# US 9,608,809 B1 · Systems and methods for encryption and provision of information security using platform services

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,608,809 B1
- Document ID: US9608809B1
- Status: Granted
- Kind: B1
- Application number: 15/017,284
- Filed: 2016-02-05
- Granted: 2017-03-28
- Earliest claimed: 2015-02-05
- Assignees: Ionic Security Inc.
- Applicants: Ionic Security, Inc.
- Inventors: Adam Ghetti; Jeffrey Howard; James Jordan; Nicholas Smith; Jeremy Eckman; Ryan Speers; Sohaib Bhatti
- Web page: https://patentgrep.com/patent/US9608809B1

## CPC

- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0822: {using key encryption key}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/102: {Entity profiles}
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- G06F 2221/2133: Verifying human interaction, e.g., Captcha
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods for securing or encrypting data or other information arising from a user's interaction with software and/or hardware, resulting in transformation of original data into ciphertext. Generally, the ciphertext is generated using context-based keys that depend on the environment in which the original data originated and/or was accessed. The ciphertext can be stored in a user's storage device or in an enterprise database (e.g., at-rest encryption) or shared with other users (e.g., cryptographic communication). The system generally allows for secure federation across organizations, including mechanisms to ensure that the system itself and any other actor with pervasive access to the network cannot compromise the confidentially of the protected data.

## Claims

### Claim 1

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
receiving, at a server, an enrollment request from the electronic computing device corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted and the identity data comprises unique cryptographic information corresponding to the enrollment request;
determining, based on the routing data, a key space corresponding to a tenant affiliated with the user;
transmitting the enrollment request from the server to a key service corresponding to the determined key space;
receiving, at the server, a response from the key service, wherein the response comprises a user identifier, a tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, wherein the response was generated at the key service based on the encrypted identity data, and wherein the cryptographic enrollment data was encrypted by the key service using the unique cryptographic information corresponding to the enrollment request prior to transmission to the server; and
transmitting the cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device for enrollment of the user with the multi-party encryption and key management system.

### Claim 2 (depends on 1)

The method of claim 1, wherein the response further comprises the unique cryptographic information corresponding to the enrollment request.

### Claim 3 (depends on 2)

The method of claim 2, further comprising the steps of:
generating, at the server, cryptographic server enrollment data;
encrypting the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmitting the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device.

### Claim 4 (depends on 3)

The method of claim 3, further comprising the step of storing the cryptographic server enrollment data in association with the tenant-specific device identifier and user identifier.

### Claim 5 (depends on 1)

The method of claim 1, wherein the identity data further comprises an enrollment request identifier and an electronic computing device identifier.

### Claim 6 (depends on 5)

The method of claim 5, wherein the enrollment request identifier is compared, by the key service, to the electronic computing device identifier to authenticate the enrollment request.

### Claim 7 (depends on 5)

The method of claim 5, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmitting the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 8 (depends on 5)

The method of claim 5, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receiving, at the server, a request for the enrollment package from the electronic computing device;
authenticating the request for the enrollment package; and
transmitting, based on the authentication, the enrollment package from the server to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 9 (depends on 1)

The method of claim 1, wherein the multi-party encryption and key management system comprises the server.

### Claim 10 (depends on 1)

The method of claim 1, further comprising the step of extracting, at the server prior to the step of determining the key space, the routing data from the enrollment request.

### Claim 11 (depends on 10)

The method of claim 10, wherein the step of determining the key space further comprises analyzing the extracted routing data to determine the tenant affiliated with the user and then identifying the key space associated with the tenant affiliated with the user.

### Claim 12 (depends on 1)

The method of claim 1, wherein the step of determining the key space further comprises the step of determining, based on the key space, the key service corresponding to the determined key space.

### Claim 13

A system for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising:
the electronic computing device that generates an enrollment request corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system and transmits the enrollment request to a server, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted and the identity data comprises unique cryptographic information corresponding to the enrollment request;
the server that receives the enrollment request from the electronic computing device, wherein the server determines, based on the routing data, a key space corresponding to a tenant affiliated with the user and transmits the enrollment request to a key service corresponding to the determined key space;
the key service that receives the enrollment request, wherein the key service generates, based on the encrypted identity data, a response comprising a user identifier, tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, encrypts the cryptographic enrollment data using the unique cryptographic information corresponding to the enrollment request, and transmits the response to the server;
the server that receives the response from the key service, wherein the server transmits the cryptographic enrollment data and tenant-specific device identifier to the electronic computing device; and
the electronic computing device that receives the cryptographic enrollment data and tenant-specific device identifier from the server, wherein the electronic computing device enrolls the user, based on the cryptographic enrollment data and tenant-specific device identifier, in the multi-party encryption and key management system.

### Claim 14 (depends on 13)

The system of claim 13, wherein the response further comprises the unique cryptographic information corresponding to the enrollment request.

### Claim 15 (depends on 14)

The system of claim 14, wherein the server, after receiving the response from the key service:
generates cryptographic server enrollment data;
encrypts the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmits the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier to the electronic computing device.

### Claim 16 (depends on 13)

The system of claim 13, wherein the identity data further comprises an enrollment request identifier and an electronic computing device identifier.

### Claim 17 (depends on 16)

The system of claim 16, wherein the server, prior to receiving the enrollment request:
generates the enrollment request identifier;
generates an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmits the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 18 (depends on 16)

The system of claim 16, wherein the server, prior to receiving the enrollment request:
generates the enrollment request identifier;
generates an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receives a request for the enrollment package from the electronic computing device;
authenticates the request for the enrollment package; and
transmits, based on the authentication, the enrollment package to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 19 (depends on 13)

The system of claim 13, wherein the multi-party encryption and key management system comprises the server.

### Claim 20

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
generating, at the electronic computing device, an enrollment request corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, wherein the enrollment request comprises identity data corresponding to the user and routing data for routing the enrollment request, wherein the identity data comprises first unique cryptographic information corresponding to the enrollment request;
encrypting, at the electronic computing device, at least the identity data with unique cryptographic information to prevent a server from accessing the identity data;
transmitting the enrollment request from the electronic computing device to the server; and
receiving, at the electronic computing device, a response from the server, wherein the response comprises a user identifier, a tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, wherein the cryptographic enrollment data comprises cryptographic key service enrollment data and cryptographic server enrollment data, and wherein the response was generated both at the server and a key service capable of accessing the encrypted identity data, and at least the cryptographic key service enrollment data was encrypted by the key service using the first unique cryptographic information corresponding to the enrollment request and at least the cryptographic server enrollment data was encrypted by the server using the first unique cryptographic information corresponding to the enrollment request.

### Claim 21 (depends on 20)

The method of claim 20, wherein the electronic computing device decrypts at least the cryptographic key service enrollment data and the cryptographic server enrollment data using second unique cryptographic information corresponding to the enrollment request.

### Claim 22 (depends on 20)

The method of claim 20, wherein the identity data further comprises an enrollment request identifier and an electronic computing device identifier.

### Claim 23 (depends on 22)

The method of claim 22, further comprising the steps of:
prior to generating the enrollment request, generating a request for an enrollment package from the server;
transmitting the request for the enrollment package from the electronic computing device to the server;
receiving, at the electronic computing device, the enrollment package from the server, wherein the enrollment package comprises the enrollment request identifier and unique cryptographic information corresponding to the key service; and
encrypting the identity data using the unique cryptographic information corresponding to the key service.

### Claim 24 (depends on 20)

The method of claim 20, wherein the multi-party encryption and key management system comprises the server.

### Claim 25

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
receiving, at a server, an enrollment request from the electronic computing device corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted and the identity data comprises unique cryptographic information corresponding to the enrollment request;
determining, based on the routing data, a key space corresponding to a tenant affiliated with the user;
transmitting the enrollment request from the server to a key service corresponding to the determined key space;
receiving, at the server, a response from the key service, wherein the response comprises a user identifier, a tenant-specific device identifier, the unique cryptographic information corresponding to the enrollment request, and cryptographic enrollment data for enrolling the user, wherein the response was generated at the key service based on the encrypted identity data; and
transmitting the cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device for enrollment of the user with the multi-party encryption and key management system.

### Claim 26 (depends on 25)

The method of claim 25, wherein the cryptographic enrollment data is encrypted by the key service using the unique cryptographic information corresponding to the enrollment request prior to transmission to the server.

### Claim 27 (depends on 25)

The method of claim 25, further comprising the steps of:
generating, at the server, cryptographic server enrollment data;
encrypting the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmitting the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device.

### Claim 28 (depends on 27)

The method of claim 27, further comprising the step of storing the cryptographic server enrollment data in association with the tenant-specific device identifier and user identifier.

### Claim 29 (depends on 25)

The method of claim 25, wherein the identity data further comprises an enrollment request identifier and an electronic computing device identifier.

### Claim 30 (depends on 29)

The method of claim 29, wherein the enrollment request identifier is compared, by the key service, to the electronic computing device identifier to authenticate the enrollment request.

### Claim 31 (depends on 29)

The method of claim 29, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmitting the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 32 (depends on 29)

The method of claim 29, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receiving, at the server, a request for the enrollment package from the electronic computing device;
authenticating the request for the enrollment package; and
transmitting, based on the authentication, the enrollment package from the server to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 33 (depends on 25)

The method of claim 25, wherein the multi-party encryption and key management system comprises the server.

### Claim 34 (depends on 25)

The method of claim 25, further comprising the step of extracting, at the server prior to the step of determining the key space, the routing data from the enrollment request.

### Claim 35 (depends on 34)

The method of claim 34, wherein the step of determining the key space further comprises analyzing the extracted routing data to determine the tenant affiliated with the user and then identifying the key space associated with the tenant affiliated with the user.

### Claim 36 (depends on 25)

The method of claim 25, wherein the step of determining the key space further comprises the step of determining, based on the key space, the key service corresponding to the determined key space.

### Claim 37

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
receiving, at a server, an enrollment request from the electronic computing device corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted and the identity data comprises an enrollment request identifier and an electronic computing device identifier;
determining, based on the routing data, a key space corresponding to a tenant affiliated with the user;
transmitting the enrollment request from the server to a key service corresponding to the determined key space, wherein the enrollment request identifier is compared, by the key service, to the electronic computing device identifier to authenticate the enrollment request;
receiving, at the server, a response from the key service, wherein the response comprises a user identifier, a tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, wherein the response was generated at the key service based on the encrypted identity data; and
transmitting the cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device for enrollment of the user with the multi-party encryption and key management system.

### Claim 38 (depends on 37)

The method of claim 37, wherein the identity data further comprises unique cryptographic information corresponding to the enrollment request.

### Claim 39 (depends on 38)

The method of claim 38, wherein the cryptographic enrollment data is encrypted by the key service using the unique cryptographic information corresponding to the enrollment request prior to transmission to the server.

### Claim 40 (depends on 38)

The method of claim 38, wherein the response further comprises the unique cryptographic information corresponding to the enrollment request.

### Claim 41 (depends on 40)

The method of claim 40, further comprising the steps of:
generating, at the server, cryptographic server enrollment data;
encrypting the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmitting the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device.

### Claim 42 (depends on 41)

The method of claim 41, further comprising the step of storing the cryptographic server enrollment data in association with the tenant-specific device identifier and user identifier.

### Claim 43 (depends on 37)

The method of claim 37, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmitting the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 44 (depends on 37)

The method of claim 37, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receiving, at the server, a request for the enrollment package from the electronic computing device;
authenticating the request for the enrollment package; and
transmitting, based on the authentication, the enrollment package from the server to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 45 (depends on 37)

The method of claim 37, wherein the multi-party encryption and key management system comprises the server.

### Claim 46 (depends on 37)

The method of claim 37, further comprising the step of extracting, at the server prior to the step of determining the key space, the routing data from the enrollment request.

### Claim 47 (depends on 46)

The method of claim 46, wherein the step of determining the key space further comprises analyzing the extracted routing data to determine the tenant affiliated with the user and then identifying the key space associated with the tenant affiliated with the user.

### Claim 48 (depends on 37)

The method of claim 37, wherein the step of determining the key space further comprises the step of determining, based on the key space, the key service corresponding to the determined key space.

### Claim 49

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
generating, at a server, an enrollment request identifier and an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to a key service;
transmitting the enrollment package from the server to the electronic computing device;
receiving, at the server, an enrollment request from the electronic computing device corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service, and wherein the identity data comprises the enrollment request identifier and an electronic computing device identifier;
determining, based on the routing data, a key space corresponding to a tenant affiliated with the user;
transmitting the enrollment request from the server to the key service corresponding to the determined key space;
receiving, at the server, a response from the key service, wherein the response comprises a user identifier, a tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, wherein the response was generated at the key service based on the encrypted identity data; and
transmitting the cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device for enrollment of the user with the multi-party encryption and key management system.

### Claim 50 (depends on 49)

The method of claim 49, wherein the identity data further comprises unique cryptographic information corresponding to the enrollment request.

### Claim 51 (depends on 50)

The method of claim 50, wherein the cryptographic enrollment data is encrypted by the key service using the unique cryptographic information corresponding to the enrollment request prior to transmission to the server.

### Claim 52 (depends on 50)

The method of claim 50, wherein the response further comprises the unique cryptographic information corresponding to the enrollment request.

### Claim 53 (depends on 52)

The method of claim 52, further comprising the steps of:
generating, at the server, cryptographic server enrollment data;
encrypting the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmitting the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device.

### Claim 54 (depends on 53)

The method of claim 53, further comprising the step of storing the cryptographic server enrollment data in association with the tenant-specific device identifier and user identifier.

### Claim 55 (depends on 49)

The method of claim 49, wherein the enrollment request identifier is compared, by the key service, to the electronic computing device identifier to authenticate the enrollment request.

### Claim 56 (depends on 49)

The method of claim 49, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receiving, at the server, a request for the enrollment package from the electronic computing device;
authenticating the request for the enrollment package; and
transmitting, based on the authentication, the enrollment package from the server to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 57 (depends on 49)

The method of claim 49, wherein the multi-party encryption and key management system comprises the server.

### Claim 58 (depends on 49)

The method of claim 49, further comprising the step of extracting, at the server prior to the step of determining the key space, the routing data from the enrollment request.

### Claim 59 (depends on 58)

The method of claim 58, wherein the step of determining the key space further comprises analyzing the extracted routing data to determine the tenant affiliated with the user and then identifying the key space associated with the tenant affiliated with the user.

### Claim 60 (depends on 49)

The method of claim 49, wherein the step of determining the key space further comprises the step of determining, based on the key space, the key service corresponding to the determined key space.

### Claim 61

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
generating, at a server, an enrollment request identifier and an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to a key service;
receiving, at the server, a request for the enrollment package from the electronic computing device;
authenticating the request for the enrollment package;
transmitting, based on the authentication, the enrollment package from the server to the electronic computing device;
receiving, at the server, an enrollment request from the electronic computing device corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service, and wherein the identity data comprises the enrollment request identifier and an electronic computing device identifier;
determining, based on the routing data, a key space corresponding to a tenant affiliated with the user;
transmitting the enrollment request from the server to the key service corresponding to the determined key space;
receiving, at the server, a response from the key service, wherein the response comprises a user identifier, a tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, wherein the response was generated at the key service based on the encrypted identity data; and
transmitting the cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device for enrollment of the user with the multi-party encryption and key management system.

### Claim 62 (depends on 61)

The method of claim 61, wherein the identity data further comprises unique cryptographic information corresponding to the enrollment request.

### Claim 63 (depends on 62)

The method of claim 62, wherein the cryptographic enrollment data is encrypted by the key service using the unique cryptographic information corresponding to the enrollment request prior to transmission to the server.

### Claim 64 (depends on 62)

The method of claim 62, wherein the response further comprises the unique cryptographic information corresponding to the enrollment request.

### Claim 65 (depends on 64)

The method of claim 64, further comprising the steps of:
generating, at the server, cryptographic server enrollment data;
encrypting the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmitting the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device.

### Claim 66 (depends on 65)

The method of claim 65, further comprising the step of storing the cryptographic server enrollment data in association with the tenant-specific device identifier and user identifier.

### Claim 67 (depends on 61)

The method of claim 61, wherein the enrollment request identifier is compared, by the key service, to the electronic computing device identifier to authenticate the enrollment request.

### Claim 68 (depends on 61)

The method of claim 61, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmitting the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 69 (depends on 61)

The method of claim 61, wherein the multi-party encryption and key management system comprises the server.

### Claim 70 (depends on 61)

The method of claim 61, further comprising the step of extracting, at the server prior to the step of determining the key space, the routing data from the enrollment request.

### Claim 71 (depends on 70)

The method of claim 70, wherein the step of determining the key space further comprises analyzing the extracted routing data to determine the tenant affiliated with the user and then identifying the key space associated with the tenant affiliated with the user.

### Claim 72 (depends on 61)

The method of claim 61, wherein the step of determining the key space further comprises the step of determining, based on the key space, the key service corresponding to the determined key space.

### Claim 73

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
receiving, at a server, an enrollment request from the electronic computing device corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted;
extracting the routing data from the enrollment request;
determining, based on the routing data, a key space corresponding to a tenant affiliated with the user;
transmitting the enrollment request from the server to a key service corresponding to the determined key space;
receiving, at the server, a response from the key service, wherein the response comprises a user identifier, a tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, wherein the response was generated at the key service based on the encrypted identity data; and
transmitting the cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device for enrollment of the user with the multi-party encryption and key management system.

### Claim 74 (depends on 73)

The method of claim 73, wherein the identity data further comprises unique cryptographic information corresponding to the enrollment request.

### Claim 75 (depends on 74)

The method of claim 74, wherein the cryptographic enrollment data is encrypted by the key service using the unique cryptographic information corresponding to the enrollment request prior to transmission to the server.

### Claim 76 (depends on 74)

The method of claim 74, wherein the response further comprises the unique cryptographic information corresponding to the enrollment request.

### Claim 77 (depends on 76)

The method of claim 76, further comprising the steps of:
generating, at the server, cryptographic server enrollment data;
encrypting the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmitting the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier from the server to the electronic computing device.

### Claim 78 (depends on 77)

The method of claim 77, further comprising the step of storing the cryptographic server enrollment data in association with the tenant-specific device identifier and user identifier.

### Claim 79 (depends on 73)

The method of claim 73, wherein the identity data further comprises an enrollment request identifier and an electronic computing device identifier.

### Claim 80 (depends on 79)

The method of claim 79, wherein the enrollment request identifier is compared, by the key service, to the electronic computing device identifier to authenticate the enrollment request.

### Claim 81 (depends on 79)

The method of claim 79, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmitting the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 82 (depends on 79)

The method of claim 79, further comprising the steps of:
prior to receiving the enrollment request, generating, at the server, the enrollment request identifier;
generating an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receiving, at the server, a request for the enrollment package from the electronic computing device;
authenticating the request for the enrollment package; and
transmitting, based on the authentication, the enrollment package from the server to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 83 (depends on 73)

The method of claim 73, wherein the multi-party encryption and key management system comprises the server.

### Claim 84 (depends on 73)

The method of claim 73, wherein the step of determining the key space further comprises analyzing the extracted routing data to determine the tenant affiliated with the user and then identifying the key space associated with the tenant affiliated with the user.

### Claim 85 (depends on 73)

The method of claim 73, wherein the step of determining the key space further comprises the step of determining, based on the key space, the key service corresponding to the determined key space.

### Claim 86

A system for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising:
the electronic computing device that generates an enrollment request corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system and transmits the enrollment request to a server, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted and the identity data comprises unique cryptographic information corresponding to the enrollment request;
the server that receives the enrollment request from the electronic computing device, wherein the server determines, based on the routing data, a key space corresponding to a tenant affiliated with the user and transmits the enrollment request to a key service corresponding to the determined key space;
the key service that receives the enrollment request, wherein the key service generates, based on the encrypted identity data, a response comprising a user identifier, tenant-specific device identifier, the unique cryptographic information corresponding to the enrollment request, and cryptographic enrollment data for enrolling the user and transmits the response to the server;
the server that receives the response from the key service, wherein the server transmits the cryptographic enrollment data and tenant-specific device identifier to the electronic computing device; and
the electronic computing device that receives the cryptographic enrollment data and tenant-specific device identifier from the server, wherein the electronic computing device enrolls the user, based on the cryptographic enrollment data and tenant-specific device identifier, in the multi-party encryption and key management system.

### Claim 87 (depends on 86)

The system of claim 86, wherein the key service encrypts, prior to transmission to the server, the cryptographic enrollment data using the unique cryptographic information corresponding to the enrollment request.

### Claim 88 (depends on 86)

The system of claim 86, wherein the server, after receiving the response from the key service:
generates cryptographic server enrollment data;
encrypts the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmits the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier to the electronic computing device.

### Claim 89 (depends on 86)

The system of claim 86, wherein the identity data further comprises an enrollment request identifier and an electronic computing device identifier.

### Claim 90 (depends on 89)

The system of claim 89, wherein the server, prior to receiving the enrollment request:
generates the enrollment request identifier;
generates an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmits the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 91 (depends on 89)

The system of claim 89, wherein the server, prior to receiving the enrollment request:
generates the enrollment request identifier;
generates an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receives a request for the enrollment package from the electronic computing device;
authenticates the request for the enrollment package; and
transmits, based on the authentication, the enrollment package to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 92 (depends on 86)

The system of claim 86, wherein the multi-party encryption and key management system comprises the server.

### Claim 93

A system for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising:
the electronic computing device that generates an enrollment request corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system and transmits the enrollment request to a server, the enrollment request comprising identity data corresponding to the user and routing data for routing the enrollment request, wherein at least the identity data is encrypted and the identity data comprises an enrollment request identifier and an electronic computing device identifier;
the server that receives the enrollment request from the electronic computing device, wherein the server determines, based on the routing data, a key space corresponding to a tenant affiliated with the user and transmits the enrollment request to a key service corresponding to the determined key space;
the key service that receives the enrollment request, wherein the key service generates, based on the encrypted identity data, a response comprising a user identifier, tenant-specific device identifier and cryptographic enrollment data for enrolling the user and transmits the response to the server;
the server that receives the response from the key service, wherein the server transmits the cryptographic enrollment data and tenant-specific device identifier to the electronic computing device; and
the electronic computing device that receives the cryptographic enrollment data and tenant-specific device identifier from the server, wherein the electronic computing device enrolls the user, based on the cryptographic enrollment data and tenant-specific device identifier, in the multi-party encryption and key management system.

### Claim 94 (depends on 93)

The system of claim 93, wherein the identity data further comprises unique cryptographic information corresponding to the enrollment request.

### Claim 95 (depends on 94)

The system of claim 94, wherein the key service encrypts, prior to transmission to the server, the cryptographic enrollment data using the unique cryptographic information corresponding to the enrollment request.

### Claim 96 (depends on 94)

The system of claim 94, wherein the response further comprises the unique cryptographic information corresponding to the enrollment request.

### Claim 97 (depends on 96)

The system of claim 96, wherein the server, after receiving the response from the key service:
generates cryptographic server enrollment data;
encrypts the cryptographic server enrollment data using the unique cryptographic information corresponding to the enrollment request; and
transmits the transformed cryptographic server enrollment data along with the transformed cryptographic enrollment data and tenant-specific device identifier to the electronic computing device.

### Claim 98 (depends on 93)

The system of claim 93, wherein the server, prior to receiving the enrollment request:
generates the enrollment request identifier;
generates an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service; and
transmits the enrollment package to the electronic computing device, wherein at least the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 99 (depends on 93)

The system of claim 93, wherein the server, prior to receiving the enrollment request:
generates the enrollment request identifier;
generates an enrollment package comprising the enrollment request identifier and unique cryptographic information corresponding to the key service;
receives a request for the enrollment package from the electronic computing device;
authenticates the request for the enrollment package; and
transmits, based on the authentication, the enrollment package to the electronic computing device, wherein the identity data is encrypted using the unique cryptographic information corresponding to the key service.

### Claim 100 (depends on 93)

The system of claim 93, wherein the multi-party encryption and key management system comprises the server.

### Claim 101

A method for enrolling a user of an electronic computing device in a multi-party encryption and key management system, comprising the steps of:
generating a request for an enrollment package from a server;
transmitting the request for the enrollment package from the electronic computing device to the server;
receiving, at the electronic computing device, the enrollment package from the server, wherein the enrollment package comprises an enrollment request identifier and unique cryptographic information corresponding to a key service;
generating, at the electronic computing device, an enrollment request corresponding to a user of the electronic computing device for enrollment in the multi-party encryption and key management system, wherein the enrollment request comprises routing data for routing the enrollment request and identity data corresponding to the user, wherein the identity data comprises the enrollment request identifier and an electronic computing device identifier;
encrypting, at the electronic computing device, at least the identity data with the unique cryptographic information corresponding to the key service to prevent the server from accessing the identity data;
transmitting the enrollment request from the electronic computing device to the server; and
receiving, at the electronic computing device, a response from the server, wherein the response comprises a user identifier, a tenant-specific device identifier, and cryptographic enrollment data for enrolling the user, wherein the response was generated both at the server and the key service capable of accessing the encrypted identity data.

### Claim 102 (depends on 101)

The method of claim 101, wherein the identity data further comprises first unique cryptographic information corresponding to the enrollment request.

### Claim 103 (depends on 102)

The method of claim 102, wherein the cryptographic enrollment data comprises cryptographic key service enrollment data and cryptographic server enrollment data, wherein at least the cryptographic key service enrollment data was encrypted by the key service using the first unique cryptographic information corresponding to the enrollment request and at least the cryptographic server enrollment data was encrypted by the server using the first unique cryptographic information corresponding to the enrollment request.

### Claim 104 (depends on 103)

The method of claim 103, wherein the electronic computing device decrypts at least the cryptographic key service enrollment data and the cryptographic server enrollment data using second unique cryptographic information corresponding to the enrollment request.

### Claim 105 (depends on 101)

The method of claim 101, wherein the multi-party encryption and key management system comprises the server.