# US 9,224,000 B1 · Systems and methods for providing information security using context-based keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,224,000 B1 - Document ID: US9224000B1 - Status: Granted - Kind: B1 - Application number: 13/523,411 - Filed: 2012-06-14 - Granted: 2015-12-29 - Earliest claimed: 2011-06-14 - Assignees: Ionic Security Inc. - Applicants: Adam Ghetti - Inventors: Adam Ghetti - Web page: https://patentgrep.com/patent/US9224000B1 ## CPC - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/0872: {using geo-location information, e.g. location data, time, relative position or proximity to other entities} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 63/0478: {applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - G06F 2212/402: Encrypted data - G06F 2221/2107: File encryption - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for securing or encrypting data or other information arising from a user's interaction with software and/or hardware, resulting in transformation of original data into ciphertext. Generally, the ciphertext is generated using context-based keys that depend on the environment in which the original data originated and/or accessed. The ciphertext can be stored in a user's storage device or in an enterprise database (e.g., at-rest encryption), or shared with other users (e.g., cryptographic communication). Use of context-based encryption keys enables key association with individual data elements, as opposed to public-private key pairs, or use of conventional user-based or system-based keys. In scenarios wherein data is shared by a sender with other users, the system manages the rights of users who are able to send and/or access the sender's data according to pre-defined policies/roles. ## Claims ### Claim 1 A method for autonomously encrypting data associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: autonomously detecting via a particular client module operating on a particular electronic computing device an item of original data that is to be persistently encrypted; identifying via the particular client module contextual information relating to creation of the item of original data; transmitting a request for encryption of the item of original data from the particular client module to a central server module, wherein the request includes the contextual information relating to the creation of the item of original data; receiving a response from the central server module at the particular client module, wherein the response comprises unique cryptographic information generated by processing an identifier comprising at least a portion of the contextual information through a cryptographic algorithm; and generating a persistently encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information, wherein the persistently encrypted output is only accessible via local decryption in a subsequent client module having appropriate access authority and operating on a subsequent electronic computing device. ### Claim 2 (depends on 1) The method of claim 1, wherein the step of generating the persistently encrypted output of the item of original data further includes parsing the response from the central server module to extract the unique cryptographic information. ### Claim 3 (depends on 1) The method of claim 1, wherein the persistently encrypted output is stored in volatile or non-volatile memory associated with the particular electronic computing device. ### Claim 4 (depends on 1) The method of claim 1, further comprising the steps of: temporarily diverting the item of original data from an expecting application program operating on the particular electronic computing device to a local memory associated with the particular electronic computing device; and upon generation of the persistently encrypted output of the item of original data, reinserting the persistently encrypted output into the expecting application program for subsequent use. ### Claim 5 (depends on 4) The method of claim 4, further comprising the step of prior to reinserting the persistently encrypted output into the expecting application program, processing the persistently encrypted output so as to ensure compatibility in appearance and format of the display of the persistently encrypted output within the expecting application program. ### Claim 6 (depends on 1) The method of claim 1, wherein the contextual information is selected from the group comprising: a user identifier associated with a user entering the item of original data, a user identifier of a user interacting with the item of original data, a session identifier, a time instant at which the item of original data was generated, a time instant at which the item of original data was accessed, an electronic device identifier, an application program identifier, an enterprise identifier, a network address. ### Claim 7 (depends on 1) The method of claim 1, wherein the unique cryptographic information further comprises a context-based key (CBK). ### Claim 8 (depends on 7) The method of claim 7, wherein the step of generating the persistently encrypted output further comprises the step of processing the item of original data and the context-based key through an encryption algorithm. ### Claim 9 (depends on 8) The method of claim 8, wherein the step of generating the persistently encrypted output further comprises concatenating a CBK identifier with an encrypted version of the item of original data. ### Claim 10 (depends on 1) The method of claim 1, whereby the persistently encrypted output is utilized in connection with the one or more application programs. ### Claim 11 (depends on 1) The method of claim 1, further comprising the step of transmitting the persistently encrypted output to one or more third party systems for subsequent use. ### Claim 12 A method for recovering original data from persistently encrypted outputs associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: receiving a particular persistently encrypted output corresponding to an item of original data at a particular client module operating on a particular electronic computing device, wherein the particular persistently encrypted output comprises at least a first type of cryptographic information, the first type of cryptographic information comprising contextual information relating to creation of the item of original data; transmitting a request for local decryption of the particular persistently encrypted output from the particular client module to a central server module, wherein the request includes the first type of cryptographic information; receiving a response from the central server module at the particular client module, wherein the response comprises a second type of cryptographic information for locally decrypting the particular persistently encrypted output, the second type of cryptographic information having been generated by processing the first type of cryptographic information through a cryptographic algorithm; and locally decrypting the item of original data from the particular persistently encrypted output by processing the second type of cryptographic information via an encryption algorithm, wherein the locally decrypted item of original data from the particular persistently encrypted output is only locally accessible within the particular client module. ### Claim 13 (depends on 12) The method of claim 12, wherein the particular persistently encrypted output further comprises an encrypted version of the item of original data. ### Claim 14 (depends on 13) The method of claim 13, wherein the step of locally decrypting the item of original data further comprises processing the encrypted version of the item of original data via the encryption algorithm. ### Claim 15 (depends on 12) The method of claim 12, further comprising the step of parsing the particular persistently encrypted output to extract the first type of cryptographic information. ### Claim 16 (depends on 12) The method of claim 12, further comprising the step of reinserting the locally decrypted item of original data into a particular application program operating in association with the particular client module on the particular electronic device. ### Claim 17 (depends on 16) The method of claim 16, further comprising the step of prior to reinserting the locally decrypted output into the particular application program, processing the locally decrypted item of original data so as to ensure compatibility in appearance and format of the display of the locally decrypted item of original data within the particular application program. ### Claim 18 (depends on 12) The method of claim 12, wherein the particular persistently encrypted output is received from volatile or non-volatile memory associated with the particular electronic computing device. ### Claim 19 (depends on 12) The method of claim 12, wherein the original data is processed so as to ensure compatibility in appearance and format associated with the application program associated with the recovery of the original data. ### Claim 20 (depends on 12) The method of claim 12, wherein the first type of cryptographic information further comprises a context-based key (CBK) identifier embedded in the particular persistently encrypted output. ### Claim 21 (depends on 12) The method of claim 12, wherein the second type of cryptographic information further comprises a context-based key (CBK). ### Claim 22 (depends on 12) The method of claim 12, wherein the contextual information is selected from the group comprising: a user identifier associated with a user entering the item of original data, a user identifier of a user interacting with the item of original data, a session identifier, a time instant at which the item of original data was generated, a time instant at which the item of original data was accessed, an electronic device identifier, an application program identifier, an enterprise identifier, a network address. ### Claim 23 (depends on 12) The method of claim 12, wherein the first type of cryptographic information further comprises a string of predetermined length and position with respect to the particular persistently encrypted output. ### Claim 24 A method for managing autonomous, persistent encryption of data associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: receiving at a context-based security system (CBSS) centralized server module a request for persistent encryption of an item of original data from a particular client module operating on a particular electronic computing device, wherein the request for persistent encryption includes contextual information relating to creation of the item of original data; extracting the contextual information from the request for persistent encryption; generating via the CBSS centralized server module a context-based key (CBK) and a context-based key identifier (CBK ID) based on the contextual information for use in persistently encrypting the item of original data, wherein the CBK ID comprises at least a portion of the contextual information and the CBK is generated by processing the CBK ID through a cryptographic algorithm; storing and associating the CBK and the CBK ID in a CBSS database; and transmitting the CBK and the CBK ID from the CBSS centralized server module to the particular client module operating on the particular electronic computing device for use in persistent encryption of the item of original data, wherein the persistent encryption of the item of original data generates a persistently encrypted output of the item of original data that is only accessible via local decryption in a subsequent client module having appropriate access control authority and operating on a subsequent electronic computing device. ### Claim 25 (depends on 24) The method of claim 24, wherein the contextual information is selected from the group comprising: a user identifier associated with a user entering the item of original data in the particular electronic computing device, a user identifier of a user interacting with the item of original data via the particular electronic computing device, a session identifier, a time instant at which the item of original data was generated, a time instant at which the item of original data was accessed, an electronic device identifier, an application program identifier, an enterprise identifier, a network address. ### Claim 26 (depends on 24) The method of claim 24, wherein the CBK ID partially comprises prior-used CBK IDs. ### Claim 27 (depends on 24) The method of claim 24, wherein the CBK is generated by extracting a predetermined number of bits from an output of the cryptographic algorithm. ### Claim 28 (depends on 24) The method of claim 24, wherein the stored CBK and CBK ID are used for a subsequent auditing function. ### Claim 29 (depends on 24) The method of claim 24, further comprising the step of authenticating the credentials of the request for persistent encryption. ### Claim 30 (depends on 24) The method of claim 24, further comprising the step of retrieving one or more predefined access control policies relating to the contextual information prior to generating the CBK and CBK ID. ### Claim 31 (depends on 30) The method of claim 30, further comprising the step of generating the CBK and CBK ID only upon determining that the predefined access control policies are satisfied. ### Claim 32 (depends on 30) The method of claim 30, wherein the predefined access control policies govern rights of CBSS users in regards to locally decrypting the persistently encrypted output of the item of original data. ### Claim 33 (depends on 30) The method of claim 30, wherein the predefined access control policies are retrieved from a third party system associated with the particular electronic computing device. ### Claim 34 (depends on 30) The method of claim 30, further comprising the step of upon determining that the predefined access control policies are not satisfied, transmitting an alert message to the particular client module operating on the particular electronic computing device. ### Claim 35 (depends on 24) The method of claim 24, wherein the request for persistent encryption received at the CBSS centralized server module is transmitted through a secure communication protocol. ### Claim 36 A method for managing autonomous, persistent encryption of data associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: receiving at a context-based security system (CBSS) centralized server module a request for decryption of a particular persistently encrypted output corresponding to an item of original data from a particular client module operating on a particular electronic computing device, wherein the request for decryption includes a first type of cryptographic information relating to the particular persistently encrypted output; extracting the first type of cryptographic information from the request for decryption, wherein the first type of cryptographic information is known to the CBSS centralized server module and comprises contextual information relating to creation of the item of original data; retrieving from a CBSS database one or more access control policies associated with the first type of cryptographic information and determining that the particular client module is authorized to access the item of original data associated with the first type of cryptographic information; upon determination that the particular client module is authorized to access the item of original data, retrieving from the CBSS database a second type of cryptographic information associated with the first type of cryptographic information in the CBSS database, wherein the second type of cryptographic information was generated by processing the first type of cryptographic information through a cryptographic algorithm; and transmitting the second type of cryptographic information from the CBSS centralized server module to the particular client module operating on the particular electronic computing device for use in locally decrypting the particular persistently encrypted output at the particular electronic computing device, wherein the particular persistently encrypted output is only locally decrypted within the particular client module. ### Claim 37 (depends on 36) The method of claim 36, wherein the first type of cryptographic information further comprises a context-based key identifier (CBK ID). ### Claim 38 (depends on 36) The method of claim 36, wherein the second type of cryptographic information further comprises a context-based key (CBK). ### Claim 39 (depends on 36) The method of claim 36, wherein the contextual information is selected from the group comprising: a user identifier associated with a user entering the item of original data in a specific electronic computing device, a user identifier of a user interacting with the item of original data via a specific electronic computing device, a session identifier, a time instant at which the item of original data was generated, a time instant at which the item of original data was accessed, an electronic device identifier, an application program identifier, an enterprise identifier, a network address. ### Claim 40 A method for autonomously encrypting data associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: autonomously detecting via a particular client module operating on a particular electronic computing device an item of original data that is to be permanently encrypted; identifying via the particular client module contextual information relating to creation of the item of original data; transmitting a request for encryption of the item of original data from the particular client module to a central server module, wherein the request includes the contextual information relating to the creation of the item of original data; receiving a response from the central server module at the particular client module, wherein the response comprises unique cryptographic information generated by processing an identifier comprising at least a portion of the contextual information through a cryptographic algorithm; and generating a permanently encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information, wherein the permanently encryption output is only accessible during an application session via local decryption to local volatile memory for presentation to and/or interaction by a user of a subsequent client module operating a subsequent electronic computing device. ### Claim 41 A method for recovering original data from permanently encrypted outputs associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: receiving a particular permanently encrypted output corresponding to an item of original data at a particular client module operating on a particular electronic computing device, wherein the particular permanently encrypted output comprises at least a first type of cryptographic information, the first type of cryptographic information comprising contextual information relating to creation of the item of original data; transmitting a request for decryption of the particular permanently encrypted output from the particular client module to a central server module, wherein the request includes the first type of cryptographic information; receiving a response from the central server module at the particular client module, wherein the response comprises a second type of cryptographic information for decrypting the particular permanently encrypted output, the second type of cryptographic information having been generated by processing the first type of cryptographic information through a cryptographic algorithm; and locally decrypting, to local volatile memory, the item of original data from the particular permanently encrypted output by processing the second type of cryptographic information via an encryption algorithm, wherein the locally decrypted item of original data from the particular permanently encrypted output is only accessible during an application session within the particular client module for presentation to and/or interaction by a user of the particular client module. ### Claim 42 A method for managing autonomous, permanent encryption of data associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: receiving at a context-based security system (CBSS) centralized server module a request for encryption of an item of original data from a particular client module operating on a particular electronic computing device, wherein the request for encryption includes contextual information relating to the creation of the item of original data; extracting the contextual information from the request for encryption; generating via the CBSS centralized server module a context-based key (CBK) and a context-based key identifier (CBK ID) based on the contextual information for use in permanently encrypting the item of original data, wherein the CBK ID comprises at least a portion of the contextual information and the CBK is generated by processing the CBK ID through a cryptographic algorithm; storing and associating the CBK and the CBK ID in a CBSS database; and transmitting the CBK and the CBK ID from the CBSS centralized server module to the particular client module operating on the particular electronic computing device for use in permanent encryption of the item of original data, wherein the permanent encryption of the item of original data generates a permanently encrypted output of the item of original data that is only accessible during an application session via local decryption to local volatile memory for presentation to and/or interaction by a user of a subsequent client module operating a subsequent electronic computing device. ### Claim 43 A method for managing autonomous, permanent encryption of data associated with one or more application programs operating on one or more electronic computing devices, comprising the steps of: receiving at a context-based security system (CBSS) centralized server module a request for decryption of a particular permanently encrypted output corresponding to an item of original data from a particular client module operating on a particular electronic computing device, wherein the request for decryption includes a first type of cryptographic information relating to the particular permanently encrypted output; extracting the first type of cryptographic information from the request for decryption, wherein the first type of cryptographic information is known to the CBSS centralized server module and comprises contextual information relating to creation of the item of original data; retrieving from a CBSS database one or more access control policies associated with the first type of cryptographic information and determining that the particular client module is authorized to access the item of original data associated with the first type of cryptographic information; upon determination that the particular client module is authorized to access the item of original data, retrieving from the CBSS database a second type of cryptographic information associated with the first type of cryptographic information in the CBSS database, wherein the second type of cryptographic information was generated by processing the first type of cryptographic information through a cryptographic algorithm; and transmitting the second type of cryptographic information from the CBSS centralized server module to the particular client module operating on the particular electronic computing device for use in locally decrypting, to local volatile memory, the particular permanently encrypted output at the particular electronic computing device, wherein the particular permanently encrypted output is only locally decrypted within the particular client module for presentation to and/or interaction by a user of the particular client module during an application session.