Containerless data for trustworthy computing and data services

Abstract

A digital escrow pattern and trustworthy platform is provided for data services including mathematical transformation techniques, such as searchable encryption techniques, for obscuring data stored at remote site or in a cloud service, distributing trust across multiple entities to avoid a single point of data compromise. Using the techniques of a trustworthy platform, data (and associated metadata) is decoupled from the containers that hold the data (e.g., file systems, databases, etc.) enabling the data to act as its own custodian through imposition of a shroud of mathematical complexity that is pierced with presented capabilities, such as keys granted by a cryptographic key generator of a trust platform. Sharing of, or access to, the data or a subset of that data is facilitated in a manner that preserves and extends trust without the need for particular containers for enforcement.

What is claimed is: 
     
         1 . A computer-readable storage medium encoded with computer-executable instructions that, when executed by a processor, cause the processor to carry out a method, the method comprising:
 receiving, by at least one computing device in a first region of control from at least one computing device in a second region of control, obscured data formed from application of at least one first mathematical transformation of data for a defined data set of the at least one computing device in the second region of control;   receiving, by the at least one computing device in the first region of control, obscured metadata formed from application of an analysis of the data and at least one second mathematical transformation of an output of the analysis; and   determining at least one container of a plurality of containers of at least two disparate container types in which to store at least one of the obscured data or the obscured metadata within the first region of control;   wherein the first and second mathematical transformations utilize cryptographic key information provided by at least one computing device in a third region of control,   wherein the first region of control, the second region of control and the third region of control are distinct.   
     
     
         2 . The computer-readable storage medium of  claim 1 , wherein the obscured data includes encrypted data formed from at least one encryption of the data according to at least one searchable encryption algorithm based on cryptographic key information. 
     
     
         3 . The computer-readable storage medium of  claim 2 , wherein the determining includes determining the at least one container in which to store at least one of the encrypted data or the obscured metadata. 
     
     
         4 . The computer-readable storage medium of  claim 1 , wherein the obscured metadata includes encrypted metadata formed from the analysis of the data and the at least one second mathematical transformation of the output of the analysis based on cryptographic key information. 
     
     
         5 . The computer-readable storage medium of  claim 4 , wherein the determining includes determining the at least one container in which to store at least one of the obscured data or the encrypted metadata. 
     
     
         6 . The computer-readable storage medium of  claim 1 , the method further comprising:
 automatically changing the at least one container in which the obscured data is stored if a pre-defined condition of the plurality of containers is met.   
     
     
         7 . The computer-readable storage medium of  claim 6 , wherein the changing includes copying at least some of the obscured data stored in a first container of a first container type to a second container of a second container type. 
     
     
         8 . The computer-readable storage medium of  claim 7 , wherein the changing includes deleting the at least some of the obscured data from the first container. 
     
     
         9 . The computer-readable storage medium of  claim 1 , the method further comprising:
 automatically changing the at least one container in which the obscured metadata is stored if a pre-defined condition of the plurality of containers is met.   
     
     
         10 . The computer-readable storage medium of  claim 9 , wherein the changing includes copying at least some of the obscured metadata stored in a first container of a first container type to a second container of a second container type. 
     
     
         11 . The computer-readable storage medium of  claim 10 , wherein the changing includes deleting the at least some of the obscured metadata from the first container. 
     
     
         12 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured data based on a storage size associated with the obscured data. 
     
     
         13 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured data based on a storage size associated with the obscured metadata. 
     
     
         14 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured data based on a speed of access requirement specified for the obscured data. 
     
     
         15 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured data based on a speed of access requirement specified for the obscured metadata. 
     
     
         16 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured data based on a reliability of recovery requirement specified for the obscured data. 
     
     
         17 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured data based on a reliability of recovery requirement specified for the obscured metadata. 
     
     
         18 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured data based on proximity to one or more devices that have access to the obscured data. 
     
     
         19 . The computer-readable storage medium of  claim 1 , wherein the determining includes determining at least one container in which to store the obscured metadata based on proximity to one or more devices that have access to the obscured metadata. 
     
     
         20 . The computer-readable storage medium of  claim 1 , the method further comprising:
 receiving trapdoor data enabling visible access to the obscured data as defined by at least one cryptographic trapdoor of the trapdoor data.   
     
     
         21 . The computer-readable storage medium of  claim 1 , the method further comprising:
 receiving a request to restore at least one data item from the defined data set;   receiving at least one trapdoor for extracting the at least one data item from the obscured data; and   if the at least one trapdoor is valid, extracting and transmitting the at least one data item from the obscured data.   
     
     
         22 . A computer-readable storage medium, comprising:
 a network service provider implementing a network service for data or the metadata obscured by at least one mathematical transformation component, the network service provider including a data container management component that manages where the data or the metadata obscured by the at least one mathematical transformation component is stored based on at least one of a data latency requirement, a data reliability requirement, a distance from data consumption requirement, or a data scale requirement of the network service,   wherein the mathematical transformation component is distributed by a first computing device having a mathematical transformation algorithm provider, the mathematical transformation component performs at least one searchable data obfuscation algorithm or searchable data revelation algorithm based on mathematical transformation predicate information generated by a generator,   wherein the generator generates mathematical transformation predicate information for at least one of publishing data and metadata or subscribing to data and metadata, the generator associated with a second computing device,   wherein the first computing device, the second computing device, and the network service provider are distinct.   
     
     
         23 . The computer-readable storage medium of  claim 22 , wherein the mathematical transformation component is a cryptographic component provided by a cryptographic technology provider,
 wherein the generator is a key generator and the mathematical transformation predicate information is key information.   
     
     
         24 . The computer-readable storage medium of  claim 23 , wherein the data or the metadata is encrypted by the cryptographic component,
 wherein the data container management component manages where the data or metadata encrypted by the cryptographic component is stored.   
     
     
         25 . The computer-readable storage medium of  claim 22 , wherein the data container management component manages where the data or the metadata obscured by the at least one mathematical transformation component is stored based on a data latency requirement specified for delivery of the network service by the network service provider. 
     
     
         26 . The computer-readable storage medium of  claim 22 , wherein the data container management component manages where the data or the metadata obscured by the at least one mathematical transformation component is stored based on a data reliability requirement specified for storage of the data or the metadata by the network service. 
     
     
         27 . The computer-readable storage medium of  claim 22 , wherein the data container management component manages where the data or the metadata obscured by the at least one mathematical transformation component is stored based on a distance from data consumption requirement specified for transmitting the data or the metadata by the network service to one or more requesting devices. 
     
     
         28 . The computer-readable storage medium of  claim 22 , wherein the data container management component manages where the data or the metadata obscured by the at least one mathematical transformation component is stored based on a data scale requirement specified for storage of data or the metadata by the network service. 
     
     
         29 . The computer-readable storage medium of  claim 23 , wherein the key information includes capability information that defines access privileges with respect to the data or the metadata encrypted by the at least one mathematical transformation component. 
     
     
         30 . The computer-readable storage medium of  claim 29 , wherein the capability information is late bound whereby up to date access privileges are granted to a given subscriber. 
     
     
         31 . A computer-readable storage medium, comprising:
 a publisher that publishes selectively accessible data or metadata that is stored in at least one data store, the data store communicatively coupled to the publisher, the published data or metadata obscured with cryptographic key information, the cryptographic key information generated from a first independent device,   wherein a second independent device encrypts the published data or metadata based on the cryptographic key information prior to distributing the data or the metadata as published across a set of data stores while maintaining knowledge of the set of data stores that store the data or the metadata as published as a secret that cannot be revealed without the cryptographic key information,   wherein a network service provides selective access to the data or the metadata as published for a given request to the network service based on late bound selected privileges granted by the publisher,   wherein the data store includes a plurality of containers and the data or the metadata as published is automatically distributed across at least one container of a plurality of containers,   wherein the publisher, the first independent device, the second independent device, and the network service are distinct.   
     
     
         32 . The computer-readable storage medium of  claim 31 , wherein the data store includes a plurality of containers of disparate container types. 
     
     
         33 . The computer-readable storage medium of  claim 31 , wherein the cryptographic key information is a data map for re-assembly of the data across the plurality of containers. 
     
     
         34 . The computer-readable storage medium of  claim 31 , wherein the data or the metadata as published is automatically distributed based on a real-time analysis of storage resources represented by the plurality of containers.