# US 2020/0401734 A1 · Encrypting data associated with decentralized identifier > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401734 A1 - Document ID: US20200401734A1 - Status: Published application - Kind: A1 - Application number: 16/445,106 - Filed: 2019-06-18 - Published: 2020-12-24 - Earliest claimed: 2019-06-18 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Brandon MURDOCH; Ankur PATEL; Ronald John Kamiel Eurphrasia BJONES; Daniel James BUCHNER - Web page: https://patentgrep.com/patent/US20200401734A1 ## CPC - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04L 9/0822: {using key encryption key} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Encrypting and sharing one or more data objects stored or to be stored in a personal storage that is associated with a DID. First an encryption/decryption key is generated using a passphrase and an identifier of the personal storage that stores or is to store a data object in the personal storage. The data object stored or to be stored in the personal storage is then encrypted by the generated encryption/decryption key. The encrypted data object is then stored in the personal storage. The encrypted data object may then be accessed by a DID management module that is configured to manage the DID or be shared to another entity that is not associated with the DID. ## Claims ### Claim 1 A computing system comprising: one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to perform a method for encrypting and sharing one or more data objects stored in a personal storage that is associated with a first DID, the method comprising: generating an encryption/decryption key using a passphrase and an identifier of the personal storage that stores or is to store a data object; encrypting the data object stored or to be stored in the personal storage using the encryption/decryption key; and storing the encrypted data object in the personal storage. ### Claim 2 (depends on 1) The computing system of claim 1, the method further comprising: allowing a DID management module that is configured to manage the DID to access the data object. ### Claim 3 (depends on 2) The computing system of claim 2, the allowing the DID management module that is configured to manage the DID to access the data object comprising: receiving a request for the encrypted data object from a DID management module that is configured to manage the DID; sending the encrypted data object to the DID management module. ### Claim 4 (depends on 3) The computing system of claim 3 the allowing the DID management module that is configured to manage the DID to access the data object further comprising: causing the DID management module to have access to the passphrase and the identifier of the personal storage; causing the DID management module to regenerate the encryption/decryption key; and causing the DID management module to decrypt the encrypted data object using the regenerated encryption/decryption key. ### Claim 5 (depends on 1) The computing system of claim 1, wherein the passphrase is received from a user input. ### Claim 6 (depends on 1) The computing system of claim 1, wherein the identifier of the personal storage is a constant that is associated with the first personal storage. ### Claim 7 (depends on 1) The computing system of claim 1, wherein the generating an encryption/decryption key is further based on a key identifier, the key identifier corresponds to the particular data object, such that a different encryption/decryption key is generated for encrypting a different data object. ### Claim 8 (depends on 7) The computing system of claim 7, wherein the key identifier is generated by the computing system or by a user input. ### Claim 9 (depends on 1) The computing system of claim 1, wherein the method further comprising: receiving a request for accessing the encrypted data object from another entity that is not associated with the DID; negotiating with the other entity a protection strategy for protecting the encryption/decryption key; protecting the encryption/decryption key based on the negotiated protection strategy; and sending the encrypted data object and the protected encryption/decryption key to the other entity. ### Claim 10 (depends on 9) The computing system of claim 9, wherein: the negotiated protection strategy comprises protecting the encryption/decryption key using a second encryption/decryption key of the other entity; the protecting the encryption/decryption key comprises encrypting the encryption/decryption key using the second encryption/decryption key of the other entity; the sending the encrypted data object and the protected encryption/decryption key comprises sending the encrypted data object and the encrypted encryption/decryption key to the other entity. ### Claim 11 (depends on 10) The computing system of claim 10, further comprising causing the other entity to decrypt the encrypted encryption/decryption key; and causing the other entity to decrypt the encrypted data object using the decrypted encryption/decryption key. ### Claim 12 (depends on 10) The computing system of claim 10, wherein the protecting the encryption/decryption key further comprising: receiving a public key from the other entity, wherein the encrypting the encryption/decryption key includes encrypting the encryption/decryption key using the received public key from the other entity; and storing the encrypted encryption/decryption key with the encrypted data object. ### Claim 13 (depends on 12) The computing system of claim 12, the method further comprising causing the other entity to decrypt the encrypted encryption/decryption key using a private key that corresponds to the public key that was used to encrypt the encryption/decryption key. ### Claim 14 (depends on 9) The computing system of claim 9, wherein the other entity is associated with a second DID that is different from the first DID. ### Claim 15 In a computing system that is implemented in a decentralized network that implements a distributed ledger, the distributed ledger being configured to back one or more decentralized identities (DID) for one or more users of the computing system, a method for encrypting and sharing one or more data objects stored in a personal storage that is associated with a first DID, the one or more encrypted objects being stored in a personal storage associated with a first DID, the method comprising: generating an encryption/decryption key using a passphrase and an identifier of the personal storage that stores or is to store a data object; encrypting the data object stored or to be stored in the personal storage using the encryption/decryption key; and storing the encrypted data object in the personal storage. ### Claim 16 (depends on 15) The method of claim 15, the method further comprising: receiving a request for the encrypted data object from a DID management module that is configured to manage the DID; and sending the encrypted data object to the DID management module. ### Claim 17 (depends on 16) The method of claim 16, the method further comprising: causing the DID management module to have access to the passphrase and the identifier of the personal storage; causing the DID management module to regenerate the encryption/decryption key; and causing the DID management module to decrypt the encrypted data object using the regenerated encryption/decryption key. ### Claim 18 (depends on 15) The method of claim 15, the method further comprising: wherein the passphrase is received from a user input. ### Claim 19 (depends on 15) The method of claim 15, wherein the identifier of the personal storage is a constant that associated with the first personal storage. ### Claim 20 A computer implemented process for encrypting and sharing one or more encrypted objects stored in a personal storage associated with a first DID, the process comprising: generating an encryption/decryption key using a passphrase and an identifier of the personal storage that stores or is to store a data object; encrypting the data object stored or to be stored in the personal storage using the encryption/decryption key; and storing the encrypted data object in the personal storage.