Secure and zero knowledge data sharing for cloud applications
AssigneeMasimo Corporation
InventorsAmer Haider, Ali Ahmed
Life of this patent
Estimating the term…
Abstract
Disclosed is a zero-knowledge distributed application configured to securely share information among groups of users having various roles, such as doctors and patients. Confidential information may be encrypted client-side, with private keys that reside solely client side. Encrypted collections of data may be uploaded to, and hosted by, a server that does not have access to keys suitable to decrypt the data. Other users may retrieve encrypted data from the server and decrypt some or all of the data with keys suitable to gain access to at least part of the encrypted data. The system includes a key hierarchy with multiple entry points to a top layer by which access is selectively granted to various users and keys may be recovered.
Claims15
A system comprising one or more hardware processors configured to:
- receive encrypted patient data over a network from a remote computing system, wherein said encrypted patient data is encrypted with a first key, wherein said remote computing system does not have a decryption key to decrypt the encrypted patient data;
- and
- decrypt the encrypted patient data with a second key that is different than the first key at a computing device associated with a caregiver;
- wherein the second key is a private key, and wherein the private key is obtained by decrypting an encrypted private key (EPK) that was stored as part of a key hierarchy structure (KHS).
A system for communicating patient data, the system comprising a computing system including a memory configured to store data associated with a plurality of patients for a healthcare provider, wherein the computing system is configured to:
- store encrypted patient data associated with a patient in the memory of the computing system without the computing system having access to any decryption keys to decrypt the encrypted patient data, wherein the encrypted patient data is encrypted with a first key;
- and
- transmit the encrypted patient data based on a request for stored patient data, wherein the encrypted patient data is decrypted with a second key that is different than the first key and wherein the second key is a private key.
A method for communicating patient data, the method comprising:
- receiving encrypted patient data over a network from a remote computing system, wherein said encrypted patient data is encrypted with a first key, wherein said remote computing system does not have a decryption key to decrypt the encrypted patient data;
- and
- decrypting the encrypted patient data with a second key that is different than the first key at a computing device associated with a caregiver;
- wherein the second key is a private key, and wherein the private key is obtained by decrypting an encrypted private key (EPK) that was stored as part of a key hierarchy structure (KHS).
Dependencies are inferred from the claim text.