# US 9,608,810 B1 · Systems and methods for encryption and provision of information security using platform services

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,608,810 B1
- Document ID: US9608810B1
- Status: Granted
- Kind: B1
- Application number: 15/017,290
- Filed: 2016-02-05
- Granted: 2017-03-28
- Earliest claimed: 2015-02-05
- Assignees: Ionic Security Inc.
- Applicants: Ionic Security, Inc.
- Inventors: Adam Ghetti; Ken Green; Kenneth Silva; Michael Rollins; Nathaniel Tinkler; Jeremy Eckman; Ryan Speers
- Web page: https://patentgrep.com/patent/US9608810B1

## CPC

- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0822: {using key encryption key}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/102: {Entity profiles}
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- G06F 2221/2133: Verifying human interaction, e.g., Captcha
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods for securing or encrypting data or other information arising from a user's interaction with software and/or hardware, resulting in transformation of original data into ciphertext. Generally, the ciphertext is generated using context-based keys that depend on the environment in which the original data originated and/or was accessed. The ciphertext can be stored in a user's storage device or in an enterprise database (e.g., at-rest encryption) or shared with other users (e.g., cryptographic communication). The system generally allows for secure federation across organizations, including mechanisms to ensure that the system itself and any other actor with pervasive access to the network cannot compromise the confidentially of the protected data.

## Claims

### Claim 1

A method, comprising the steps of:
retrieving a secure enrollment profile, wherein the secure enrollment profile comprises cryptographic identity data corresponding to a user of a particular electronic computing device that is enrolled with a federated security platform associated with a plurality of tenants, wherein the cryptographic identity data comprises a tenant-specific device identifier and one or more shared secrets between the platform and the particular electronic computing device;
determining, based on at least the tenant-specific device identifier in the cryptographic identity data of the secure enrollment profile, a particular tenant corresponding to the user for enabling secure tenant-specific tracking, by the platform, of electronic activities of the user and the particular electronic computing device;
receiving, from a platform server associated with the federated security platform at a predetermined interval, one or more tenant-specific policies defining actions to be taken with respect to certain electronic activities resulting from interaction by the user with the particular electronic computing device, wherein the one or more shared secrets enable secure communications between the platform server and the particular electronic computing device;
identifying a particular electronic activity resulting from user interaction with the particular electronic computing device;
comparing the identified particular electronic activity to the one or more tenant-specific policies to determine the appropriate action to take with respect to the identified particular electronic activity; and
initiating the appropriate action with respect to the identified particular electronic activity.

### Claim 2 (depends on 1)

The method of claim 1, wherein the cryptographic identity data further comprises a key space identifier and unique cryptographic information.

### Claim 3 (depends on 2)

The method of claim 2, further comprising the steps of:
prior to retrieving the secure enrollment profile, transmitting an enrollment request to the platform server for enrollment of the user of the particular electronic computing device in the federated security platform;
receiving, from the platform server, an enrollment response corresponding to the enrollment request, wherein the enrollment response comprises the cryptographic identity data;
generating, based on the enrollment response, the secure enrollment profile; and
storing the secure enrollment profile in a database.

### Claim 4 (depends on 3)

The method of claim 3, wherein at least a portion of the enrollment response is encrypted.

### Claim 5 (depends on 4)

The method of claim 4, wherein the step of generating the secure enrollment profile further comprises decrypting the encrypted portion of the enrollment response.

### Claim 6 (depends on 1)

The method of claim 1, wherein the appropriate action is selected from the group comprising blocking a particular functionality of a particular application operating on the particular electronic computing device, removing a particular user interface element of a particular application, blocking network traffic associated with a particular application, and encrypting or decrypting electronic data entered into a particular data field of a particular application.

### Claim 7 (depends on 6)

The method of claim 6, wherein identifying the particular electronic activity further comprises the step of detecting, via a client module operating on the particular electronic computing device, an item of original data entered into the particular data field.

### Claim 8 (depends on 7)

The method of claim 7, wherein comparing the identified particular electronic activity to the one or more tenant-specific policies further comprises the step of identifying a need to encrypt the item of original data.

### Claim 9 (depends on 8)

The method of claim 8, wherein initiating the appropriate action further comprises the steps of:
identifying, via the client module, contextual information relating to the item of original data;
transmitting a request for encryption of the item of original data from the client module to the platform server, wherein the request includes the contextual information relating to the item of original data;
receiving, at the client module, a response from the platform server, wherein the response comprises unique cryptographic information generated based on the contextual information corresponding to the item of original data; and
generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.

### Claim 10 (depends on 6)

The method of claim 6, wherein identifying the particular electronic activity further comprises the step of detecting, via a client module operating on the particular electronic computing device, an encrypted output of an item of original data entered into the particular data field.

### Claim 11 (depends on 10)

The method of claim 10, wherein comparing the identified particular electronic activity further comprises the step of identifying a need to decrypt the encrypted output of the item of original data.

### Claim 12 (depends on 11)

The method of claim 11, wherein initiating the appropriate action further comprises the steps of:
identifying, via the client module, a context-based key identifier relating to the encrypted output of the item of original data;
transmitting a request for decryption of the encrypted output of the item of original data from the client module to the platform server, wherein the request includes the context-based key identifier;
receiving, at the client module, a response from the platform server, wherein the response comprises unique cryptographic information corresponding to the context-based key identifier; and
generating the item of original data as a function of the encrypted output of the item of original data and the unique cryptographic information.

### Claim 13

A system, comprising:
a federated security platform associated with a plurality of tenants, the platform comprising a server; and
an electronic computing device enrolled with the platform, the electronic computing device comprising a processor, the processor operative to:
retrieve a secure enrollment profile, the secure enrollment profile comprising cryptographic identity data corresponding to a user of the electronic computing device, wherein the cryptographic identity data comprises a tenant-specific device identifier and one or more shared secrets between the platform and the electronic computing device;
determine, based on at least the tenant-specific device identifier in the cryptographic identity data of the secure enrollment profile, a particular tenant corresponding to the user for enabling secure tenant-specific tracking, by the platform, of electronic activities of the user and the electronic computing device;
receive, from the server at a predetermined interval, one or more tenant-specific policies defining actions to be taken with respect to certain electronic activities resulting from interaction by the user with the electronic computing device, wherein the one or more shared secrets enable secure communications between the server and the particular electronic computing device;
identify a particular electronic activity resulting from user interaction with the electronic computing device;
compare the identified particular electronic activity to the one or more tenant-specific policies to determine the appropriate action to take with respect to the identified particular electronic activity; and
initiate the appropriate action with respect to the identified particular electronic activity.

### Claim 14 (depends on 13)

The system of claim 13, wherein the cryptographic identity data further comprises a key space identifier and unique cryptographic information.

### Claim 15 (depends on 14)

The system of claim 14, where the processor is further operative to:
prior to retrieving the secure enrollment profile, transmit an enrollment request to the server for enrollment of the user of the particular electronic computing device in the federated security platform;
receive, from the server, an enrollment response corresponding to the enrollment request, wherein the enrollment response comprises the cryptographic identity data;
generate, based on the enrollment response, the secure enrollment profile; and
store the secure enrollment profile in a database operatively connected to the electronic computing device.

### Claim 16 (depends on 15)

The system of claim 15, wherein at least a portion of the enrollment response is encrypted.

### Claim 17 (depends on 16)

The system of claim 16, wherein the processor is further operative to decrypt the encrypted portion of the enrollment response as part of generating the secure enrollment profile.

### Claim 18 (depends on 13)

The system of claim 13, wherein the appropriate action is selected from the group comprising blocking a particular functionality of a particular application operating on the electronic computing device, removing a particular user interface element of a particular application, blocking network traffic associated with a particular application, and encrypting or decrypting electronic data entered into a particular data field of a particular application.

### Claim 19 (depends on 18)

The system of claim 18, wherein the processor is further operative, as part of identifying the particular electronic activity, to detect, via a client module operating on the electronic computing device, an item of original data entered into the particular data field.

### Claim 20 (depends on 19)

The system of claim 19, wherein the processor is further operative, as part of comparing the identified particular electronic activity to the one or more tenant-specific policies, to identify a need to encrypt the item of original data.

### Claim 21 (depends on 20)

The system of claim 20, wherein the processor is further operative, as part of initiating the appropriate action, to:
identify, via the client module, contextual information relating to the item of original data;
transmit a request for encryption of the item of original data from the client module to the server, wherein the request includes the contextual information relating to the item of original data;
receive, at the client module, a response from the server, wherein the response comprises unique cryptographic information generated based on the contextual information corresponding to the item of original data; and
generate an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.

### Claim 22 (depends on 18)

The system of claim 18, wherein the processor is further operative, as part of identifying the particular electronic activity, to detect, via a client module operating on the electronic computing device, an encrypted output of an item of original data entered into the particular data field.

### Claim 23 (depends on 22)

The system of claim 22, wherein the processor is further operative, as part of comparing the identified particular electronic activity, to identify a need to decrypt the encrypted output of the item of original data.

### Claim 24 (depends on 23)

The system of claim 23, wherein the processor is further operative, as part of initiating the appropriate action, to:
identify, via the client module, a context-based key identifier relating to the encrypted output of the item of original data;
transmit a request for decryption of the encrypted output of the item of original data from the client module to the server, wherein the request includes the context-based key identifier;
receive, at the client module, a response from the server, wherein the response comprises unique cryptographic information corresponding to the context-based key identifier; and
generate the item of original data as a function of the encrypted output of the item of original data and the unique cryptographic information.