# US 12,003,634 B2 · Systems and methods for encrypted content management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,634 B2
- Document ID: US12003634B2
- Status: Granted
- Kind: B2
- Application number: 18/174,713
- Filed: 2023-02-27
- Published: 2023-07-20
- Granted: 2024-06-04
- Earliest claimed: 2021-01-18
- Assignees: Axiom Technologies LLC
- Applicants: Axiom Technologies LLC
- Inventors: Maxwell Doherty; Jonathan Graham
- Web page: https://patentgrep.com/patent/US12003634B2

## CPC

- H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 9/065: {Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3}
- H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/16: the keys or algorithms being changed during operation
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods for encrypted content management are provided and include generating a user private key, a user public key, and a symmetric encryption key. A group private key, a group public key, and a group symmetric encryption key are generated and the group private key is encrypted with the group symmetric encryption key. A first shared-secret key is generated based on the user public key and the group private key using a diffie-hellman exchange algorithm. The group symmetric encryption key is encrypted using the first shared-secret key to generate an escrow key. Plaintext data is encrypted using a content symmetric key. A second shared-secret key is generated based on an ephemeral private key and the group public key using a diffie-hellman exchange algorithm. The content symmetric key is encrypted using the second shared-secret key.

## Claims

### Claim 1

A method comprising:
receiving, with an encrypted content management module, a user public key and a user escrow key transmitted from a client module, the client module having a processor and memory configured to (i) generate an asymmetric key pair for a user, including a user private key and the user public key, (ii) generate a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user, (iii) encrypt the user private key using the symmetric encryption key to generate the user escrow key, (iv) transmit the user public key and the user escrow key, (v) encrypt plaintext data into ciphertext data using a content symmetric key, (vi) store the ciphertext data in a data storage unit, and generate an ephemeral pair of keys including an ephemeral public key and an ephemeral private key;
storing, with the encrypted content management module, the user public key and the user escrow key;
transmitting, with the encrypted content management module, the user public key to the client module, the processor and memory of the client module being further configured to (vii) generate a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm, (viii) encrypt the content symmetric key using the shared-secret key, and (ix) communicate the encrypted content symmetric key and the ephemeral public key to the encrypted content management module;
receiving, with the encrypted content management module, the encrypted content symmetric key and the ephemeral public key from the client module and
storing, with the encrypted content management module, the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
receiving, with the encrypted content management module, a request from the client module for the user escrow key;
transmitting, with the encrypted content management module, the user escrow key to the client module, the processor and memory of the client module being further configured to generate the symmetric encryption key based on the unique information known only to the user, and decrypt the user escrow key with the symmetric encryption key to obtain the user private key;
receiving, with the encrypted content management module, a request from the client module for the ephemeral public key;
transmitting, with the encrypted content management module, the ephemeral public key to the client module, the processor and memory of the client module being further configured to generate the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm;
receiving, with the encrypted content management module, a request from the client module for the encrypted content symmetric key;
transmitting, with the encrypted content management module, the encrypted content symmetric key to the client module, the processor and memory of the client module being further configured to decrypt the encrypted content symmetric key using the shared-secret key, retrieve the ciphertext data from the data storage unit, and decrypt the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.

### Claim 3 (depends on 1)

The method of claim 1, wherein the unique information known to the user is a password.

### Claim 4 (depends on 1)

The method of claim 1, wherein the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.

### Claim 5 (depends on 4)

The method of claim 4, wherein the cryptographic hardware is at least one of a smart card and a hardware token.

### Claim 6 (depends on 1)

The method of claim 1, wherein the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.

### Claim 7 (depends on 1)

The method of claim 1, wherein code for the client module is communicated over the network to an application module in communication with the data storage unit.

### Claim 8 (depends on 7)

The method of claim 7, wherein the code for the client module and the client module are each secured and protected from modification by the application module.

### Claim 9 (depends on 7)

The method of claim 7, wherein the unique information known to the user is provided directly to the client module without being received by the application module.

### Claim 10 (depends on 7)

The method of claim 7, wherein the processor and memory of the client module are further configured to display the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibiting access to the plaintext data by the application module.

### Claim 11 (depends on 1)

The method of claim 1, wherein the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.

### Claim 12

A system comprising:
at least one processor and memory storing code for an encrypted content management module that, when executed by the at least one processor, causes the at least one processor to:
receive a user public key and a user escrow key transmitted from a client module, the client module having a processor and memory configured to (i) generate an asymmetric key pair for a user, including a user private key and the user public key, (ii) generate a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user, (iii) encrypt the user private key using the symmetric encryption key to generate the user escrow key, (iv) transmit the user public key and the user escrow key, (v) encrypt plaintext data into ciphertext data using a content symmetric key, (vi) store the ciphertext data in a data storage unit, and generate an ephemeral pair of keys including an ephemeral public key and an ephemeral private key;
store the user public key and the user escrow key;
transmit the user public key to the client module, the processor and memory of the client module being further configured to (vii) generate a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm, (viii) encrypt the content symmetric key using the shared-secret key, and (ix) communicate the encrypted content symmetric key and the ephemeral public key to the encrypted content management module;
receive the encrypted content symmetric key and the ephemeral public key from the client module and
store the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.

### Claim 13 (depends on 12)

The system of claim 12, wherein the code for the encrypted content management module, when executed by the at least one processor, further causes the at least one processor to:
transmit the user escrow key to the client module in response to receiving a request for the user escrow key from the client module, the processor and memory of the client module being further configured to generate the symmetric encryption key based on the unique information known to the user, and decrypt the user escrow key with the symmetric encryption key to obtain the user private key;
transmit the ephemeral public key and the encrypted content symmetric key to the client module in response to receiving a request for the ephemeral public key and the encrypted content symmetric key from the client module, the processor and memory of the client module being further configured to generate the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm, decrypt the encrypted content symmetric key using the shared-secret key, retrieve the ciphertext data from the data storage unit, and decrypt the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.

### Claim 14 (depends on 12)

The system of claim 12, wherein the unique information known to the user is a password.

### Claim 15 (depends on 12)

The system of claim 12, wherein the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.

### Claim 16 (depends on 15)

The system of claim 15, wherein the cryptographic hardware is at least one of a smart card and a hardware token.

### Claim 17 (depends on 16)

The system of claim 16, wherein the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.

### Claim 18 (depends on 16)

The system of claim 16, wherein code for the client module is communicated over the network to an application module in communication with the data storage unit.

### Claim 19 (depends on 18)

The system of claim 18, wherein the code for the client module and the client module are each secured and protected from modification by the application module.

### Claim 20 (depends on 18)

The system of claim 18, wherein the unique information known to the user is provided directly to the client module without being received by the application module.

### Claim 21 (depends on 18)

The system of claim 18, wherein the processor and memory of the client module are further configured to display the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibit access to the plaintext data by the application module.

### Claim 22 (depends on 12)

The system of claim 12, wherein the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.