# US 2021/0240840 A1 · Data protection using functional encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240840 A1
- Document ID: US20210240840A1
- Status: Published application
- Kind: A1
- Application number: 16/780,971
- Filed: 2020-02-04
- Published: 2021-08-05
- Earliest claimed: 2020-02-04
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: ABIGAIL GOLDSTEEN; RON SHMELKIN; GILAD EZOV; MUHAMMAD BARHAM
- Web page: https://patentgrep.com/patent/US20210240840A1

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of limiting data usage for certified purposes by using functional encryption, comprising: receiving from a software publisher an application code and declared privacy information, the declared privacy information specifies at least one declared usage for at least one data type; analyzing the application's usage of data collected by the application, to identify an actual usage of the at least one data type by a function; identifying when the actual usage is compliant with the at least one declared usage according to the analysis; in response to the identification, creating a pair of a public key and a master private key; creating a function private key for the function using the master private key; and sending the function private key to the software publisher to be used for operating the function on data which is encrypted using the public key.

## Claims

### Claim 1

A method of limiting data usage for certified purposes by using functional encryption, comprising:
receiving from a software publisher an application code and declared privacy information, the declared privacy information specifies at least one declared usage for at least one data type;
analyzing the application's usage of data collected by the application, to identify an actual usage of the at least one data type by a function;
identifying when the actual usage is compliant with the at least one declared usage according to the analysis;
in response to the identification, creating a pair of a public key and a master private key;
creating a function private key for the function using the master private key; and
sending the function private key to the software publisher to be used for operating the function on data which is encrypted using the public key.

### Claim 2 (depends on 1)

The method of claim 1 wherein the function private key is bundled with the application code by the software publisher.

### Claim 3 (depends on 1)

The method of claim 1 wherein at least some of the analyzing is done by automated algorithms.

### Claim 4 (depends on 1)

The method of claim 1 wherein at least some of the analyzing is done by a human.

### Claim 5

A method of limiting data usage for certified purposes during runtime by using functional encryption, comprising:
retrieving data from a memory in response to a query for data received from an application;
encrypting the queried data using a public key which is paired with a function private key and created by a purpose certifier;
sending the encrypted queried data to the application to be used by a function of the application, wherein the function is operated on the encrypted queried data using the function private key which is created by the purpose certifier after verifying that actual usage of at least one data type by the function is compliant with at least one declared usage of the function.

### Claim 6 (depends on 5)

The method of claim 5 wherein the encrypted queried data is sent by the application to a server, and the function is operated on the encrypted queried data on the server.

### Claim 7 (depends on 5)

The method of claim 5 wherein the application is installed on a user's client device.

### Claim 8 (depends on 5)

The method of claim 5 wherein the sending is done via inter-app communication from an application performing the encryption to the application which is using the function.

### Claim 9

A method of using data for certified purposes by using functional encryption, comprising:
receiving a function private key which is created for a function from a master private key paired with a public key, wherein the function private key is created by a purpose certifier after verifying that actual usage of at least one data type by the function is compliant with at least one declared usage of the function;
receiving encrypted data which is encrypted using the public key;
operating the function on the encrypted data using the function private key to extract an unencrypted result of the function for the data.