# US 2021/0344485 A1 · Label-based double key encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344485 A1
- Document ID: US20210344485A1
- Status: Published application
- Kind: A1
- Application number: 16/864,269
- Filed: 2020-05-01
- Published: 2021-11-04
- Earliest claimed: 2020-05-01
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Benjamin Sean LEVIN; Kartik Tirunelveli KANAKASABESAN; Laurie Lee LITWACK; Kurt Matthew BRENDON; Ajay Kumar KARANAM; Kiran DORESWAMY; Ryan Jay BEST
- Web page: https://patentgrep.com/patent/US20210344485A1

## CPC

- H04L 9/0822: {using key encryption key}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Double key encryption encrypts sensitive data using a content key, obtains a user public key from a key management service, encrypts the content key using the user public key, and encrypts the result using a cloud service provider key. Data confidentiality is protected efficiently through multilevel encryption and also by utilizing keys that are managed by different entities. Sensitivity labeling allows analytics to track sensitive data without compromising confidentiality. Compliance mechanisms may use attribute-based access control to support storage of sensitive data in a cloud, but only inside a permitted region, and without giving the cloud service provider access to the sensitive data.

## Claims

### Claim 1

A system configured for multilevel encryption confidentiality protection, the system comprising:
a digital memory; and
a processor in operable communication with the memory, the processor configured to perform double key encryption steps for protecting confidentiality of sensitive data, the steps including (a) getting a content key, (b) encrypting the sensitive data using the content key, thereby producing content-key-encrypted sensitive data, (c) obtaining a user public key from a user key management service, (d) encrypting the content key using the user public key, thereby producing a user-key-encrypted content key that is decryptable using a user private key that corresponds to the user public key, and (e) encrypting the user-key-encrypted content key using a cloud service provider key, thereby producing a double-encrypted content key;
whereby confidentiality of the sensitive data is protected by using at least three levels of encryption and also by utilizing keys which as a set are managed by at least two key management entities.

### Claim 2 (depends on 1)

The system of claim 1, further characterized in at least one of the following ways:
the content key is a symmetric encryption key; or
the cloud service provider key is a public key which corresponds to a cloud service provider private key.

### Claim 3 (depends on 1)

The system of claim 1, further characterized in at least one of the following ways:
the content key is generated by a cloud-connected application;
the cloud service provider key is a cloud tenant root key; or
the user-key-encrypted content key is in a publishing license which also contains a rights management policy.

### Claim 4 (depends on 1)

The system of claim 1, wherein the sensitive data is associated with a sensitivity label, and the system is further characterized in at least one of the following ways:
the sensitivity label includes a uniform resource locator of the user key management service; or
the sensitivity label indicates that double key encryption is in use to protect the sensitive data.

### Claim 5 (depends on 1)

The system of claim 1, wherein the sensitive data is associated with a particular sensitivity label value which induces double key encryption protection, and the system is configured to perform the double key encryption steps in response to the particular sensitivity label value.

### Claim 6 (depends on 1)

The system of claim 1, wherein the system is further configured with an attribute-based access control subsystem which is configured to utilize the keys to control access to the sensitive data based on at least one attribute defined in a policy.

### Claim 7

A method performed by or on behalf of a connectable application to enhance confidentiality protection of sensitive data, the method comprising:
getting a content key which is a symmetric encryption key;
symmetrically encrypting the sensitive data using the content key, thereby producing content-key-encrypted sensitive data;
obtaining a user public key from a user key management service;
asymmetrically encrypting the content key using the user public key, thereby producing a user-key-encrypted content key that is decryptable using a user private key that corresponds to the user public key; and
asymmetrically encrypting the user-key-encrypted content key using a cloud service provider key managed by a cloud service provider, thereby producing a double-encrypted content key;
whereby confidentiality of the sensitive data is protected by using at least three levels of encryption and also by utilizing keys which as a set are managed by at least two key management entities.

### Claim 8 (depends on 7)

The method of claim 7, wherein the method further comprises verifying, prior to asymmetrically encrypting the content key using the user public key, that a sensitivity label which is associated with the sensitive data induces double key encryption.

### Claim 9 (depends on 7)

The method of claim 7, wherein obtaining the user public key from the user key management service comprises reading a uniform resource locator of the user key management service, from a location associated with a sensitivity label which is associated with the sensitive data.

### Claim 10 (depends on 7)

The method of claim 7, wherein the method further comprises employing an attribute-based access control coordinated with double key encryption to control access to the sensitive data based on at least one of the following attributes: a geographic attribute, or a legal jurisdiction attribute, or an industry standard attribute.

### Claim 11 (depends on 7)

The method of claim 7, wherein the method comprises associating multiple labels with the sensitive content, the labels including a first label which induces double key encryption protection of the sensitive content and also including a second label which specifies a user-defined protection of the sensitive content.

### Claim 12 (depends on 7)

The method of claim 7, wherein the method is repeated by instances of the connectable application for multiple sets of sensitive data which reside respectfully in at least two of the following: a cloud, an on-premises network, or a hybrid network which spans a cloud and an on-premises network.

### Claim 13 (depends on 7)

The method of claim 7, wherein obtaining the user public key from the user key management service comprises communicating with a reference implementation of the user key management service.

### Claim 14 (depends on 7)

The method of claim 7, further comprising:
obtaining the user-key-encrypted content key from the cloud service provider;
obtaining the user private key from the user key management service;
decrypting the user-key-encrypted content key using the user private key, thereby reproducing the content key in a fully decrypted form; and
decrypting the sensitive data using the fully decrypted content key.

### Claim 15 (depends on 7)

The method of claim 7, wherein the method is performed by or on behalf of one of the following connectable applications: a cloud-based word processor, a cloud-connected word processor which runs locally on a user machine outside the cloud, a cloud-based slide presentation application, a cloud-connected slide presentation application which runs locally on a user machine outside the cloud, a cloud-based spreadsheet application, a cloud-connected spreadsheet application which runs locally on a user machine outside the cloud, or an email application.

### Claim 16

A computer-readable storage medium configured with data and instructions which upon execution by a processor cause a computing system to perform a method to enhance confidentiality protection of sensitive data, the method comprising:
encrypting the sensitive data using a content key, thereby producing content-key-encrypted sensitive data;
obtaining a user public key from a user key management service;
asymmetrically encrypting the content key using the user public key, thereby producing a user-key-encrypted content key that is decryptable using a user private key that corresponds to the user public key; and
asymmetrically encrypting the user-key-encrypted content key using a cloud service provider key managed by a cloud service provider, thereby producing a double-encrypted content key;
whereby confidentiality of the sensitive data is protected by using at least three levels of encryption and also by utilizing keys which as a set are managed by at least two key management entities.

### Claim 17 (depends on 16)

The storage medium of claim 16, further comprising caching at least one of the following for at least eight hours: the user public key, the cloud service provider key, thereby reducing or eliminating repetition of operations which obtained the cached key or keys prior to caching.

### Claim 18 (depends on 16)

The storage medium of claim 16, further comprising receiving an encryption type preference and configuring an implementation of asymmetric encryption of the content key with the user public key to conform with the encryption type preference.

### Claim 19 (depends on 16)

The storage medium of claim 16, further comprising supplying label data to an analytics engine without providing the analytics engine access to the sensitive data in an unencrypted form.

### Claim 20 (depends on 19)

The storage medium of claim 19, further comprising configuring at least one of the following additional protection mechanisms based at least in part on a result from the analytics engine: multi-factor authentication, attribute-based access control, data loss prevention, access tracking, or access revocation.