Distributed encryption key allocation
AssigneeZoom Communications, Inc.
InventorsJohn Kennedy, Prasanna Kumar Malaiyandi, Karthik Raman, Jan Zila
Life of this patent
Estimating the term…
Abstract
Customers of a software platform, such as a unified communications as a service platform, are enabled to control their own encryption keys used to encrypt and decrypt data from various communication services in the software platform. A key broker server is employed to map encryption and decryption requests from servers in the platform to key management servers of customers based on user identifiers. Examples of data encrypted may includes conference recordings, webinar recordings, phone call recordings, voicemails, emails, and calendar tokens.
Claims20
A method comprising:
- receiving an encryption request from a first server that includes an identifier for one or more users, wherein the identifier includes at least one of a customer identification number, a host email address, or a telephone number;
- selecting a key management server based on the identifier;
- transmitting a request for a data encryption key to the selected key management server;
- receiving a plaintext key and an encrypted key from the key management server;
- in response to the encryption request, transmitting the plaintext key and the encrypted key to the first server;
- and
- deleting the plaintext key.
A system comprising:
- a network interface,
- a processor, and
- a memory, wherein the memory stores instructions executable by the processor to:
- receive an encryption request from a first server that includes an identifier for one or more users, wherein the identifier includes at least one of a customer identification number, a host email address, or a telephone number;
- select a key management server based on the identifier;
- transmit, using the network interface, a request for a data encryption key to the selected key management server;
- receive, using the network interface, a plaintext key and an encrypted key from the key management server;
- in response to the encryption request, transmit the plaintext key and the encrypted key to the first server;
- and
- delete the plaintext key.
A method comprising:
- receiving a decryption request from a first server that includes an identifier for one or more users and an encrypted key, wherein the identifier includes at least one of a customer identification number, a host email address, or a telephone number;
- selecting a key management server based on the identifier;
- transmitting a request for a data encryption key to the selected key management server, wherein the request includes the encrypted key;
- receiving a plaintext key from the key management server;
- in response to the decryption request, transmitting the plaintext key to the first server;
- and
- deleting the plaintext key.
Dependencies are inferred from the claim text.