Back to results
US 10,608,817 B2Granted
Secure and zero knowledge data sharing for cloud applications
AssigneeMasimo Corporation
InventorsAmer Haider, Ali Ahmed
Life of this patent
Estimating the term…
Abstract
Disclosed is a zero-knowledge distributed application configured to securely share information among groups of users having various roles, such as doctors and patients. Confidential information may be encrypted client-side, with private keys that reside solely client side. Encrypted collections of data may be uploaded to, and hosted by, a server that does not have access to keys suitable to decrypt the data. Other users may retrieve encrypted data from the server and decrypt some or all of the data with keys suitable to gain access to at least part of the encrypted data. The system includes a key hierarchy with multiple entry points to a top layer by which access is selectively granted to various users and keys may be recovered.
Claims24
A method, comprising:
- obtaining, by one or more processors of a first client device, a private key for a first user of the first client device that is paired to a public key for the first user of the first client device;
- receiving, by one or more processors of the first client device, encrypted user data over a network, the encrypted user data having been created by a second user of a second client device;
- receiving, by one or more processors of the first client device, a shared data key hierarchy structure (SD-KHS) over the network, the SD-KHS comprising one or more encrypted shared data encryption keys (ESDEKs);
- decrypting, by one or more processors of the first client device, an ESDEK with the private key to make available a shared data encryption key (SDEK);
- and
- decrypting, by one or more processors of the first client device, the encrypted user data with the SDEK to make available the user data;
- editing, by one or more processors of the first client device, one or more elements of the user data;
- encrypting, by one or more processors of the first client device, a notification message using a public key for the second user of the second user device, wherein the notification message comprises an indication of the user data having been edited to at least the second user of the second user device;
- and
- sending, by one or more processors of the first client device, the notification message over the network.
7 more elements
A method, comprising:
- deriving, by one or more client-side processors, a derived key (DK) based on information provided by a user of a client device without the information or the DK being made available to other parties;
- receiving, by one or more client-side processors, encrypted user data sent from a server over a network, the encrypted user data having been created by the user of the client device;
- decrypting, by one or more client-side processors, an encrypted master encryption key (EMEK) with the DK to make available a master encryption key (MEK), wherein the MEK serves to encrypt data encryption keys;
- decrypting, by one or more client-side processors, an encrypted data encryption key (EDEK) with the MEK to make available a data encryption key (DEK), wherein the DEK serves to encrypt user data;
- decrypting, by one or more client-side processors, the encrypted user data with the DEK;
- decrypting, by one or more client-side processors, another encrypted data encryption key with the MEK to make available a private key, the private key being paired to a public key stored in a lookup directory of the server device;
- receiving, by one or more client-side processors, encrypted shared user data sent from the server device over the network, the encrypted shared user data having been created by another user of another client device;
- receiving, by one or more client-side processors, a shared data key hierarchy structure sent from the server device over the network, the shared data key hierarchy structure comprising one or more encrypted shared data encryption keys (ESDEKs) and having been created for the another client device;
- decrypting, by one or more client-side processors, an ESDEK with the private key to make available a shared data encryption key (SDEK);
- and
- decrypting, by one or more client-side processors, the encrypted shared user data with the SDEK.
8 more elements
A tangible, non-transitory, machine-readable media storing instructions that when executed by a client computing device in a zero knowledge messaging system effectuate operations comprising:
- deriving, by the one or more client-side processors, a derived key (DK) based on information provided by a user of the client device without the information or the DK being made available to other parties;
- receiving, by the one or more client-side processors, encrypted user data sent from another device over a network;
- decrypting, by the one or more client-side processors, an encrypted master encryption key (EMEK) with the DK to make available a master encryption key (MEK), wherein the MEK serves to encrypt data encryption keys;
- decrypting, by the one or more client-side processors, an encrypted data encryption key (EDEK) with the MEK to make available a data encryption key (DEK), wherein the DEK serves to encrypt user data;
- and
- decrypting, by the one or more client-side processors, the encrypted user data with the DEK,
- generating, by the one or more client-side processors, a random salt variable;
- hashing, by the one or more client-side processors, the password;
- and
- repetitively applying a pseudorandom function, by the one or more client-side processors, to the hashed password and the random salt variable;
- generating, by the one or more client-side processors, a random salt variable;
- hashing, by the one or more client-side processors, the password;
- and
- repetitively applying a pseudorandom function, by the one or more client-side processors, to the hashed password and the random salt variable.
11 more elements
Dependencies are inferred from the claim text.