# US 10,372,930 B2 · Hierarchical encryption of data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,372,930 B2
- Document ID: US10372930B2
- Status: Granted
- Kind: B2
- Application number: 15/275,287
- Filed: 2016-09-23
- Published: 2017-12-14
- Granted: 2019-08-06
- Earliest claimed: 2016-06-12
- Assignees: Apple Inc.
- Applicants: Apple Inc.
- Inventors: Nihar Sharma; Xiaonan Ma; Van Hong; Jean-Gabriel Morard; Olivier Bonnet
- Web page: https://patentgrep.com/patent/US10372930B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 16/13: File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06)
- G06F 16/164: {File meta data generation}
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0836: {using tree structure or hierarchical structure}
- H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G06F 2221/2107: File encryption
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 2463/062: applying encryption of the keys
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Some embodiments provide a method for storing multiple data assets in a folder structure on a cloud services platform. The method stores a separate encrypted structure for each of the data assets on the cloud services platform. A same first key provides access to each of the encrypted structures. The method stores, on the cloud services platform, a folder structure with an encrypted copy of the first key. The method stores a parent structure of the folder on the cloud services platform. The parent structure includes an encrypted copy of a second key that provides access to the encrypted copy of the first key.

## Claims

### Claim 1

A method comprising:
storing, by a cloud services computing platform, a separate encrypted structure for each of a plurality of data assets on the cloud services computing platform, wherein a first private key provides access to each of the encrypted structures, each of the encrypted structures encrypted with a first public key;
storing, on the cloud services computing platform, a folder structure with an encrypted copy of the first private key, the first private key encrypted with a second public key; and
storing a parent structure of the folder structure on the cloud services computing platform, the parent structure comprising an encrypted copy of a second private key that provides access to the encrypted copy of the first private key.

### Claim 2 (depends on 1)

The method of claim 1, wherein the second private key is accessible with another key associated with an entity that requires access to the plurality of data assets.

### Claim 3 (depends on 2)

The method of claim 2, wherein the entity is a user account of the cloud services computing platform, wherein the other key is derived from a password for the user account.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
receiving a command to share the plurality of data assets with a user account through the cloud services computing platform; and
adding to the folder structure a second copy of the first private key that is encrypted with another key associated with the user account.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
receiving a command to remove the user account from a list of users with which the plurality of data assets are shared;
removing, from the folder structure, the second encrypted copy of the first private key.

### Claim 6 (depends on 1)

The method of claim 1 further comprising:
receiving addition of a new data asset to the folder structure;
encrypting the new data asset for decryption with the first private key; and
storing the encrypted new data asset on the cloud services computing platform with a reference to the folder structure.

### Claim 7 (depends on 1)

The method of claim 1, wherein the parent structure is a first parent structure, the method further comprising:
receiving input to move the plurality of data assets in the folder structure to a second parent structure;
removing the encrypted copy of the first private key from the folder structure; and
adding a second encrypted copy of the first private key to the folder structure, wherein the second parent structure comprises an encrypted copy of another key that provides access to the second encrypted copy of the first private key.

### Claim 8 (depends on 1)

The method of claim 1, wherein the folder structure represents a note document and the plurality of data assets are attachments to the note document.

### Claim 9 (depends on 1)

The method of claim 1, wherein the folder structure represents a file system folder stored on the cloud services computing platform and at least a subset of the plurality of data assets are files stored in the folder structure, wherein the parent structure represents a parent folder of the file system folder.

### Claim 10 (depends on 1)

The method of claim 1, wherein the folder structure represents a file system folder stored on the cloud services computing platform and at least one data asset is a sub-folder that stores a plurality of files, the method further comprising storing, on the cloud services computing platform, a second folder structure for the sub-folder with an encrypted another key that provides access to each of the files, the other key for decryption with the first private key.

### Claim 11 (depends on 1)

The method of claim 1, further comprising encrypting each of the plurality of data assets with the first public key, wherein encrypting a particular data asset comprises:
encrypting, with the first public key, a third private key in a structure record for the particular data asset; and
encrypting one or more content records for the particular data asset with a third public key.

### Claim 12 (depends on 11)

The method of claim 11, wherein the particular data asset is a document having multiple versions, wherein each version has a separate content record that stores the content of the corresponding version of the document.

### Claim 13

A non-transitory machine readable medium storing a program which when executed by at least one processing unit causes the at least one processing unit to perform operations, the program comprising sets of instructions for:
storing a separate encrypted structure for each of a plurality of data assets on a cloud services platform, wherein a first key provides access to each of the encrypted structures;
storing, on the cloud services platform, a folder structure with an encrypted copy of the first key;
storing a parent structure of the folder structure on the cloud services platform, the parent structure comprising an encrypted copy of a second key that provides access to the encrypted copy of the first key;
adding to the folder structure a second copy of the first key that is encrypted with a third key associated with a user account, responsive to a request to share the plurality of data assets; and
removing the second encrypted copy of the first key from the folder structure responsive to a request to remove the user account from a list of user accounts with which the plurality of data assets are shared.

### Claim 14 (depends on 13)

The non-transitory machine readable medium of claim 13, wherein the second key is accessible with a fourth key associated with an entity that requires access to the plurality of data assets, wherein the entity is another user account of the cloud services platform, wherein the fourth key is derived from a password for the other user account.

### Claim 15 (depends on 13)

The non-transitory machine readable medium of claim 13, wherein the program further comprises sets of instructions for:
receiving input to move the plurality of data assets in the folder structure to a second parent structure;
removing the encrypted copy of the first key from the folder structure; and
adding a second encrypted copy of the first key to the folder structure, wherein the second parent structure comprises an encrypted copy of a fourth key that provides access to the second encrypted copy of the first key.

### Claim 16

An electronic device comprising:
at least one hardware processor;
a non-transitory machine readable medium storing a program comprising sets of instructions for:
storing a separate encrypted structure for each of a plurality of data assets on a cloud services platform, wherein a first key provides access to each of the encrypted structures;
storing, on the cloud services platform, a folder structure with an encrypted copy of the first key;
storing a first parent structure of the folder structure on the cloud services platform, the first parent structure comprising an encrypted copy of a second key that provides access to the encrypted copy of the first key;
receiving input to move the plurality of data assets in the folder structure to a second parent structure;
removing the encrypted copy of the first key from the folder structure; and
adding a second encrypted copy of the first key to the folder structure, wherein the second parent structure comprises an encrypted copy of a third key that provides access to the second encrypted copy of the first key.

### Claim 17 (depends on 16)

The electronic device of claim 16, wherein:
the first key is a first private key, the second key is a second private key, and each of the data assets is encrypted with a first public key, and the first private key is encrypted with a second public key.

### Claim 18 (depends on 16)

The electronic device of claim 16, wherein the program further comprises sets of instructions for:
receiving a command to share the plurality of data assets with a user account through the cloud services platform; and
adding to the folder structure a second copy of the first key that is encrypted with a fourth key associated with the user account.

### Claim 19 (depends on 18)

The electronic device of claim 18, wherein the program further comprises sets of instructions for:
receiving a command to remove the user account from a list of users with which the plurality of data assets are shared; and
removing from the folder structure the second encrypted copy of the first key.

### Claim 20 (depends on 16)

The electronic device of claim 16, wherein the program further comprises sets of instructions for:
receiving addition of a new data asset to the folder structure;
encrypting the new data asset for decryption with the first key; and
storing the encrypted new data asset on the cloud services platform with a reference to the folder structure.