Devices, systems, and methods for implementing quantum security data in multi-tenant environment

Abstract

The embodiment of the invention relates to equipment, a system and a method for implementing quantum security data in a multi-tenant environment. In accordance with an embodiment of the present disclosure, there is provided a computing device capable of implementing quantum security data in a multi-tenant environment, the device may include a cooling device and circuitry communicatively coupled with the cooling device, where the circuitry is configured to alternate between a high computing activity period that increases heat dissipation and a low computing activity period that reduces heat dissipation, and instructing the cooling device to reduce the cooling power during the high computing activity period and to boost the cooling power during the low computing activity period. Various other devices, systems, and methods are also provided.

Description

Background Art

[0001] Multi-tenant environments are typically deployed and / or configured to enable different entities, customers, and / or tenants to selectively access and / or obtain telemetry data via the cloud. Unfortunately, some multi-tenant environments may have certain disadvantages and / or deficiencies that negatively impact and / or diminish the experience of these entities, customers, and / or tenants. For example, a conventional multi-tenant environment that implements a shared telemetry service may not ensure and / or guarantee data confidentiality for all tenants (e.g., encryption and decryption dynamics). In another example, a conventional multi-tenant environment that implements independent and / or per-tenant telemetry services may be costly and / or impractical.

[0002] Additionally or alternatively, traditional multi-tenant environments may fail to ensure and / or guarantee that only authorized and / or trusted users have access to certain telemetry data. Furthermore, traditional multi-tenant environments may process and / or distribute telemetry data that is not necessarily quantum safe and / or secure. Accordingly, the present disclosure identifies and addresses a need for additional and / or improved apparatuses, systems, and methods for implementing quantum safe data in a multi-tenant environment. Summary of the invention

[0003] As described in more detail below, the present disclosure generally relates to devices, systems, and methods for implementing quantum-safe data in a multi-tenant environment. In one example, a system for accomplishing such a task may include at least one network device, at least one collector, and / or at least one service. In this example, the service may be configured and / or arranged to: (1) provide a key identifier to the network device and the collector, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs and enabling the collector to decrypt the logs; (2) provide one or more policy tokens to the network device, the policy tokens representing one or more policies that control access to the logs; and (3) and / or provide a policy token to the collector to enable the collector to enforce the policy represented by the policy token applied to the log by the network device.

[0004] Similarly, a server that facilitates and / or supports quantum-safe data in a multi-tenant environment may include at least one storage device configured to maintain a database of policy tokens that represent policies that control access to certain logs. In one example, the server may also include circuitry communicatively coupled to the storage device. In this example, the circuitry may be configured and / or arranged to: (1) provide a key identifier to a network device and a collector, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs and enabling the collector to decrypt the one or more logs; (2) provide one or more policy tokens to the network device, the policy tokens representing one or more policies that control access to the one or more logs; and / or (3) provide one or more policy tokens to the collector to enable the collector to enforce policies represented by the one or more policy tokens applied to the one or more logs by the one or more network devices.

[0005] The corresponding method may include: (1) providing a key identifier by a server to a network device, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs; (2) providing a key identifier by a server to a collector, the key identifier enabling the collector to decrypt the logs; (3) providing one or more policy tokens by a server to the network device, the policy tokens representing one or more policies that control access to the logs; and / or (4) providing a policy token by a server to a collector to enable the collector to enforce the policy represented by the policy token applied to the logs by the network device.

[0006] Features from any of the above embodiments may be used in combination with each other according to the general principles described herein.These and other embodiments, features and advantages can be more fully understood by reading the following detailed description in conjunction with the accompanying drawings and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The accompanying drawings illustrate several exemplary embodiments and are a part of the specification. These drawings and the following description demonstrate and explain various principles of the present disclosure.

[0008] Figure 1 A schematic diagram illustrating an exemplary server capable of facilitating and / or supporting quantum-safe data in a multi-tenant environment according to one or more embodiments of the present disclosure;

[0009] Figure 2 A schematic diagram showing an exemplary system capable of implementing and / or providing quantum secure data in a multi-tenant environment according to one or more embodiments of the present disclosure;

[0010] Figure 3 A schematic diagram showing an exemplary system capable of implementing and / or providing quantum secure data in a multi-tenant environment according to one or more embodiments of the present disclosure;

[0011] Figure 4 A schematic diagram illustrating an exemplary distributed ledger for maintaining and / or distributing records associating device identifiers, key identifiers, and / or policy tokens according to one or more embodiments of the present disclosure is shown;

[0012] Figure 5 A schematic diagram showing an exemplary system capable of implementing and / or providing quantum secure data in a multi-tenant environment according to one or more embodiments of the present disclosure;

[0013] Figure 6 A flowchart illustrating an exemplary method for implementing and / or providing quantum secure data in a multi-tenant environment according to one or more embodiments of the present disclosure

[0014] Figure 7 A block diagram illustrating an exemplary computing system that can be implemented and / or used in conjunction with one or more embodiments described and / or illustrated herein;

[0015] In all drawings, the same reference numerals and descriptions represent similar but not necessarily identical elements. Although the exemplary embodiments described herein are susceptible to various modifications and alternative forms, specific embodiments are shown herein by way of example and detailed description in the drawings. However, the exemplary embodiments described herein are not intended to limit the specific forms disclosed. On the contrary, the present disclosure covers all modifications, equivalents, and alternatives that fall within the scope of the appended claims. DETAILED DESCRIPTION

[0016] The present disclosure describes various apparatuses, systems, and methods for implementing quantum-safe data in a multi-tenant environment. In some examples, data may be considered and / or deemed to be quantum-safe or reliable if quantum computing cannot destroy and / or obtain such data in a readable form during transmission. As will be explained in greater detail below, embodiments of the present disclosure may include and / or relate to a multi-tenant system that provides telemetry encryption services for protecting data and telemetry authorization services for facilitating selective access to such data. Additionally or alternatively, embodiments of the present disclosure may include and / or relate to a multi-tenant system that provides and / or proposes policy-based access to quantum-safe telemetry data for and / or across multiple tenants.

[0017] In some examples, a network administrator may input and / or provide input to a Telemetry Encryption and Authorization Service (TEAS), which protects telemetry data and / or provides policy-based access to such data to authorized and / or trusted users. In one example, the input input and / or provided by the network administrator may define, describe, illustrate, and / or explain certain policies that control the ability of a user to access, read, and / or obtain logs generated and / or compiled by a corresponding network device. In this example, TEAS may create, generate, and / or release such a policy based at least in part on the input. Additionally or alternatively, TEAS may distribute and / or provide one or more policy tokens in a policy token representing such a policy to a network device to classify and / or mark telemetry data and / or logs according to such a policy.

[0018] In some examples, TEAS can act as, serve as, and / or act as a key server. For example, TEAS can create, generate, and / or release one or more secret seed values ​​and / or key identifiers, such as post-quantum pre-shared key identifiers (Post-Quantum Pre-Shared Key Identifiers, PQPSK IDs). In one example, TEAS can share one or more secret seed values ​​and / or key identifiers with certain network devices. In this example, the network device can utilize and / or generate and / or generate encryption keys such as PQPSK keys from secret seed values ​​and / or key identifiers. These network devices can then encrypt telemetry data and / or logs with encryption keys, and / or attach appropriate policy tokens before providing telemetry data and / or logs to the collector.

[0019] In some examples, TEAS can load and / or provide a policy token and / or key identifier to a distributed ledger (e.g., a blockchain) in conjunction with one or more transactions. In one example, a collector can obtain and / or acquire a policy token and / or key identifier from a distributed ledger. In this example, the collector can decrypt telemetry data and / or logs with a key identifier. Additionally or alternatively, the collector can determine which users are authorized to access, read and / or obtain telemetry data and / or logs based at least in part on a policy token. For example, if a user requests access and / or browse certain telemetry data and / or logs, the collector can confirm whether the user is authorized to access and / or browse such access based at least in part on a corresponding policy token. When it is confirmed that the user is so authorized, the collector can then provide and / or deliver a decrypted version of the telemetry data and / or log to the user according to the policy.

[0020] The following will be combined Figures 1 to 5A detailed description of exemplary devices, systems, and corresponding implementations for implementing quantum secure data in a multi-tenant environment is provided. Figure 6 A detailed description of an exemplary method for implementing quantum-safe data in a multi-tenant environment is provided. Figure 7 A detailed description of an exemplary computing system for performing such a method is provided.

[0021] Figure 1 An exemplary server 100 capable of implementing quantum secure data in a multi-tenant environment is shown. Figure 1 As shown, the exemplary server 100 may include and / or represent a storage device 102, a circuit 104, and / or a service 106. In some examples, the circuit 104 may be communicatively coupled and / or electrically coupled to the storage device 102. Additionally or alternatively, the circuit 104 may execute and / or run the service 106. Thus, when the circuit 104 executes and / or runs, the server 106 may instruct and / or cause the circuit 104 to perform and / or complete various actions and / or tasks, including any combination of the following: Figures 1 to 6 describe.

[0022] In some examples, service 106 can be configured and / or programmed to provide a key identifier to a network device and / or collector. In one example, the key identifier can enable the network device to generate an encryption key for encrypting one or more telemetry logs. Additionally or alternatively, the key identifier can enable the collector to decrypt the telemetry log for viewing by an authorized user.

[0023] In some examples, service 106 can also be configured and / or programmed to provide one or more policy tokens to the network device. In one example, the network token can correspond to and / or represent one or more policies that control access to the telemetry log. In this example, the network device can apply the telemetry log to the policy token before providing and / or sending the telemetry log to the collector.

[0024] In some examples, the server 106 may also be configured and / or arranged to provide policies and / or policy tokens to the collector (e.g., via a distributed ledger and / or blockchain). In one example, the policies and / or policy tokens may enable the collector to enforce a policy on the telemetry log based at least in part on a policy token applied to the telemetry log by the network device. For example, the collector may provide access to authorized users in accordance with a corresponding policy to enable the user to read and / or browse the telemetry log. In this example, the collector may also deny such access to unauthorized users in accordance with a corresponding policy.

[0025] In some examples, the storage device 102 may include and / or represent any type or form of volatile or non-volatile memory device or medium capable of storing data and / or computer-readable instructions. In one example, the storage device 102 may store, load and / or maintain certain modules and / or computer-readable instructions executed by the circuit 104. For example, the storage device 102 may store, load and / or maintain all or part of the service 106. Additionally or alternatively, the storage device 102 may store, load and / or maintain a database in which policies, policy tokens, network devices and / or device names are associated with each other. Examples of the storage device 102 include, but are not limited to, random access memory (RAM), read-only memory (ROM), flash memory, hard disk drives (HDDs), solid-state drives (SSDs), optical drives, cache memory, one or more portions of the same device, one or more variations or combinations of the same device, and / or any other suitable memory device.

[0026] In some examples, circuitry 104 may include and / or represent one or more electrical and / or electronic circuits capable of processing, applying, modifying, converting, transmitting, receiving, and / or executing instructions and / or data for server 100. In one example, circuitry 104 may access, read, write, and / or allocate memory of storage device 102 on server 100. Additionally or alternatively, circuitry 104 may receive, resolve, process, and / or send traffic (e.g., data and / or control packets) on server 100. Furthermore, circuitry 104 may receive input from a network administrator and / or generate policies based at least in part on such input.

[0027] In some examples, circuitry 104 may launch, run, and / or execute certain executable files, code segments, and / or computer-readable instructions to facilitate and / or support quantum-safe data in a multi-tenant environment on server 100. Figure 1A single unit is shown in FIG. 1 , but the circuit 104 may include and / or represent a plurality of processing units and / or a collection of electrical or electronic components that operate and / or operate in coordination with each other. Examples of the circuit 104 include, but are not limited to, processing devices, microprocessors, microcontrollers, Application-Specific Integrated Circuits (ASICs), Central Processing Units (CPUs), Graphics Processing Units (GPUs), Field-Programmable Gate Arrays (FPGAs), Systems on Chips (SoCs), parallel acceleration processors, tensor cores, integrated circuits, chip particles, optical modules, receivers, transmitters, transceivers, optical modules, service forwarding devices, one or more portions of the same circuit, one or more variations or combinations of the same circuit, and / or any other suitable circuit.

[0028] In some examples, service 106 may include and / or represent any type or form of program, application, and / or service that implements or provides quantum-safe data in a multi-tenant environment. In one example, service 106 may include and / or represent TEAS. Thus, service 106 may ensure and / or protect telemetry data and / or logs of various network devices and / or elements included on the network. Additionally or alternatively, service 106 may selectively provide access to authorized users to enable users to obtain and / or read such telemetry data and / or logs.

[0029] In some examples, server 100 may constitute and / or represent any type or form of physical computing device capable of reading computer executable instructions, performing calculations, converting data, and / or providing services. In one example, server 100 may include and / or represent a single computing device. In another example, server 100 may include and / or represent a collection of multiple computing devices that operate and / or operate in coordination with each other. Server 100 may execute, run, and / or provide service 106. Examples of server 100 include, but are not limited to, key servers, application servers, authorization servers, security servers, encryption servers, database servers, web servers, portions of one or more identical servers, variations or combinations of one or more identical servers, and / or any other suitable servers.

[0030] Figure 2At least a portion of an exemplary system 200 is shown, including and / or representing a server 100, network devices 208(1) to 208(N), a distributed ledger 204, and / or a collector 206. In some examples, Figure 2 The system 200 may include and / or represent certain operations and / or provide in conjunction with the above Figure 1 The server 100 and the collector 206 may be communicatively coupled to the network devices 208(1) to 208(N) and / or the distributed ledger 204. Additionally or alternatively, the collector 206 may be communicatively coupled to the network devices 208(1) to 208(N) and / or the distributed ledger 204. Thus, the server 100 and the collector 206 may be communicatively coupled to each other via the network devices 208(1) to 208(N) and / or the distributed ledger 204.

[0031] In some examples, service 106 running on server 100 may be configured and / or arranged to generate or create one or more secret seed values ​​and / or key identifiers for network devices 208(1)-208(N). For example, service 106 running on server 100 may generate and / or create a PQPSK ID for network device 208(1) and another PQPSK ID for network device 208(N). In this example, service 106 may direct and / or instruct server 100 to provide, send and / or transmit the PQPSK IDs to network devices 208(1)-208(N).

[0032] In some examples, the service 106 running on the server 100 can be configured and / or arranged to generate or create one or more access policies for telemetry data and / or logs. For example, the service 106 running on the server 100 can generate and / or create policies that control and / or limit who is authorized to access the telemetry data and / or logs or who is not authorized to access the telemetry data and / or logs. In this example, the service 106 running on the server 100 can be configured and / or programmed to generate or create policy tokens that represent and / or correspond to these policies. Additionally or alternatively, the service 106 can direct and / or instruct the server 100 to provide, send and / or transmit policies and / or policy tokens to the network devices 208(1) to 208(N), the distributed ledger 204 and / or the collector 206.

[0033] In some examples, a service 106 running on a server 100 may be configured and / or programmed to generate a policy based at least in part on input obtained from an administrator 202. For example, an administrator 202 may input, load, and / or provide input to a server 100. In this example, a service running on a server 100 may obtain input from the administrator 202 and then generate or create a policy based at least in part on the input.

[0034] In some examples, network devices 208(1)-208(N) may cryptographically authenticate service 106 prior to utilizing and / or implementing a secret seed value and / or key identifier received from server 100. In one example, to facilitate and / or support such authentication, service 106 and / or server 100 may be provided with private key 212, respectively, and network devices 208(1)-208(N) may be provided with public keys 214(1)-214(N), respectively. For example, service 106 running on server 100 may be configured and / or programmed to sign a PQPSK identity using private key 212. In this example, network devices 208(1)-208(N) may be configured and / or programmed to verify the signature of the PQPSK identity using public keys 214(1)-(N). By verifying these signatures in this manner, network devices 208(1)-208(N) are able to authenticate service 106.

[0035] In some examples, the distributed ledger 204 may include and / or represent a blockchain, with records in a block column and / or securely linked together via cryptographic hashes via entries. Additionally or alternatively, the collector 206 may include and / or represent a telemetry cluster consisting of multiple computing nodes that operate and / or operate in coordination with each other. For example, the collector 206 may include and / or represent a telemetry collector cluster (e.g., syslog, etc.). In one example, and as will be described in more detail below, the user 210 may submit a request to the collector 206 to access, read, and / or browse one or more logs.

[0036] Figure 3 2 shows a portion of an exemplary embodiment of system 200. In some examples, Figure 3 The system 200 may include and / or represent certain operations and / or provide in conjunction with the above Figure 1 or Figure 2Devices, components, configurations, and / or features that have similar and / or identical functions to those described herein. In one example, server 100 may receive and / or obtain input 304 from administrator 202. In this example, service 106 running on server 100 may generate and / or create policies 308(1), 308(2), and 308(N) based at least in part on input 304. Additionally or alternatively, service 106 running on server 100 may generate and / or create policy tokens 310(1), 310(2), and 310(N) to represent and / or correspond to policies 308(1), 308(2), and 308(N), respectively. In some embodiments, policy tokens 310(1) to 310(N) may include and / or represent any type or form of identifiers and / or strings that are capable of distinguishing policies 308(1) to 308(N) from one another.

[0037] In some examples, storage device 102 of server 100 may include, store, and maintain a database 306 of policy tokens that represent policies that control access to certain telemetry data and / or logs. For example, database 306 may associate policies 308(1), 308(2), and 308(N) with policy tokens 310(1), 310(2), and / or 310(N), respectively. In this example, and as maintained by database 306, policy token 310(1) may correspond to and / or represent policy 308(1), policy token 310(2) may correspond to and / or represent policy 308(2), and / or policy token 310(3) may correspond to and / or represent policy 308(3).

[0038] In some examples, a service 106 running on a server 100 may generate and / or create key identifiers 302(1)-302(N) for distribution to one or more network devices 208(1)-208(N), a distributed ledger 204, and / or a collector 206. In one example, a service 106 running on a server 100 may provide, send, and / or transmit key identifiers 302(1)-302((N) and / or policy tokens 310(1)-310(N) to a distributed ledger 204. In this example, a service 106 running on a server 100 may provide, send, and / or transmit key identifiers 302(1)-302((N)) and / or policy tokens 310(1)-310(N) to a network device 208(1). Additionally or alternatively, a service 106 running on a server 100 may provide, send, and / or transmit key identifiers 302(N) and policy tokens 310(1)-310(2) to a network device 208(1).

[0039] Figure 4Portions of an exemplary embodiment of a distributed ledger 204 are shown. In some examples, a distributed ledger may include and / or represent one or more blockchains (e.g., open source blockchains) and / or corresponding features or tools. Figure 4 As shown, distributed ledger 204 may include and / or represent a number of records that conform to and / or implement a certain format. For example, distributed ledger 204 may include and / or represent records 404(1), 404(2), and 404(3) that conform to and / or implement format 402. In some embodiments, distributed ledger 204 may also include and / or represent records that are not necessarily in Figure 4 Various other records are shown and / or labeled in.

[0040] In some examples, format 402 may include and / or represent a network device name, a network device identifier, a key identifier, and / or a policy token. Thus, for the purpose of providing quantum-safe data in a multi-tenant environment, each of records 404(1) to 404(3) may follow and / or implement format 402 to associate a network device name, a network device identifier, a key identifier, and / or a policy token with each other. In one example, record 404(1) may correspond to and / or represent a network device named "Device-1" with a network device identifier "ND-1", the network device identifier "ND-1" being provided by a key identifier "123456789" and policy tokens "Token1" and "Token2". In another example, record 404(2) may correspond to and / or represent a network device named "Device-2" with a network device identifier "ND-2", the network device identifier "ND-2" being provided by a key identifier "987654321" and policy tokens "Token1" and "Token3". In additional examples, record 404(3) may correspond to and / or represent a network device named "Device-3" with a network device identifier "ND-3" provided by a key identifier "1234567331" and policy tokens "Token4" and "Token5".

[0041] In some examples, server 100 and / or service 106 may be configured to provide such key identifiers, policy tokens, network device identifiers, and / or network device names to collector 206 via distributed ledger 204. For example, server 100 and / or service 106 may add and / or provide records 404(1) to 404(3) to distributed ledger 204. In this example, records 404(1) to 404(3) may associate corresponding key identifiers, policy tokens, network device identifiers, and / or network device names with each other. By adding and / or providing records 404(1) to 404(3) to distributed ledger 204 in this manner, collector 206 may be able to retrieve, extract, and / or obtain 404(1) to 404(3) or any of their contents from distributed ledger 204.

[0042] Figure 5 2 shows a portion of an exemplary embodiment of system 200. In some examples, Figure 5 The system 200 may include and / or represent certain operations and / or provide any combination of the above Figures 1 to 5 1 and / or 310(N) may be used to represent or represent devices, components, configurations, and / or features that may be used to represent or represent functions similar to those described herein. In one example, network device 208(1) may receive and / or obtain key identifier 302(1) and / or tokens 310(1) and 310(N) from server 100 and / or service 106. Additionally or alternatively, network device 208(N) may receive and / or obtain key identifier 302(N) and / or tokens 310(1) and 310(2) from server 100 and / or service 106.

[0043] In some examples, network device 208(1) may generate and / or create encryption key 502(1) based at least in part on key identifier 302(1). Additionally or alternatively, network device 208(N) may generate and / or create encryption key 502(N) based at least in part on key identifier 302(N). Network devices 208(1)-208(N) may generate and / or create such encryption keys using any type or form of cryptographic techniques. Examples of such cryptographic techniques include, but are not limited to, public key algorithms, symmetric key algorithms, random number generation, pseudo-random number generation, distributed key generation, portions of one or more of the same cryptographic techniques, variations or combinations of one or more of the same cryptographic techniques, and / or any other suitable cryptographic techniques.

[0044] In some examples, network device 208(1) may identify, generate, and / or obtain logs 506(1) and 506(2). In one example, network device 208(1) may identify and / or discover one or more attributes of logs 506(1) and 506(2). In this example, network device 208(1) may search for any policy tokens received and / or obtained from server 100 or service 106 that represent a policy that matches those attributes of logs 506(1) and 506(2). For example, network device 208(1) may determine and / or discover, based at least in part on the search, that the policy represented by policy token 310(N) matches and / or is consistent with one or more attributes of log 506(1). Additionally or alternatively, network device 208(1) may determine and / or discover, based at least in part on the search, that the policy represented by policy token 310(1) matches and / or is consistent with one or more attributes of log 506(2).

[0045] In some examples, network device 208(1) may apply policy token 310(N) to log 506(1) based at least in part on a matching criterion between the policy represented by policy token 310(N) and log 506(1). For example, network device 208(1) may append, mark, and / or attach policy token 310(N) to log 506(1). In one example, network device 208(1) may apply policy token 310(1) to log 506(2) based at least in part on a matching criterion between the policy represented by policy token 310(1) and log 506(2). For example, network device 208(1) may append, mark, and / or attach policy token 310(1) to log 506(2).

[0046] In some examples, network device 208(1) may encrypt logs 506(1) and 506(2) using encryption key 502(1). In one example, network device 208(1) may encrypt logs 506(1) and 506(2) after applying policy tokens 310(N) and 310(1), respectively. In another example, network device 208(1) may encrypt logs 506(1) and 506(2) before applying policy tokens 310(N) and 310(1), respectively. Network device 208(1) may then provide, send, and / or transmit the encrypted versions of logs 506(1) and 506(2) to collector 206.

[0047] In some examples, network device 208(N) may identify, generate, and / or obtain logs 506(3) and 506(4). In one example, network device 208(N) may identify and / or discover one or more attributes of logs 506(3) and 506(4). In this example, network device 208(N) may search for any policy tokens received and / or obtained from server 100 or service 106 that represent a policy that matches those attributes of logs 506(3) and 506(4). For example, network device 208(N) may determine and / or discover, based at least in part on the search, that the policy represented by policy token 310(1) matches and / or is consistent with one or more attributes of log 506(3). Additionally or alternatively, network device 208(N) may determine and / or discover, based at least in part on the search, that the policy represented by policy token 310(2) matches and / or is consistent with one or more attributes of log 506(4).

[0048] In some examples, network device 208(N) may apply policy token 310(1) to log 506(3) based at least in part on a matching criterion between the policy represented by policy token 310(1) and log 506(3). For example, in response to determining that log 506(3) is subject to the policy represented by policy token 310(1), network device 208(N) may append, mark, and / or attach policy token 310(1) to log 506(3). In one example, network device 208(N) may apply policy token 310(2) to log 506(4) based at least in part on a matching criterion between the policy represented by policy token 310(2) and log 506(4). For example, in response to determining that log 506(4) is subject to the policy represented by policy token 310(2), network device 208(N) may append, mark, and / or attach policy token 310(2) to log 506(4).

[0049] In some examples, network device 208(N) may encrypt logs 506(3) and 506(4) with encryption key 502(N). In one example, network device 208(N) may encrypt logs 506(3) and 506(4) after applying policy tokens 310(1) and 310(2), respectively. In another example, network device 208(N) may encrypt logs 506(3) and 506(4) before applying policy tokens 310(1) and 310(2), respectively. Network device 208(N) may then provide, send, and / or transmit the encrypted versions of logs 506(3) and 506(4) to collector 206.

[0050] Network devices 208(1) to 208(N) may use various attributes to determine which policies correspond to and / or apply to telemetry data and / or logs. For example, policies regarding specific entities, customers, and / or tenants may correspond to and / or apply to telemetry data and / or logs regarding those specific entities, customers, and / or tenants. Thus, such policies may enable specific entities, customers, and / or tenants to access such telemetry data and / or logs. In addition, such policies may prevent any or all other entities, customers, and / or tenants from accessing such telemetry data and / or logs. Examples of attributes that can be used to determine which policies correspond to and / or apply to telemetry logs include, but are not limited to, specific entities, specific customers, specific tenants, specific users, specific roles, user groups and / or tenant groups, users or groups authorized by an authority, users or groups with a specific security level, variations or combinations of one or more of the same attributes, and / or any other suitable attributes.

[0051] System 200 can implement and / or apply various types and / or models of access control in conjunction with these attributes and / or policies. Examples of these types and / or models of access control include, but are not limited to, discretionary access control (DAC), role-based access control (RBAC), mandatory access control (MAC), and / or attribute-based access control (ABAC), variations or combinations of one or more of the same access control types and / or models, and / or any other suitable access control types and / or models.

[0052] In some examples, collector 206 may be configured and / or programmed to receive and / or obtain a request 508 from user 210 to access one or more logs 506(1)-506(4). For example, user 210 may submit a request 508 to collector 206 to attempt to access, read, and / or browse log 506(1). In this example, user 210 may be authorized to access, read, and / or browse any log that is subject to the policy represented by policy token 310(N).

[0053] In some examples, collector 206 may be configured and / or programmed to determine whether user 210 is authorized to access log 506(1) based at least in part on a policy token 310(N) attached and / or marked on log 506(1). For example, collector 206 may identify and / or discover a policy token 310(N) attached and / or marked on log 506(1). In this example, collector 206 may analyze and / or evaluate the policy represented by policy token 310(N). In doing so, collector 206 may determine that user 210 is authorized to access, read, and / or browse log 506(1). In some embodiments, collector 206 may satisfy request 508 by decrypting log 506(1) using key identifier 302(1), and then provide user 210 with access to a decrypted version of log 506(1).

[0054] As another example, user 210 may submit another request to collector 206 to attempt to access, read and / or browse log 506(4). In one example, user 210 may be authorized to access, read and / or browse any log that is subject to the policy represented by policy token 310(1). In this example, collector 206 may identify and / or find policy token 310(2) attached and / or marked to log 506(4). In this example, collector 206 may analyze and / or evaluate the policy represented by policy token 310(2). In doing so, collector 206 may determine that user 210 is not authorized to access, read and / or browse log 506(4). In certain embodiments, collector 206 may refuse to satisfy this request at least in part because user 210 is not authorized to access log 506(4).

[0055] In some examples, collector 206 may include and / or represent a telemetry cluster consisting of nodes 510(1), 510(2), 510(3), 510(4), and 510(5) that operate and / or collaborate with each other. In one example, nodes 510(1)-(5) may constitute and / or represent a cluster of telemetry collectors (e.g., syslog, etc.).

[0056] In some examples, combined Figures 1 to 5 The various devices and systems described may include and / or represent one or more Figures 1 to 5 Additional circuits, components and / or features shown and / or labeled in FIG. Figures 1 to 5The devices shown in the drawings may also include and / or represent additional analog and / or digital circuits, on-board logic, transistors, transmitters, receivers, transceivers, antennas, resistors, capacitors, diodes, inductors, switches, registers, flip-flops, connectors, traces, buses, semiconductor (e.g., silicon) devices and / or structures, processing devices, storage devices, circuit boards, sensors, packages, substrates, housings, variations or combinations of one or more of the same, and / or any other suitable components that facilitate and / or support quantum secure data in a multi-tenant environment. In certain embodiments, one or more of these additional circuits, components, and / or features may be inserted into and / or applied to Figures 1 to 5 Any existing circuits, components and / or features shown that are consistent with the goals and / or objectives described herein. Therefore, reference is made to Figures 1 to 5 The couplings and / or connections described may be directly connected without the use of intermediary components, devices and / or nodes or indirectly connected using one or more intermediary components, devices and / or nodes.

[0057] In some examples, the phrase "coupled to" and / or the term "coupled in" as used herein may refer to a direct connection and / or an indirect connection. For example, a direct coupling between two components may constitute and / or represent a coupling in which the two components are directly connected to each other through a single node that provides continuity from one of the two components to the other component. In other words, a direct coupling may exclude and / or omit any additional components between the two components.

[0058] Additionally or alternatively, an indirect coupling between two components may constitute and / or represent a coupling in which the two components are indirectly connected to each other through a plurality of nodes that do not provide continuity from one of the two components to the other. In other words, the indirect coupling may include and / or incorporate at least one additional component between the two components.

[0059] Figure 6 A flow chart of an exemplary method 600 for implementing quantum secure data in a multi-tenant environment is shown. In one example, Figure 6 The steps presented may be implemented and / or performed by a system, computing device, and / or server for facilitating and / or supporting secure data in a multi-tenant environment. Additionally or alternatively, Figure 6 The steps shown may be combined and / or related to the above Figures 1 to 5 Certain sub-steps and / or step variations consistent with the description are provided.

[0060] like Figure 6As shown, method 600 may include step 610 of providing a key identifier by the server to the network device, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs. Step 610 may be performed in a variety of ways, including any combination of the above. Figures 1 to 5 For example, the server and / or service may provide, send, and / or transmit a key identifier to the network device. By doing so, the server and / or service may enable the network device to generate an encryption key for encrypting one or more logs.

[0061] Method 600 may also include step 620 of providing a key identifier to the collector by the server, the key identifier enabling the collector to decrypt the log. Step 620 may be performed in a variety of ways, including any combination of the above. Figures 1 to 5 For example, the server and / or service may provide, send, and / or transmit a key identifier to the collector via a distributed ledger. By doing so, the server and / or service may enable the collector to decrypt the logs.

[0062] Method 600 may further include step 630 of providing, by the server, one or more policy tokens to the network device, the policy tokens representing one or more policies controlling access to the log. Step 630 may be performed in a variety of ways, including any combination of the above. Figures 1 to 5 For example, the server and / or service may provide, send, and / or transmit one or more policy tokens to the network device. In this example, the policy token may represent one or more policies that control access to the log.

[0063] Method 600 may additionally include step 640 of providing a policy token by the server to the collector, the policy token enabling the collector to enforce the policy represented by the policy token applied to the log by the network device. Step 640 may be performed in a variety of ways, including any combination of the above. Figures 1 to 5 For example, the server and / or service may provide, send, and / or transmit a policy token to the collector via a distributed ledger. By doing so, the server and / or service may enable the collector to enforce the policy represented by the policy token applied by the network device to the log.

[0064] Figure 7 A block diagram of an exemplary computing system 700 is shown that can be implemented and / or used in conjunction with one or more of the embodiments described and / or illustrated herein. In some embodiments, all or part of the computing system 700 can perform and / or be used to perform one or more combined operations, either alone or in conjunction with other elements. Figure 6All or part of the computing system 700 may also execute and / or be used to execute and / or implement any other steps, methods, or processes described and / or illustrated herein.

[0065] The computing system 700 broadly represents any type or form of electrical load, including a single or multi-processor computing device or system capable of executing computer-readable instructions. Examples of the computing system 700 include, but are not limited to, workstations, notebook computers, client-side terminals, servers, distributed computing systems, mobile devices, network switches, network routers (e.g., backbone routers, edge routers, core routers, mobile service routers, broadband routers, etc.), network devices (e.g., network security devices, network control devices, network timing devices, Secure Sockets Layer Virtual Private Network (SSL VPN) devices, etc.), network controllers, gateways (e.g., service gateways, mobile packet gateways, multi-access gateways, security gateways, etc.), and / or any other type or form of computing system or device.

[0066] The computing system 700 may be programmed, configured, and / or otherwise designed to comply with one or more networking protocols. According to some embodiments, the computing system 700 may be designed to operate using protocols at one or more layers of the Open Systems Interconnection (OSI) model, such as a physical layer protocol, a link layer protocol, a network layer protocol, a transport layer protocol, a session layer protocol, a presentation layer protocol, and / or an application layer protocol. For example, the computing system 700 may include network devices that are configured according to a Universal Serial Bus (USB) protocol, an Institute of Electrical and Electronics Engineers (IEEE) 1394 protocol, an Ethernet protocol, a T1 protocol, a Synchronous Optical Networking (SONET) protocol, a Synchronous Digital Hierarchy (SDH) protocol, an Integrated Services Digital Network (ISDN) protocol, an Asynchronous Transfer Mode (ATM) protocol, a Point-to-Point Protocol (PPP) protocol, a Point-to-Point Protocol over Ethernet (PPPoE) protocol, a Point-to-Point Protocol over ATM (PPPoA) protocol, a Bluetooth protocol, an IEEE802.XX protocol, a Frame Relay protocol, a Token Ring protocol, a Spanning Tree Protocol, and / or any other suitable protocol.

[0067] The computing system 700 may include various network and / or computing components. For example, the computing system 700 may include at least one processor 714 and a system memory 716. The processor 714 generally represents any type or form of processing unit capable of processing data or interpreting and executing instructions. For example, the processor 714 may represent an application-specific integrated circuit (ASIC), a system on a chip (e.g., a network processor), a hardware accelerator, a general-purpose processor, and / or any other suitable processing element.

[0068] Processor 714 may process data in accordance with one or more of the network protocols discussed above. For example, processor 714 may execute or implement portions of a protocol stack, may process packets, may perform memory operations (e.g., queue packets for later processing), may execute end-user applications, and / or may perform any other processing tasks.

[0069] The system memory 716 generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and / or other computer-readable instructions. Examples of the system memory 716 include, but are not limited to, random access memory (RAM), read-only memory (ROM), flash memory, or any other suitable memory device. Although not required, in some embodiments, the computing system 700 may include a volatile memory unit (e.g., the system memory 716) and a non-volatile storage device (e.g., the main memory device 732 described in detail below). The system memory 716 can be implemented as a shared memory and / or distributed memory in a network device. In addition, the system memory 716 can store packets and / or other information used in networking operations.

[0070] In some embodiments, the exemplary computing system 700 may also include components or elements other than the processor(s) 714 and the system memory 716. For example, Figure 7 As shown, computing system 700 may include a memory controller 718, an input / output (I / O) controller 720, and a communication interface 722, each of which may be interconnected via a communication infrastructure 712. Communication infrastructure 712 generally represents any type or form of infrastructure capable of facilitating communication between one or more components of a computing device. Examples of communication infrastructure 712 include, but are not limited to, communication buses (e.g., Serial ATA (SATA), Industry Standard Architecture (ISA), Peripheral Component Interconnect (PCI), PCI Express (PCIe), and / or any other suitable bus) and networks.

[0071] Memory controller 718 generally represents any type or form of device capable of handling memory or data or controlling communications between components of one or more computing systems 700. For example, in some embodiments, memory controller 718 may control communications between processor 714, system memory 716, and I / O controller 720 via communication infrastructure 712. In some embodiments, memory controller 718 may include a Direct Memory Access (DMA) unit that may transfer data (e.g., packets) to or from a link adapter.

[0072] I / O controller 720 generally represents any type or form of device or module capable of coordinating and / or controlling the input and output functions of a computing device. For example, in some embodiments, I / O controller 720 can control or facilitate data transfer between one or more elements of computing system 700, such as processor 714, system memory 716, communication interface 722, and storage interface 730.

[0073] The communication interface 722 broadly represents any type or form of communication device or adapter that can facilitate communication between the exemplary computing system 700 and one or more additional devices. For example, in some embodiments, the communication interface 722 can facilitate communication between the computing system 700 and a private or public network including additional computing systems. Examples of the communication interface 722 include, but are not limited to, a link adapter, a wired network interface (e.g., a network interface card), a wireless network interface (e.g., a wireless network interface card), and any other suitable interface. In at least one embodiment, the communication interface 722 can provide a direct connection to a remote server via a direct link connected to a network such as the Internet. The communication interface 722 can also provide such a connection indirectly through, for example, a local area network (e.g., Ethernet), a personal area network, a wide area network, a private network (e.g., a virtual private network), a telephone or cable network, a cellular phone connection, a satellite data connection, or any other suitable connection.

[0074] In some embodiments, the communication interface 722 may also represent a host adapter configured to facilitate communication between the computing system 700 and one or more attached network or storage devices via an external bus or communication channel. Examples of host adapters include, but are not limited to, a Small Computer System Interface (SCSI) host adapter, a USB host adapter, an IEEE 1394 host adapter, an Advanced Technology Attachment (ATA), a Parallel ATA (PATA), a Serial ATA (SATA) and an External SATA (eSATA) host adapter, a Fibre Channel interface adapter, an Ethernet adapter, and the like. The communication interface 722 may also enable the computing system 700 to participate in distributed computing or remote computing. For example, the communication interface 722 may receive instructions from a remote device or send instructions to a remote device for execution.

[0075] like Figure 7 As shown, the exemplary computing system 700 may also include a primary storage device 732 and / or a backup storage device 734 coupled to the communication infrastructure 712 via a storage interface 730. The storage devices 732 and 734 generally represent any type or form of storage device or medium capable of storing data and / or other computer-readable instructions. For example, the storage devices 732 and 734 may represent a disk drive (e.g., a so-called hard disk drive), a solid-state drive, a floppy disk drive, a tape drive, an optical drive, a flash drive, etc. The storage interface 730 generally represents any type or form of interface or device for transferring data between the storage devices 732 and 734 and other components of the computing system 700.

[0076] In certain embodiments, storage devices 732 and 734 may be configured to read from and / or write to a removable storage unit that is configured to store computer software, data, or other computer-readable information. Examples of suitable removable storage units include, but are not limited to, floppy disks, magnetic tapes, optical disks, flash memory devices, and the like. Storage devices 732 and 734 may also include other similar structures or devices for allowing computer software, data, or other computer-readable information to be loaded into computing system 700. For example, storage devices 732 and 734 may be configured to read and write software, data, or other computer-readable information. Storage devices 732 and 734 may be parts of computing system 700 or may be independent devices accessed through other interface systems.

[0077] Many other devices or subsystems may be connected to computing system 700. In contrast, Figure 7All components and devices shown in the drawings need not be present to practice the embodiments described and / or shown herein. The above-mentioned devices and subsystems may also be used in different Figure 7 The method shown is interconnected. The computing system 700 may also employ any number of software, firmware, and / or hardware configurations. For example, one or more exemplary embodiments disclosed herein may be encoded as a computer program (also referred to as computer software, software applications, computer-readable instructions, or computer control logic) on a computer-readable medium. The term "computer-readable medium" generally refers to any form of device, carrier, or medium capable of storing or carrying computer-readable instructions. Examples of computer-readable media include, but are not limited to, transmission-type media such as carrier waves and non-transient media such as magnetic storage media (e.g., hard disk drives and floppy disks), optical storage media (e.g., compact disks (CDs) and digital video disks (DVDs)), electronic storage media (e.g., solid-state drives and flash memory media), and other distribution systems.

[0078] Although the present disclosure foregoing uses specific block diagrams, flow charts and examples to set forth various embodiments, each and / or illustrated block diagram component, flow chart step, operation and / or component described herein may be implemented individually and / or collectively with a wide range of hardware, software or firmware (or any combination thereof) configurations. In addition, any disclosure of components contained within other components should be considered exemplary in nature, as many other architectures may be implemented to achieve the same functionality.

[0079] According to an embodiment of the present disclosure, a system is disclosed, including: at least one network device; at least one collector; and at least one service, configured to: provide a key identifier to the network device and the collector, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs and enabling the collector to decrypt the logs; provide one or more policy tokens to the network device, the policy tokens representing one or more policies that control access to the logs; and provide the policy tokens to the collector to enable the collector to enforce the policies represented by the policy tokens applied to the logs by the network device.

[0080] The service is further configured to: generate a key identifier for distribution to the network devices and collectors; and generate a policy for distribution to the network devices and collectors. The service is further configured to: obtain input from an administrator; and generate a policy based at least in part on the input.

[0081] The system also includes at least one additional network device; and wherein the service is further configured to: provide additional key identifiers to the additional network device and the collector, the additional key identifiers enabling the additional network device to generate additional encryption keys for encrypting one or more additional logs and enabling the collector to decrypt the logs; provide one or more additional policy tokens to the additional network device, the additional policy tokens representing one or more additional policies controlling access to the additional logs; and provide the additional policy tokens to the collector to enable the collector to enforce the additional policies applied by the additional network device to the additional logs.

[0082] The service is further configured to sign the key identifier using the private key; and the network device is further configured to verify the service by confirming the signature of the key identifier using the public key corresponding to the private key. The network device is further configured to: apply a first policy token included in the policy token to a first log included in the log; and provide the first policy token together with the first log to the collector.

[0083] The network device is also configured to: identify an attribute of the first log; search the policy tokens for a policy token representing a policy that matches the attribute; determine, based at least in part on the search, that the first policy token represents a policy that matches the attribute; and in response to determining that the first policy token represents a policy that matches the attribute, apply the first policy token to the first log.

[0084] The network device is further configured to: apply a second policy token included in the policy token to a second log included in the log; and provide the second policy token together with the second log to the collector.

[0085] The service is also configured to provide the key identifier and the policy token to the collector via the distributed ledger by adding a record to the distributed ledger that associates the device identifier, the key identifier, and the policy token for the network device; and enabling the collector to obtain the key identifier and the policy token from the record via the distributed ledger.

[0086] The network device is further configured to: generate an encryption key based at least in part on the key identifier; and encrypt the log using the encryption key. The collector is further configured to: receive a request from a user to access a log included in the log; determine that the user is authorized to access the log; and satisfy the request by decrypting the log using the key identifier and providing the user with access to the log. The collector is further configured to: receive a request from a user to access a log included in the log; determine that the user is not authorized to access the log; and refuse to satisfy the request at least in part because the user is not authorized to access the log.

[0087] The key identifier comprises a post-quantum pre-shared key identifier; and the encryption key comprises a post-quantum pre-shared key.

[0088] According to an embodiment of the present disclosure, a server is disclosed, comprising: at least one storage device configured to maintain a database of policy tokens, the policy tokens representing policies that control access to certain logs; and a circuit communicatively coupled to the storage device, wherein the circuit is configured to: provide a key identifier to a network device and a collector, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs and enabling the collector to decrypt the one or more logs; provide one or more policy tokens to the network device, the policy tokens representing one or more policies that control access to the one or more logs; and provide one or more policy tokens to the collector to enable the collector to enforce one or more policies represented by the one or more policy tokens applied by the network device to the one or more logs.

[0089] The circuit is further configured to: generate a key identifier for distribution to the network devices and collectors; and generate one or more policies for distribution to the network devices and collectors. The circuit is further configured to: obtain input from an administrator; and generate one or more policies based at least in part on the input.

[0090] The circuit is also configured to: provide additional key identifiers to the additional network device and the collector, the additional key identifiers enabling the additional network device to generate additional encryption keys for encrypting one or more additional logs and enabling the collector to decrypt the one or more additional logs; provide one or more additional policy tokens to the additional network device, the additional policy tokens representing one or more additional policies that control access to the one or more additional logs; and provide one or more additional policy tokens to the collector to enable the collector to enforce the one or more additional policies applied by the additional network device to the one or more additional logs.

[0091] The circuit is further configured to sign the key identifier using the private key so that the network device can verify the signature of the key identifier using a public key corresponding to the private key. The circuit is further configured to provide the key identifier and the one or more policy tokens to the collector via the distributed ledger by: adding a record to the distributed ledger associating a device identifier for the network device, the key identifier, and the one or more policy tokens; and enabling the collector to obtain the key identifier and the one or more policy tokens from the distributed ledger.

[0092] According to an embodiment of the present disclosure, a method is disclosed, including: providing a key identifier by a server to a network device, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs; providing a key identifier by the server to a collector, the key identifier enabling the collector to decrypt the logs; providing one or more policy tokens by the server to the network device, the policy tokens representing one or more policies controlling access to the logs; and providing a policy token by the server to the collector to enable the collector to enforce the policy represented by the policy token applied to the log by the network device.

[0093] In some examples, Figure 1 All or part of the server 100 in the embodiment may represent part of a cloud computing or network-based environment. Cloud computing and network-based environments may provide various services and applications via the Internet. These cloud computing and network-based services (e.g., software as a service, platform as a service, infrastructure as a service, etc.) may be accessed through a web browser or other remote interface. The various functions described herein may also provide network switching capabilities, gateway access capabilities, network security functions, caching and delivery services for network content, network control services, and / or other networking functions.

[0094] Furthermore, one or more modules described herein may transform data, physical devices, and / or representations of physical devices from one form to another. Additionally or alternatively, one or more modules described herein may transform a processor, volatile memory, non-volatile memory, and / or any other portion of a physical computing device from one form to another by executing on a computing device, storing data on a computing device, and / or otherwise interacting with a computing device.

[0095] The process parameters and step sequences described and / or illustrated herein are given as examples only and may vary as desired. For example, although the steps illustrated and / or described herein may be displayed or discussed in a particular order, these steps may not necessarily be performed in the order illustrated or discussed. The various exemplary methods described and / or illustrated herein may also omit one or more of the steps described and / or illustrated herein or include those additional steps outside of these disclosed steps.

[0096] The foregoing disclosure has been provided to enable those skilled in the art to best utilize the various aspects of the exemplary embodiments disclosed herein. This exemplary description is not intended to be exhaustive or limit any precise form disclosed. Many modifications and variations are possible without departing from the spirit and scope of the present disclosure. The embodiments disclosed herein should be considered illustrative rather than restrictive. In determining the scope of the present disclosure, reference should be made to the attached examples and their equivalents.

[0097] Unless otherwise indicated, the terms "connected to" and "coupled to" (and their derivatives) used in the specification and claims should be interpreted as allowing both direct and indirect (i.e., through other elements or components) connections. In addition, the terms "a" or "an" used in the specification and claims should be interpreted as meaning "at least one". Finally, for ease of use, the terms "including" and "having" (and their derivatives) used in the specification and claims are interchangeable with the word "comprising" and have the same meaning as the word "comprising".

Claims

1. A system comprising: at least one network device; at least one collector; as well as At least one service, configured to: providing a key identifier to the network device and the collector, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs and enabling the collector to decrypt the logs; providing one or more policy tokens to the network device, the policy tokens representing one or more policies controlling access to the log; as well as The policy token is provided to the collector to enable the collector to enforce the policy represented by the policy token applied by the network device to the log.

2. The system of claim 1, wherein the service is further configured to: generating the key identifier for distribution to the network device and the collector; and The policy is generated for distribution to the network devices and the collector.

3. The system of claim 2, wherein the service is further configured to: Obtaining input from an administrator; and The policy is generated based at least in part on the input.

4. The system of claim 2, further comprising at least one additional network device; and The service is also configured as: providing an additional key identifier to the additional network device and the collector, the additional key identifier enabling the additional network device to generate an additional encryption key for encrypting one or more additional logs and enabling the collector to decrypt the logs; providing one or more additional policy tokens to the additional network device, the additional policy tokens representing one or more additional policies controlling access to the additional log; as well as The additional policy token is provided to the collector to enable the collector to enforce the additional policy applied to the additional log by the additional network device.

5. The system of claim 2, wherein: The service is further configured to sign the key identifier using a private key; and The network device is further configured to authenticate the service by validating the signature of the key identifier using a public key corresponding to the private key.

6. The system according to claim 1, wherein the network device is further configured to: applying a first policy token included in the policy token to a first log included in the log; and The first policy token is provided to the collector along with the first log.

7. The system according to claim 6, wherein the network device is further configured to: Identify a certain attribute of the first log; Searching the policy tokens for a policy token representing a policy matching the certain attribute; determining, based at least in part on the searching, that the first policy token represents a policy that matches the certain attribute; as well as In response to determining that the first policy token represents the policy that matches the certain attribute, the first policy token is applied to the first log.

8. The system according to claim 6, wherein the network device is further configured to: applying a second policy token included in the policy token to a second log included in the log; and The second policy token is provided to the collector along with the second log.

9. The system of claim 1 , wherein the service is further configured to provide the key identifier and the policy token to the collector via a distributed ledger by: adding to the distributed ledger a record associating a device identifier for the network device, the key identifier, and the policy token; and The collector is enabled to obtain the key identifier and the policy token from the record via the distributed ledger.

10. The system according to claim 1, wherein the network device is further configured to: generating the encryption key based at least in part on the key identifier; and The log is encrypted using the encryption key.

11. The system of claim 1 , wherein the collector is further configured to: receiving a request from a user to access a log included in the log; determining that the user is authorized to access the log; and The request is satisfied by decrypting the log using the key identifier and providing access to the log to the user.

12. The system of claim 1, wherein the collector is further configured to: receiving a request from a user to access a log included in the log; determining that the user is not authorized to access the log; and The request is denied due at least in part to the user not being authorized to access the log.

13. The system of claim 1, wherein: The key identifier comprises a post-quantum pre-shared key identifier; and The encryption key includes a post-quantum pre-shared key.

14. A server, comprising: at least one storage device configured to maintain a database of policy tokens representing policies controlling access to certain logs; as well as circuitry, communicatively coupled to the memory device, wherein the circuitry is configured to: providing a key identifier to a network device and a collector, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs, and enabling the collector to decrypt the one or more logs; providing one or more policy tokens to the network device, the policy tokens representing one or more policies controlling access to the one or more logs; as well as The one or more policy tokens are provided to the collector to enable the collector to enforce the one or more policies represented by the one or more policy tokens applied by the network device to the one or more logs.

15. A method comprising: providing, by the server, a key identifier to a network device, the key identifier enabling the network device to generate an encryption key for encrypting one or more logs; providing, by the server, the key identifier to a collector, the key identifier enabling the collector to decrypt the log; providing, by the server, one or more policy tokens to the network device, the policy tokens representing one or more policies controlling access to the log; as well as The policy token is provided by the server to the collector to enable the collector to enforce the policy represented by the policy token applied by the network device to the log.

Images