# US 10,769,285 B2 · Privacy enabled runtime

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,769,285 B2
- Document ID: US10769285B2
- Status: Granted
- Kind: B2
- Application number: 15/157,919
- Filed: 2016-05-18
- Published: 2017-11-23
- Granted: 2020-09-08
- Earliest claimed: 2016-05-18
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Victor G. Alonzo; Zachary A. Burns; Yuk L. Chan; Gisela C. Cheng; Kin K. Choi; Kin Ng
- Web page: https://patentgrep.com/patent/US10769285B2

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/02: {for separating internal from external traffic, e.g. firewalls}
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H04L 2209/80: Wireless
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Technical solutions are described for securing data by a communication apparatus. An example computer-implemented method includes receiving, by an encryption engine, a request to apply cryptography to input data. The computer-implemented method also includes generating metadata for the input data, where the metadata identifies characteristics of content included in the input data. The method further includes applying a cryptographic technique to the input data to generate output data, and outputting the output data and metadata in response to the request.

## Claims

### Claim 1

An apparatus for securing data, the apparatus comprising:
a memory;
a communication interface; and
an encryption engine, having an encryption unit and an analytics unit, communicably coupled with the memory and the communication interface, the encryption engine configured to:
receive a request to apply cryptography to input data;
generate metadata for the input data using the analytics unit, wherein the metadata identifies characteristics of content included in the input data;
generate output data by applying a cryptographic technique to the input data;
return the output data and the metadata in response to the request, wherein the encryption unit and the analytics unit are on separate hardware units,
wherein the metadata includes a first metadata instance and a second metadata instance, the first metadata instance identifies a first set of characteristics in the input data, and the second metadata instance identifies a second set of characteristics in the input data, and
wherein the encryption engine applies a first cryptographic technique to the first metadata instance and a second cryptographic technique to the second metadata instance, the first cryptographic technique being distinct from the second cryptographic technique;
wherein the encryption engine further comprises a firewall, wherein the first metadata instance is decipherable by the firewall and the second metadata instance is not decipherable by the firewall.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the cryptographic technique is a first cryptographic technique, and wherein the encryption engine is further configured to apply a second cryptographic technique to the metadata, the second cryptographic technique being distinct from the first cryptographic technique.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the encryption engine is further configured to record a mapping between the metadata and an identity of an application that sent the request to apply cryptography to input data.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the encryption engine is further configured to record a mapping between the metadata and an identity of a user executing an application that sent the request to apply cryptography to input data.