Systems and methods for selective access to logs
Systems are provided for managing access to a log of dataset that is generated when the dataset is accessed. A system stores, with respect to each of a log producer and a log accessor, an encrypted symmetric key for dataset that is encrypted using a corresponding public key. The system returns the encrypted symmetric key for the log producer, such that the log producer can decrypt the dataset that is encrypted using the symmetric key. A log of the dataset is generated when the log producer accesses the dataset.
1. A system, comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the system to perform:
generating a first key commensurate with a first access privilege to a dataset;
providing access to the dataset commensurate with the first access privilege in response to receiving and authenticating the first key;
in response to the providing of access to the dataset, generating a log for the dataset, the log being divided into a secured data portion commensurate with the first access privilege and an unsecured data portion commensurate with a second access privilege lower than the first access privilege, the secured data portion being inaccessible under the second access privilege.
2. The system of claim 1 , wherein the instructions further cause the system to perform:
generating an additional key in response to generating an additional dataset;
encrypting the additional key;
storing the encrypted additional key within a first datastore;
receiving a request to access the additional dataset;
decrypting the encrypted additional key;
authenticating the decrypted additional key;
providing access to the additional dataset;
in response to providing the access, generating a log corresponding to the additional dataset; and
storing the log within a second datastore.
3. The system of claim 2 , wherein the instructions further cause the system to perform:
encrypting the log, and wherein:
the providing of the access to the additional dataset comprises decrypting the additional dataset, wherein the additional dataset is stored in association with the log.
4. The system of claim 2 , wherein the instructions further cause the system to perform:
encrypting the log corresponding to the additional dataset using the additional key.
5. The system of claim 4 , wherein the encrypting of the additional key is via a public key.
6. The system of claim 4 , wherein the instructions further cause the system to perform:
receiving a request for deletion of the additional key;
determining whether an access privilege corresponding to the request for deletion exceeds the first access privilege;
deleting the additional key in response to the access privilege exceeding the first access privilege; and
refraining from deleting the additional key in response to the access privilege being equal or less than the first access privilege.
7. The system of claim 2 , wherein the encrypted additional key is decrypted using a secret key.
8. The system of claim 1 , wherein the instructions further cause the system to perform:
inactivating the first key in response to the log being generated.
9. The system of claim 1 , wherein the generating of the first key comprises encrypting a symmetric key based on a public key of a user corresponding to the first access privilege and decrypting the encrypted symmetric key.
10. The system of claim 1 , wherein the instructions further cause the system to perform:
generating individual logs corresponding to individual access requests by different users, wherein the individual logs comprise respective secured data portions and unsecured data portions.
11. A system comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the system to perform:
obtaining, from a first server, an encrypted symmetric key for a dataset, the encrypted symmetric key being encrypted using a public key;
decrypting the obtained encrypted symmetric key using a secret key corresponding to the public key;
obtaining, from a second server, an encrypted dataset that is generated by encrypting the dataset;
decrypting the encrypted dataset using the decrypted symmetric key; and
upon access to the decrypted dataset, generating a log for the decrypted dataset, the log being divided into a secured data portion commensurate with the first access privilege and an unsecured data portion commensurate with a second access privilege lower than the first access privilege, the secured data portion being inaccessible under the second access privilege.
12. The system of claim 11 , wherein the instructions further cause the system to perform:
generating an additional key in response to generating an additional dataset;
encrypting the additional key;
storing the encrypted additional key within a first datastore;
receiving a request to access the additional dataset;
decrypting the encrypted additional key;
authenticating the decrypted additional key;
providing access to the additional dataset;
in response to providing the access, generating a log corresponding to the additional dataset; and
storing the log within a second datastore.
13. The system of claim 12 , wherein the instructions further cause the system to perform:
encrypting the log, and wherein:
the providing of the access to the additional dataset comprises decrypting the additional dataset, wherein the additional dataset is stored in association with the log.
14. The system of claim 12 , wherein the instructions further cause the system to perform:
encrypting the log corresponding to the additional dataset using the additional key.
15. The system of claim 14 , wherein the instructions further cause the system to perform:
receiving a request for deletion of the additional key;
determining whether an access privilege corresponding to the request for deletion exceeds the first access privilege;
deleting the additional key in response to the access privilege exceeding the first access privilege; and
refraining from deleting the additional key in response to the access privilege being equal or less than the first access privilege.
16. A system comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the system to perform:
obtaining, from a first server, an encrypted symmetric key for a dataset, the encrypted symmetric key being encrypted using a public key;
decrypting the obtained encrypted symmetric key using a secret key corresponding to the public key;
obtaining, from a second server, an encrypted log that is generated by encrypting a log that is generated when the dataset is accessed; and
decrypting the encrypted log using the decrypted symmetric key, wherein the encrypted log is divided into a secured data portion commensurate with the first access privilege and an unsecured data portion commensurate with a second access privilege lower than the first access privilege, the secured data portion being inaccessible under the second access privilege.
17. The system of claim 16 , wherein the instructions further cause the system to perform:
generating an additional key in response to generating an additional dataset;
encrypting the additional key;
storing the encrypted additional key within a first datastore;
receiving a request to access the additional dataset;
decrypting the encrypted additional key;
authenticating the decrypted additional key;
providing access to the additional dataset;
in response to providing the access, generating a log corresponding to the additional dataset; and
storing the log within a second datastore.
18. The system of claim 17 , wherein the instructions further cause the system to perform:
encrypting the log, and wherein:
the providing of the access to the additional dataset comprises decrypting the additional dataset, wherein the additional dataset is stored in association with the log.
19. The system of claim 17 , wherein the instructions further cause the system to perform:
encrypting the log corresponding to the additional dataset using the additional key.
20. The system of claim 19 , wherein the instructions further cause the system to perform:
receiving a request for deletion of the additional key;
determining whether an access privilege corresponding to the request for deletion exceeds the first access privilege;
deleting the additional key in response to the access privilege exceeding the first access privilege; and
refraining from deleting the additional key in response to the access privilege being equal or less than the first access privilege.