Variable epoch scheduler for proactive cryptography systems
View Patent ↗An improved technique involves protecting a set of resources in a distributed computer system by scheduling epochs for replacing keys that have a variable duration. Along these lines, a Variable Epoch Scheduler (VES) generates schedules of key updates for a set of players in the distributed system such that at least two epochs in the schedules have different durations. For example, the epoch durations within a schedule may vary, or the epoch durations for different players may be different. At the end of each epoch, the VES notifies the distributed system to update the key identified in the schedule as corresponding to that epoch.
1. A method of protecting a set of resources in a distributed computer system, the method comprising:
generating, by a processor, a schedule that includes a set of times, each time of the set of times defining an end of an epoch having a duration over which a key of a set of keys that corresponds to the time is valid, each key of the set of keys being associated with a resource of the set of resources, the set of times including a first time and a second time different from the first time;
for a first key that corresponds to the first time, sending, by the processor, a request to update the first key to the distributed system at the first time to produce an updated first key; and
for a second key that corresponds to the second time, sending, by the processor, a request to update the second key to the distributed system at the second time to produce an updated second key.
2. A method as in claim 1 , further comprising:
after sending the request to update the first key, producing, as part of the schedule, a new first time defining an end of a new first epoch having a duration over which the updated first key is valid; and
after sending the request to update the second key, producing, as part of the schedule, a new second time defining an end of a new second epoch having a duration over which the updated second key is valid.
3. A method as in claim 2 ,
wherein the distributed system includes a set of players, each player of the set of players being configured to receive a key of the set of keys;
wherein a first player of the set of players is configured to receive the first key, and a second player of the set of players is configured to receive the second key;
wherein the method further comprises:
granting the first player access to the resource to which the first key is associated in the epoch having a duration over which the first key is valid; and
granting the second player access to the resource to which the second key is associated in the epoch having a duration over which the second key is valid.
4. A method as in claim 3 ,
wherein each player of the set of players is associated with a user of a set of users, each user of the set of users having a value of a risk score indicative of a level of risk associated with that user, the first player being associated with a first user having a first risk score, the second player being associated with a second user having a second risk score;
wherein generating the schedule includes:
performing a comparison operation on the risk score of the first user and the risk score of the second user to produce a comparison result,
when the comparison result indicates that the first user has a higher risk score than the second user, assigning the duration of the epoch over which the first key is valid to have a duration less than the duration of the epoch over which the second key is valid, and
when the comparison result indicates that the first user has a lower risk score than the second user, assigning the duration of the epoch over which the first key is valid to have a duration greater than the duration of the epoch over which the second key is valid.
5. A method as in claim 4 ,
wherein each user of the set of users has a role within a role-based access control (RBAC) system indicative of a permission level for handling sensitive data, the value of the risk score of the user being based on the role of the user within the RBAC system; and
wherein performing the comparison operation includes:
setting the value of the risk score of the first user greater than the value of the risk score of the second user when the permission level indicated by the role of the first user within the RBAC system is higher than the permission level indicated by the role of the second user within the RBAC system.
6. A method as in claim 3 ,
wherein each resource of the set of resources has a classification indicative of an importance of concealing that resource from unauthorized users;
wherein generating the schedule includes:
performing a comparison operation on the classification a first resource with which the first key is associated and the classification a second resource with which the second key is associated to produce a comparison result,
when the comparison result indicates that the first resource has a higher classification than the second resource, assigning the duration of the epoch over which the first key is valid to have a duration less than the duration of the epoch over which the second key is valid, and
when the comparison result indicates that the first resource has a lower classification than the second resource, assigning the duration of the epoch over which the first key is valid to have a duration greater than the duration of the epoch over which the second key is valid.
7. A method as in claim 6 ,
wherein performing the comparison operation includes:
obtaining sensitivity results for the first resource and the second resource from a data loss prevention (DLP) system, the classification of the first resource being set higher than the classification of the second resource when the DLP system indicates that the first resource is more sensitive than the second resource.
8. A method as in claim 3 ,
wherein generating the schedule includes:
receiving a predetermined event schedule specifying that an event involving the first player will take place during the epoch having the duration over which the first key is valid, and
in response to receiving the predetermined event schedule, adjusting the duration of that epoch to indicate a changed level of risk associated with the event.
9. A method as in claim 3 ,
wherein a number of proactivization operations per unit time interval is bounded from above by a proactivization rate bound; and
wherein sending the request to update the first key to the distributed system at the first time includes:
when the ratio of a number of keys to be received by the distributed system according to the set of epoch schedules to a predetermined schedule time interval exceeds the proactivization rate bound, transmitting the request to a queue manager, the queue manager being configured to transmit requests to the distributed system at a rate less than the proactivization rate bound.
10. A method as in claim 3 ,
wherein a particular subset of the set of keys forms a set of shared keys which are associated with a particular resource of the set of resources, the particular resource being recoverable to a set of sharing players which is a subset of the set of players, each player of the set of sharing players being configured to receive a shared key of the set of shared keys, the particular resource being recoverable from a threshold number of shared keys, the set of sharing players including the first player and the second player;
wherein each epoch whose end is defined by a time of the set of times to which a shared key of the set of shared keys corresponds includes an index value which defines a subset of the set of shared keys from which the particular resource is recoverable;
wherein generating the schedule includes:
generating a set of epoch schedules, each epoch schedule of the set of epoch schedules corresponding to a player of the set of sharing players and including an epoch having an index value of one and another epoch having an index value of two, a duration of the epoch of an epoch schedule corresponding to the first player having the index value of one being different from a duration of the epoch of an epoch schedule corresponding to the second player having the index value of one, a duration of the epoch of an epoch schedule corresponding to the first player having the index value of two being different from a duration of the epoch of an epoch schedule corresponding to the second player having the index value of two;
wherein sending the request to update the first key to the distributed system at the first time includes:
transmitting to the distributed system a first signal prior to the end of the epoch of the epoch schedule corresponding to the first player having the index value of one, the resource being recoverable from a threshold number of keys corresponding to players of the set of players during epochs having the index value of one; and
wherein producing the new first time defining an end of the new first epoch having the duration over which the updated first key is valid includes:
transmitting to the distributed system a second signal at the end of the epoch of the epoch schedule corresponding to the first player having the index value of two, the resource being recoverable from a threshold number of keys corresponding to players of the set of players during epochs having the index value of two.
11. A method as in claim 10 ,
wherein another subset of the set of keys forms a set of independent keys each of which are associated with a independent resources of the set of resources;
wherein generating the schedule includes:
producing a schedule, independent of other schedules, corresponding to a player of the set of players that protects an independent resource of the set of resources.
12. A method as in claim 3 , further comprising:
obtaining a first output and a second output of a random number generator, output of the random number generator being distributed according to a probability distribution having a finite variance;
wherein generating the schedule includes:
setting the duration of the epoch having a duration over which the first key is valid to the first output of the random number generator, and
setting the duration of the epoch having a duration over which the second key is valid to the second output of the random number generator.
13. A method as in claim 12 ,
wherein the probability distribution of the random number generator has a mean; and
wherein setting the duration of the epoch having a duration over which the first key is valid to the first output of the random number generator includes:
assigning, as the duration of the epoch having a duration over which the first key is valid, a value equal to a sum of a fixed duration and the first output of the random number generator.
14. A method as in claim 1 ,
wherein generating the schedule includes:
producing a new time after a time of the set of times has elapsed.
15. An electronic system constructed and arranged to protect a set of resources in a distributed computer system, the electronic system comprising:
a network interface;
memory; and
a controller including controlling circuitry, the controlling circuitry being constructed and arranged to:
generate a schedule that includes a set of times, each time of the set of times defining an end of an epoch having a duration over which a key of a set of keys that corresponds to the time is valid, each key of the set of keys being associated with a resource of the set of resources, the set of times including a first time and a second time different from the first time;
for a first key that corresponds to the first time, send a request to update the first key to the distributed system at the first time to produce an updated first key; and
for a second key that corresponds to the second time, send a request to update the second key to the distributed system at the second time to produce an updated second key.
16. An electronic system as in claim 15 , wherein the controlling circuitry is further constructed and arranged to:
after sending the request to update the first key, produce, as part of the schedule, a new first time defining an end of a new first epoch having a duration over which the updated first key is valid; and
after sending the request to update the second key, produce, as part of the schedule, a new second time defining an end of a new second epoch having a duration over which the updated second key is valid.
17. An electronic system as in claim 16 ,
wherein the distributed system includes a set of players, each player of the set of players being configured to receive a key of the set of keys;
wherein a first player of the set of players is configured to receive the first key, and a second player of the set of players is configured to receive the second key;
wherein the controlling circuitry is further constructed and arranged to:
grant the first player access to the resource to which the first key is associated in the epoch having a duration over which the first key is valid; and
grant the second player access to the resource to which the second key is associated in the epoch having a duration over which the second key is valid.
18. An electronic system as in claim 17 ,
wherein a particular subset of the set of keys forms a set of shared keys which are associated with a particular resource of the set of resources, the particular resource being recoverable to a set of sharing players which is a subset of the set of players, each player of the set of sharing players being configured to receive a shared key of the set of shared keys, the particular resource being recoverable from a threshold number of shared keys, the set of sharing players including the first player and the second player;
wherein each epoch whose end is defined by a time of the set of times to which a shared key of the set of shared keys corresponds includes an index value which defines a subset of the set of shared keys from which the particular resource is recoverable;
wherein generating the schedule includes:
generating a set of epoch schedules, each epoch schedule of the set of epoch schedules corresponding to a player of the set of sharing players and including an epoch having an index value of one and another epoch having an index value of two, a duration of the epoch of an epoch schedule corresponding to the first player having the index value of one being different from a duration of the epoch of an epoch schedule corresponding to the second player having the index value of one, a duration of the epoch of an epoch schedule corresponding to the first player having the index value of two being different from a duration of the epoch of an epoch schedule corresponding to the second player having the index value of two;
wherein sending the request to update the first key to the distributed system at the first time includes:
transmitting to the distributed system a first signal prior to the end of the epoch of the epoch schedule corresponding to the first player having the index value of one, the resource being recoverable from a threshold number of keys corresponding to players of the set of players during epochs having the index value of one; and
wherein producing the new first time defining an end of the new first epoch having the duration over which the updated first key is valid includes:
transmitting to the distributed system a second signal at the end of the epoch of the epoch schedule corresponding to the first player having the index value of two, the resource being recoverable from a threshold number of keys corresponding to players of the set of players during epochs having the index value of two.
19. An electronic system as in claim 17 , wherein the controlling circuitry is further constructed and arranged to:
obtain a first output and a second output of a random number generator, output of the random number generator being distributed according to a probability distribution having a finite variance;
wherein generating a set of epoch schedules includes:
setting the duration of the epoch having a duration over which the first key is valid to the first output of the random number generator, and
setting the duration of the epoch having a duration over which the second key is valid to the second output of the random number generator.
20. A computer program product having a non-transitory, computer-readable storage medium which stores code to protect a set of resources in a distributed computer system, the code including instructions to:
generate a schedule that includes a set of times, each time of the set of times defining an end of an epoch having a duration over which a key of a set of keys that corresponds to the time is valid, each key of the set of keys being associated with a resource of the set of resources, the set of times including a first time and a second time different from the first time;
for a first key that corresponds to the first time, send a request to update the first key to the distributed system at the first time to produce an updated first key; and
for a second key that corresponds to the second time, send a request to update the second key to the distributed system at the second time to produce an updated second key.
21. A computer program product as in claim 20 , wherein the code includes further instructions to:
after sending the request to update the first key, produce, as part of the schedule, a new first time defining an end of a new first epoch having a duration over which the updated first key is valid; and
after sending the request to update the second key, produce, as part of the schedule, a new second time defining an end of a new second epoch having a duration over which the updated second key is valid.
22. A computer program product as in claim 21 ,
wherein the distributed system includes a set of players, each player of the set of players being configured to receive a key of the set of keys;
wherein a first player of the set of players is configured to receive the first key, and a second player of the set of players is configured to receive the second key;
wherein the code contains further instructions to:
grant the first player access to the resource to which the first key is associated in the epoch having a duration over which the first key is valid; and
grant the second player access to the resource to which the second key is associated in the epoch having a duration over which the second key is valid.