Separate cryptographic keys for protecting different operations on data

Patent metadata

Field	Value
Publication number	US-9563789-B1
Application number	US-201615132491-A
Country	US
Kind code	B1
Filing date	Apr 19, 2016
Priority date	May 4, 2009
Publication date	Feb 7, 2017
Grant date	Feb 7, 2017

Abstract

The disclosed embodiments provide a system that processes data. During operation, the system uses a first key to protect a write operation on the data. Next, the system uses a second key to protect a read operation on the data.

First claim

What is claimed is:

1. A method, comprising:
using a first key to protect a write operation on data by encrypting, by computer, the data with a data key;
using a second key to protect a read operation on the data by decrypting the data with the data key and verifying a signature associated with the data with the second key;
using a third key to protect a write operation on metadata for the data by encrypting the metadata with a metadata key;
using a fourth key to protect a read operation on the metadata by decrypting the metadata with the metadata key and verifying a signature associated with the metadata with the fourth key; and
performing one of: generating the signature associated with the data with the first key or generating the signature associated with the metadata with the third key;
wherein using the first key to protect the write operation further involves appending an amount of padding in the encrypted data to the encrypted data;
wherein the write operation is protected prior to performing the write operation with a remote storage mechanism; and
wherein the read operation is protected after performing the read operation with the remote storage mechanism.

2. The method of claim 1 , further comprising:
determining an amount of padding by performing a modulo operation on a length of the data with a block size used to encrypt the data and subtracting a result of the modulo operation from the block size; and
appending the determined amount of padding to the encrypted data.

3. The method of claim 1 , wherein the first and second keys are associated with at least one of a file, a set of files, and a user.

4. The method of claim 1 , wherein the data key is associated with at least one of a block and a file.

5. A system, comprising:
a computer write-management apparatus configured to:
use a first key to protect a write operation on data by encrypting the data with a data key; and
use a third key to protect a write operation on metadata for the data by encrypting the metadata with a metadata key; and

a computer read-management apparatus configured to:
use a second key to protect a read operation on the data by decrypting the data with the data key and verifying a signature associated with the data with the second key;
use a fourth key to protect a read operation on the metadata by decrypting the metadata with the metadata key and verifying a signature associated with the metadata with the fourth key;

wherein the computer write-management apparatus is configured to perform one of: generate the signature associated with the data with the first key or generate the signature associated with the metadata with the third key;
wherein using the first key to protect the write operation further involves an amount of padding in the encrypted data appended to the encrypted data;
wherein the write operation is protected prior to performing the write operation with a remote storage mechanism; and
wherein the read operation is protected after performing the read operation with the remote storage mechanism.

6. The system of claim 5 , further comprising:
a determination of an amount of padding by performing a modulo operation on a length of the data with a block size used to encrypt the data and subtracting a result of the modulo operation from the block size; and
the determined amount of padding appended to the encrypted data.

7. The system of claim 5 , further comprising:
a computer management apparatus configured to:
provide the first key to the computer write-management apparatus; and
provide the second key to the computer read-management apparatus.

8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform:
using a first key to protect a write operation on data by encrypting the data with a data key; and
using a second key to protect a read operation on the data by decrypting the data with the data key and verifying a signature associated with the data with the second key;
using a third key to protect a write operation on metadata for the data by encrypting the metadata with a metadata key;
using a fourth key to protect a read operation on the metadata by decrypting the metadata with the metadata key and verifying a signature associated with the metadata with the fourth key; and
one of: generating the signature associated with the data with the first key or generating the signature associated with the metadata with the third key;
wherein using the first key to protect the write operation further involves appending an amount of padding in the encrypted data to the encrypted data;
wherein the write operation is protected prior to performing the write operation with a remote storage mechanism; and
wherein the read operation is protected after performing the read operation with the remote storage mechanism.

9. The non-transitory computer-readable storage medium of claim 8 , storing instructions that when executed by the computer cause the computer to perform:
determining an amount of padding by performing a modulo operation on a length of the data with a block size used to encrypt the data and subtracting a result of the modulo operation from the block size; and
appending the determined amount of padding to the encrypted data.

10. The non-transitory computer-readable storage medium of claim 8 :
wherein the first and second keys are associated with at least one of a file, a set of files, and a user, and
wherein the data key is associated with at least one of a block and the file.

Assignees

• Open Invention Network Llc
• Open Invention Network Llc

Inventors

• Thomas Geoffrey G
• Whaley John
• Purtell Ii Thomas Joseph

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/6272 Primary

  by registering files or documents with a third party · CPC title

• G06F12/1466

  Key-lock mechanism · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title