Systems and methods for maintaining immutable data access logs with privacy

Abstract

Systems and methods for maintaining immutable data access logs with privacy are disclosed. In one embodiment, in a cloud provider comprising at least one computer processor, the cloud provider having a plurality of clients, a method for maintaining immutable data access logs with privacy can comprise: (1) receiving data from a data owner, wherein the data owner is one of the clients; (2) storing the data in cloud storage; (3) performing an action or condition affecting the data stored in the cloud storage; (4) generating a log entry associated with the action or condition; (5) encrypting at least a portion of the log entry using a public key of the data owner; and (6) submitting the log entry including the encrypted portion to a distributed ledger, such that the submitted log entry is immutable and can be cryptographically verified.

Description

Background of the Invention 1. Technical Field

[0002] This disclosure generally relates to systems and methods for maintaining privacy-preserving, immutable data access logs. 2. Background Technology

[0004] Cloud services that fail to truly implement Bring Your Own Key (BYOK) or hold their own key (HYOK) may expose their clients to unnecessary risks. Any improper handling of keys stored and used by the cloud service provider could jeopardize all cloud storage data and may go undetected by the client.

[0005] The next best available control is visibility into the key management system within the cloud environment, but this also depends on the cloud provider not manipulating or retaining access logs. Furthermore, the cloud provider must protect itself and its other clients from exposing too much information in the logs. This requires the cloud provider to strictly restrict access and optionally redact portions of log entries. Summary of the Invention

[0006] This invention discloses a system and method for maintaining privacy-preserving, immutable data access logs. In one embodiment, in a cloud provider including at least one computer processor and having multiple clients, a method for maintaining privacy-preserving, immutable data access logs may include: (1) receiving data from a data owner, wherein the data owner is one of the clients; (2) storing the data in cloud storage; (3) performing an action or condition that affects the data stored in the cloud storage; (4) generating log entries associated with the action or condition; (5) encrypting at least a portion of the log entries using the data owner's public key; and (6) submitting the log entries, including the encrypted portion, to a distributed ledger such that the submitted log entries are immutable and cryptographically verifiable.

[0007] In one embodiment, data received from the data owner can be encrypted.

[0008] In one embodiment, the action or condition may include accessing data stored in cloud storage.

[0009] In one embodiment, the action or condition may include encrypting or decrypting data stored in cloud storage.

[0010] In one embodiment, the action or condition may include environmental changes in data stored in cloud storage.

[0011] In one embodiment, the action or condition may include a security event of data stored in cloud storage.

[0012] In one embodiment, the action or condition may be part of a service provided by a cloud provider.

[0013] In one embodiment, the public key may be maintained by a cloud provider within a public key infrastructure.

[0014] In one embodiment, a log entry may include a timestamp of an action or condition, an identifier of the system associated with the action or condition, an identifier of at least a portion of the accessed data, etc.

[0015] In one embodiment, the distributed ledger can be a blockchain-based distributed ledger or an Ethereum-based distributed ledger.

[0016] According to another embodiment, a system for maintaining a privacy-preserving, immutable data access log is disclosed. The system may include: a cloud provider comprising at least one computer processor and having multiple clients; and a distributed ledger. The cloud provider may receive data from a data owner, where the data owner is one of the clients; may store the data in cloud storage; may perform actions or conditions affecting the data stored in the cloud storage; may generate log entries associated with the actions or conditions; may encrypt at least a portion of the log entries using the data owner's public key; and may commit the log entries, including the encrypted portion, to the distributed ledger such that the committed log entries are immutable and cryptographically verifiable.

[0017] In one embodiment, data received from the data owner can be encrypted.

[0018] In one embodiment, the action or condition may include accessing data stored in cloud storage.

[0019] In one embodiment, the action or condition may include encrypting or decrypting data stored in cloud storage.

[0020] In one embodiment, the action or condition may include environmental changes in data stored in cloud storage.

[0021] In one embodiment, the action or condition may include a security event of data stored in cloud storage.

[0022] In one embodiment, the action or condition may be part of a service provided by a cloud provider.

[0023] In one embodiment, the public key may be maintained by a cloud provider within a public key infrastructure.

[0024] In one embodiment, a log entry may include a timestamp of an action or condition, an identifier of the system associated with the action or condition, an identifier of at least a portion of the accessed data, etc. Attached Figure Description

[0025] To gain a more complete understanding of the invention, its objectives and advantages, reference is now made to the following description in conjunction with the accompanying drawings, wherein:

[0026] Figure 1 A system for maintaining privacy-preserving, immutable data access logs is described according to one embodiment;

[0027] Figure 2 A method for creating an immutable data log with privacy, according to one embodiment, is described;

[0028] Figure 3 A method for accessing privacy-preserving immutable data logs is described according to one embodiment. Detailed Implementation

[0029] The examples point to systems and methods for using privacy-preserving immutable logs.

[0030] Examples of implementations can apply cryptographically secure systems to log collection, storage, and access systems supporting cloud architectures. For instance, distributed ledgers, such as blockchains, Ethereum, or other suitable distributed ledgers, can be used to store log entries in a tamper-proof (e.g., cryptographically verified) and immutable manner using a consensus model. Furthermore, examples can use policies to drive which parts of log entries need to be encrypted, and then encrypt those parts (or the entire entry) with a private key before committing them to the distributed ledger.

[0031] In this embodiment, the implementation of software and technical controls becomes auditable to third parties, adding a multi-layered guarantee that was previously unavailable in cloud services.

[0032] refer to Figure 1 According to one embodiment, a system for privacy-preserving immutable logs is disclosed. System 100 may include cloud provider 150, which may include public key infrastructure 155, distributed ledger 160, log entries 165, and cloud storage 170.

[0033] System 100 may also include clients 110, 120, and 130, and each client may maintain or be associated with distributed ledgers 115, 125, and 135, respectively. Although Figure 1 Three clients, 110, 120, and 130, are depicted, but it should be noted that fewer or more clients may be provided as needed and / or desired.

[0034] Cloud provider 150 can be any suitable cloud provider and can provide services such as Software as a Service. Cloud provider 150 can provide one or more working systems (not shown) that provide services.

[0035] Cloud provider 150 can receive data from clients 110, 120, and 130 and can maintain the data in cloud storage 170. In one embodiment, the data can be received in any suitable manner. For example, the data can be encrypted by one of clients 110, 120, and 130, transmitted to cloud provider 150, and decrypted upon receipt by cloud provider 150.

[0036] In another embodiment, the data maintained by cloud provider 150 may be generated by cloud provider 150 or by a third party (not shown). Examples of such data may include data feeds that are integrated or processed from another system, information about systems specific to cloud provider 150 (e.g., configuration data), etc.

[0037] Data stored in cloud storage can be statically encrypted using a key maintained by cloud provider 150. In one embodiment, data for each client 110, 120, 130 can be encrypted using a different key for each client 110, 120, 130.

[0038] The public key infrastructure 155 can maintain public keys for clients 110, 120, and 130. The public keys stored in the public key infrastructure 155 can be used to encrypt log entries 165.

[0039] Log entry 165 may reflect any actions or conditions that may affect the availability or access to data stored in cloud storage 170. Examples may include data received by cloud provider 150, data generated by cloud provider 150 or a third party, encryption and / or decryption of data, attempts to access data, environmental changes, security events, etc. In one embodiment, actions related to any other virtual resources (e.g., virtual desktops, server infrastructure, etc.) managed by cloud provider 150 on behalf of clients 110, 120, 130 may be logged.

[0040] In one embodiment, log entry 165 may include the timestamp of the access, the accessed system, the accessed data, the requested action (e.g., read, write, delete), the resulting action (e.g., allow, deny, invalidate), the target system (e.g., the system that processed the request), etc.

[0041] In one embodiment, some or all of the log entries may be encrypted using a public key used by the data owner (e.g., clients 110, 120, 130). In another embodiment, data deemed confidential to cloud provider 150 and not required to be disclosed may be further encrypted. For example, the IP addresses of working systems in cloud storage 170 may be encrypted or otherwise prevented from being disclosed to clients 110, 120, 130. Other examples may include logging of the activities of other customers or tenants of the cloud service, law enforcement access to customer data (e.g., a gag order preventing cloud provider 150 from publicly accessing it), etc.

[0042] refer to Figure 2 According to one embodiment, a method for creating an immutable data log with privacy is disclosed.

[0043] In step 205, the cloud provider may receive data from the client. In one embodiment, the cloud provider may be any suitable cloud provider, including a software-as-a-service cloud provider.

[0044] In one embodiment, the data can be stored in cloud storage. For example, the data can be encrypted and stored in cloud storage.

[0045] In one embodiment, the data can be encrypted using a key used by the client providing the data.

[0046] In step 210, actions or conditions may occur that could affect the availability or access to data stored in the cloud storage. Examples of such actions or conditions include receiving data from the cloud provider, encrypting and / or decrypting data, attempts to access data, environmental changes, security events, etc. In one embodiment, actions related to any other virtual resources managed by the cloud provider on behalf of the client (e.g., virtual desktops, server infrastructure, etc.) may be recorded.

[0047] In step 215, the cloud provider system that creates the action or condition may generate a log entry. In one embodiment, the working system (i.e., the cloud system that performs the service on the data) may generate the log entry. The log entry may include the timestamp of the access, the accessed system, the accessed data, the requested action (e.g., read, write, delete), the resulting action (e.g., allow, deny, invalidate), the target system (e.g., the system that processes the request), and any other information that may be necessary and / or expected.

[0048] In step 220, some log entries may be encrypted. For example, the data may be encrypted using a public key used by the data owner. In one embodiment, data deemed confidential to the cloud provider and not necessarily needing to be disclosed may be further encrypted.

[0049] In step 225, the log entry may be signed using the private key of the system and / or cloud provider used to create the log entry.

[0050] In step 230, log entries may be submitted to a distributed ledger, such as a blockchain-based distributed ledger, an Ethereum-based distributed ledger, or a similar distributed ledger. In one embodiment, other nodes in the distributed ledger network (e.g., distributed ledgers associated with cloud provider clients) may further submit log entries to their own distributed ledgers.

[0051] In one embodiment, each log entry may have a one-to-one commit to the distributed ledger. In another embodiment, log entries may be batched, collected, and / or sent at regular intervals, or when otherwise necessary and / or desired, to prevent frequency analysis of those commits.

[0052] In one embodiment, it may not be necessary to commit the entire contents of a log entry directly to the distributed ledger. Instead, a cryptographically signed copy of the contents can be provided to the distributed ledger, and the entire contents can be encrypted and stored elsewhere.

[0053] Therefore, using these two techniques, it is impossible for any third party with access to the ledger but not to the complete logs in the data store to perform frequency analysis.

[0054] refer to Figure 3 According to one embodiment, a method for accessing privacy-preserving immutable data logs is disclosed.

[0055] In step 305, the data owner can retrieve log entries, such as data access log entries, from their distributed ledger. In one embodiment, some log entries may be in plaintext, some may be encrypted using a key used by the data owner, some may be encrypted using a key used by another data owner, and some may be masked or edited using a key used by the cloud provider.

[0056] In another embodiment, a cryptographic signature or digest can be retrieved from a distributed ledger.

[0057] In step 310, the encrypted portion of a log entry encrypted with the data owner's key (e.g., the data owner's public key) can be decrypted using, for example, the data owner's private key.

[0058] In step 315, other parts of log entries that are encrypted, masked, or otherwise hidden using another data owner's key may be unavailable to the data owner.

[0059] In step 320, an auditing process can be used to ensure the validity of log entries. In one embodiment, the auditing process may include verifying the integrity of all records in the distributed ledger (e.g., verifying cryptographic signatures within and between each record), verifying the decryption of record content, and verifying any included signatures.

[0060] It should be recognized that the embodiments disclosed herein are not mutually exclusive; features and elements of one embodiment may be used with other embodiments as needed and / or desired.

[0061] In the following text, general aspects of implementations of the systems and methods of the present invention will be described.

[0062] The system of the present invention, or parts thereof, may be in the form of a "processing machine," such as a general-purpose computer. As used herein, the term "processing machine" should be understood to include at least one processor using at least one memory. At least one memory stores a set of instructions. Instructions may be stored permanently or temporarily in one or more memories of the processing machine. The processor executes the instructions stored in the one or more memories to process data. The set of instructions may include various instructions for performing one or more specific tasks, such as those described above. Such a set of instructions for performing a specific task may be described as a program, a software program, or simply as software.

[0063] In one embodiment, the processing machine may be a dedicated processor.

[0064] As described above, the processing machine executes instructions stored in one or more memories to process data. For example, this data processing may be in response to commands from one or more users of the processing machine, in response to previous processing, in response to a request from another processing machine, and / or any other input.

[0065] As described above, the processing machine used to implement the present invention can be a general-purpose computer. However, the aforementioned processing machine can also utilize any of a variety of other technologies, including: a special-purpose computer, a computer system including, for example, a microcomputer, a minicomputer, or a mainframe, a programmable microprocessor, a microcontroller, peripheral integrated circuit elements, CSIC (customer application-specific integrated circuit) or ASIC (application-specific integrated circuit) or other integrated circuits, logic circuits, digital signal processors, programmable logic devices such as FPGA, PLD, PLA, or PAL, or any other device or device arrangement capable of implementing the steps of the process of the present invention.

[0066] The processing machine used to implement this invention can utilize a suitable operating system. Therefore, embodiments of this invention may include operating systems such as iOS, OS X, Android, and Microsoft Windows.TM Operating systems, Unix operating systems, Linux operating systems, Xenix operating systems, IBM AIX TM Operating system, Hewlett-PackardUX TM Operating system, Novell Netware TM Operating system, Sun Microsystems Solaris TM Operating system, OS / 2 TM Operating system, BeOS TM Operating systems, Macintosh operating system, Apache operating system, OpenStep TM Operating system or other operating system or platform processing machine.

[0067] It should be understood that, in order to practice the method of the present invention as described above, the processor and / or memory of the processing machine do not necessarily need to be physically located in the same geographical location. That is, each of the processors and memories used by the processing machine can be located in geographically different locations and connected to communicate in any suitable manner. Furthermore, it should be understood that each processor and / or memory can consist of different physical devices. Therefore, the processor does not necessarily have to be a single device in one location, and the memory does not necessarily have to be another single device in another location. That is, it is contemplated that the processor can be two devices located in two different physical locations. The two different devices can be connected in any suitable manner. In addition, the memory can include two or more memory portions located in two or more physical locations.

[0068] To further explain, the processes described above are performed by various components and various memories. However, it should be understood that, according to another embodiment of the invention, processes performed by two different components as described above can be performed by a single component. Furthermore, processes performed by one different component as described above can be performed by two different components. Similarly, according to another embodiment of the invention, memory storage performed by two different memory portions as described above can be performed by a single memory portion. Furthermore, memory storage performed by one different memory portion as described above can be performed by two memory portions.

[0069] Furthermore, various technologies can be used to provide communication between various processors and / or memories, and to allow the processors and / or memories of this invention to communicate with any other entity; for example, to obtain further instructions or to access and use remote memory storage. Such technologies for providing this communication can include, for example, networks, the Internet, intranets, extranets, LANs, Ethernet, wireless communications via base stations or satellites, or any client-server system providing communication. This communication technology can use any suitable protocol, such as TCP / IP, UDP, or OSI.

[0070] As described above, an instruction set can be used in the processing of this invention. This instruction set can be in the form of a program or software. For example, the software can be in the form of system software or application software. For example, the software can also be a collection of individual programs, a program module within a larger program, or a part of a program module. The software used can also include modular programming in the form of object-oriented programming. The software tells the processing machine how to process the data being processed.

[0071] Furthermore, it should be understood that the instructions or instruction sets used in the embodiments and operation of this invention can be in a suitable form that allows a processing machine to read the instructions. For example, the instructions forming a program can be in the form of a suitable programming language, which is converted into machine language or object code to allow one or more processors to read the instructions. That is, a compiler, assembler, or interpreter is used to convert program code or source code lines written in a particular programming language into machine language. Machine language is binary-encoded machine instructions that are specific to a particular type of processing machine, i.e., a particular type of computer. Computers understand machine language.

[0072] According to various embodiments of the present invention, any suitable programming language can be used. Illustratively, the programming language used may include assembly language, such as Ada, APL, Basic, C, C++, COBOL, dBase, Forth, Fortran, Java, Modula-2, Pascal, Prolog, REXX, Visual Basic, and / or JavaScript. Furthermore, it is unnecessary to use a single type of instruction or a single programming language in conjunction with the operation of the systems and methods of the present invention. Instead, any number of different programming languages ​​may be used as needed and / or desired.

[0073] Furthermore, as needed, the instructions and / or data used in the practice of this invention can utilize any compression or encryption technology or algorithm. An encryption module can be used to encrypt data. Additionally, a suitable decryption module can be used, for example, to decrypt files or other data.

[0074] As described above, the present invention can be illustratively embodied in the form of a processing machine, including, for example, a computer or computer system including at least one memory. It should be understood that the instruction set that enables the computer operating system to perform the above operations, i.e., software, can be contained on any of a wide variety of one or more media. Furthermore, the data processed by the instruction set can also be contained on any of a wide variety of one or more media. That is, for example, the specific medium used to store the instruction set and / or data used in the present invention, i.e., the memory in the processing machine, can take on any of a variety of physical forms or transmission methods. Illustratively, the medium can be paper, transparent paper, optical disc, DVD, integrated circuit, hard disk, floppy disk, optical disc, magnetic tape, RAM, ROM, PROM, EPROM, wire, cable, optical fiber, communication channel, satellite transmission, memory card, SIM card or other telemetry, and any other medium or data source that the processor of the present invention can read.

[0075] Furthermore, the one or more memories used in the processing machine implementing this invention can be of any of a variety of forms to allow the memories to store instructions, data, or other information as needed. Therefore, the memories can be stored in the form of a database. The database can use any desired file arrangement, such as a flat file arrangement or a relational database arrangement.

[0076] In the systems and methods of this invention, various "user interfaces" can be utilized to allow a user to interact with one or more processing machines used to implement the invention. As used herein, a user interface includes any hardware, software, or combination of hardware and software used by the processing machine that allows the user to interact with the processing machine. For example, a user interface may be in the form of a dialog box. A user interface may also include a mouse, touchscreen, keyboard, keypad, voice reader, voice recognizer, dialog box, menu box, list, checkbox, toggle switch, button, or any other device that allows the user to receive information about the operation of the processing machine while processing a set of instructions and / or providing information to the processing machine. Therefore, a user interface is any device that provides communication between a user and a processing machine. For example, information provided by the user to the processing machine through the user interface may be in the form of commands, data selections, or some other input.

[0077] As described above, the processing machine utilizes a user interface to execute a set of instructions, enabling the processing machine to process data for the user. The user interface is typically used by the processing machine to interact with the user to convey or receive information. However, it should be understood that, in some embodiments of the systems and methods according to the invention, actual interaction between a human user and the user interface used by the processing machine of the invention is not necessary. Instead, it is contemplated that the user interface of the invention can interact with another processing machine instead of a human user, i.e., to transmit and receive information. Therefore, another processing machine can be characterized as the user. Furthermore, it is contemplated that the user interface used in the systems and methods of the invention can interact partially with one or more other processing machines while also interacting partially with a human user.

[0078] Those skilled in the art will readily understand that the present invention has broad applicability and utility. Many embodiments and adaptations of the invention, as well as many variations, modifications, and equivalent arrangements, other than those described herein, will be apparent or reasonably proposed from the invention and its foregoing description without departing from the spirit or scope of the invention.

[0079] Therefore, although the invention has been described in detail herein with respect to exemplary embodiments thereof, it should be understood that this disclosure is merely illustrative and exemplary and is intended to provide a feasible disclosure of the invention. Consequently, the foregoing disclosure is not intended to interpret or limit the invention to excluding any other such embodiments, adaptations, variations, modifications, or equivalent arrangements, or otherwise exclude any other such embodiments, adaptations, variations, modifications, or equivalent arrangements.

Claims

1. A method for maintaining a privacy-preserving, immutable data access log, comprising: In a cloud provider that includes at least one computer processor, the cloud provider has multiple clients: Receive data from a data owner, wherein the data owner is one of the clients; The data is stored in cloud storage; Perform actions or conditions that affect the data stored in cloud storage; Generate a log entry associated with the action or condition, wherein the log entry includes a timestamp of the action or condition, an identifier of the system associated with the action or condition, and an identifier of the data associated with the action or condition; The confidential portion of the log entry is encrypted using the data owner's public key; The log entries are cryptographically signed; The cryptographic signature is submitted to the distributed ledger so that the submitted cryptographic signature is immutable and can be cryptographically verified. and The log entries, including the encrypted portion, are stored in a location separate from the distributed ledger.

2. The method of claim 1, wherein the data received from the data owner is encrypted.

3. The method of claim 1, wherein the action or condition includes accessing the data stored in cloud storage.

4. The method of claim 1, wherein the action or condition includes encrypting or decrypting the data stored in cloud storage.

5. The method of claim 1, wherein the action or condition includes environmental changes to the data stored in cloud storage.

6. The method of claim 1, wherein the action or condition includes a security event of the data stored in cloud storage.

7. The method of claim 3, wherein the action or condition is part of a service provided by the cloud provider.

8. The method according to claim 1, wherein the distributed ledger includes a blockchain-based distributed ledger or an Ethereum-based distributed ledger.

9. A system for maintaining a privacy-preserving, immutable data access log, comprising: A cloud provider, the cloud provider including at least one computer processor, the cloud provider having multiple clients; and Distributed ledger; in: The cloud provider receives data from a data owner, wherein the data owner is one of the clients; The cloud provider stores the data in cloud storage; The cloud provider performs actions or conditions that affect the data stored in the cloud storage; The cloud provider generates log entries associated with the action or condition, wherein the log entries include a timestamp of the action or condition, an identifier of the system associated with the action or condition, and an identifier of the data associated with the action or condition; The cloud provider uses the data owner's public key to encrypt the confidential portion of the log entry; The cloud provider cryptographically signs the log entries; The cloud provider submits the cryptographic signature of the encrypted portion of the log entry to the distributed ledger so that the cryptographic signature is immutable and cryptographically verifiable; and The cloud provider stores the log entries, including the encrypted portion, in a location separate from the distributed ledger.

10. The system of claim 9, wherein the data received from the data owner is encrypted.

11. The system of claim 9, wherein the action or condition includes accessing the data stored in cloud storage.

12. The system of claim 9, wherein the action or condition includes encrypting or decrypting the data stored in cloud storage.

13. The system of claim 9, wherein the action or condition includes environmental changes to the data stored in cloud storage.

14. The system of claim 9, wherein the action or condition includes a security event of the data stored in cloud storage.

15. The system of claim 11, wherein the action or condition is part of a service provided by the cloud provider.

16. The system of claim 9, wherein the public key is maintained by the cloud provider in a public key infrastructure.

17. The system of claim 9, wherein the distributed ledger includes a blockchain-based distributed ledger or an Ethereum-based distributed ledger.

Images