Cloud key directory for federating data exchanges
Embodiments are directed to facilitating data transfer using an anonymous directory and to providing attribute-based data access to identified users. In an embodiment, a computer system instantiates an anonymous directory that stores data in various client-specific directories for different clients. The anonymous directory is configured to provide data access according to access controls defined and managed by the client. The computer system receives a data request from a user that identifies the user and specifies a portion of data that is to be returned to the user. The computer system determines which of the client's data is to be returned to the user based on the client's specified access controls. The access controls grant access to specified data in some of the client-specific directories, based on the user's identity. The computer system then provides the determined data to the user.
1. At a computer system including at least one processor and a memory, in a computer networking environment including a plurality of computing systems, a computer-implemented method for facilitating data transfer using an anonymous directory, the method comprising:
an act of instantiating an anonymous directory that stores data in one or more client-specific directories for a plurality of different clients, the anonymous directory being configured to provide access to the stored data according to access controls defined by and managed by each client, the stored data including a particular portion of data that is associated with a particular client, the particular portion of data being encrypted using multi-authority attribute-based encryption that associates the particular portion of data with one or more specified data attributes, the particular portion of data being decryptable based on an identified user requesting data associated with the one or more specified data attributes;
an act of receiving a data request from a user that identifies the user and that specifies data attributes describing data that is to be found in the stored data in the anonymous directory, the data attributes including one or more of the one or more specified data attributes;
in response to receiving the data request, an act of determining that the particular portion of data is to be returned to the user based on an identified user requesting data having the one or more specified data attributes; and
an act of providing the particular portion of data to the user.
2. The method of claim 1 , wherein the anonymous directory allows discovery of the particular clients' data based on a threshold number of attributes being requested in the user's request.
3. The method of claim 1 , wherein the anonymous directory allows data owners to specify which data is presented in a search result for each of a plurality of different users.
4. The method of claim 1 , wherein the anonymous directory allows data owners to specify which data is presented in a search result for each of a plurality of different user types.
5. The method of claim 1 , wherein the anonymous directory allows data owners to dynamically change which data is presented in a given search result.
6. The method of claim 5 , wherein the data owner converts the query received from the user based on the user's identity, to provide that user with a specified set of data.
7. The method of claim 1 , wherein the user is authenticated to verify the user's identity.
8. The method of claim 1 , wherein at least a portion of the particular client's data is made visible to the anonymous directory.
9. The method of claim 1 , wherein at least a portion of the particular client's data remains invisible to the anonymous directory.
10. A computer program product for implementing a method for providing attribute-based data access to identified users, the computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the method, the method comprising:
an act of receiving encrypted data from a client, the encrypted data to be stored in a client-specific directory, the data having been encrypted using multi-authority attribute-based encryption that associates one or more portions of the encrypted data with one or more data attributes, such that the client specifies access rights to the encrypted data by allowing identified users to access data when the identified users search for the data using the one or more data attributes;
an act of receiving a data request from a user, wherein the data request includes the user's identity and specifies the one or more data attributes, wherein data that includes those attributes is to be returned to the user;
an act of determining which portions of the encrypted data have data attributes that match the requested one or more data attributes specified by the user and are identified as being allowable to release to the identified user; and
an act of sending to the user the one or more portions of the encrypted data whose one or more associated attributes match the requested one or more attributes specified by the user.
11. The computer program product of claim 10 , wherein the client applies one or more attributes to each portion of data stored in the client-specific directory.
12. The computer program product of claim 11 , wherein the attributes applied by the client are user-specific, such that identified users receive different data based on their identity.
13. The computer program product of claim 10 , wherein at least one of the attributes is verified by an authority, the authority comprising a trusted third party.
14. The computer program product of claim 10 , wherein the user's query is sent to a plurality of different authorities requesting specific attributes.
15. The computer program product of claim 14 , further comprising:
an act of receiving attributes from at least one of the authorities; and
an act of allowing the user access to the data corresponding to the attributes returned by the authorities.
16. The computer program product of claim 15 , further comprising an act of preventing access to the data corresponding to the attributes not returned by the authorities.
17. A computer system comprising the following:
one or more processors;
system memory;
one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for providing attribute-based data access to identified users, the method comprising the following:
an act of receiving encrypted data from a client, the encrypted data to be stored in a client-specific directory, the data having been encrypted using multi-authority attribute-based encryption that associates one or more portions of the encrypted data with one or more data attributes, such that the client specifies access rights to the encrypted data by allowing identified users to access data when the identified users search for the data using the one or more data attributes;
an act of receiving a data request from a user, wherein the data request includes the user's identity and specifies the one or more data attributes, wherein data that includes those attributes is to be returned to the user;
an act of determining which portions of the encrypted data have data attributes that match the requested one or more data attributes specified by the user and are identified as being allowable to release to the identified user; and
an act of sending to the user the one or more portions of the encrypted data whose one or more associated attributes match the requested one or more attributes specified by the user.