# US 10,484,352 B2 · Data operations using a proxy encryption key > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,352 B2 - Document ID: US10484352B2 - Status: Granted - Kind: B2 - Application number: 15/616,392 - Filed: 2017-06-07 - Published: 2018-10-04 - Granted: 2019-11-19 - Earliest claimed: 2017-03-31 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Mitica Manu; Baskar Sridharan; Raghunath Ramakrishnan; Sriram K. Rajamani; Victor V. Boyko; Pushkar Vijay Chitnis; Shastry M. C. Shankara; Ramarathnam Venkatesan - Web page: https://patentgrep.com/patent/US10484352B2 ## CPC - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6281: {at program execution time, where the protection is within the operating system} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/064: {Hierarchical key distribution, e.g. by multi-tier trusted parties} - G06F 2212/1052: Security improvement - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Operating upon encrypted data with a particular data scope. A base encryption key is established and associated with the particular data scope, and then stored in a base encryption key store. That base encryption key store might be managed by an application or service that stores base encryption keys for multiple data scopes. A proxy encryption key acts as a kind of proxy for the base encryption key. The proxy encryption key may be used for frequent operations on encrypted data within the particular data scope. Thus, the principles described herein act as a frequency amplifier that allows key-based operations upon the particular data scope to be performed at much higher frequencies than otherwise would be possible by operating directly using the base encryption key. ## Claims ### Claim 1 A computing system comprising: one or more processors; one or more computer-readable hardware storage device having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to perform a method for operating upon encrypted data within a particular data scope for which there is a base encryption key established and stored in a base encryption key store that stores base encryption keys for a plurality of data scopes so as not to thereafter reveal the base encryption key to the computing system, the method comprising: causing a base encryption key to be established, associated with the particular data scope, and stored in a base encryption key store establishing a proxy encryption key that is also associated with the particular data scope; causing the proxy encryption key to be encrypted using the base encryption key; storing the encrypted proxy encryption key in a proxy encryption key store; performing a plurality of operations using the encrypted proxy encryption key, a first operation of the plurality of operations involving accessing the encrypted proxy encryption key from the proxy encryption key store, acquire a decrypted form of the proxy encryption key that was decrypted using the base encryption key, and storing the decrypted form of the proxy encryption key in protected cache, the remainder of the plurality of operations using the cached decrypted form of the proxy encryption key to perform the respective remainder of the plurality of operations; and after the plurality of operations are performed, removing the decrypted form of the proxy encryption key from the protected cache. ### Claim 2 (depends on 1) The computing system in accordance with claim 1, the act of acquiring the decrypted form of the proxy encryption key comprising: sending a request to an application that manages the base encryption key store to decrypt the encrypted proxy encryption key, and receiving the decrypted form of the proxy encryption key from the application that may also manage the base encryption key store. ### Claim 3 (depends on 2) The computing system in accordance with claim 2, the data scope being an account associated with a particular user entity, the request being signed with a key associated with the particular user entity. ### Claim 4 (depends on 1) The computing system in accordance with claim 1, the plurality of operations comprising operations on different portions of the particular data scope, each different portion stored in encrypted form and being encrypted using a different portion encryption key that is derived from the proxy encryption key, wherein when an operation is performed on a portion of the particular data scope for which there is not presently a portion encryption key available, the portion encryption key is derived from the decrypted form of the proxy encryption key. ### Claim 5 (depends on 1) The computing system in accordance with claim 1, the data scope being a populated file system. ### Claim 6 (depends on 5) The computing system in accordance with claim 5, the first operation of the plurality of operations comprising opening a file of the populated file system, at least some of the remainder of the plurality of operations comprising performing operations on the opened file. ### Claim 7 (depends on 1) The computing system in accordance with claim 1, performing a plurality of operations using the encrypted proxy encryption key, comprising: for each of the plurality of operations, checking to see if a decrypted form of a proxy encryption key is already in the protected cache, and if so, performing the operation using the decrypted form of the proxy encryption key that is already in the protected cache, and if not, acquiring a decrypted form of the proxy encryption key from an application that manages the base encryption key store and that decrypts the encrypted proxy encryption key using the base encryption key. ### Claim 8 (depends on 1) The computing system in accordance with claim 1, the data scope being an account associated with a particular user entity. ### Claim 9 (depends on 8) The computing system in accordance with claim 8, the method further comprising the following prior to establishing the proxy encryption key: authenticating the particular user entity; and receiving authorization from the particular user entity to establish proxy encryption key. ### Claim 10 (depends on 8) The computing system in accordance with claim 8, the base encryption key being selected by the particular user entity. ### Claim 11 (depends on 8) The computing system in accordance with claim 8, management policy for the base encryption key being selected by the particular user entity. ### Claim 12 (depends on 8) The computing system in accordance with claim 8, management policy for the base encryption key being selected by an application that manages the base encryption key store. ### Claim 13 (depends on 8) The computing system in accordance with claim 8, the proxy encryption key store also storing one or more keys for operation on data outside of the data scope and that is also authorized to be accessed by the particular user entity. ### Claim 14 (depends on 1) The computing system in accordance with claim 1, the base encryption key being selected by an application that manages the base encryption key store. ### Claim 15 (depends on 1) The computing system in accordance with claim 1, the particular data scope comprising data that is stored at the computing system. ### Claim 16 (depends on 1) The computing system in accordance with claim 1, the method further comprising: garbage collecting the encrypted proxy encryption key after detecting that the base encryption key has been deleted. ### Claim 17 (depends on 1) The computing system in accordance with claim 1, wherein access to the base encryption key stored in the base encryption key store occurs at a frequency that is at least two orders of magnitude less frequent than the frequency at which the decrypted form of the proxy encryption key is accessed from the protected cache. ### Claim 18 (depends on 1) The computing system in accordance with claim 1, wherein access to the base encryption key stored in the base encryption key store occurs at a frequency that is at least three orders of magnitude less frequent than the frequency at which the decrypted form of the proxy encryption key is accessed from the protected cache. ### Claim 19 A method for operating upon encrypted data within a particular data scope for which there is a base encryption key established and stored in a base encryption key store that stores base encryption keys for a plurality of data scopes so as not to thereafter reveal the base encryption key to the computing system, the method comprising: causing a base encryption key to be established, associated with the particular data scope, and stored in a base encryption key store establishing a proxy encryption key that is also associated with the particular data scope; causing the proxy encryption key to be encrypted using the base encryption key; storing the encrypted proxy encryption key in a proxy encryption key store; performing a plurality of operations using the encrypted proxy encryption key, a first operation of the plurality of operations involving accessing the encrypted proxy encryption key from the proxy encryption key store, acquire a decrypted form of the proxy encryption key that was decrypted using the base encryption key, and storing the decrypted form of the proxy encryption key in protected cache, the remainder of the plurality of operations using the cached decrypted form of the proxy encryption key to perform the respective remainder of the plurality of operations; and after the plurality of operations are performed, removing the decrypted form of the proxy encryption key from the protected cache. ### Claim 20 A computer program product comprising one or more computer-readable hardware storage device having computer-executable instructions that are structured such that, when executed by one or more processors of a computing system, the computing system is caused to perform a method for operating upon encrypted data within a particular data scope for which there is a base encryption key established and stored in a base encryption key store that stores base encryption keys for a plurality of data scopes so as not to thereafter reveal the base encryption key to the computing system, the method comprising: causing a base encryption key to be established, associated with the particular data scope, and stored in a base encryption key store establishing a proxy encryption key that is also associated with the particular data scope; causing the proxy encryption key to be encrypted using the base encryption key; storing the encrypted proxy encryption key in a proxy encryption key store; performing a plurality of operations using the encrypted proxy encryption key, a first operation of the plurality of operations involving accessing the encrypted proxy encryption key from the proxy encryption key store, acquire a decrypted form of the proxy encryption key that was decrypted using the base encryption key, and storing the decrypted form of the proxy encryption key in protected cache, the remainder of the plurality of operations using the cached decrypted form of the proxy encryption key to perform the respective remainder of the plurality of operations; and after the plurality of operations are performed, removing the decrypted form of the proxy encryption key from the cache.