# US 2025/0097202 A1 · Selective encryption service interface for use with third-party network services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097202 A1 - Document ID: US20250097202A1 - Status: Published application - Kind: A1 - Application number: 18/968,939 - Filed: 2024-12-04 - Published: 2025-03-20 - Earliest claimed: 2016-11-09 - Assignees: StratoKey Pty Ltd. - Applicants: StratoKey Pty Ltd. - Inventors: Anthony Scotney Scotney - Web page: https://patentgrep.com/patent/US20250097202A1 ## CPC - H04L 63/0281: {Proxies} - G06F 16/955: using information identifiers, e.g. uniform resource locators [URL] - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 67/566: Grouping or aggregating service requests, e.g. for unified processing - H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A network computer system implements a service interface to provide encryption as a service, performs cryptographic operations on a plurality of data elements communicated between client computers of an enterprise and a third-party network service, and stores decryption logic in association with the plurality of data elements. The network computer system receives a decryption request via the service interface from a programmatic entity implemented by the third-party network service, the decryption request specifying an encrypted form of a data element. The network computer system decrypts the encrypted form of the data element to generate a decrypted form of the data element using a decryption key, of the one or more decryption keys that is associated with the data element. The network computer system provides a response to the decryption request to the programmatic entity, the response including the decrypted form of the data element. ## Claims ### Claim 1 A network computer system comprising: one or more processors; one or more memory resources storing a set of instructions, that, when executed by the one or more processors, cause the network computer system to provide a proxy service for a plurality of users associated with an enterprise to utilize when accessing a third-party network service, wherein in providing the proxy service, the one or more processors: receive a content submission from the client computer intended for the third-party network service; analyze the content submission to identify one or more sensitive data elements within the content submission, wherein a remainder of the content submission is not recognized as being sensitive; perform an encryption operation on the one or more sensitive data elements; store a decryption key associated with the sensitive data elements with the server system; transmit the content submission to the third-party network service to store the content submission with the sensitive data elements in an encrypted form; receive a request, independent of the client computer, identifying the sensitive data elements in the encrypted form; provide a response to the request using the decryption key, the response enabling the sensitive data elements to be used in a decrypted form; and provide a service interface comprising a program entity interface for a programmatic entity associated with the enterprise to access the sensitive data elements stored in the encrypted form with the third-party network service by the proxy service. ### Claim 2 (depends on 1) The network computer system of claim 1, wherein, in providing the service interface, the one or more processors: receive an encryption request via the service interface from the programmatic entity, the encryption request including one or more data elements in the unencrypted form; generate the encrypted form of the one or more data elements using one or more stored decryption keys; and provide a response to the encryption request to the programmatic entity. ### Claim 3 (depends on 1) The network computer system of claim 1, wherein, in providing the service interface, the one or more processors: receive a decryption request via the service interface from the programmatic entity, the decryption request specifying an encrypted form of one or more data elements stored with the third-party network service; decrypt the encrypted form of the one or more data elements to generate a decrypted form of the one or more data elements using one or more stored decryption keys; and provide a response to the decryption request to the programmatic entity, the response including the decrypted form of the one or more data elements. ### Claim 4 (depends on 1) The network computer system of claim 1, wherein the service interface includes a Representation State Transfer (REST) interface. ### Claim 5 (depends on 1) The network computer system of claim 1, wherein the decryption request comprises a web service call to the service interface. ### Claim 6 (depends on 1) The network computer system of claim 1, wherein the service interface conforms to Simple Object Access Protocol (SOAP). ### Claim 7 (depends on 3) The network computer system of claim 3, wherein a decryption key of the one or more stored decryption keys is associated a corresponding data element based on one or more of: a data element type of the corresponding data element, and a client computer associated with the corresponding data element. ### Claim 8 (depends on 1) The network computer system of claim 1, wherein the programmatic entity is implemented by the third-party network service as a workflow on behalf of the enterprise. ### Claim 9 (depends on 1) The network computer system of claim 1, wherein, in providing the proxy service, the one or more processors: store decryption logic comprising a set of interoperability parameters that enable the third-party network service to utilize the decrypted form of the data element. ### Claim 10 (depends on 1) The network computer system of claim 1, wherein the programmatic entity comprises a first script that executes in a backend scripting engine of the third-party network service, the first script configured to execute in response to a request, from a client computer to the third-party network service, for a web page that displays the data element. ### Claim 11 (depends on 1) The network computer system of claim 1, wherein the programmatic entity comprises a second script that executes in a backend scripting engine of the third-party network service, the second script configured to execute in response to submission of a web form to the third-party network service by a client computer. ### Claim 12 A method comprising: providing a proxy service for a plurality of users associated with an enterprise to utilize when accessing a third-party network service, wherein in providing the proxy service comprises: receiving a content submission from the client computer intended for the third-party network service; analyzing the content submission to identify one or more sensitive data elements within the content submission, wherein a remainder of the content submission is not recognized as being sensitive; performing an encryption operation on the one or more sensitive data elements; storing a decryption key associated with the sensitive data elements with the server system; transmitting the content submission to the third-party network service to store the content submission with the sensitive data elements in an encrypted form; receiving a request, independent of the client computer, identifying the sensitive data elements in the encrypted form; and providing a response to the request using the decryption key, the response enabling the sensitive data elements to be used in a decrypted form; and providing a service interface comprising a program entity interface for a programmatic entity associated with the enterprise to access the sensitive data elements stored in the encrypted form with the third-party network service by the proxy service. ### Claim 13 (depends on 12) The method of claim 12, wherein providing the service interface comprises: receiving an encryption request via the service interface from the programmatic entity, the encryption request including the one or more data elements in the unencrypted form; generating the encrypted from of the one or more data elements using one or more stored decryption keys; and providing a response to the encryption request to the programmatic entity. ### Claim 14 (depends on 12) The method of claim 12, wherein providing the service interface comprises: receiving a decryption request via the service interface from the programmatic entity, the decryption request specifying an encrypted form of one or more data elements stored with the third-party network service; decrypting the encrypted form of the one or more data elements to generate a decrypted form of the one or more data elements using one or more stored decryption keys; and providing a response to the decryption request to the programmatic entity, the response including the decrypted form of the one or more data elements. ### Claim 15 (depends on 12) The method of claim 12, wherein the service interface includes a Representation State Transfer (REST) interface. ### Claim 16 (depends on 12) The method of claim 12, wherein a decryption key of the one or more stored decryption keys stored in association with the data element is associated with the data element based on the data element type. ### Claim 17 (depends on 14) The method of claim 14, wherein a decryption key of the one or more stored decryption keys is associated with a corresponding data element based on one or more of: a data element type of the corresponding data element, and a client computer associated with the corresponding data element. ### Claim 18 (depends on 12) The method of claim 12, wherein the programmatic entity comprises a first script that executes in a backend scripting engine of the third-party network service, the first script configured to execute in response to a request, from a client computer to the third-party network service, for a web page that displays the data element. ### Claim 19 (depends on 12) The method of claim 12, wherein the programmatic entity comprises a second script that executes in a backend scripting engine of the third-party network service, the second script configured to execute in response to submission of a web form to the third-party network service by a client computer. ### Claim 20 A computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to: provide a proxy service for a plurality of users associated with an enterprise to utilize when accessing a third-party network service, wherein in providing the proxy service, the one or more processors: receive a content submission from the client computer intended for the third-party network service; analyze the content submission to identify one or more sensitive data elements within the content submission, wherein a remainder of the content submission is not recognized as being sensitive; perform an encryption operation on the one or more sensitive data elements; store a decryption key associated with the sensitive data elements with the server system; transmit the content submission to the third-party network service to store the content submission with the sensitive data elements in an encrypted form; receive a request, independent of the client computer, identifying the sensitive data elements in the encrypted form; provide a response to the request using the decryption key, the response enabling the sensitive data elements to be used in a decrypted form; and provide a service interface comprising a program entity interface for a programmatic entity associated with the enterprise to access the sensitive data elements stored in the encrypted form with the third-party network service by the proxy service.