating a secure searchable path by hashing each component of the path

Patent metadata

Field	Value
Publication number	US-2020302065-A1
Application number	US-201916356707-A
Country	US
Kind code	A1
Filing date	Mar 18, 2019
Priority date	Mar 18, 2019
Publication date	Sep 24, 2020
Grant date	—

Abstract

In some examples, a computing device creates an event log when an event occurs. If the event log includes a path comprising one or more components, the computing device may determine a hash, using a hash function and a salt, for each of the components and substitute each component in the path with an index to the hash stored in a dictionary. In this way, the computing device replaces each component of the path with an index to a hash in the dictionary to create a modified path. The resulting modified path can be traversed and searched. For example, a search term may be hashed using the hash function and salt, and the dictionary associated with the logs searched for a match. In this way, a particular file name or a particular folder name can be identified in the modified path.

First claim

What is claimed is:

1 . A method comprising:
determining, by one or more processors, that a file includes a path; selecting, by the one or more processors, a component of the path; generating, by the one or more processors, a hash corresponding to the component; determining, by the one or more processors, that the hash is included in a dictionary; determining, by the one or more processors, an index associated with the hash; adding, by the one or more processors, the index to a modified path; and sending, by the one or more processors, a modified file comprising the modified path to a server.

2 . The method of claim 1 , further comprising:
selecting a second component of the path; generating a second hash corresponding to the second component; determining that the second hash is excluded from the dictionary; creating a second index; associating the second index with the second hash; adding the second index and the second hash to the dictionary; and adding the second index to the modified path.

3 . The method of claim 1 , wherein generating the hash corresponding to the component comprises:
generating the hash using a hash function and a salt compromising a randomly generated number.

4 . The method of claim 3 , wherein the modified file further comprises:
the dictionary; the hash function; and the salt.

5 . The method of claim 1 , wherein the component comprises one of:
a drive name; a drive letter; a volume name; a device name; a folder name; or a file name.

6 . The method of claim 1 , wherein:
a particular component of the path has a corresponding index in the modified path; and the corresponding index accesses a particular hash stored in the dictionary.

7 . The method of claim 1 , wherein the modified path comprises an array of indexes.

8 . A computing device comprising:
one or more processors; and one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:
determining that a file includes a path;
selecting a component of the path;
generating a hash corresponding to the component;
determining that the hash is included in a dictionary;
determining an index associated with the hash;
adding the index to the path to a modified path; and
sending, to a server, a modified file comprising the modified path.

9 . The computing device of claim 8 , further comprising:
selecting a second component of the path; generating a second hash corresponding to the second component; determining that the second hash is excluded from the dictionary; creating a second index; associating the second index with the second hash; adding the second index and the second hash to the dictionary; and adding the second index to the modified path.

10 . The computing device of claim 8 , wherein:
the file comprises an event log generated based on determining that a particular event occurred on the computing device.

11 . The computing device of claim 8 , wherein the modified file further comprises:
the dictionary; a salt; and a hash function to generate the hash based on the component and the salt.

12 . The computing device of claim 8 , wherein the modified file further comprises:
information to identify the computing device, the information comprising at least one of a system name, a system identifier, a serial number, a service tag, or an internet protocol (IP) address.

13 . The computing device of claim 8 , wherein the component comprises one of:
a drive name; a drive letter; a volume name; a device name; a folder name; or a file name.

14 . The computing device of claim 8 , wherein:
a particular component of the path has a corresponding index in the modified path; and the corresponding index accesses a particular hash stored in the dictionary.

15 . One or more non-transitory computer readable media storing instructions executable by one or more processors to perform operations comprising:
determining that a file includes a path; selecting a component of the path; generating a hash corresponding to the component; determining that the hash is included in a dictionary; determining an index associated with the hash; adding the index to the path to a modified path; and sending, to a server, a modified file comprising the modified path.

16 . The one or more non-transitory computer readable media of claim 15 , wherein:
the file comprises an event log generated based on determining that a particular event occurred on the computing device.

17 . The one or more non-transitory computer readable media of claim 15 , wherein the modified file further comprises:
the dictionary; a salt; and a hash function to generate the hash based on the component and the salt.

18 . The one or more non-transitory computer readable media of claim 15 , further comprising:
determining a particular hash based at least in part on a particular component; determining that the particular hash is included in the dictionary associated with the modified file; and determining that the particular component is included in the modified file.

19 . The one or more non-transitory computer readable media of claim 15 , wherein the component comprises one of:
a drive name; a drive letter; a volume name; a device name; a folder name; or a file name.

20 . The one or more non-transitory computer readable media of claim 15 , wherein:
a particular component of the path has a corresponding index in the modified path; and the corresponding index accesses a particular hash stored in the dictionary.

Assignees

• Dell Products Lp

Inventors

• Lawson David Craig
• Phillips Michael A

Classifications

• G06F16/164

  File meta data generation · CPC title

• H04L9/3239 Primary

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title