# US 2021/0344484 A1 · Multicast Encryption Scheme for Data-Ownership Platform

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344484 A1
- Document ID: US20210344484A1
- Status: Published application
- Kind: A1
- Application number: 17/012,689
- Filed: 2020-09-04
- Published: 2021-11-04
- Earliest claimed: 2020-04-29
- Assignees: Ecosteer Srl
- Applicants: Ecosteer Srl
- Inventors: Elena PASQUALI; Daniele GRAZIOLI
- Web page: https://patentgrep.com/patent/US20210344484A1

## CPC

- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)}
- H04L 65/1045: Proxies, e.g. for session initiation protocol [SIP]
- H04L 65/611: for multicast or broadcast (systems for broadcast or conference H04L12/18; arrangements for broadcast or distribution combined with broadcast H04H20/00; arrangements for broadcast applications with a direct linkage to broadcast information or to broadcast space-time H04H60/00; selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS], H04W4/06)
- H04L 65/80: Responding to QoS
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 67/53: using third party service providers
- H04L 67/55: Push-based network services
- H04L 67/562: Brokering proxy services
- H04L 2209/60: Digital content management, e.g. content distribution
- H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Disclosed herein are embodiments for implementing periodic management of cryptographic keys. An embodiment includes a processor configured to perform operations comprising receive a first input associating a first set of subscribers with a first data stream published by the first publisher device, and a first cryptographic key. Processor may transmit, to the first publisher device, a first confirmation, indicating that the first cryptographic key is ready for use, for example. In some embodiments, processor may release the first cryptographic key to a first set of subscribers, receive a second input from a publishing user, associating a different, second set of subscribers with the first data stream, and receive a second cryptographic key after a certain time period. Processor may further transmit, to the first device, a second confirmation, indicating that the second cryptographic key is ready for use, and release the second cryptographic key to the second set of subscribers.

## Claims

### Claim 1

A non-transitory computer-readable storage device having instructions stored thereon, wherein the instructions, when executed by at least one computer processor, cause the at least one computer processor to perform operations comprising:
loading a first cryptographic key associated with a first set of subscribers;
encrypting at least one first data payload, wherein the at least one first data payload, once encrypted, requires the first cryptographic key for any subsequent decryption of the at least one first data payload;
publishing, via a data stream, the at least one first data payload as encrypted;
loading a second cryptographic key associated with a second set of subscribers, responsive to a determination that the second set of subscribers differs from the first set of subscribers, wherein the first set of subscribers comprises a revoked subscriber;
encrypting at least one second data payload, wherein the at least one second data payload, once encrypted, requires the second cryptographic key for any subsequent decryption of the at least one second data payload, and wherein the first cryptographic key is ineffective to decrypt the at least one second data payload; and
publishing, via the data stream, the at least one second data payload as encrypted, wherein the first data payload and the second data payload comprise a first data point and a second data point, respectively, wherein the first data point and the second data point are collected from at least one sensor on-board an edge device, and wherein the at least one sensor is communicatively coupled with the at least one computer processor.

### Claim 2 (depends on 1)

The non-transitory computer-readable storage device of claim 1, the operations further comprising:
associating the data stream with a smart contract on a blockchain platform, and wherein the first data stream is tokenized via the smart contract.

### Claim 3 (depends on 2)

The non-transitory computer-readable storage device of claim 2, wherein the blockchain platform is associated with a key-proxy service.

### Claim 4 (depends on 1)

The non-transitory computer-readable storage device of claim 1, the operations further comprising transmitting a record in the data stream, wherein the record comprises a timestamp.

### Claim 5 (depends on 1)

The non-transitory computer-readable storage device of claim 1, the operations further comprising:
associating the first cryptographic key with a first index value;
associating the second cryptographic key with a second index value; and
transmitting, with the second cryptographic key, the second index value to a back-end service comprising a key-proxy service.

### Claim 6 (depends on 1)

The non-transitory computer-readable storage device of claim 1, wherein to load either of he first cryptographic key or the second cryptographic key, the operations further comprise generating the first cryptographic key or the second cryptographic key using at least one entropy source on-board the edge device.

### Claim 7 (depends on 1)

The non-transitory computer-readable storage device of claim 1, wherein to load either of the first cryptographic key or the second cryptographic key, the operations further comprise receiving the first cryptographic key or the second cryptographic key from a source external to the edge device.

### Claim 8 (depends on 1)

The non-transitory computer-readable storage device of claim 1, the operations further comprising transmitting, to a back-end service comprising a key-proxy service, information to interface with a data-volume rating system.

### Claim 9 (depends on 8)

The non-transitory computer-readable storage device of claim 8, wherein the information comprises a quantity of bytes that have been encrypted using the first cryptographic key, the second encrypted key, or a combination thereof.

### Claim 10

A system comprising:
a memory; and
at least one processor coupled to the memory and configured to perform operations comprising:
receiving a first input associating a first set of subscribers with a first data stream published by a data-stream publisher device;
loading a first cryptographic key;
transmitting a first confirmation, indicating that the first cryptographic key is ready for use;
releasing, via a key-proxy service, the first cryptographic key to at least the first set of subscribers comprising a first subscriber device;
receiving a second input, from a publishing user, associating a second set of subscribers with the first data stream published by the data-stream publisher device, wherein the second set of subscribers excludes the first subscriber device;
loading a second cryptographic key after a predetermined amount of time has elapsed, wherein the second cryptographic key is ineffective to decrypt data that can be decrypted using the first cryptographic key;
transmitting a second confirmation, indicating that the second cryptographic key is ready for use; and
releasing the second cryptographic key to at least the second set of subscribers.

### Claim 11 (depends on 10)

The system of claim 10, the operations further comprising:
associating the first cryptographic key with a first index value; and
associating the second cryptographic key with a second index value, wherein the second index value and the second cryptographic key are received from the data-stream publisher device.

### Claim 12 (depends on 11)

The system of claim 11, the operations further comprising receiving a timestamp from the data-stream publisher device.

### Claim 13 (depends on 10)

The system of claim 10, wherein to load either of he first cryptographic key or the second cryptographic key, the operations further comprise generating the first cryptographic key or the second cryptographic key using at least one entropy source within the system.

### Claim 14 (depends on 10)

The system of claim 10, the operations further comprising receiving, via the key-proxy service, information to interface with a data-volume rating system.

### Claim 15 (depends on 14)

The system of claim 14, wherein the information comprises a quantity of bytes that have been encrypted using the first cryptographic key, the second encrypted key, or a combination thereof.

### Claim 16

An apparatus for publishing an encrypted data stream, the apparatus comprising:
at least one memory device configured to store computer-executable instructions; and
at least one computer processor communicatively coupled with the at least one memory, the at least one computer processor capable of being configured, via at least the computer-executable instructions, to perform operations comprising:
receiving, from source external to the apparatus, a first cryptographic key associated with a first set of subscribers;
encrypting at least one first data payload, wherein the at least one first data payload, once encrypted, requires the first cryptographic key for any subsequent decryption of the at least one first data payload;
publishing, via a data stream, the at least one first data payload as encrypted;
receiving, from source external to the apparatus, a second cryptographic key associated with a second set of subscribers, responsive to a determination that the second set of subscribers differs from the first set of subscribers, wherein the first set of subscribers comprises a revoked subscriber;
encrypting at least one second data payload, wherein the at least one second data payload, once encrypted, requires the second cryptographic key for any subsequent decryption of the at least one second data payload, and wherein the first cryptographic key is ineffective to decrypt the at least one second data payload; and
publishing, via the data stream, the at least one second data payload as encrypted, wherein the first data payload and the second data payload comprise a first data point and a second data point, respectively, wherein the first data point and the second data point are collected from at least one sensor on-board an edge device, and wherein the at least one sensor is communicatively coupled with the at least one computer processor.

### Claim 17 (depends on 16)

The apparatus of claim 16, the operations further comprising transmitting a record in the data stream, wherein the record comprises a timestamp.

### Claim 18 (depends on 16)

The apparatus of claim 16, the operations further comprising transmitting, to a back-end service comprising a key-proxy service, information to interface with a data-volume rating system.

### Claim 19 (depends on 18)

The apparatus of claim 18, wherein the information comprises a quantity of bytes that have been encrypted using the first cryptographic key, the second encrypted key, or a combination thereof.

### Claim 20 (depends on 16)

The apparatus of claim 16, the operations further comprising:
associating the first cryptographic key with a first index value;
associating the second cryptographic key with a second index value; and
transmitting, with the second cryptographic key, the second index value to a back-end service comprising a key-proxy service.