Secure data storage

Abstract

A method and apparatus for storing data and performing logical comparisons and other operations on said data, the results of said comparisons and operations reveal only limited information about the stored data. Stored data may include, but is not limited to, confidential information such as passwords, biometric data, credit card data, personal identifiers that uniquely identify an individual, authorisation levels where an entity may make a claim to have a certain level of access right or authorisation, votes cast in an election, and encryption keys. Control logic within the apparatus prevents direct access to the data store other than via a restricted command interface which prevents data from being revealed. For example, operations such as checking a putative password against a password in the data store is performed by the apparatus which returns a pass or fail, but does not reveal the stored password.

1 . A comparator store apparatus, including a processor, a non-transitory memory and a first interface,
 the memory configured to store information, wherein the information stored in the memory comprises indices and data associated with each index,   the processor configured to receive data and an associated index via the first interface, and to store the data in association with the index in the memory as part of the stored information,   the processor configured to receive comparison data, and an associated comparison index, via the first interface; to verify the comparison data in relation to the associated comparison index using the stored information, and to return via the first interface an indication of success or failure of the comparison data in relation to the associated comparison index,   and wherein the information stored in the memory is not extractable from the memory via the first interface of the apparatus.   
     
     
         2 . The comparator store apparatus of  claim 1 , wherein the indication of success or failure of the comparison data in relation to the associated comparison index is a byte of data. 
     
     
         3 . The comparator store apparatus of  claim 1 , wherein the comparator store apparatus is a hardware storage device. 
     
     
         4 . The comparator store apparatus of  claim 1 , wherein the data associated with an index is updatable via the first interface, in response to the processor receiving update data and specific secret information already stored on the comparator store apparatus. 
     
     
         5 . The comparator store apparatus of  claim 4 , wherein the data associated with the index is updatable via the first interface, in response to the processor receiving update data and specific secret information already stored on the comparator store apparatus under certain indices. 
     
     
         6 . The comparator store apparatus of  claim 1 , wherein the comparator store apparatus includes a second interface, wherein the apparatus is configured to send data stored in association with an index in the memory via the second interface, in response to a command received via the first interface. 
     
     
         7 . The comparator store apparatus of  claim 6 , wherein the apparatus is not configured to send data stored in association with the index in the memory via the second interface, in response to a command received via the second interface. 
     
     
         8 . The comparator store apparatus of  claim 1 , wherein the processor is arranged not to be programmable at run-time. 
     
     
         9 . The comparator store apparatus of  claim 1 , wherein the processor is configured to only accept input messages up to a predetermined length and to reject or truncate input messages that are larger than the predetermined length. 
     
     
         10 . The comparator store apparatus of  claim 1 , wherein the comparator store apparatus includes multiple comparator store sub-apparatuses, to achieve fault tolerance. 
     
     
         11 . The comparator store apparatus of  claim 1 , wherein the apparatus further comprises a third interface for providing information to a back-up entity and wherein the processor is configured to provide secure data, in encrypted form, to the back up entity via the third interface. 
     
     
         12 . The comparator store apparatus of  claim 1 , wherein the memory comprises memory organized as a hash table for storing the information being organized as a single uniform space of blocks, each of which accommodates a user profile. 
     
     
         13 . The comparator store apparatus of  claim 12 , wherein the memory is configured to store data and metadata associated with a user profile in the same block of the uniform space of blocks. 
     
     
         14 . The comparator store apparatus of  claim 12 , wherein the memory allows single block writes, removing the need for secondary tables of metadata, which improves write and read times and the risk of data inconsistency is reduced. 
     
     
         15 . The comparator store apparatus of  claim 1 , wherein the processor is configured to perform a limited number of pre-determined operations on the information stored in the memory. 
     
     
         16 . The comparator store apparatus of  claim 1 , wherein the information is kept secure from unauthorized access. 
     
     
         17 . The comparator store apparatus of  claim 1 , wherein the processor is configured to receive the data and the associated index via the first interface from an application server. 
     
     
         18 . The comparator store apparatus of  claim 1 , wherein the information stored in the memory comprises user ids and one or more out of passwords, biometric data and pins associated with the user ids for one or more external resources. 
     
     
         19 . The comparator store apparatus of  claim 1 , wherein the memory is arranged to be accessible to the processor only. 
     
     
         20 . The comparator store apparatus of  claim 1 , wherein the processor and the memory comprise a single integrated circuit. 
     
     
         21 . The comparator store apparatus of  claim 1 , wherein the processor is configured to process the received comparison data, and the associated comparison index, before performing verification using the stored information. 
     
     
         22 . The comparator store apparatus of  claim 1 , wherein the processor and the first interface are configured to provide a limited, specific interface to the outside world that only allows the operations of storing, comparing, updating and deleting data and additional management functions that do not affect or disclose data. 
     
     
         23 . The comparator store apparatus of  claim 1 , wherein the processor is implemented as a Harvard architecture processor, a special purpose field programmable gate array (FPGA) or an application specific integrated circuit (ASIC) processor that prohibits code injection attacks against the processor. 
     
     
         24 . The comparator store apparatus of  claim 1 , wherein the processor is further configured to return via the first interface an indication of an error condition, with respect to the comparison data in relation to the associated comparison index.