# US 12,015,699 B2 · Method, apparatus, and computer program product for encryption key management within a group-based communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,699 B2 - Document ID: US12015699B2 - Status: Granted - Kind: B2 - Application number: 16/989,452 - Filed: 2020-08-10 - Published: 2020-11-26 - Granted: 2024-06-18 - Earliest claimed: 2018-06-06 - Assignees: Salesforce, Inc. - Applicants: Slack Technologies, Inc. - Inventors: Richard Crowley; Audrei Drummond; Jessica Fain; Leah Jones; Ilan Frank; Nikolas Kinkel - Web page: https://patentgrep.com/patent/US12015699B2 ## CPC - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/321: {involving a third party or a trusted authority} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various embodiments are directed to systems and methods for encryption key management within a group-based communication platform. ## Claims ### Claim 1 One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method of providing encryption key management, the method comprising the steps of: receiving, from a server, an encrypt request, the encrypt request comprising an encryption key request data structure and encrypt request plaintext, wherein the encryption key request data structure comprises one or more keyscope components, and the encrypt request plaintext comprises one or more of a message plaintext, a file plaintext, or a search index plaintext; upon determining that an encryption key associated with the encryption key request data structure is not stored in at least one local memory, transmitting an encryption key generation request to a key server, the encryption key generation request comprising the encryption key request data structure; upon determining that the key server has not responded with one or more of the encryption key and encryption key ciphertext, transmitting an encrypt request error to the server, wherein the encrypt request error comprises an electronic message indicating that access to a requested encryption key is denied; and revoking, on a per keyscope component basis, access to encryption keys associated with the one or more keyscope components. ### Claim 2 (depends on 1) The media of claim 1, wherein the method further comprises the step of revoking access to data associated with a revoked keyscope component while maintaining access to other data owned by the key server. ### Claim 3 (depends on 2) The media of claim 2, wherein the method further comprises the steps of: transmitting, to the server, at least a part of the encryption key request data structure; and storing the at least a part of the encryption key request data structure in a repository. ### Claim 4 (depends on 1) The media of claim 1, wherein the encryption key associated with the encryption key request data structure is unique to an organization and not shared with other organizations. ### Claim 5 (depends on 4) The media of claim 4, wherein the organization can revoke the encryption key associated with the encryption key request data structure at any time. ### Claim 6 (depends on 4) The media of claim 4, wherein the one or more keyscope components include an organization identifier, a workspace identifier, a channel identifier, a timestamp, or a user identifier. ### Claim 7 (depends on 1) The media of claim 1, wherein the method further comprises the step of refreshing the at least one local memory, and wherein refreshing the at least one local memory occurs after lapsing of an encryption key management cache persistence period and prior to determining that the encryption key associated with the encryption key request data structure is not stored in the at least one local memory. ### Claim 8 A method of providing encryption key management comprising the steps of: receiving, from a server, an encrypt request, the encrypt request comprising an encryption key request data structure and encrypt request plaintext, wherein the encryption key request data structure comprises one or more keyscope components, and the encrypt request plaintext comprises one or more of a message plaintext, a file plaintext, or a search index plaintext; upon determining that an encryption key associated with the encryption key request data structure is not stored in at least one local memory, transmitting an encryption key generation request to a key server, the encryption key generation request comprising the encryption key request data structure; upon determining that the key server has not responded with one or more of the encryption key and encryption key cipher text, transmitting an encrypt request error to the server, wherein the encrypt request error comprises an electronic message indicating that access to a requested encryption key is denied; and revoking, on a per keyscope component basis, access to encryption keys associated with the one or more keyscope components. ### Claim 9 (depends on 8) The method of claim 8, further comprising the step of revoking access to data associated with a revoked keyscope component while maintaining access to other data owned by the key server. ### Claim 10 (depends on 8) The method of claim 8, further comprising the steps of: transmitting, to the server, at least a part of the encryption key request data structure; and storing the at least a part of the encryption key request data structure in a repository. ### Claim 11 (depends on 8) The method of claim 8, wherein the encryption key associated with the encryption key request data structure is unique to an organization, and not shared with other organizations. ### Claim 12 (depends on 11) The method of claim 11, wherein the organization can revoke the encryption key associated with the encryption key request data structure at any time. ### Claim 13 (depends on 11) The method of claim 11, wherein the one or more keyscope components include an organization identifier, a workspace identifier, a channel identifier, a timestamp, or a user identifier. ### Claim 14 (depends on 8) The method of claim 8 further comprising the step of refreshing the at least one local memory, and wherein refreshing the at least one local memory occurs after lapsing of an encryption key management cache persistence period and prior to determining that the encryption key associated with the encryption key request data structure is not stored in the at least one local memory. ### Claim 15 A system for providing encryption key management, comprising: a server; a key server; and an encryption key management server, wherein the encryption key management server is programmed to perform a method of providing encryption key management, the method comprising the steps of: receiving, from the server, an encrypt request, the encrypt request comprising an encryption key request data structure and encrypt request plaintext, wherein the encryption key request data structure comprises one or more keyscope components, and the encrypt request plaintext comprises one or more of a message plaintext, a file plaintext, or a search index plaintext; upon determining that an encryption key associated with the encryption key request data structure is not stored in at least one local memory, transmitting an encryption key generation request to the key server, the encryption key generation request comprising the encryption key request data structure; upon determining that the key server has not responded with one or more of the encryption key and encryption key cipher text, transmitting an encrypt request error to the server, wherein the encrypt request error comprises an electronic message indicating that access to a requested encryption key is denied; and revoking, on a per keyscope component basis, access to encryption keys associated with the one or more keyscope components. ### Claim 16 (depends on 15) The system of claim 15, further comprising a repository and wherein the method further comprises the step of revoking access to data associated with a revoked keyscope component while maintaining access to other data owned by the key server. ### Claim 17 (depends on 15) The system of claim 15, wherein the encryption key associated with the encryption key request data structure is unique to an organization and not shared with other organizations. ### Claim 18 (depends on 17) The system of claim 17, wherein the organization can revoke the encryption key associated with the encryption key request data structure at any time. ### Claim 19 (depends on 17) The system of claim 17, wherein the one or more keyscope components include an organization identifier, a workspace identifier, a channel identifier, a timestamp, or a user identifier. ### Claim 20 (depends on 15) The system of claim 15, wherein the method further comprises the step of refreshing the at least one local memory, and wherein refreshing the at least one local memory occurs after lapsing of an encryption key management cache persistence period and prior to determining that the encryption key associated with the encryption key request data structure is not stored in the at least one local memory.