# US 2021/0344482 A1 · Method of data transfer, a method of controlling use of data and cryptographic device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344482 A1
- Document ID: US20210344482A1
- Status: Published application
- Kind: A1
- Application number: 17/376,930
- Filed: 2021-07-15
- Published: 2021-11-04
- Earliest claimed: 2016-02-05
- Assignees: Ncipher Security Limited
- Applicants: Ncipher Security Limited
- Inventors: Ian BYGRAVE; Alec EDGINGTON; Richard KETTLEWELL; David O'DOHERTY; Nicholas SMITH; Neil WALKER
- Web page: https://patentgrep.com/patent/US20210344482A1

## CPC

- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/606: {by securing the transmission between two devices or processes}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method of data transfer from a tenant to a service provider comprises encrypting the data with a public key of a key pair generated by a secure device within the service provider system. The data thus cannot be accessed by the service provider during transmission. The data is generated with a corresponding access control list, which specifies that a valid certificate must be presented in order to grant a particular use of the data once stored. The tenant can thus retain control of the use of the data even though it has been transferred out of the tenant system. A method of controlling use of data securely stored in the service provider system comprises issuing a use certificate having an expiry time to the party requesting use of the data. The use certificate must be validated before use of the stored data is granted. This enables the tenant to grant use of the stored data for a limited time period.

## Claims

### Claim at position 1

1-50. (canceled)

### Claim 51

A method of controlling use of data, the data being stored in a service provider system in a manner which is accessible to a trusted second security context in the service provider system but secure from the rest of the service provider system, wherein an access control list specifying that a valid use credential must be presented in order to grant a first type of use of the data is stored with the data, the method comprising:
generating a use credential in a first security context, wherein the use credential comprises:
information from which the data corresponding to the use credential can be identified;
information from which the expiry of the use credential can be determined;
issuing the use credential and information from which the origin of the use credential can be validated;
validating the use credential with respect to the access control list, and validating that the use credential has not expired at the second security context;
granting the first type of use of the data, in the second security context, on the condition that the use credential is valid and not expired.

### Claim 52 (depends on 51)

The method of claim 51, wherein the data comprises a cryptographic key, Ktenant.

### Claim 53 (depends on 52)

The method of claim 52 wherein the information from which the cryptographic key Ktenant corresponding to the use credential can be identified is a hash of Ktenant.

### Claim 54 (depends on 52)

The method of claim 52, wherein the first type of use is one or more cryptographic operations.

### Claim 55 (depends on 54)

The method of claim 54, wherein the use credential and information from which the origin of the use credential can be validated is issued to the service provider, the method further comprising:
providing the use credential, the information from which the origin of the use credential can be validated, and a request to perform an operation with the key Ktenant, the operation being a first type of use, to the second security context;
performing the operation at the second security context, on the condition that the use credential is valid and not expired.

### Claim 56 (depends on 52)

The method of claim 52, wherein the use credential is a use certificate and further comprising:
cryptographically signing the use certificate with a private key Ktenant-signpriv in the first security context, wherein the information from which the origin of the use certificate can be validated is the signature and wherein the corresponding public key Ktenant-signpub is integrity protect and accessible to the second security context;
verifying the use certificate using the public key Ktenant-signpub at the second security context.

### Claim 57 (depends on 51)

The method of claim 51, wherein the information from which the expiry of the use credential can be determined comprises:
an expiry time;
information identifying a reference time source.

### Claim 58 (depends on 57)

The method of claim 57, wherein validating that the use credential has not expired at the second security context comprises:
requesting a current time stamp from the reference time source;
sending a message comprising the current time stamp from the reference time source to the second security context, together with information from which an origin of the message can be validated; and
validating the origin of the message.

### Claim 59 (depends on 58)

The method of claim 58, wherein validating that the use credential has not expired at the second security context further comprises comparing the time stamp to the expiry time.

### Claim 60 (depends on 51)

The method of claim 51, wherein the generating a use credential in a first security context comprises:
selecting a reference time source;
requesting a current time stamp from the reference time source;
sending a message comprising the current time stamp from the reference time source to a tenant system, together with information from which an origin of the message can be validated, wherein the first security context is in the tenant system;
validating the origin of the message; and
calculating an expiry time based on the current time stamp.

### Claim 61 (depends on 58)

The method of claim 58, wherein the message further comprises information relating to the current configuration of the reference time source.

### Claim 62 (depends on 58)

The method of claim 58, wherein the method further comprises providing the public half of an identity cryptographic key pair of the time source to the first security context, together with information validating the origin of the identity cryptographic key pair.

### Claim 63 (depends on 58)

The method of claim 58, wherein the method further comprises providing the public half of an identity cryptographic key pair of the time source to the second security context, together with information validating the origin of the identity cryptographic key pair.

### Claim 64 (depends on 62)

The method of claim 62, wherein the information from which the origin of the message can be validated is a signed message, the signed message signed with the private half of the identity cryptographic key pair of the time source.

### Claim 65 (depends on 63)

The method of claim 63, wherein the information from which the origin of the message can be validated is a signed message, the signed message signed with the private half of the identity cryptographic key pair of the time source.

### Claim 66 (depends on 51)

The method of claim 51, wherein information relating to a start time is included in the use credential.

### Claim 67 (depends on 51)

A non-transitory computer readable storage medium comprising computer readable code configured to cause a computer to perform the method of claim 51.