Method and apparatus for providing a scalable service platform using a network cache

Patent metadata

Field	Value
Publication number	US-9992015-B2
Application number	US-201313874154-A
Country	US
Kind code	B2
Filing date	Apr 30, 2013
Priority date	Jun 30, 2009
Publication date	Jun 5, 2018
Grant date	Jun 5, 2018

Abstract

An approach is provided for building a scalable service platform by initiating transmission of encrypted data from a public network cache. An access control server platform determines a first authorization key for a user and a second authorization key for a resource, and then encrypts the resource with the second authorization key, and encrypts the second authorization key with the first authorization key. The access control server platform initiates distribution of the encrypted second authorization key with the encrypted resource over a network. The access control server platform further initiates caching the encrypted second authorization key with the encrypted resource that meets a predefined threshold value (e.g., a data size, an access frequency, a modification frequency, or an auditing requirement) in a cache in the network, and initiates transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity.

First claim

What is claimed is:

1. A method comprising:
encrypting, utilizing at least one processor, a resource with a second authorization key,
wherein the resource is encrypted with the second authorization key through an access control service platform to include information specifying a user entity is permitted to decrypt the encrypted resource,
wherein the second authorization key is not specific to the user identity,
wherein the second authorization key includes a protocol specific hash associated with the resource,
wherein the resource is identified with the user identity through the user entity uploading the resource to the access control service platform,
wherein information identifying the user entity is included in a header of a packet including the encrypted resource;

encrypting data known to the user entity with the second authorization key;
determining a first authorization key for the user entity through the access control service platform;
encrypting, utilizing the at least one processor, the second authorization key with the first authorization key,
wherein the first authorization key is configured to be utilized by the user entity,
wherein the first authorization key is generated based on a previous registration of the user entity with the access control service platform;

initiating a distribution, to the user entity, of the encrypted resource with the encrypted second authorization key,
wherein the distribution further includes the encrypted data, the encrypted second authorization key is decrypted with the first authorization key, the encrypted data is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted data matches with the data known to the user entity; and

initiating a caching of the encrypted second authorization key with the encrypted resource in a network cache located, remote from an origin point of the distribution, on a network path.

2. The method according to claim 1 ,
wherein the hash is specific to the MD5 protocol,
wherein the network path is a path data travels during the distribution.

3. The method according to claim 1 ,
wherein at least one of the network cache and the network path are on a public network.

4. The method according to claim 1 , wherein the user entity is an owner of the resource, a contact of the owner, or a social group of the owner and wherein members of the social group share an identical first authorization key specific for the social group.

5. The method according to claim 1 , further comprising:
determining a third authorization key for a second user entity, wherein the encrypted second authorization key is further configured to be decrypted with the third authorization key and the information further indicates the second user entity.

6. The method according to claim 1 , wherein the distribution is to at least a server, the method further comprising:
initiating caching of the encrypted second authorization key with the encrypted resource in a cache of the server; and
initiating transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity.

7. The method according to claim 6 , further comprising:
initiating a distribution of an access rights filter (ARF) to the server, the ARF being configured to determine access rights of the at least one authorized entity according to one or more authorization keys, wherein the server determines access rights of the at least one authorized entity based on the ARF.

8. An apparatus comprising:
at least one processor; and
at least one memory including computer program code,
wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:
encrypt a resource with a second authorization key,
wherein the resource is encrypted with the second authorization key through an access control service platform to include information specifying a user entity is permitted to decrypt the encrypted resource,
wherein the second authorization key is not specific to the user identity,
wherein the second authorization key includes a protocol specific hash associated with the resource,
wherein the resource is identified with the user identity through the user entity uploading the resource to the access control service platform,
wherein information identifying the user entity is included in a header of a packet including the encrypted resource,

encrypt data known to the user entity with the second authorization key,
determine a first authorization key for the user entity through the access control service platform,
encrypt the second authorization key with the first authorization key,
wherein the first authorization key is configured to be utilized by the user entity,
wherein the first authorization key is generated based on a previous registration of the user entity with the access control service platform,

initiate a distribution, to the user entity, of the encrypted resource with the encrypted second authorization key,
wherein the distribution further includes the encrypted data, the encrypted second authorization key is decrypted with the first authorization key, the encrypted data is decrypted with the decrypted second authorization key, and the encrypted resource is decrypted with the decrypted second authorization key when the decrypted data matches with the data known to the user entity, and

initiate a caching of the encrypted second authorization key with the encrypted resource in a network cache located, remote from an origin point of the distribution, on a network path.

9. The apparatus of claim 8 ,
wherein the hash is specific to the MD5 protocol,
wherein the network path is a path data travels during the distribution.

10. The apparatus of claim 8 ,
wherein at least one of the network cache and the network path are on a public network.

11. The apparatus of claim 8 , wherein the user entity is an owner of the resource, a contact of the owner, or a social group of the owner and wherein members of the social group share an identical first authorization key specific for the social group.

12. The apparatus of claim 8 , wherein the apparatus is further caused to:
determine a third authorization key for a second user entity, wherein the encrypted second authorization key is further configured to be decrypted with the third authorization key and the information further indicates the second user entity.

13. The apparatus of claim 8 , wherein the distribution is to at least a server and the apparatus is further caused to:
initiate caching of the encrypted second authorization key with the encrypted resource in a cache of the server, and
initiate transmission of the cached and encrypted second authorization key with the cached and encrypted resource from the cache to at least one authorized entity.

14. The apparatus of claim 13 , wherein the apparatus is further caused to:
initiate a distribution of an access rights filter (ARF) to the server, the ARF being configured to determine access rights of the at least one authorized entity according to one or more authorization keys, wherein the server determines access rights of the at least one authorized entity based on the ARF.

15. A non-transitory computer-readable storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to perform at least the following:
encrypt

Assignees

• Nokia Technologies Oy

Inventors

• Fu Yan
• Vepsalainen Ari M
• Aarnio Ari Antero
• Vimpari Markku Kalevi
• Laitinen Pekka Johannes

Classifications

• H04L9/0822 Primary

  using key encryption key · CPC title

• H04L2209/60

  Digital content management, e.g. content distribution · CPC title

• H04L9/08 Primary

  Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} · CPC title

• H04L2209/80

  Wireless · CPC title