Back to results
US RE49,673 E1Granted
Systems and methods for secure data exchange
AssigneeDocuSign, Inc.
InventorsDavid Steeves, Allan Wetter
Life of this patent
Estimating the term…
Abstract
Embodiments described herein provide enhanced computer- and network-based systems and methods for providing data security with respect to computing services, such as a digital transaction service (DTS). Example embodiments further provide a discovery service that enables nodes that are included in, or otherwise communicatively coupled to, the DTS to actively or passively “discover” roles and keys associated with the nodes. These node roles are associated with the various services provided by the DTS.
Claims20
A computing system comprising:
- one or more processorsof a machine;
- and
- a memory storing instructions that, when executed by the one or more processors, cause the machine a first node to perform operations comprising:
- providing receiving discovery data to a plurality of nodes including a first node and a second node from a discovery server, the discovery data including a list of public keys for each of the nodes in the plurality of nodes, the list of public keys including a first public key of the first node and a second public key of the a second node, and service role data specifying roles in a network for nodes of the plurality of nodes, the first public key being from a first public and private key pair associated with the first node, the second public key being from a second public and private key pair associated with the second node, the discovery data also received by the second node from the discovery server, the private keys of each key pair being used to decrypt messages encrypted using their respective public keys, the first node and the second node verifying that the discovery data is trustworthy by verifying a private key signature applied to the discovery data by the discovery server using a public key of the discovery server that is obtained in a secure session from an external key manager other than the discovery server;
- generating a first message by encrypting, via the first node, a plaintext message using a unidirectional session key for messages from the first node to the second node, the unidirectional session key in the first message further encrypted, via the first node, using the second public key of the second node;
- and
- transmitting, by the first note, the first message to the second node;, wherein the second node:
- stores the unidirectional session key for subsequent use;
- generating generates a second message by encrypting, via the second node, an additional plaintext message using an additional unidirectional session key for additional messages from the second node to the first node, the additional unidirectional session key in the second message encrypted, via the second node, using the first public key of the first node;
- and
- transmitting, by the second node, transmits the second message to the first node.
8 more elements
A method comprising:
- providing receiving, by a first node, from a discovery server, discovery data to a plurality of nodes including a first node and a second node, the discovery data including a list of public keys for each of the nodes in the a plurality of nodes including the first node and a second node, the list of public keys including a first public key of the first node and a second public key of the second node, and service role data specifying roles in a network for nodes of the plurality of nodes, the first public key being from a first public and private key pair associated with the first node, the second public key being from a second public and private key pair associated with the second node, the discovery data also received by the second node from the discovery server, the private keys of each key pair being used to decrypt messages encrypted using their respective public keys, the first node and the second node verifying that the discovery data is trustworthy by verifying a private key signature applied to the discovery data by the discovery server using a public key of the discovery server that is obtained in a secure session from an external key manager other than the discovery server;
- generating a first message by encrypting, via the first node, a plaintext message using a unidirectional session key for messages from the first node to the second node, the unidirectional session key in the first message further encrypted, via the first node using the second public key of the second node;
- and
- transmitting, by the first node, the first message to the second node;, wherein the second node:
- stores the unidirectional session key for subsequent use;
- generating generates a second message by encrypting, via the second node, an additional plaintext message using an additional unidirectional session key for additional messages from the second node to the first node, the additional unidirectional session key in the second message encrypted, via the second node, using the first public key of the first node;
- and
- transmitting, by the second node, transmits the second message to the first node.
5 more elements
A non-transitory computer-readable storage device including instructions that, when executed by a computing system, cause the computing system to perform operations comprising:
- providing receiving, by a first node, from a discovery server, discovery data to a plurality of nodes including a first node and a second node, the discovery data including a list of public keys for each of the nodes in the a plurality of nodes including the first node and a second node, the list of public keys including a first public key of the first node and a second public key of the second node, and service role data specifying roles in a network for nodes of the plurality of nodes, the first public key being from a first public and private key pair associated with the first node, the second public key being from a second public and private key pair associated with the second node, the discovery data also received by the second node from the discovery server, the private keys of each key pair being used to decrypt messages encrypted using their respective public keys, the first node and the second node verifying that the discovery data is trustworthy by verifying a private key signature applied to the discovery data by the discovery server using a public key of the discovery server that is obtained in a secure session from an external key manager other than the discovery server;
- generating a first message by encrypting, via the first node, a plaintext message using a unidirectional session key for messages from the first node to the second node, the unidirectional session key in the first message further encrypted, via the first node using the second public key of the second node;
- and
- transmitting, by the first node, the first message to the second node;, wherein the second node:
- stores the unidirectional session key for subsequent use;
- generating generates a second message by encrypting, via the second node, an additional plaintext message using an additional unidirectional session key for additional messages from the second node to the first node, the additional unidirectional session key in the second message encrypted, via the second node, using the first public key of the first node;
- and
- transmitting, by the second node, transmits the second message to the first node.
5 more elements
Dependencies are inferred from the claim text.