# US 12,010,232 B2 · User-friendly, secure and auditable cryptography administration system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,232 B2
- Document ID: US12010232B2
- Status: Granted
- Kind: B2
- Application number: 17/502,624
- Filed: 2021-10-15
- Published: 2023-03-30
- Granted: 2024-06-11
- Earliest claimed: 2021-09-30
- Assignees: Palantir Technologies Inc.
- Applicants: Palantir Technologies Inc.
- Inventors: Mihir Patil; Hugo Dobbelaere; Yeong Wei Wee; Maia Hamin; Piotr Kraus; Yurii Mashtalir; Hussein Farah; Alexander Galimberti; Caterina Wanka; Lukas Czypulovski; Juraj Micko; Nezihe Pehlivan
- Web page: https://patentgrep.com/patent/US12010232B2

## CPC

- H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)}
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/606: {by securing the transmission between two devices or processes}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 2209/60: Digital content management, e.g. content distribution
- H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A cryptography administration system facilitates secure, user-friendly and auditable cryptography. An administrator may create channels with associated cryptographic keys and algorithms for performing cryptographic operations such as encryption and decryption. The channel may be associated with licenses which may include permissions to perform cryptographic operations. The licenses may be shared with one or more users. A user may perform cryptographic operations using the channel according to the permissions and operations included in the licenses, to which the user has access, associated with the channel. The user does not need a technical understanding of the cryptographic system (e.g., keys and algorithms) to perform the cryptographic operations and does not need access to the keys to perform the operations. The cryptographic operations may be stored in an audit log that can be reviewed by user.

## Claims

### Claim 1

A computing system configured to provide a cryptography administration system, the computing system comprising:
a computer readable storage medium having program instructions embodied therewith; and
one or more processors configured to execute the program instructions to cause the computing system to:
display, via an interactive user interface, a raw data set including a plurality of raw data values;
receive, via the interactive user interface, a user selection of one or more of the raw data values;
receive, via the interactive user interface, a user selection of a cryptography algorithm;
generate one or more cryptography keys;
initiate generation of a channel associated with the selected cryptography algorithm and the one or more cryptography keys, wherein the channel is accessible by a plurality of front-end applications to facilitate encryption and decryption operations;
generate a channel identifier associated with the channel, the channel identifier comprising a pointer configured to access a location in storage associated with the channel, the location in storage comprising the one or more cryptography keys;
generate one or more encrypted data values by encrypting the one or more selected raw data values based, at least in part, on the selected cryptography algorithm associated with the channel, the one or more encrypted data values comprising the channel identifier;
receive, via the interactive user interface, a user input of a third-party user;
generate a license comprising one or more permissions of the third-party user to perform decryption operations on the encrypted data values via a front-end application that accesses the channel to initiate said decryption operations; and
store the license in the location in storage accessible by the pointer as part of the channel identifier.

### Claim 2 (depends on 1)

The computing system of claim 1, wherein said generating the license further comprises:
display, via an interactive user interface, a plurality of permissions and a plurality of operations;
receive, via the interactive user interface, selection of the one or more permissions of the third-party user; and
receive, via the interactive user interface, selection of one or more of the plurality of operations permitted by the third-party user, wherein the license includes indications of the selected permissions and operations.

### Claim 3 (depends on 2)

The computing system of claim 2, wherein the plurality of operations comprises encrypting and decrypting data.

### Claim 4 (depends on 2)

The computing system of claim 2, wherein the plurality of permissions comprise one or more of encrypting and/or decrypting full data sets, encrypting and/or decrypting individual values, or a rate at which data may be encrypted and/or decrypted.

### Claim 5 (depends on 1)

The computing system of claim 1, wherein the one or more processors are further configured to execute the program instructions to cause the computing system to:
display, via the interactive user interface, one or more cryptography algorithms selectable by the user, and
wherein the one or more cryptography algorithms comprise one or more of a user-configured algorithm, a preconfigured algorithm, or a third-party configured algorithm.

### Claim 6 (depends on 1)

The computing system of claim 1, wherein the one or more cryptography keys and the selected cryptography algorithm are stored in one or more storage devices local to the cryptography administration system.

### Claim 7 (depends on 1)

The computing system of claim 1, wherein the one or more cryptography keys and the selected cryptography algorithm are stored in one or more storage devices remote to the cryptography administration system, and wherein generating the one or more encrypted data values is done remotely from the cryptography administration system.

### Claim 8 (depends on 1)

The computing system of claim 1, wherein the one or more processors are further configured to execute the program instructions to cause the computing system to generate a plurality of licenses and wherein the channel further comprises the plurality of licenses.

### Claim 9 (depends on 1)

The computing system of claim 1, wherein the one or more processors are further configured to execute the program instructions to cause the computing system to receive, via the interactive user interface, input by a user of a justification prompt associated with the generated license.

### Claim 10 (depends on 9)

The computing system of claim 9, wherein the justification prompt comprises a prompt question and one or more justification options.

### Claim 11

A method of decrypting data, the method comprising:
receiving, at a cryptography device from a requesting device, an encrypted value comprising metadata for accessing stored data;
identifying a user requesting decryption of the encrypted value;
identifying a channel based on the metadata, wherein the channel includes one or more licenses associated with respective users and corresponding user permissions;
determining a license associated with the user among the one or more licenses of the identified channel;
determining one or more permissions of the user based on the determined license;
in response to determining that the one or more permissions include a decryption permission, accessing a cryptography key and a cryptography algorithm associated with the channel from a location in storage based on at least the metadata of the encrypted value;
generating a decrypted value by decrypting the encrypted value using the cryptography key and the cryptography algorithm; and
transmitting the decrypted value to the requesting device.

### Claim 12 (depends on 11)

The method of claim 11, wherein the one or more permissions comprise one or more of encrypting and/or decrypting full data sets, encrypting and/or decrypting individual values, or a rate at which data may be encrypted and/or decrypted by the identified user.

### Claim 13 (depends on 11)

The method of claim 11, further comprising generating an audit log.

### Claim 14 (depends on 13)

The method of claim 13, wherein the audit log comprises an indication of the identified user and a date and time of receiving the encrypted value.

### Claim 15 (depends on 11)

The method of claim 11, further comprising displaying a justification prompt, wherein the justification prompt comprises a prompt question and one or more justification options, and receiving a user selection of a justification option.

### Claim 16 (depends on 15)

The method of claim 15, further comprising generating an audit log, wherein the audit log comprises the received justification option, the indication of the identified user and a date and time of receiving the encrypted value.

### Claim 17 (depends on 11)

The method of claim 11, wherein determining the cryptography key and the cryptography algorithm associated with the channel comprises retrieving the cryptography key and the cryptography algorithm from one or more storage devices local to the cryptography device.

### Claim 18 (depends on 11)

The method of claim 11, wherein determining the cryptography key and the cryptography algorithm associated with the channel comprises retrieving the cryptography key and the cryptography algorithm from one or more storage devices remote to the cryptography device.

### Claim 19 (depends on 11)

The method of claim 11, wherein the identified user does not have direct access to the cryptography key or the cryptography algorithm.

### Claim 20 (depends on 11)

The method of claim 11, wherein generating the decrypted value is done remotely from the cryptography device.