Distributed storage and management of data

Abstract

A method and system for distributed storage and management of data may include storing a data abstraction including one or more structured data entities, each structured data entity including at least three pairs of nodes. The first node pair contains a hash, a unique identifier, a digital signature, and a data key for a first node in the second node pair. The first node of the second node pair includes a hash of the first node of the third node pair and a hash of the second node of the second node pair. A second node of the second node pair is encrypted with an entity relationship node key and contains a summary of data contained in the encrypted data node and a data decryption key for the encrypted data node. The third node pair contains the encrypted data node having data encrypted using the data encryption key and an encrypted data file.

Description

Technical Field

[0001] The present disclosure relates to methods, systems, and computer program products for distributed storage and management of data. More particularly, the present disclosure relates to storing sensitive data in a system in which knowledge and access to the sensitive data is controlled via a directed acyclic graph. Background Art

[0002] Computer networks hold highly sensitive data across many different computer systems, requiring multiple levels of access and security. Identifying, sending, and accessing this data in an efficient and secure manner is an increasingly complex task. This is especially true for medical data. Medical data has various legal and ethical protections to protect the privacy of this data. Such protections can include how and where the data is stored, when the data can be viewed and by whom, where the data can be sent and why it is sent, and when and how the data can be deleted. Previously, the storage and retrieval of this medical data was primarily intended for reading by people (such as medical professionals). However, based on the introduction of new technologies (such as automatic and semi-automatic diagnosis, computer modeling, computer-aided design of various medical devices and prostheses, etc.), other computer systems and personnel may need to access the data at least partially. Dental data is an example area of ​​this medical data, which will benefit from the ability to store and share sensitive data at different levels and packages, so that these new technical functions can be performed quickly, securely, and in compliance with various regulations.

[0003] A peer-to-peer (P2P) storage system combines the storage capacity of a network of storage devices (peers) into a common pool of storage space to store and share content between peers. A P2P system provides data persistence and availability that is independent of the capabilities of each peer in a decentralized environment. Current P2P methods and technologies, including distributed data storage, require each device in the system to have a considerable storage capacity because each device stores a complete copy of the relevant database and / or requires the same data to be transmitted multiple times between devices in the P2P storage system. Current P2P systems avoid having each device within the P2P system have a copy of the entire database, but in such systems, local caching of data is generally required. In addition, in such current P2P systems, each device within the P2P system must be aware of the existence of the segment of data and where the segment of data is stored within the system. For example, if a device needs a segment of data, the device will have to request the segment of data and store the segment of data locally on the device for use. Current data storage systems also cannot distinguish between knowing that data is stored in a storage system and actually storing the data in the storage system. For example, current methods and techniques propagate data to each device in a storage system by providing a complete copy of a database to each device (e.g., a distributed network). In addition, current methods and techniques require that data stored in a storage system be transmitted multiple times between all devices in the storage system, resulting in inefficient transmission and storage of data. Finally, current data storage systems, including P2P storage systems, cannot tolerate offline, especially when data conflicts are involved, such as when different devices simultaneously update the same data segment offline. In instances of such data conflicts, current data storage systems may save the same data as different versions, save the data under different file names, or require a user to select which version of the data should be stored and discard the other version of the data. Therefore, there is a need for methods and systems for more efficiently storing, managing, and accessing data stored in a P2P storage system. Summary of the invention

[0004] Various systems and methods are described herein that address the above-described needs for efficient, secure, and compliant processing and transmission of sensitive data, such as medical and / or dental data. The systems and methods described herein allow for greater accessibility and sharing of information between properly authenticated computer systems. The manner and location of storage and retrieval is based at least in part on the credentials of the computer system and user, as well as the type of data.

[0005] A method for distributed storage and management of data is disclosed. The method includes: storing a data abstraction connected to a database interface by a computing device in a network, the data abstraction storing one or more structured data entities, each of the one or more structured data entities including at least three node pairs, the at least three node pairs including: a first transmission header node, which is paired with a commit node, the first transmission header node at least including a blob reference of the commit node, one of the blob references of the commit node including a hash of the commit node and a size of one of the blob references of the commit node, and a second blob reference of the first transmission header including a hash of the second transmission header node and a size of the second blob reference of the first transmission header, the commit node including a unique identifier, a digital signature, and a data key, the data key being a relationship node key encrypted with an entity key, the entity key being dedicated to an associated structured data entity in the one or more structured data entities; the second transmission header node, which is paired with an encrypted relationship node encrypted with a relationship node key, the second transmission header including at least a blob reference of the encrypted relationship node, one of the blob references of the encrypted relationship node including a hash of a third transmission header node and a size of the blob reference of the encrypted relationship node. size, and the second blob reference of the second transfer header contains a hash of the encryption relationship node and the size of the second blob reference of the second transfer header, the encryption relationship node contains a summary of the data contained in the encrypted data node and a data decryption key for the encrypted data node; a third transfer header node, which is paired with the encrypted data node and the encrypted data file, the third transfer header node contains at least a blob reference of the data node, the blob reference of the data node contains at least the size of the encrypted data node and the hash of the encrypted data node, wherein the encrypted data node contains encrypted data related to the associated structured data entity encrypted using the data encryption key; a computing device transmits a request for the first transfer header node and the paired submission node for a specific structured data entity among one or more structured data entities; and the computing device receives the first transfer header node and the paired submission node for the specific structured data entity.

[0006] A system for distributed storage and management of data is disclosed. The system includes a memory of a processor in a network, the memory being configured to: store a data abstraction connected to a database interface, the data abstraction storing one or more structured data entities, each of the one or more structured data entities including at least three node pairs, the at least three node pairs including: a first transmission header node paired with a submission node, the first transmission header node at least including a blob reference of the submission node, the blob reference of the submission node including a hash of the submission node and a hash of the second transmission header node, the submission node including a unique identifier, a digital signature, and a data key, the data key being a relationship node key encrypted with an entity key, the entity key being specific to the associated structured data entity of the one or more structured data entities; a second transmission header node paired with an encrypted relationship node encrypted with a relationship node key, the second transmission header at least including a blob reference of the encrypted relationship node, the encrypted relationship node The blob reference of the node includes a hash of a third transmission header node and a hash of an encryption relationship node, the encryption relationship node includes a summary of the data contained in the encrypted data node and a data decryption key for the encrypted data node; a third transmission header node, which is paired with the encrypted data node and the encrypted data file, the third transmission header node includes a blob reference of the data node, the blob reference of the data node includes at least the size of the encrypted data node and the hash of the encrypted data node, wherein the encrypted data node includes encrypted data related to the associated structured data entity encrypted using the data encryption key; a transmission device of the processor, configured to transmit a request for a first transmission header node and a paired submission node of a specific structured data entity among the one or more structured data entities; and a receiving device of the processor, configured to receive the first transmission header node and the paired submission node of the specific structured data entity.

[0007] According to one embodiment, a computer program product for distributed storage and management of data is disclosed. The computer program product is embodied in a non-transitory computer-readable medium, and the computer program product includes a computer-readable program code executable by a hardware data processor to enable the hardware data processor to perform a method for distributed storage and management of data as disclosed in one or more embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The scope of the present disclosure can be best understood from the following detailed description of exemplary embodiments when read in conjunction with the accompanying drawings, which include the following figures:

[0009] Figure 1 illustrates a high-level system architecture for distributed storage and management of data according to an exemplary embodiment;

[0010] Figure 2An example producer device 102a is illustrated according to an example embodiment;

[0011] Figure 3A illustrates an example first transfer header node and a commit node of a structured data entity according to an example embodiment;

[0012] Figure 3B illustrates an example second transfer header node and relationship nodes of a structured data entity according to an example embodiment;

[0013] Figure 3C illustrates an example third transmission header node and data nodes of a structured data entity according to an example embodiment;

[0014] Figure 4 illustrates example structured data entities according to example embodiments;

[0015] FIG. 5A to FIG. 5C is a flow chart illustrating a method for distributed storage and management of data according to an exemplary embodiment; and

[0016] Figure 6 is a block diagram illustrating a computer system architecture according to an exemplary embodiment. DETAILED DESCRIPTION

[0017] As discussed above, current methods and techniques for data storage including distributed data storage require considerable storage capacity, where each node in the storage system has a complete copy of the database and / or integrated knowledge of the data domain being modeled, which requires multiple transfers of the same data between the devices of the storage system. Example embodiments of the methods and systems provided herein provide a peer-to-peer storage engine that supports local indexes, such as projection indexes, and search data stored as structured data entities, including but not limited to dental scans, designed crowns, a set of settings, etc. The structured data entities in the methods and systems provided herein overcome limitations on the actual structure of the data being stored, such as limitations on data tables, data arrays, linked lists, stacks, queues, hash tables, trees, heaps, graphs, etc. The methods and systems provided herein allow data to be segmented into multiple data chunks that can be used in multiple structured data entities while enabling the advantages of a P2P storage system and a directed acyclic graph. The methods and systems provided herein consist of peers with different access controls by limiting the functions and capabilities of peers based on peer types. Thus, through the methods and systems disclosed herein, a more efficient and secure network for processing, storing and distributing sensitive data, such as dental patient data, is provided. The methods and systems provided herein provide an offline tolerant system in which data conflicts are permitted and stored within a directed acyclic graph, such as when different devices simultaneously update the same segment of data offline. Furthermore, the data of the methods and systems provided herein exists in two ways: first, some peers may know the existing data of the structured data entity, but cannot access the actual data itself that is encrypted, and second, some peers may know the existing data and can access the data itself via one or more users of the encryption key.

[0018] Overview of systems for distributed storage and management of data

[0019] Figure 1 A system 100 for distributed data storage and management of data is illustrated according to an exemplary embodiment. In some embodiments, the data storage and management of data is performed to protect sensitive data, such as medical data, or more particularly dental data.

[0020] The system 100 includes one or more peers, which operate one or more devices including one or more producer devices 102a-102b, backup devices 104, proxy devices 106, and storage devices 108 to generate, access, manage, and store data of one or more structured data entities. The one or more peers can be divided into two general types of peers: peers with user-oriented applications that can read and write data in the system 100, such as one or more producer devices 102a-102b and backup devices 104, and background peers that store and transmit data but do not have data read or write permissions, such as backup devices 104, proxy devices 106, and storage devices 108. User-oriented peers can run in the context of a specific user, such as a registered user. Background peers can be set up without a specific user, and, for example, due to encryption, will not understand and cannot read most of the data passed through them. Both user-facing peers and backend peers can access the complete data history (e.g., data size) of one or more structured data entities, but not all peers can access the actual underlying data, as will be described in more detail below. Figure 1 5 discusses peer types in more detail. Although producer devices 102a-102b, a single backup device 104, and a single proxy device 106 are Figure 1 100, but it will be appreciated that any number of producer devices 102, backup devices 104, and proxy devices 106 may be part of the system 100, including zero, one, or more than one.

[0021] The one or more producer devices 102a-102b may be a server, desktop computer, notebook, laptop computer, tablet computer, handheld device, smart phone, thin client, or any other electronic device or computing system capable of generating, storing, compiling, organizing, and / or displaying audio, visual, and / or textual data and receiving and sending such data from other computing devices, such as backup device 104, proxy device 106, and / or storage device 108. For example, the one or more producer devices 102a-102b may be any type of electronic device or computing system specifically configured to perform the functions discussed herein, such as Figure 6The computing system 600 is shown. In an embodiment, the producer devices 102a-102b generate data associated with one or more structured data entities, such as a dental patient scan, and transmit the data to the storage device 108. For example, one or more producer devices 102a-102b are devices located in a dental clinic, such as, but not limited to, dental imaging equipment, dental design equipment, etc. For example, the producer device 102a can be an intraoral scanning device, such as but not limited to the TRIOS series intraoral scanners of 3Shape AS or a laboratory dental scanner, such as but not limited to the E series laboratory scanners of 3Shape A / S, or any other intraoral scanner, such as WO 2002 / 16867 "Method and Apparatus for Three-Dimensional Optical Scanning of Interior Surfaces" filed on August 24, 2001, WO 2010 / 048960 A1 "Scanner with Feedback Control" filed on October 28, 2009, WO 2012 / 083967 A1 "Optical System in 3D Focus Scanner" filed on December 21, 2011, WO 2013 / 083967 A1 "Optical System in 3D Focus Scanner" filed on March 19, 2018, 2018 / 172257 “3D Scanner System with Handheld Scanner”, U.S. Patent No. 11,076,146 filed on March 19, 2021 “Focus Scanning Apparatus”, which are incorporated herein by reference in their entirety. Reference Figure 2 An example producer device 102a is discussed in more detail. Furthermore, although two producer devices 102a-102b are illustrated, it is to be understood that any number of producer devices 102 may be part of the system 100, including less than two or more than two producer devices. Furthermore, the producer devices 102a-102b may be located in one or more physical locations. For example, producer device 102a may be a dental imaging device, such as an intraoral scanner, located in a first room of a dental clinic, and producer device 102b may be a dental design device, such as a computing device used by a user to design a crown, located in a second room of a dental clinic or a separate remote office, and producer device 102c (not illustrated) may be a computing device located at a producer, such as a crown producer, etc.

[0022] The backup device 104 may be a server, desktop computer, notebook, laptop computer, tablet computer, handheld device, smart phone, thin client, USB drive, or any other electronic device or computing system capable of storing, compiling, organizing, and / or displaying audio, visual, and / or textual data and receiving and sending such data from other computing devices, such as one or more producer devices 102a-102b, proxy device 106, and / or storage device 108. For example, the backup device 104 may be any type of electronic device or computing system specifically configured to perform the functions as discussed herein, such as Figure 6 1. The computing system 600 shown. In one embodiment, the backup peer 104 can store data associated with a structured data entity that has been deleted from the system 100 for a specified period of time after the structured data entity has been deleted, so that the deleted structured data entity can be restored in the system 100. Although only a single backup device 104 is illustrated, it is understood that any number of backup devices 104 can be part of the system 100. For example, if the producer devices 102a-102b are located in multiple physical locations, there may be one backup device 104 at each physical location, or a single location may contain more than one backup device 104. In addition, the backup device 104 can be a temporary device in the system 100. For example, the backup device 104 can be a USB drive that is only part of the system 100 when the USB drive is inserted into another device of the system 100, such as one or more producer devices 102a-102b, the proxy device 106, the storage device 108, etc.

[0023] When a backup server is added to the network, peers on the network will automatically discover the new backup server. This will allow the peers to configure the backup server through some appropriate UI, using, for example, 3DD. The backup server is then configured, and the peers will begin offloading all their data to the backup server. In other words, installing a backup server is as simple as plugging in an internet cable, a power cord, and then configuring it remotely.

[0024] The proxy device 106 is an optional device 106 in the system 100. The proxy device 106 may be a server, desktop computer, notebook, laptop computer, tablet computer, handheld device, smart phone, thin client, or any other electronic device or computing system capable of storing, compiling, organizing, and / or displaying audio, video, and / or text data and receiving and sending such data from other computing devices, such as one or more of the production devices 102a-102b, the backup device 104, and / or the storage device 108. For example, the proxy device 106 may be any type of electronic device or computing system specifically configured to perform the functions as discussed herein, such as Figure 6 The computing system 600 shown. In an exemplary embodiment, the proxy device 106 is a temporary storage device that acts as an intermediary between one or more producer devices 102a-102b, the backup device 104, and the storage device 108. For example, one or more producer devices 102a-102b may be located in a dental clinic, and the proxy device 104 may act as an intermediary between the producer devices 102a-102b and a communication network (e.g., the Internet). In the system 100, the proxy device 106 unloads data from the producer devices 102a-102b and transmits the data to the storage device 108 so that the producer devices 102a-102b can be offline, moved, or turned off. The proxy device 106 can also be a cache of data retrieved by the producer devices 102a-102b in the system 100, so that the producer devices 102a-102b can retrieve data from the storage device 108 once through the proxy device 106 without having to communicate with the storage device 108 in subsequent retrievals of the same data. The proxy device 106 reduces the number of connections in the system 100 so that each producer device 102 does not need to connect to the storage device 108 or each of the other producer devices 102 .

[0025] The storage device 108 includes a database 110. The storage device 108 may be deployed on one or more nodes, such as a storage or memory node in a cloud storage system, or one or more nodes with processing capabilities, such as a server computer, desktop computer, notebook computer, laptop computer, tablet computer, handheld device, smart phone, thin client, or any other electronic device or computing system capable of storing, compiling and / or processing data and computer instructions and receiving and sending data from other devices, such as producer devices 102a-102n, backup devices 104, and / or agent devices 106. The storage device 108 may be located in the same or different physical location as one or more of the producer devices 102a-102b, backup devices 104, and / or agent devices 106. For example, if the storage device 108 is a cloud storage device, the storage device 108 will be located in a different physical location than the rest of the system 100, such as in a different state or country, and communicate with the rest of the system 100 via the Internet or any other suitable communication network. Furthermore, although only a single storage device 108 is illustrated, it is to be understood that any number of storage devices 108 may be part of the system 100, and each of the storage devices 108 may be located in a different physical location. For example, the system 100 may include two storage devices 108, a first storage device 108 located in the same physical location as the producer devices 102a-102b, such as in a dental office, and a second storage device 108 located in a physical location remote from the producer devices 102a-102b. In embodiments with more than one storage device 108, each of the storage devices 108 may store the entire database 110, or each of the storage devices 108 may store a different portion of the database 110.

[0026] Database 110 may be any suitable storage configuration, such as, but not limited to, a relational database, a structured query language (SQL) database, a distributed database, an object database, a file storage database, a blob storage database, etc. In addition, storage device 108 may be a cloud storage device and / or system. Suitable configurations and storage types will be apparent to those skilled in the relevant art. In an example embodiment, the devices of system 100 do not store a complete copy of database 110, but rather each device in system 100 may access a copy of a data abstraction of database 110, such as a copy of data abstraction 208, which will be referred to below. Figure 21 and 1 , discussed in more detail. The database 110 includes structured data entities 112. Although only a single structured data entity 112 is illustrated, it is understood that any number of structured data entities 112 may be part of the database 110. The database 110 includes the complete history and content of each structured data entity 112. Each structured data entity 112 includes the history and content associated with a data file. For example, the structured data entity 112 may be, but is not limited to, a dental scan from an intraoral imaging device, a designed crown, a set of settings, etc. Each structured data entity 112 includes at least three pairs of nodes forming a directed acyclic graph (DAG).

[0027] Since the content of the stored and replicated data is opaque to the system itself, applications using the system need to search for specific entities. The system can provide a "projection" mechanism to search for those projections. Projection is accomplished by user-supplied code (e.g., control software) that is called or otherwise activated by the system. The data used for searching is stored in an unencrypted (or partially unencrypted) manner to allow the database to be searched. However, the database itself must be encrypted at rest so that the data cannot be leaked or accessed in an unauthorized manner. Some embodiments can reduce this by "attaching" a user-specific database containing the projection data for this particular user.

[0028] When the user system can access and decrypt the data, the user system supplies one or more custom projections that allow the user to extract the data they need to index in the form they deem most appropriate. These projections may be limited to entities that the user system understands and can deserialize.

[0029] It should be understood that embodiments of the present invention separate the knowledge of data from the data itself. Therefore, it is possible to create projections and searchable data by partial traversal and transfer of the DAG. The result is that blobs / data not needed for the projection are not transferred. This means that an entity can be projected and made searchable without having to transfer all the blobs contained in the entity.

[0030] The first node pair includes a first transfer header node and a commit node. The first transfer header node includes, but is not limited to, a blob reference to a paired commit node. The first node may also include an entity identifier of the structured data entity 112, such as an alphanumeric string unique to the structured data entity 112. The blob reference to the paired commit node includes, but is not limited to, the size of the paired commit node (e.g., in bytes), the node height of the paired commit node, and the hash of the paired commit node. The first transfer header node may also have a second blob reference, which includes, but is not limited to, the size (e.g., in bytes), node height, and hash of one or more other transfer header nodes referenced by the paired commit node. The commit node includes, but is not limited to, for example, a unique identifier referenced by the author, a digital signature (e.g., a digital signature of the author generated using the private key of the encryption key pair), a timestamp (e.g., the date and / or time when the commit node was created), identification of one or more parent commit nodes (e.g., commit nodes created after the current commit node), a root relationship node identification, an associated data format version number (e.g., an associated data format version number of data stored in the encryption data node of the third node pair), and an encryption data key, such as the encryption data key described below with reference to Figure 3B Describes the key used for the relationship node. Figure 3A , an example first node pair 302 including an entity identifier 303, a first transfer header node 304, and a commit node 306 is illustrated. The first transfer header node 304 includes a commit node blob reference 308, which indicates that the paired node is 40kb in size and has a hash of "XJHS324IUB343IB", such as the commit node 306. The system 100 can use any suitable hashing algorithm to encrypt and generate a hash of data, such as the commit node 306. The first transfer header node 304 also includes a blob reference 310, which identifies two nodes of the structured data entity 112 referenced by the submission node 306 (such as other transfer header nodes, parent submission nodes, etc.). The blob reference 310 indicates that the first related transfer header node is 50kb in size, has a node height of 4 and a hash of "BHSYE2432NBS352", and the second related transfer header node is 50kb in size, has a node height of 3 and a hash of "NMLOYT275PL2304". The submission node 306 includes a digital signature, which is generated by, for example, a private key of an encryption key pair associated with the author, a timestamp of 10:45 am Eastern Time on February 1, 2022, an indication of no parent submission node, such as a value of "0", an associated data version number "6.0", and a data key "0x1 6D2B2D". The data key of the submission node is a relationship node key, for example, as described below with reference to Figure 3BThe hash of the relationship node described is symmetrically encrypted with an entity read key specific to the structured data entity 112. Therefore, the data key protects all second node pairs and third node pairs from read access by users without the entity read key. Figure 3A Only a single first node pair is illustrated in FIG. 1 , but it is understood that the structured data entity 112 may have multiple first node pairs, such as multiple first transmission header nodes and multiple submission nodes, as described below with reference to FIG. Figure 4 discussed in more detail.

[0031] The second node pair includes a second transmission header node and an encrypted relationship node. The relationship node is encrypted with a symmetric key generated by hashing the relationship node. The second transmission header node includes, but is not limited to, a blob reference of the paired relationship node. The blob reference of the paired relationship node includes, but is not limited to, the size of the paired relationship node, for example, in bytes, and the hash of the paired relationship node. The second transmission header node may also have a second blob reference, which includes, but is not limited to, the size, for example, in bytes, the node height, and the hash of one or more other transmission relationship nodes referenced by the associated relationship node. The relationship node includes, but is not limited to, summary information of the data contained in the encrypted data node, and a data decryption key for the encrypted data node. The data decryption key is a symmetric key for encrypting and decrypting the data node of the structured data entity 112. The summary information of the data contained in the encrypted data node includes, but is not limited to, data relationship type, data format version, index in the header, and data relationship key, etc. Data relationship types include, but are not limited to, entity identification relationships, relationship references, submission / entity relationships, and binary relationships. An entity identification relationship is a relationship between an encrypted data node and another structured data entity 112, such as another structured data entity 112 stored in the database 110. For example, but not limited to, an entity identification relationship, an alphanumeric entity identification of another structured data entity 112 in the system 100. The entity identification relationship is a system-wide unique identifier because it identifies another structured data entity 112 in the database 110. A relationship reference is a reference to another encrypted data node of the structured data entity 112 and contains a data decryption key for the encrypted data node. A commit / entity relationship is a reference to a commit node pointing to another structured data entity 112 stored in the database 110 and contains a data decryption key associated with the top-level relationship header of the commit node. A binary relationship is a direct reference to an encrypted data node. In Figure 3BAn example second node pair 320 including a transfer header 322 and an encrypted relationship node 324 is illustrated in . The second transfer header node 322 includes a blob reference 326, which indicates that the paired relationship node, such as the relationship node 324, is 40kb in size and has a hash of "BHSTENDFL8356CBW". The system 100 can use any suitable hashing algorithm to encrypt and generate hashes of data, such as the relationship node 324. The transfer header node 324 also includes a blob reference 328 that identifies a node of the structured data entity 112 referenced by the relationship node 324 (e.g., another relationship node). The blob reference 328 indicates that the first related transfer header is 230kb in size, has a node height of 2, and has a hash of "MDIRTSN9346JBND", and the second related transfer header node is 240kb in size, has a node height of 2, and has a hash of "JMRDYT458PK2568". The relationship node 324 contains the data decryption key used to encrypt the data node data, the data relationship type (eg, an alphanumeric description of the relationship type), the data format version number 6, and the data relationship key.

[0032] The third node pair includes a third transmission header node and an encryption data node. Figure 3B As described, the data node is encrypted with the data encryption key contained in the associated relationship node. The data decryption key is a symmetric key generated by hashing the data node. The third transmission header node includes, but is not limited to, a blob reference of the associated data node. The blob reference of the associated data node includes, but is not limited to, the size of the paired data node, for example in bytes, and the hash of the paired data node. The third transmission header node may also have a second blob reference, including, but not limited to, the size (for example in bytes), node height, and hash of one or more other transmission header nodes referenced by the associated data node. The data node contains encrypted data of the associated structured data entity 112. For example, the encrypted data may be a crown design file. Figure 3CAn example third node pair 330 including a third transfer header 332, an encrypted data node 334, and a data file 336 is illustrated in FIG. The third transfer header 332 includes a blob reference 338 indicating that the associated node, such as data node 334, is 40kb in size and has a hash of “LPHSDJE492LK03D”. The system 100 may use any suitable hashing algorithm to encrypt and generate data hashes. The transfer header 332 also includes a blob reference 340 that identifies one other transfer header referenced by the data node 334. The blob reference 340 indicates that the associated data node is 280kb in size, has a height of 1, and has a hash of “GHASBDRE0174BHS”. The data node 334 includes, but is not limited to, a data decryption key used to encrypt the data node data, a data relationship type, such as an alphanumeric description of the relationship type, and a data format version number 6, and a data relationship key. The data file 336 is a dental crown design file that has been hashed, and the resulting hash is then used as a symmetric key, such as a data decryption key stored in the relationship node 324 , to encrypt and decrypt the data 336 .

[0033] Although only three node pairs are shown, it is understood that the structured data entity 112 may include any number of node pairs greater than three. Figure 4As shown, the structured data entity 112 may include two first node pairs, such as a first transfer header 402 and a commit node 404 and a first transfer header 406 and a commit node 408. As shown by line 410, the first transfer header 402 may point to the first transfer header 406 in the blob reference of the commit node 404. The blob reference of the first transfer header 402 may also point to a second transfer header 412 paired with a relationship node 414, as shown by line 411. The blob reference of the second transfer node 412 may in turn point to a third transfer header 416 paired with a data node 418, as shown by line 413. The blob reference of the second transfer node 412 may also point to a second transfer header 420 paired with a relationship node 422, as shown by line 415. The blob reference of the second transfer header 420 may point to a third transfer header 424 paired with a data node 428, as shown by line 417, and to a third transfer header 426 paired with a relationship node 430, as shown by line 419. The blob reference of the third transfer header 426 may also point to a third transfer header 432 paired with a data node 434, as shown by line 421. Returning to the first transfer header 406, the hash of the blob reference of the first transfer header 406 may point to a second transfer header 436 paired with a relationship node 438, as shown by line 423. The hash of the blob reference of the second transfer header 436 may point to a third transfer header 440 paired with a data node 442, as shown by line 425. The above connections between pairs of nodes of structured data entity 112, such as lines 410, 411, 413, 415, 417, 419, 421, 423, and 425, illustrate two commit nodes pointing to complete versions of a data set, such as commit nodes 402 and 406), for example, each commit node pointing to the history of a single data file. However, a blob reference of a second transfer header node paired with an encrypted relationship node can point to one or more related third transfer header nodes paired with an encrypted data node. For example, a blob reference of second transfer header 412 can point to third transfer header 440, as shown by line 423. In this example, when the second transmission header, such as second transmission header 412, points to a third transmission header, such as third transmission header 440, originating from a different submission node (e.g., submission node 408 vs. submission node 404), it means that the associated encrypted data, such as data node 442, has been modified in some way when both relationship nodes 414 and 438 were created, such as two users updating the data of data node 442 at the same time. It can be understood that, if Figure 4All nodes of the illustrated structured data entity 112 form a directed acyclic graph (DAG), i.e., the nodes of the structured data entity 112 have a linear ordering that never forms a closed loop. Furthermore, although a single structured data entity 112 is illustrated, two or more structured data entities may reference each other, and the data of each referenced structured data entity will be automatically available in the same manner as the content of the referencing structured data entity itself. In the system 100, the same data is reused across multiple submission nodes and structured data entities so that the system 100 does not store or transmit the same data more than once.

[0034] The transfer header node of the structured data entity 112 links together the data history associated with the structured data entity 112, making it more efficient to transfer, index, and view data. For example, the root data (e.g., the first data node) is usually small, such as a json or .xml file, and larger data based on this data, such as a 3D model, is linked from this data. This means that to populate an index or projection, such as a blob reference of the transfer header node, it is sufficient for a search to retrieve only the root data.

[0035] Reference again Figure 1 , the producer devices 102a-102b, the backup device 104, the proxy device 106, and the storage device 108 can communicate using any network suitable for performing the functions disclosed herein, and can include a local area network (LAN), a wide area network (WAN), a wireless network (e.g., WiFi), a personal area network (PAN) (e.g., Bluetooth), a near field communication (NFC) network, a mobile communication network, a satellite network, the Internet, optical fiber, coaxial cable, other hard-wired networks, infrared, radio frequency (RF), or any combination of the foregoing. Other suitable network types and configurations will be apparent to those skilled in the relevant art. In general, the network can be any combination of connections and protocols that support communication between the producer devices 102a-102b, the backup device 104, the proxy device 106, and the storage device 108. In some embodiments, the network can be optional based on the configuration of the producer devices 102a-102b, the backup device 104, the proxy device 106, and the storage device 108.

[0036] In some embodiments, the optimization is to choose to split larger files into smaller blobs, which can be called "chunking". To chunk large files, the system can divide the large file into smaller chunks that are stored and encrypted independently. There may be many reasons for doing this, such as to avoid potential limitations in the underlying storage system, better support recovery of large blobs, reduce client memory requirements, and allow streaming of incomplete data.

[0037] In order to reduce the data stored in the system, it is possible to reduce the number of blobs in the DAG without losing any generality or expressiveness. The system can reduce the number of blobs while keeping functionality intact. The goal is to store and send less data, which improves the performance and reliability of the system (because fewer blobs can be lost).

[0038] To reduce the number of blobs transferred (since performance depends not only on the amount of data but also on the number of blobs), the system may allow data to be embedded directly in the transfer header in some (or all) cases.

[0039] The network mapping allows an application to get a set of all directly and indirectly connected peers, as well as some information about each peer. This information may contain connection information, peer name, peer type, untyped errors, and / or information about the peer's application name and version. A relevant function may be OnPremisePeer.NetworkMapping.AllPeersAsync(). It is recommended that each application call OnPremisePeer.SetApplicationNameAndVersion(string) with a meaningful application name and version (e.g. Dental Desktop Server 1.18.0.01.18.0.0) at startup. It should be noted that there may be some delay before a value is set on one peer and the result is visible on another peer. Peer type, connection status, and untyped errors (e.g. in OtherStatuses) are intended for machine consumption - the latter are good candidates for displaying verbiage to the user.

[0040] Producer device 102a

[0041] Figure 2 An embodiment of a producer device 102a in the system 100 is illustrated. It will be apparent to those skilled in the relevant art that Figure 2 The embodiment of the producer device 102a illustrated in the FIGURE is provided for illustration only and may not be exhaustive of all possible configurations of the producer device 102a suitable for performing the functions discussed herein. For example, Figure 6 The computer system 600 illustrated in FIG. 1 and discussed in more detail below may be a suitable configuration for the producer device 102. In an exemplary embodiment, the producer device 102 in the system 100 generates at least a portion of the dental data or other medical data that is protected and accessed by the system 100.

[0042] The producer device 102a may include a receiving device 202. The receiving device 202 may be configured to receive data through one or more networks via one or more network protocols. In some instances, the receiving device 202 may be configured to receive data from the producer device 102b, the backup device 104, the proxy device 106, the storage device 108, and other systems and entities via one or more communication methods, such as radio frequency, a local area network, a wireless local area network, a cellular communication network, Bluetooth, the Internet, etc. In some embodiments, the receiving device 202 may include multiple devices, such as different receiving devices for receiving data via different networks, such as a first receiving device for receiving data via a local area network and a second receiving device for receiving data via the Internet. The receiving device 202 may receive an electronically transmitted data signal, wherein the data may be superimposed or otherwise encoded on the data signal, and is decoded, parsed, read, or otherwise obtained by receiving the data signal by the receiving device 202. In some instances, the receiving device 202 may include a parsing module for parsing the received data signal to obtain the data superimposed thereon. For example, receiving device 202 may include a parser program configured to receive data signals and convert the received data signals into usable inputs for functions executed by a processing device to implement the methods and systems described herein.

[0043] The receiving device 202 may be configured to receive a data signal electronically transmitted by the producer device 102b, the backup device 104, the proxy device 106, the storage device 108, which may be superimposed or otherwise encoded with a structured data entity, such as the structured data entity 112 or a data abstraction of the structured data entity, etc. The receiving device 202 may also be configured to receive a data signal electronically transmitted by the producer device 102b, the backup device 104, the proxy device 106, the storage device 108, which may be superimposed or otherwise encoded with a data request, an entity key request, a user access key request, etc.

[0044] The producer device 102a may also include a communication module 204. The communication module 204 may be configured to transmit data between modules, engines, databases, memories and other components of the producer device 102a for performing functions as discussed herein. The communication module 204 may include one or more communication types and communicate within the computing device using various communication methods. For example, the communication module 204 may include a bus, a contact pin connector, wires, etc. In some embodiments, the communication module 204 may also be configured to communicate between internal components of the producer device 102a and external components of the producer device 102a, such as externally connected databases, display devices, input devices, etc. The producer device 102a may also include a processing server. As is apparent to those skilled in the relevant art, the processing device may be configured to perform the functions of the producer device 102a discussed herein. In some embodiments, the processing server may include and / or include multiple engines and / or modules specifically configured to perform one or more functions of the producer device 102a, such as a query module 214, a generation module 216, a verification module 218, etc. As used herein, the term "module" may be software or hardware that is specifically programmed to receive input, perform one or more processes using the input, and provide output. Based on this disclosure, the input, output, and processing performed by the various modules will be apparent to those skilled in the art.

[0045] The producer device 102a may also include a memory 206. The memory 206 may be configured to store data, such as public and private keys, symmetric keys, etc., for use by the producer device 102a when performing functions as discussed herein. The memory 206 may be configured to store data using suitable data formatting methods and patterns, and may be any suitable type of memory, such as read-only memory, random access memory, etc.). The memory 206 may include, for example, encryption keys and algorithms, communication protocols and standards, data formatting standards and protocols, program code for modules and applications for processing devices, and other data that may be suitable for use by the producer device 102a when performing functions disclosed herein, as is apparent to a person skilled in the relevant art. In some embodiments, the memory 206 may consist of a relational database that uses a structured query language to store, identify, modify, update, access, etc. a structured data set stored therein, or may otherwise include a relational database that uses a structured query language to store, identify, modify, update, access, etc. a structured data set stored therein. The memory 206 can be configured to store, for example, data abstraction 208 of the database 110, entity keys 210, user access keys 212, communication information of the producer device 102b, the backup device 104, the proxy device 106, the storage device 108, address generation and verification algorithms, digital signature generation and verification algorithms, hash algorithms for generating reference values ​​(such as transfer header node values), rules for generating new nodes in the structured data entity 112, rules for generating new structured data entities in the database 110, rules for access to structured data entities, etc.

[0046] Data abstraction 208 includes the transfer headers of structured data entities of database 110 (e.g., FIG. 3A to FIG. 3C The first transmission header node 304, the second transmission header node 322 and the third transmission header node 332, and / or Figure 4110 ). The data abstraction 208 provides knowledge of the data context of the database 110 (e.g., the unencrypted transfer header nodes of the structured data entity 112) to devices in the system 100 without actually accessing the data. For example, the data abstraction 208 enables devices of the system 100 to traverse the transfer header nodes of the database 110 without the ability to decrypt encrypted portions of the database 110 (e.g., encrypted relationship nodes and encrypted data nodes). The entity key 210 is a decryption key for decrypting data keys stored in one or more commit nodes of the structured data entity 112. For example, the entity key 210 is a public key of an encryption key pair associated with the structured data entity 112. The user access key 212 is associated with one or more users of the devices of the system 100 and permits the associated users to access the one or more entity keys 210. For example, database 110 may contain structured data entities 112a-d, and a user associated with producer device 102a may have an access key 212 that permits the user to access entity keys 210a-b of structured data entities 112a-b, but does not permit the user to access entity keys 210c-d of structured data entities 112c-d. User access key 212 may be a group access key that permits a group of one or more users to access one or more entity keys 210 associated with the user access key 212. For example, users of system 100 may be divided into three groups, and each group would have its own access key 212 that permits each user of the group to access a unique subset of the one or more entity keys 210.

[0047] The processing device 102 may include a query module 214. The query module 214 may be configured to perform a query on a database to identify information. The query module 214 may receive one or more data values ​​or query strings and may execute the query string based on a database indicated thereon, such as the memory 206 of the producer device 102a or the database 110 of the storage device 108, to identify information stored therein. The query module 214 may then output the identified information to an appropriate engine or module of the producer device 102a as needed. The query module 214 may, for example, perform a query on the memory 206 to access the data abstraction 208, the entity key 210, and / or the user access key 212. In addition, the query module 214 may, for example, perform a query on the database 110 for one or more structured data entities 112 and data associated therewith.

[0048] The processing device 102 may also include a generation module 216. The generation module 216 may be configured to generate data for use by the producer device 102a in performing functions as discussed herein. The generation module 216 may receive instructions as input, may generate data based on the instructions, and may output the generated data to one or more modules of the producer device 102a. For example, the generation module 216 may be configured to generate one or more structured data entities 112 and / or update one or more structured data entities 112, including generating one or more transmission header nodes, one or more submission nodes, one or more relationship nodes, and / or one or more data nodes. The nodes of the structured data entity 112 are immutable in themselves, and any update to the structured data entity 112 will result in the generation of new nodes. In addition, the generation module 216 may be configured to generate one or more hashes, such as but not limited to the hashes of the data nodes of the structured data entity 112, the hashes of the relationship nodes, and the hashes of the submission nodes.

[0049] The producer device 102a may also include a verification module 218. The verification module 218 may be configured to perform verification of the producer device 102a as part of the functionality as discussed herein. The verification module 218 may receive instructions as input, which may also include data to be used in performing the verification, may perform the verification upon request, and may output the results of the verification to another module or engine of the producer device 102a. The verification module 218 may, for example, be configured to verify one or more cryptographic signatures and / or one or more hashes contained in the structured data entity 112.

[0050] The producer device 102a may also include a transmission device 220. The transmission device 220 may be configured to transmit data on one or more networks via one or more network protocols. In some instances, the transmission device 220 may be configured to transmit data to the producer device 102b, the backup device 104, the proxy device 106, the storage device 108, and other entities via one or more communication methods, a local area network, a wireless local area network, a cellular communication, Bluetooth, radio frequency, the Internet, etc. In some embodiments, the transmission device 220 may include multiple devices, such as different transmission devices for transmitting data on different networks, such as a first transmission device for transmitting data on a local area network and a second transmission device for transmitting data via the Internet. The transmission device 220 may electronically transmit a data signal superimposed with data that can be parsed by a receiving computing device. In some instances, the transmission device 220 may include one or more modules for superimposing, encoding, or otherwise formatting data into a data signal suitable for transmission.

[0051] The transmission device 220 is configured to electronically transmit a data signal to the producer device 102b, the backup device 104, the proxy device 106, and the storage device 108, the data signal being superimposed or otherwise encoded with a request for data stored in the database 110, such as an encrypted data node of the structured data entity 112. The transmission device 220 may also be configured to electronically transmit a data signal to the producer device 102b, the backup device 104, the proxy device 106, the storage device 108, the data signal being superimposed or otherwise encoded with a new structured data entity generated by the producer device 102a, an updated structured data entity 112, etc.

[0052] Exemplary methods for distributed storage and management of data

[0053] FIG. 5 illustrates a method 500 for distributed storage and management of data according to an exemplary embodiment.

[0054] Method 500 may include a block 502 of storing, by a computing device in a network (e.g., one of producer devices 102a-102b), a data abstraction (e.g., data abstraction 208) interfaced with a database (e.g., database 110). The data abstraction stores one or more structured data entities (e.g., structured data entity 112). Each of the one or more structured data entities includes at least three node pairs. A first node pair includes a first transfer header node (e.g., first transfer header node 304) paired with a commit node (e.g., commit node 306). The first transfer header includes at least a blob reference of the commit node (e.g., a blob reference of the commit node 308). The first transfer header includes, but is not limited to, a hash of the commit node (e.g., commit node 306) and a hash of the second transfer header node (e.g., second transfer header node 322). The commit node includes, but is not limited to, a unique identifier, a digital signature, and a data key. The data key is a relationship node key encrypted with an entity key specific to the associated structured data entity. The second node pair includes a second transfer header node (e.g., second transfer header node 322) paired with an encrypted relationship node (e.g., relationship node 324) encrypted with a relationship node key, such as a symmetric key generated by hashing the relationship node. The second transfer header node includes, but is not limited to, a blob reference 326 of the encrypted relationship node (e.g., relationship node). The second transfer header node includes a hash of the encrypted relationship node, and another blob reference 328 includes a hash of a third transfer header node (e.g., third transfer header node 332). The encrypted relationship node includes, but is not limited to, a summary of the data contained in the encrypted data node and a data decryption key for the encrypted data node. The third node pair includes a third transfer header node (e.g., third transfer header node 332) paired with an encrypted data node (e.g., data node 334) and a data file (e.g., data file 336). The third transfer header node includes a blob reference, which includes, but is not limited to, the size of the encrypted data node and the hash of the encrypted data node (e.g., data node 334). The encrypted data node includes, but is not limited to, encrypted data associated with the associated structured data entity 112, encrypted using a data encryption key. The producer device 102a can be part of a network of devices, such as producer device 102b, backup device 104, proxy device 106, and storage node 108. Each of the devices in the network is typically associated with one or more users, and the one or more users are defined as one or more of the following: a producer peer, a proxy peer, or a backup peer; and / or a storage peer. In addition, each user associated with the device is assigned a user access key and / or is associated with a user access key, such as user access key 212.A user access key grants its associated user permission to access one or more entity keys 210 associated with one or more structured data entities 112. For example, database 110 may contain structured data entities 112a-d, and a user associated with producer device 102a may have an access key 212 that grants the user access to entity keys 210a-b of structured data entities 112a-b, but does not grant the user access to entity keys 210c-d of structured data entities 112c-d. User access keys 212 may be group access keys that grant a group of one or more users access to one or more entity keys 210 associated with the user access keys 212. For example, users of system 100 may be divided into three groups, and each group would have its own access key 212 that grants each user of the group access to a unique subset of the one or more entity keys 210. In this manner, all users of the system 100 are aware of the data (e.g., structured data entities 112) stored in the database 110, e.g., the users know that the data is there based on the unencrypted transmission headers (e.g., data abstractions 208) of the structured data entities 112. However, only users with user access keys that grant them permission to the one or more entity keys can actually access the data stored in one or more structured data entities 112. In addition, by providing all devices in the system 100 with data abstractions 208, such as one or more transmission headers of the structured data entities 112, which have a much smaller storage size than the entire database 110, the arrangement of the system 100 allows for more efficient access to stored data (e.g., database 110). Therefore, in the system 100, each device (e.g., producer devices 102a-102b, backup devices, and proxy devices 106) does not need to store the entire database 110 or request all data stored in the database 110 in order to understand what data is stored in the database 110, but can use the data abstraction to find exactly what data they need and only that data. In an example embodiment, the producer devices 102a-102b are dental devices that generate medical data, such as dental data, and the storage device 108 is a medical office storage device, such as a dental office storage device.

[0055] The method 500 may include box 504 in which a computing device (e.g., one of the producer devices 102a-102b) transmits a request for a first transmit header node (e.g., the first transmit header node 304) and a paired commit node (e.g., the commit node 306) for a particular structured data entity (e.g., the structured data entity 112) among one or more structured data entities.

[0056] The method 500 may include block 506 of receiving, by a computing device, a first transmit header node and a paired commit node for a particular structured data entity (eg, the structured data entity 112 ).

[0057] The method 500 may include a block 508 of storing, by a computing device (e.g., one of the producer devices 102a-102b), a user access key (e.g., the user access key 212) in a memory (e.g., the memory 206) of the computing device. Although the user access key is illustrated as being stored within the computing device, it is understood that the user access key may be stored in a separate computing device, such as the storage device 108 or another access management computing device. The user access key grants, for example, a user of the producer device 102a, permission to access one or more of the plurality of entity keys. Each of the plurality of entity keys is associated with a structured data entity (e.g., the structured data entity 112) of the one or more structured data entities.

[0058] The method 500 may include block 510 of identifying, by a computing device (e.g., one of the producer devices 102a-102b), a particular entity key (e.g., entity key 210) of one or more entity keys associated with a particular structured data entity (e.g., structured data entity 112). For example, a user of the computing device (e.g., one of the producer devices 102a-102b) may be associated with entity key 212a, which permits access to entity key 210a, but does not permit access to any other entity keys 210, such as entity keys 210b-n.

[0059] The method 500 may include block 512 of decrypting, by a computing device (eg, one of the producer devices 102a-102b), the data key using a particular entity key (eg, the entity key 210).

[0060] Method 500 may include box 514 in which a computing device (e.g., one of producer devices 102a-102b) identifies a second transfer header node (e.g., second transfer header node 322) and a paired encryption relationship node (e.g., relationship node 324) based on a submission node blob reference (e.g., submission node 308) of a received submission node (e.g., submission node 306).

[0061] Method 500 may include box 516 in which a computing device (e.g., one of producer devices 102a-102b) decrypts an encrypted relationship node (e.g., relationship node 324) using a relationship node key of a decrypted data key, and box 518 in which the computing device identifies a third transmission header node (e.g., third transmission header node 332) and a paired encrypted data node (e.g., data node 334) based on the encrypted relationship node.

[0062] The method 500 may include block 520, which is a process of decrypting the encrypted data node (e.g., data node 334) by a computing device (e.g., one of the producer devices 102a-102b) using a data decryption key for decrypting a relationship node (e.g., relationship node 324) and an entity key (e.g., entity key 210) specific to an associated structured data entity (e.g., structured data entity 112). The method 500 may proceed from block 520 to block 522 and / or block 538. In blocks 522 to 536, the computing device (e.g., one of the producer devices 102a-102b) generates a data update to the data stored in the existing structured data entity (e.g., structured data entity 112). In block 538, the computing device (e.g., one of the producer devices 102a-102b) generates a new structured data entity to be added to the database 110.

[0063] The method 500 may include block 522, which is a data update of encrypted data of a particular encrypted data node of a particular structured data entity of one or more structured data entities 112 generated by a computing device (e.g., one of the producer devices 102a-102b). The nodes of the structured data entity 112 are immutable, and thus any update to the data associated with the structured data entity results in a new node. At block 324, the computing device may generate a new third transmission header node paired with the new data node, the new third transmission header node including at least the size of the new data node and a hash of the new data node.

[0064] The method 500 may include block 526 of generating, by a computing device (eg, one of the producer devices 102a-102b), a new data decryption key generated by hashing the new data node.

[0065] The method 500 may include block 527 of encrypting, by a computing device (eg, one of the producer devices 102a-102b), the new data node with a new data encryption key.

[0066] The method 500 may include block 528, which is generating, by a computing device (e.g., one of the producer devices 102a-102b) based on the new third transmission header node and the new data node, a new second transmission header and a new relationship node pair. One or more blob references of the new relationship node include at least a hash of the new third transmission header node and a hash of the new relationship node, and the new relationship node includes a summary of the data update encrypted in the new data node and a new data decryption key.

[0067] The method 500 may include block 530 of generating, by a computing device (eg, one of the producer devices 102a-102b), a new relationship node key. The new relationship node key is generated by hashing the new relationship node.

[0068] The method 500 may include block 532 of encrypting, by a computing device (eg, one of the producer devices 102a-102b), a new relationship node with a new relationship node key.

[0069] The method 500 may include block 534, which is generating, by a computing device (e.g., one of the producer devices 102a-102b), a new first transfer header node and a new commit node pair based on the data update, wherein one or more blob references of the commit node in the new first transfer header node contain at least a hash of at least one previously generated commit node (e.g., commit node 306) of the associated structured data entity (e.g., structured data entity 112). The new commit node contains a new data key, which is a new relationship node key encrypted with the entity key of the specific structured data entity.

[0070] The method 500 may include block 536, which is transmitting, by a computing device (e.g., one of the producer devices 102a-102b), a new commit node of a particular structured data entity in the one or more structured data entities to one or more second computing devices (e.g., the storage device 108) in the network. The storage device 108 adds the new commit node to the database 110.

[0071] The method 500 may include a block 538, which is a new structured data entity data generated by a computing device (e.g., one of the producer devices 102a-102b) to be added to a database (e.g., database 110). The new structured data entity may include data identifying an existing structured data entity (e.g., structured data entity 112), with which the new structured data entity is to be associated. The new structured data entity includes at least a new first transmission header node and a new submission node pair, a new second transmission header node and a new encryption relationship node pair, and a new third transmission header node and a new encryption data node pair. Generating the new structured data entity includes linking the new structured data entity with the existing structured data entity (e.g., structured data entity 112) by the computing device (e.g., one of the producer devices 102a-102b). In addition, linking the new structured data entity with the existing structured data entity includes inserting a hash of the encryption relationship node (e.g., encryption relationship node 324) of the existing structured data entity into the blob reference of the new first transmission header node. Generating the new structured data entity further includes transmitting the new structured data entity by a computing device (eg, one of producer devices 102a-102b) to one or more second computing devices (eg, backup device 104, proxy device 106, and / or storage device 108) in the network.

[0072] Softlocks can provide a mechanism to improve collaboration in distributed systems by allowing applications to express that certain workflows or data sets are being used. This enables applications to prevent multiple users from working on the same data at the same time. There is no built-in link between entities and softlocks, instead it is entirely up to the application to decide how to interpret softlocks. Softlocks can be propagated in much the same way as entities, which also means that softlocks can only be propagated if there is actually a connection between peers. Unconnected peers will not be able to see locks belonging to the other party. They will instead be able to make concurrent changes to the data (usually entities) protected by the lock.

[0073] Computer system architecture

[0074] Figure 6 A computer system 600 is illustrated in which an embodiment of the present disclosure or a portion thereof can be implemented as computer readable code. For example, Figure 1 The producer devices 102a-102b, backup devices 104, proxy devices 106, and / or storage devices 108 may be implemented in the computer system 600 using hardware, software, firmware, a non-transitory computer-readable medium having instructions stored thereon, or a combination thereof, and may be implemented in one or more computer systems or other processing systems. Hardware, software, or any combination thereof may implement the modules and components for implementing the method of FIG. 5 .

[0075] If programmable logic is used, such logic can be executed on a commercially available processing platform configured by executable software code to become a special-purpose computer or special-purpose device (e.g., a programmable logic array, an application-specific integrated circuit, etc.). It will be appreciated by those of ordinary skill in the art that embodiments of the disclosed subject matter can be practiced with a variety of computer system configurations, including multi-core multi-processor systems, minicomputers, mainframe computers, computers linked or clustered with distributed functionality, and ubiquitous computers or microcomputers that can be embedded in almost any device. For example, at least one processor device and memory can be used to implement the embodiments described above.

[0076] The processor unit or device as discussed herein may be a single processor, multiple processors, or a combination thereof. A processor device may have one or more processor "cores". The terms "computer program medium", "non-transitory computer readable medium", and "computer usable medium" as discussed herein are generally used to refer to tangible media, such as removable storage unit 618, removable storage unit 622, and a hard disk installed in hard disk drive 612.

[0077] Various embodiments of the present disclosure are described based on this example computer system 600. After reading this specification, it will be apparent to those skilled in the relevant art how to implement the present disclosure using other computer systems and / or computer architectures. Although operations may be described as sequential processes, some of the operations may actually be performed in parallel, concurrently, and / or in a distributed environment, and program code may be stored locally or remotely for access by a single processor or a multi-processor machine. In addition, in some embodiments, the order of operations may be rearranged without departing from the spirit of the disclosed subject matter.

[0078] Processor device 604 can be a special processor device or a general processor device that is specially configured to perform the functions discussed herein. Processor device 604 can be connected to communication infrastructure 606, such as bus, message queue, network, multi-core message delivery scheme, etc. The network can be any network suitable for performing the functions disclosed herein, and can include local area network (LAN), wide area network (WAN), wireless network (e.g., WiFi), mobile communication network, satellite network, Internet, optical fiber, coaxial cable, infrared, radio frequency (RF) or any combination thereof. Other suitable network types and configurations will be apparent to those skilled in the art. Computer system 600 can also include main memory 608 (e.g., random access memory, read-only memory, etc.), and can also include auxiliary memory 610. Auxiliary memory 610 can include hard disk drive 612 and removable storage drive 614, such as floppy disk drive, tape drive, optical disk drive, flash memory, etc.

[0079] Removable storage drive 614 may read from and / or write to removable storage unit 618 in a well-known manner. Removable storage unit 618 may contain a removable storage medium that can be read from and written to by removable storage drive 614. For example, if removable storage drive 614 is a floppy disk drive or a universal serial bus port, removable storage unit 618 may be a floppy disk or a portable flash drive, respectively. In one embodiment, removable storage unit 618 may be a non-transitory computer-readable recording medium.

[0080] In some embodiments, secondary memory 610 may include alternative devices for allowing computer programs or other instructions to be loaded into computer system 600, such as removable storage units 622 and interfaces 620. Examples of such devices may include program cartridges and cartridge interfaces (e.g., as found in electronic gaming systems), removable memory chips (e.g., EEPROM, PROM, etc.) and associated slots, and other removable storage units 622 and interfaces 620 as will be apparent to those skilled in the relevant art.

[0081] Data stored in the computer system 600 (e.g., in the main memory 608 and / or the secondary memory 610) may be stored on any type of suitable computer-readable medium, such as an optical storage device (e.g., a compact disk, a digital versatile disk, a Blu-ray disk, etc.) or a tape storage device (e.g., a hard drive). The data may be configured as any type of suitable database configuration, such as a relational database, a structured query language (SQL) database, a distributed database, an object database, etc. Suitable configurations and storage types will be apparent to those skilled in the relevant art.

[0082] The computer system 600 may also include a communication interface 624. The communication interface 624 may be configured to allow software and data to be communicated between the computer system 600 and external devices. Example communication interfaces 624 may include a modem, a network interface (e.g., an Ethernet card), a communication port, a PCMCIA slot and card, etc. The software and data communicated via the communication interface 624 may be in the form of signals, which may be electronic, electromagnetic, optical, or other signals as will be apparent to those skilled in the relevant art. The signals may be propagated via a communication path 626, which may be configured to carry the signals and may be implemented using wires, cables, optical fibers, telephone lines, cellular telephone links, radio frequency links, etc.

[0083] The computer system 600 may also include a display interface 602. The display interface 602 may be configured to allow data to be transferred between the computer system 600 and an external display 630. Exemplary display interfaces 602 may include a high-definition multimedia interface (HDMI), a digital video interface (DVI), a video graphics array (VGA), etc. The display 630 may be any suitable type of display for displaying data transmitted via the display interface 602 of the computer system 600, including a cathode ray tube (CRT) display, a liquid crystal display (LCD), a light emitting diode (LED) display, a capacitive touch display, a thin film transistor (TFT) display, etc.

[0084] Computer program media and computer usable media may refer to memory, such as main memory 608 and auxiliary memory 610, which may be memory semiconductors (e.g., DRAM, etc.). These computer program products may be devices for providing software to computer system 600. Computer programs (e.g., computer control logic) may be stored in main memory 608 and / or auxiliary memory 610. Computer programs may also be received via communication interface 624. Such computer programs, when executed, may enable computer system 600 to implement the present method as discussed herein. In particular, the computer program, when executed, may enable processor device 604 to implement the process and method shown in FIG. 5, as discussed herein. Therefore, such computer programs may represent the controller of computer system 600. In the case of implementing the present disclosure using software, the software may be stored in a computer program product and loaded into computer system 600 using removable storage drive 614, interface 620 and hard disk drive 612 or communication interface 624.

[0085] The processor device 604 may include one or more modules or engines configured to perform the functions of the computer system 600. Each of the modules or engines may be implemented using hardware, and in some instances, may also be implemented using software, such as corresponding to program code and / or programs stored in the main memory 608 or the auxiliary memory 610. In such instances, the program code may be compiled by the processor device 604 (e.g., by a compilation module or engine) before being executed by the hardware of the computer system 600. For example, the program code may be a source code written in a programming language that is translated into a lower-level language, such as an assembly language or machine code, for execution by the processor device 604 and / or any other hardware component of the computer system 600. The process of compiling may include using lexical analysis, preprocessing, parsing, semantic analysis, grammar-directed translation, code generation, code optimization, and any other technology that may be suitable for translating the program code into a low-level language suitable for controlling the computer system 600 to perform the functions disclosed herein. As will be apparent to one skilled in the relevant art, such a process results in the computer system 600 becoming a specially configured computer system 600 that is uniquely programmed to perform the functions discussed above.

[0086] Technology consistent with the present disclosure provides systems and methods for distributed storage and management of data, as well as other features. Although various exemplary embodiments of the disclosed systems and methods have been described above, it should be understood that they are given only for the purpose of example, not limitation. It is not exhaustive and does not limit the present disclosure to the precise form disclosed. According to the above teachings, modifications and changes are possible or can be obtained from the practice of the present disclosure without departing from the breadth or scope. Although the operation can be described as a sequential process, some of the operations can actually be performed in parallel, concurrently and / or in a distributed environment, and the program code is stored locally or remotely for access by a single processor or a multi-processor machine. In addition, in some embodiments, the order of operations can be rearranged without departing from the spirit of the disclosed subject matter. It will be understood by those skilled in the art that the present disclosure can be implemented in other specific forms without departing from the spirit or basic features of the present disclosure. Therefore, the embodiments disclosed at present are considered to be illustrative and not restrictive in all respects. The scope of the present disclosure is indicated by the appended claims rather than the preceding description, and all changes within its meaning, scope and equivalents are intended to be included therein.

[0087] Project List

[0088] 1. A method for distributed storage and management of data, the method comprising:

[0089] A data abstraction connected to a database interface is stored by a computing device in a network, the data abstraction storing one or more structured data entities, each of the one or more structured data entities comprising at least three node pairs, the at least three node pairs comprising:

[0090] a first transfer header node paired with a commit node, the first transfer header node comprising at least a blob reference of the commit node, one of the blob references of the commit node comprising a hash of the commit node and a size of one of the blob references of the commit node, and a second blob reference of the first transfer header comprising a hash of the second transfer header node and the size of the second blob reference of the first transfer header, the commit node comprising a unique identifier, a digital signature, and a data key, the data key being a relationship node key encrypted with an entity key of an associated structured data entity that is specific to one or more structured data entities;

[0091] the second transfer header node being paired with an encrypted relation node encrypted with a relation node key, the second transfer header comprising at least a blob reference to the encrypted relation node, one of the blob references to the encrypted relation node comprising a hash of the third transfer header node and a size of one of the blob references to the encrypted relation node, and the second blob reference of the second transfer header comprising a hash of the encrypted relation node and a size of the second blob reference of the second transfer header, the encrypted relation node comprising a summary of data contained in the encrypted data node and a data decryption key for the encrypted data node;

[0092] the third transfer header node, which is paired with the encrypted data node and the encrypted data file, the third transfer header node including a blob reference to the data node, the blob reference to the data node including at least a size of the encrypted data node and a hash of the encrypted data node, wherein the encrypted data node includes encrypted data related to an associated structured data entity encrypted using a data encryption key;

[0093] transmitting, by the computing device, a request for a first transfer head node and a paired commit node for a particular structured data entity of the one or more structured data entities; and

[0094] The first transmission header node and the paired submission node of the specific structured data entity are received by the computing device.

[0095] 2. The method according to item 1, comprising:

[0096] storing, by the computing device, a user access key that grants permission to access one or more of a plurality of entity keys, each of the plurality of entity keys being associated with a structured data entity of the one or more structured data entities;

[0097] identifying, by the computing device, a particular entity key among the one or more entity keys associated with the particular structured data entity;

[0098] decrypting the data key using the specific entity key by the computing device;

[0099] The computing device identifies the second transmission header node and the paired encryption relationship node based on the blob reference of the received submission node in the first transmission header node;

[0100] decrypting the encrypted relationship node using the relationship node key of the decrypted data key by the computing device;

[0101] identifying, by the computing device, a third transmission header node and a paired encryption data node based on the encryption relationship node; and

[0102] The computing device uses the data decryption key of the decrypted relationship node to decrypt the encrypted data of the encrypted data node.

[0103] 3. The method of any one of items 1 to 2 above, wherein the network comprises one or more computing devices associated with one or more users, the one or more computing devices being defined as at least one of: a storage peer, a producer peer, a proxy peer, or a backup peer; and

[0104] One or more users form one or more user groups, and each user group is associated with a user access key.

[0105] 4. A method according to any one of the preceding items 1 to 3, wherein the blob reference of the commit node in the first transfer header node includes a hash of the commit node, and the second blob reference in the first transfer header node includes at least one hash of at least one second transfer header node of the associated structured data entity.

[0106] 5. A method according to any one of the preceding items 1 to 4, wherein the encrypted relationship node blob reference in the second transfer header node contains a hash of the relationship node, and the second blob reference in the second transfer header node includes at least one hash of at least one third transfer header node of the associated structured data entity.

[0107] 6. The method according to any one of the preceding items 1 to 5, wherein the database is cloud storage.

[0108] 7. The method according to any one of the preceding items 1 to 6, wherein the network is a distributed network.

[0109] 8. A method according to any one of the preceding items 1 to 7, wherein the encrypted data is medical patient data.

[0110] 9. The method according to any one of the preceding items 1 to 8, wherein the node pairs of each of the one or more structured data entities form a directed acyclic graph.

[0111] 10. The method according to any one of the preceding items 1 to 9, comprising:

[0112] generating, by the computing device, a data update of encrypted data of a particular encrypted data node of a particular structured data entity of the one or more structured data entities;

[0113] Generate, by the computing device, a new third transmission header node paired with the new data node, the new third transmission header node including at least the size of the new data node and a blob reference of the new data node;

[0114] generating, by the computing device, a new data decryption key, the new data decryption key being generated by hashing the new data node;

[0115] Encrypting the new data node with the new data encryption key by the computing device;

[0116] The computing device generates a new second transmission header and a new relationship node pair based on the new third transmission header node and the new data node, wherein one or more blob references of the new relationship node include at least a hash of the new third transmission header node and a hash of the new relationship node, and the new relationship node includes a summary of the data update encrypted in the new data node and a new data decryption key;

[0117] generating, by the computing device, a new relationship node key, the new relationship node key being generated by hashing the new relationship node;

[0118] A new relationship node encrypted by the computing device using a new relationship node key;

[0119] generating, by the computing device, a new first transfer header node and a new commit node pair based on the data update, wherein one or more blob references of the commit node in the new first transfer header node contain at least a hash of at least one previously generated commit node of the associated structured data entity, and the new commit node contains a new data key, the new data key being a new relationship node key encrypted with an entity key of the specific structured data entity; and

[0120] The new first transmission header and submission node pair of a particular structured data entity of the one or more structured data entities is transmitted by the computing device to one or more second computing devices in the network.

[0121] 11. The method according to any one of the preceding items 1 to 10, comprising:

[0122] Generate, by a computing device, new structured data entity data to be added to a database, the new structured data entity comprising data identifying an existing structured data entity among the one or more structured data entities, the new structured data entity to be associated with the existing structured data entity, wherein the generating of the new structured data entity comprises:

[0123] Generate, by a computing device in the network, a new first transmission header node and a new submission node pair, a new second transmission header node and a new encryption relationship node pair, and a new third transmission header node and a new encryption data node pair;

[0124] linking, by the computing device, the new structured data entity with the existing structured data entity;

[0125] as well as

[0126] The new structured data entity is transmitted by the computing device to one or more second computing devices in the network.

[0127] 12. The method according to any one of the preceding items 1 to 11, wherein the new submission node contains a unique identifier of the existing structured data entity; and

[0128] The link includes:

[0129] Insert the hash of the encrypted relationship node of the existing structured data entity into the blob reference of the new first transfer header node.

[0130] 13. The method according to any one of the preceding items 1 to 12, wherein each of the one or more structured data entities is associated with a dental patient.

[0131] 14. A method according to any of the preceding items 1 to 13, wherein the storage peer is associated with a dental clinic and the producer peer is a computing device that generates dental data.

[0132] 15. A method according to any one of the aforementioned items 1 to 14, wherein the encrypted data of the one or more structured data entities is encrypted and stored in a database, so that users of the database are allowed to read only the transmission header node and the submission node of the node pair without the need for one or more decryption keys.

[0133] 16. A system for distributed storage and management of data, the system comprising:

[0134] A memory of a processor in a network, configured to:

[0135] A data abstraction connected to a database interface is stored, the data abstraction storing one or more structured data entities, each of the one or more structured data entities comprising at least three node pairs, the at least three node pairs comprising:

[0136] a first transfer header node paired with a commit node, the first transfer header node comprising at least a blob reference of the commit node, one of the blob references of the commit node comprising a hash of the commit node and a size of one of the blob references of the commit node, and a second blob reference of the first transfer header comprising a hash of the second transfer header node and the size of the second blob reference of the first transfer header, the commit node comprising a unique identifier, a digital signature, and a data key, the data key being a relationship node key encrypted with an entity key, the entity key being specific to an associated structured data entity of the one or more structured data entities;

[0137] the second transfer header node being paired with an encrypted relation node encrypted with a relation node key, the second transfer header comprising at least a blob reference to the encrypted relation node, one of the blob references to the encrypted relation node comprising a hash of a third transfer header node and a size of one of the blob references to the encrypted relation node, and the second blob reference of the second transfer header comprising a hash of the encrypted relation node and a size of the second blob reference of the second transfer header, the encrypted relation node comprising a summary of data contained in the encrypted data node and a data decryption key for the encrypted data node;

[0138] the third transfer header node, which is paired with the encrypted data node and the encrypted data file, the third transfer header node including a blob reference to the data node, the blob reference to the data node including at least a size of the encrypted data node and a hash of the encrypted data node, wherein the encrypted data node includes encrypted data related to an associated structured data entity encrypted using a data encryption key;

[0139] A transmission device of the processor configured to transmit a request for a first transmission head node and a paired submission node of a specific structured data entity of the one or more structured data entities; and

[0140] The receiving device of the processor is configured to receive the first transmission header node and the paired submission node of a specific structured data entity.

[0141] 17. The system of claim 16, further comprising:

[0142] The processor's memory is configured as:

[0143] storing a user access key granting permission to access one or more of a plurality of entity keys, each of the plurality of entity keys being associated with a particular structured data entity of the one or more structured data entities;

[0144] The processing device of the processor is configured to:

[0145] identifying a particular entity key among one or more entity keys associated with a particular structured data entity;

[0146] Decrypt the data key using the specific entity key;

[0147] identifying a second transfer header node and a paired encryption relationship node based on a blob reference of the commit node received in the first transfer header node;

[0148] Decrypting the encrypted relationship node using the relationship node key of the decrypted data key;

[0149] Identifying a third transmission header node and a paired encryption data node based on the encryption relationship node; and

[0150] The encrypted data of the encrypted data node is decrypted using the data decryption key of the decrypted relationship node.

[0151] 18. A system according to any of the preceding items 16 to 17, wherein the network comprises one or more computing devices associated with one or more users, the one or more computing devices being defined as at least one of: a storage peer, a producer peer, a proxy peer, or a backup peer; and

[0152] One or more users form one or more user groups, and each user group is associated with a user access key.

[0153] 19. A system according to any one of the preceding items 16 to 18, wherein the blob reference of the commit node in the first transfer header node includes a hash of the commit node, and the second blob reference in the first transfer header node includes at least one hash of at least one second transfer header node of the associated structured data entity.

[0154] 20. A system according to any one of the preceding items 16 to 19, wherein the blob reference in the second transfer header node contains hashes of multiple relationship nodes, and the second blob reference in the second transfer header node includes at least one hash of at least one third transfer header node of the associated structured data entity.

[0155] 21. A system according to any one of the preceding items 16 to 20, wherein the database is cloud storage.

[0156] 22. A system according to any one of the preceding items 16 to 21, wherein the network is a distributed network.

[0157] 23. A system according to any of the preceding items 16 to 22, wherein the encrypted data is medical patient data.

[0158] 24. A system according to any one of the preceding items 16 to 23, wherein the node pairs of each of the one or more structured data entities form a directed acyclic graph.

[0159] 25. The system according to any one of the preceding items 16 to 24, comprising:

[0160] The processor is a processing device configured to:

[0161] generating a data update of encrypted data of a specific encrypted data node of a specific structured data entity among the one or more structured data entities;

[0162] Generate a new third transmission header node paired with the new data node, where the new third transmission header node at least includes the size of the new data node and a blob reference of the new data node;

[0163] Generate a new data decryption key, where the new data decryption key is generated by hashing the new data node;

[0164] New data nodes encrypted with new data encryption keys;

[0165] generating a new second transmission header and a new relationship node pair based on the new third transmission header node and the new data node, wherein one or more blob references of the new relationship node include at least a hash of the new third transmission header node and a hash of the new relationship node, and the new relationship node includes an encrypted summary of the data update included in the new data node and a new data decryption key;

[0166] generating a new relationship node key generated by hashing the new relationship node;

[0167] A new relationship node encrypted with a new relationship node key;

[0168] generating a new first transfer head node and a new commit node pair based on the data update, wherein one or more blob references of the commit node in the new first transfer head node contain at least a hash of at least one previously generated commit node of the associated structured data entity, wherein the new commit node contains a new data key, the new data key being a new relationship node key encrypted with an entity key of the specific structured data entity; and

[0169] A transmission device of the processor is configured to transmit a new first transmission header and a submission node pair of a specific structured data entity of the one or more structured data entities to one or more second computing devices in the network.

[0170] 26. The system according to any one of the preceding items 16 to 25, comprising:

[0171] The processors in the distributed network are configured as:

[0172] Generate new structured data entity data to be added to the database, the new structured data entity comprising data identifying an existing structured data entity in one or more structured data entities, the new structured data entity to be associated with the existing structured data entity, wherein the generation of the new structured data entity comprises:

[0173] Generate, by a computing device in the network, a new first transmission header node and a new submission node pair, a new second transmission header node and a new encryption relationship node pair, and a new third transmission header node and a new encryption data node pair;

[0174] linking, by the computing device, the new structured data entity with the existing structured data entity; and

[0175] The transmission device of the processor is configured to transmit the new structured data entity to one or more second computing devices in the network.

[0176] 27. A system according to any of the preceding items 16 to 26, wherein the new submission node contains a unique identifier of the existing structured data entity; and

[0177] The link includes:

[0178] Insert the hash of the encrypted relationship node of the existing structured data entity into the blob reference of the new first transfer header node.

[0179] 28. A system according to any of the preceding items 16 to 27, wherein each of the one or more structured data entities is associated with a medical patient.

[0180] 29. A system according to any of the preceding items 16 to 28, wherein the storage peer is associated with a dental clinic and the producer peer is a computing device that generates dental data.

[0181] 30. A system according to any one of the preceding items 16 to 29, wherein the encrypted data of the one or more structured data entities is stored encrypted in a database so that users of the database are permitted to read only the transmission header node and the submission node of a node pair without the need for one or more decryption keys.

[0182] 31. A method for distributed data storage and management of data, the method comprising:

[0183] A data abstraction connected to a database interface is stored by a computing device in the computing network, the data abstraction storing one or more medical patient data files, each of the one or more medical patient data files containing at least three entries:

[0184] a first entry comprising a first segment having a hash of a second segment of the first entry and a hash of a third segment of the second entry, and the second segment of the first entry having at least a unique identifier, a digital signature, and a data key, the data key being a relationship node key encrypted with an entity key of an associated medical patient file specific to one or more medical patient data files;

[0185] a second entry including a third section having a hash of an encrypted fourth section encrypted with a relationship node key of the second entry and a hash of a fifth section of the third entry, and the fourth section of the second entry having a summary of data contained in the third entry and a data decryption key of the third entry;

[0186] The third entry contains encrypted data associated with a structured data entity encrypted using a data encryption key and an entity key specific to the associated medical patient data file.

[0187] Body related;

[0188] transmitting, by the computing device, a request for a first entry of a particular medical patient data file of the one or more medical patient data files; and

[0189] A first entry of the particular medical patient data file is received by the computing device.

[0190] 32. The method of claim 31, comprising:

[0191] storing, by the computing device, n first keys, the first key permitting access to one or more of a plurality of second keys, each of the plurality of second keys being associated with a particular medical patient data file among the one or more medical patient data files;

[0192] identifying, by the computing device, a particular second key of the one or more second keys associated with the particular medical patient data file;

[0193] decrypting the data key using the particular second key by the computing device;

[0194] identifying, by the computing device, a second entry of the medical patient data file;

[0195] decrypting, by the computing device, the fourth segment of the second entry using the relationship node key that decrypts the data key;

[0196] identifying, by the computing device, a third entry of the medical patient data file; and

[0197] The encrypted data of the third entry of the medical patient data file is decrypted by the computing device using the data decryption key of the decrypted fourth section of the second entry.

[0198] 33. A computer program product embodied in a non-transitory computer readable medium, the computer program product comprising a computer readable program code executable by a hardware data processor to cause the hardware data processor to perform the method of any one of claims 1 to 15.

[0199] 34. A computer program product embodied in a non-transitory computer readable medium, the computer program product comprising a computer readable program code executable by a hardware data processor to cause the hardware data processor to perform the method of any one of claims 31 to 32.

Claims

1. A method for distributed storage and management of data, the method comprising: receiving a set of dental data via a computing device on a network; A data abstraction connected to a database interface is stored by a computing device in the network, the data abstraction storing one or more structured data entities, each of the one or more structured data entities comprising at least three node pairs, the at least three node pairs comprising: a first transfer header node paired with a commit node, the first transfer header node comprising at least a blob reference of the commit node, one of the blob references of the commit node comprising a hash of the commit node and a size of one of the blob references of the commit node, and a second blob reference of the first transfer header comprising a hash of a second transfer header node and the size of the second blob reference of the first transfer header, the commit node comprising a unique identifier, a digital signature, and a data key, the data key being a relationship node key encrypted with an entity key specific to an associated structured data entity of the one or more structured data entities; the second transfer header node being paired with an encrypted relationship node encrypted with a relationship node key, the second transfer header comprising at least a blob reference to the encrypted relationship node, one of the blob references to the encrypted relationship node comprising a hash of a third transfer header node and a size of one of the blob references to the encrypted relationship node, and a second blob reference of the second transfer header comprising a hash of the encrypted relationship node and a size of the second blob reference of the second transfer header, the encrypted relationship node comprising a summary of data contained in an encrypted data node and a data decryption key for the encrypted data node; the third transfer header node, which is paired with the encrypted data node and the encrypted data file, the third transfer header node comprising a blob reference of the data node, the blob reference of the data node comprising at least a size of the encrypted data node and a hash of the encrypted data node, wherein the encrypted data node comprises encrypted data related to the associated structured data entity encrypted using the data encryption key; transmitting, by the computing device, a request for the first transfer head node and paired commit node for a particular structured data entity of the one or more structured data entities; and A first transfer header node and a paired commit node of the specific structured data entity are received by the computing device.

2. The method according to claim 1, comprising: storing, by the computing device, a user access key that grants permission to access one or more of a plurality of entity keys, each of the plurality of entity keys being associated with a structured data entity of the one or more structured data entities; identifying, by the computing device, a particular entity key among the one or more entity keys associated with the particular structured data entity; decrypting the data key by the computing device using the specific entity key; identifying, by the computing device, the second transmission header node and a paired encryption relationship node based on the blob reference of the received submission node in the first transmission header node; decrypting, by the computing device, the encrypted relationship node using the relationship node key of the decrypted data key; The computing device identifies the third transmission header node and the paired encryption data node based on the encryption relationship node; as well as The computing device decrypts the encrypted data of the encrypted data node using the data decryption key of the decrypted relationship node.

3. The method according to claim 2, wherein: The network includes one or more computing devices associated with one or more users, the one or more computing devices being defined as at least one of: a storage peer, a producer peer, a proxy peer, or a backup peer; and The one or more users form one or more user groups, and each user group is associated with a user access key.

4. The method according to claim 1, wherein: The blob reference of the commit node in the first transfer header node includes a hash of the commit node, and the second blob reference in the first transfer header node includes at least one hash of at least one second transfer header node of the associated structured data entity.

5. The method according to claim 1, wherein: The encrypted relationship node blob reference in the second transfer header node contains a hash of the relationship node, and the second blob reference in the second transfer header node includes at least one hash of at least one third transfer header node of the associated structured data entity.

6. The method according to claim 1, wherein: The database is cloud storage.

7. The method according to claim 1, wherein: The network is a distributed network.

8. The method according to claim 1, wherein: The encrypted data is medical patient data.

9. The method according to claim 1, wherein: The node pairs of each of the one or more structured data entities form a directed acyclic graph.

10. The method according to claim 1, comprising: generating, by the computing device, a data update of encrypted data of a specific encrypted data node of a specific structured data entity among the one or more structured data entities; Generate, by the computing device, a new third transmission header node paired with the new data node, wherein the new third transmission header node at least includes a size of the new data node and a blob reference of the new data node; generating, by the computing device, a new data decryption key, wherein the new data decryption key is generated by hashing the new data node; Encrypting the new data node by the computing device using the new data encryption key; The computing device generates a new second transmission header and a new relationship node pair based on the new third transmission header node and the new data node, wherein one or more blob references of the new relationship node at least include a hash of the new third transmission header node and a hash of the new relationship node, and the new relationship node includes a summary of the data update included in the encrypted new data node and the new data decryption key; generating, by the computing device, a new relationship node key, wherein the new relationship node key is generated by hashing the new relationship node; encrypting the new relationship node by the computing device using the new relationship node key; generating, by the computing device, a new first transfer header node and a new commit node pair based on the data update, wherein one or more blob references of the commit node in the new first transfer header node contain at least a hash of at least one previously generated commit node of the associated structured data entity, and the new commit node contains a new data key, wherein the new data key is the new relationship node key encrypted with the entity key of the specific structured data entity; and The computing device transmits a new first transmission header and a submission node pair for the specific structured data entity among the one or more structured data entities to one or more second computing devices in the network.

11. The method according to claim 1, comprising: Generating, by the computing device, new structured data entity data to be added to the database, the new structured data entity comprising data identifying an existing structured data entity among the one or more structured data entities, the new structured data entity to be associated with the existing structured data entity, wherein the generating of the new structured data entity comprises: Generating, by the computing device in the network, a new first transmission header node and a new submission node pair, a new second transmission header node and a new encryption relationship node pair, and a new third transmission header node and a new encryption data node pair; linking, by the computing device, the new structured data entity with the existing structured data entity; and The new structured data entity is transmitted by the computing device to one or more second computing devices in the network.

12. The method according to claim 11, wherein: The new commit node contains a unique identifier for the existing structured data entity; and The link includes: A hash of the encrypted relationship node of the existing structured data entity is inserted into the blob reference of the new first transmission header node.

13. The method according to claim 1, wherein: Each of the one or more structured data entities is associated with a dental patient.

14. The method according to claim 3, wherein: The storage peer is associated with a dental clinic and the producer peer is a computing device that generates dental data.

15. The method according to claim 1, wherein: The encrypted data of the one or more structured data entities is stored encrypted in the database such that users of the database are permitted to read only a transfer header node and a submission node of a node pair without requiring one or more decryption keys.

Images