Derived unique key per raindrop (dukpr)
AssigneeWells Fargo Bank, N.A.
InventorsPhillip H. Griffin, Jeffrey J. Stapleton
Life of this patent
Estimating the term…
Abstract
A method for a key management server to manage encryption for data stored by a cloud provider server includes receiving, by the key management server from the cloud provider server, a request for a drop key. The request includes a hash drop identifier that uniquely identifies a cipher drop, and the cipher drop comprises a unit of data stored by the cloud provider server. The method further includes generating the drop key based on at least the hash drop and the drop identifier and encrypting the drop key. A response comprising the encrypted drop key is sent to the cloud provider server.
Claims20
A method, comprising:
- decrypting, by a raindrop cryptography circuit, a cipher drop using a drop key to obtain a first drop, wherein the first drop comprises unencrypted data associated with the cipher drop;
- determining, by the raindrop cryptography circuit, following an operation involving the first drop that generates a second drop, that the second drop matches the first drop;
- and
- in response to determining that the first drop matches the second drop, destroying, by the raindrop cryptography circuit, the first drop and the drop key.
A system, comprising:
- a raindrop cryptography circuit comprising one or more processors coupled to non-transitory memory, the raindrop cryptography circuit configured to:
- decrypt a cipher drop using a drop key to obtain a first drop, wherein the first drop comprises unencrypted data associated with the cipher drop;
- determine, following an operation involving the first drop that generates a second drop, that the second drop matches the first drop;
- and
- in response to determining that the first drop matches the second drop, destroy the first drop and the drop key.
A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
- decrypting a cipher drop using a drop key to obtain a first drop, wherein the first drop comprises unencrypted data associated with the cipher drop;
- determining, following an operation involving the first drop that generates a second drop, that the second drop matches the first drop;
- and
- in response to determining that the first drop matches the second drop, destroying the first drop and the drop key.
Dependencies are inferred from the claim text.