Systems and methods for identity encapsulated cryptography
AssigneeeBay Inc.
InventorLiam Sean Lynch
Life of this patent
Estimating the term…
Abstract
A method and a system to provide identity encapsulated cryptography are provided. A method may comprise receiving a user key to access a service. The service may be provided by an enterprise and hosted within a public cloud. A request for a country key assigned to a country of a user is transmitted and the country key is received. Session data resulting from the use of the service hosted within the public cloud is encrypted using the user key and the user key is encrypted using the country key. The encrypted session data and the encrypted user key are stored in the public cloud. The country key may be provided to a legal agency of the country of the user to decrypt session data of the user and to not decrypt session data of other users of another country.
Claims16
A method comprising:
- generating a first request for a user key to access a service, the service provided by an enterprise and hosted within a public cloud;
- receiving the user key in response to the first request;
- transmitting a second request for a country key, the country key assigned to a country of a user for whom the user key is requested;
- receiving the country key in response to the second request;
- encrypting session data resulting from the use of the service hosted within the public cloud using the user key;
- encrypting, using one or more processors, the user key using the country key;
- transmitting the encrypted session data and the encrypted user key to the public cloud;
- generating a third request;
- the third request being for session data of a plurality of users of the country, including an indication of the country associated with the country key;
- receiving the country key in response to the third request;
- decrypting user keys stored in the public cloud, the user keys used to encrypt the session data of the plurality of users of the country, wherein other user keys stored in the public cloud encrypted using another country key remain encrypted;
- and
- decrypting the session data of the plurality of users of the country using the decrypted user keys.
A system comprising:
- a non-transitory memory to store one or more information claims containers, the one or more information claims containers including one or more claims and one or more key references;
- and
- one or more processors configured to;
- generate a first request for a user key to access a service, the service provided by an enterprise and hosted within a public cloud;
- receive the user key in response to the first request;
- transmit a second request for a country key the country key assigned to a country of a user for whom the user key is requested;
- receive the country key in response to the second request;
- encrypt session data resulting from the use of the service hosted within the public cloud using the user key;
- encrypt the user key using, the country key;
- transmit the encrypted session data and the encrypted user key to the public cloud;
- generate a third request, the third request being for session data of a plurality of users of the country, including an indication of the country associated with the country key;
- receive the country key in response to the third request;
- decrypt user keys stored in the public cloud, the user keys used to encrypt the session data of the plurality of users of the country, wherein other user keys stored in the public cloud encrypted using another country key remain encrypted;
- and
- decrypt the session data of the plurality of users of the country using the decrypted use keys.
Dependencies are inferred from the claim text.