Remote blind hashing
A remote data protection network provides a blind hashing service. A blind hashing server receives a message such as a digest from a client, and uses the message to derive a set of indices or offsets into a huge block of random data that is maintained by the remote data protection network. The corresponding extents of data in the block are combined, e.g. using a hash or HMAC function, and then returned to the invoking client, e.g. as a salt. The message and response may be salted with a unique client salt.
1. An apparatus comprising:
at least one physical storage device comprising a multi-petabyte block of random data; and
a blind hashing computer configured, responsive to a message from a client computer which is remote from the blind hashing computer and the at least one physical storage device, to access the block of random data to obtain at least one extent of random data as a function of a value in the message, and to provide to the client computer a response based on contents of the at least one extent of random data, wherein an account established with the client computer is authenticated based on the response.
2. The apparatus of claim 1 wherein the block of random data comprises a pseudorandom sequence and the seed is retained.
3. The apparatus of claim 1 wherein the block of random data comprises a pseudorandom sequence where the seed is destroyed, and the sequence is backed up in its entirety.
4. The apparatus of claim 1 wherein accessing the block of random data by the blind hashing computer comprises using the block as a lookup table.
5. The apparatus of claim 4 wherein an index or offset into the table is determined from the value in the message.
6. The apparatus of claim 1 wherein the value in the message includes a digest generated from a password.
7. The apparatus of claim 6 wherein the password is salted prior to being hashed to generate the digest.
8. The apparatus of claim 1 wherein the response comprises the contents of the at least one extent of random data.
9. The apparatus of claim 1 wherein the response comprises at least one of:
the hash of the contents of the at least one extent of random data; and
the salted hash of the contents of the at least one extent of random data.
10. The apparatus of claim 1 wherein the value in the message is salted with a unique client salt prior to accessing the block of random data.
11. The apparatus of claim 1 wherein accessing the block of random data comprises multiple iterations of obtaining extents of data from the block of random data.
12. The apparatus of claim 1 wherein a set of indices or offsets into the block of random data are determined from the value in the message.
13. The apparatus of claim 1 wherein one or more indices or offsets into the block of random data are determined, in part, by previously retrieved extents of data from the block of random data.
14. An apparatus comprising:
a blind hashing server device configured to:
receive a message from a first client computer which is remote from the blind hashing server device;
access a multi-petabyte block of random data stored in a non-transitory computer-readable storage medium to obtain at least one extent of random data as a function of a value in the received message; and
provide to a second client computer a response based on contents of the at least one extent of random data, wherein an account established with the first client computer is authenticated based on the response.
15. The apparatus of claim 14 wherein the block of random data comprises a pseudorandom sequence and the seed is retained.
16. The apparatus of claim 14 wherein the block of random data comprises a pseudorandom sequence where the seed is destroyed, and the sequence is backed up in its entirety.
17. The apparatus of claim 14 wherein accessing the block of random data by the blind hashing server device comprises using the block as a lookup table.
18. The apparatus of claim 17 wherein an index or offset into the table is determined from the value in the message.
19. The apparatus of claim 14 wherein the value in the message includes a digest generated from a password.
20. The apparatus of claim 19 wherein the password is salted prior to being hashed to generate the digest.
21. The apparatus of claim 14 wherein the response comprises the contents of the at least one extent of random data.
22. The apparatus of claim 14 wherein the response comprises at least one of:
the hash of the contents of the at least one extent of random data; and
the salted hash of the contents of the at least one extent of random data.
23. The apparatus of claim 11 wherein the value in the message is salted with a unique client salt prior to accessing the block of random data.
24. The apparatus of claim 11 wherein accessing the block of random data comprises multiple iterations of obtaining extents of data from the block of random data.
25. The apparatus of claim 11 wherein a set of indices or offsets into the table are determined from the value in the message.
26. The apparatus of claim 11 wherein at least one of the indices or offsets into the table is determined, in part, by previously retrieved extents of data from the block of random data.