Receiving information through a zero-knowledge data management network
The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.
1. A method, comprising:
participating, by a particular recipient, in a data storage system, wherein a storage server is configured to i) obtain source data from a source, wherein no device other than the source is able to read the source data; ii) obtain a conversion key specific to a particular recipient from the source; iii) convert, based on the conversion key and in response to a request to share the source data with the particular recipient, the source data into a format readable only by the particular recipient;
receiving, at the particular recipient from the storage server, the source data in the format readable only by the particular recipient; and
processing, by the particular recipient, the source data readable by the particular recipient,
wherein the data storage system further comprises an attestation server configured to attest to the source data and create a signed certificate based on attesting to the source data, the method further comprising:
receiving the signed certificate, the signed certificate associated with source data; and
confirming that the source data has been attested to by the attestation server based on the signed certificate.
2. The method as in claim 1 , wherein a hash of the source data attested to by the attestation service is included as part of the signed certificate, the method further comprising:
computing a hash of the source data by the particular recipient; and
confirming that the source data corresponds to the signed certificate based on matching the hash computed by the particular recipient to the hash included as part of the signed certificate.