Abstract: A method and apparatus for securing a directed acyclic graph (DAG) is described. In one embodiment, an algorithm enables encryption of a DAG given a start node (an entrypoint), the node key for that node, and a path to traverse in the graph. A unique and cryptographically random key is generated for each node (sometimes referred herein as a unique node key). The node key encrypts the node it is generated for and also any edges exiting the node. The node key is stored on the incoming edge to the node (the edge from its parent node) encrypted with the node key of the parent node. Storing the keys on the edges of the DAG instead of on nodes of the DAG enables efficient querying of the DAG and the ability for a node to have multiple parents that may change without affecting the node's relationship with the non-changing parents.

Abstract: A method and apparatus for securing a directed acyclic graph (DAG) is described. In one embodiment, an algorithm for encrypting a DAG is described that enables encryption of a DAG given a start node (an entrypoint), the node key for that node, and a path to traverse in the graph, where keys are stored on the edges of the DAG instead of on nodes of the DAG. Storing the keys on the edges of the DAG instead of on nodes of the DAG enables efficient querying of the DAG and the ability for a node to have multiple parents that may change without affecting the node's relationship with the non-changing parents. A unique and cryptographically random key is generated for each node created within the DAG (sometimes referred herein as a unique node key). The node key encrypts the node it is generated for and also any edges exiting the node. The node key is not stored with the node.