Computational systems and methods for encrypting data for anonymous storage

• US 10,079,811 B2
• Filed: 11/08/2016
• Issued: 09/18/2018
• Est. Priority Date: 09/07/2011
• Status: Active Grant

• Current Assignee: Elwha LLC (Intellectual Ventures LLC)
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Davis, Marc E., Dyor, Matthew G., Gates, William, Huang, Xeudong, Hyde, Roderick A., Jung, Edward K. Y., Kare, Jordin T., Levien, Royce A., Lord, Richard T., Lord, Robert W., Lu, Qi, Malamud, Mark A., Myhrvold, Nathan P., Nadella, Satya, Reed, Danny Allen, Shum, Harry, Tegreene, Clarence T., Wood, Jr., Lowell L.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US15/346,663
• Publication Number:
  US 20170302632A1
• Time in Patent Office: 679 Days
• Field of Search: 713168
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

Methods, apparatuses, computer program products, devices and systems are described that carry out accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption; encrypting the at least one instance of data to produce level-one-encrypted data; associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity; and transmitting the level-one-encrypted data and associated encrypted identifier.

Claims

1. A system comprising:

(a) circuitry for accepting from an identifier encryption entity at least one encrypted identifier corresponding to at least one instance of data to be encrypted;

including at least;

(1) circuitry for accepting from the identifier encryption entity at least one hash corresponding to at least one of a device identifier, a username, a real name, an alias, a unique identifier, a date, a date and time, or biometric data;

(b) circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data is separate and apart from the identifier encryption entity;

(c) circuitry for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity; and

(d) circuitry for transmitting the level-one-encrypted data and associated encrypted identifier.

2. The system of claim 1 wherein the circuitry for accepting from an identifier encryption entity at least one encrypted identifier corresponding to at least one instance of data to be encrypted comprises:

circuitry for accepting from a user identifier encryption entity at least one encrypted persona corresponding to a user having at least one instance of data for encryption.

3. The system of claim 1 wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data comprises:

circuitry for encrypting the at least one instance of data via public key cryptography.

4. The system of claim 3 wherein the circuitry for encrypting the at least one instance of data via public key cryptography comprises:

circuitry for encrypting the at least one instance of data using a certificated public key.

5. The system of claim 4 wherein the circuitry for encrypting the at least one instance of data using a certificated public key comprises:

circuitry for encrypting the at least one instance of data using an RSA key.

6. The system of claim 1 wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data comprises:

at least one of;

circuitry for encrypting the at least one instance of data using a symmetric key to produce level-one-encrypted data;

or

circuitry for encrypting the at least one instance of data using a public key that is not held by a certificating authority.

7. The system of claim 1 wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data comprises:

circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, wherein the circuitry for encrypting is configured to delete the at least one instance of data subsequent to producing the level-one-encrypted data.

8. The system of claim 1 wherein the circuitry for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity comprises:

circuitry for associating as metadata the at least one encrypted identifier with the level-one-encrypted data, and wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity.

9. The system of claim 1 wherein the circuitry for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity comprises:

circuitry for associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the identifier encryption entity, and further wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity.

10. The system of claim 9 wherein the circuitry for associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the identifier encryption entity, and further wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity comprises:

circuitry for associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the identifier encryption entity, and wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity, and further wherein a decryption key for decrypting the encrypted identifier is inaccessible to the level-one-encryption entity.

11. The system of claim 1 wherein the circuitry for transmitting the level-one-encrypted data and associated encrypted identifier comprises:

circuitry for transmitting the level-one-encrypted data and associated encrypted identifier to a level-two-encryption entity.

12. The system of claim 1, wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data is separate and apart from the identifier encryption entity comprises:

circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, wherein the circuitry for encrypting includes at least a level-one encryption entity that is a separate entity from the identifier encryption entity.

13. A computer-implemented method comprising:

(a) accepting from an identifier encryption entity at least one encrypted identifier corresponding to at least one instance of data to be encrypted, including at least;

(1) accepting from the identifier encryption entity at least one hash corresponding to at least one of a device identifier, a username, a real name, an alias, a unique identifier, a date, a date and time, or biometric data;

(b) encrypting the at least one instance of data to produce level-one-encrypted data, wherein the encrypting the at least one instance of data to produce level-one-encrypted data is performed at least in part with circuitry that is separate and apart from the identifier encryption entity;

(c) associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity; and

(d) transmitting the level-one-encrypted data and associated encrypted identifier; and

wherein at least one of the accepting, the encrypting, the associating, or the transmitting is performed at least in part with one or more processing devices.

14. The computer-implemented method of claim 13 wherein accepting from an identifier encryption entity at least one encrypted identifier corresponding to at least one instance of data to be encrypted comprises:

accepting from a user identifier encryption entity at least one encrypted persona corresponding to a user having at least one instance of data for encryption.

15. The computer-implemented method of claim 13 wherein encrypting the at least one instance of data to produce level-one-encrypted data comprises:

encrypting the at least one instance of data via public key cryptography.

16. The computer-implemented method of claim 15 wherein encrypting the at least one instance of data via public key cryptography comprises:

encrypting the at least one instance of data using a certificated public key.

17. The computer-implemented method of claim 16 wherein encrypting the at least one instance of data using a certificated public key comprises:

encrypting the at least one instance of data using an RSA key.

18. The computer-implemented method of claim 13 wherein encrypting the at least one instance of data to produce level-one-encrypted data comprises:

encrypting the at least one instance of data using a symmetric key to produce level-one-encrypted data.

19. The computer-implemented method of claim 13 wherein encrypting the at least one instance of data to produce level-one-encrypted data comprises:

encrypting the at least one instance of data using a public key that is not held by a certificating authority.

20. The computer-implemented method of claim 13 wherein encrypting the at least one instance of data to produce level-one-encrypted data comprises:

encrypting the at least one instance of data to produce level-one-encrypted data, including at least deleting the at least one instance of data subsequent to producing the level-one-encrypted data.

21. The computer-implemented method of claim 13 wherein associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity comprises:

associating as metadata the at least one encrypted identifier with the level-one-encrypted data, and wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity.

22. The computer-implemented method of claim 13 wherein associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity comprises:

associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the identifier encryption entity, and further wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity.

23. The computer-implemented method of claim 22 wherein associating as metadata the encrypted identifier with level-one-encrypted data, wherein a level-one decryption key is inaccessible to the identifier encryption entity, and wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity comprises:

associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the identifier encryption entity, and wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity, and further wherein a decryption key for decrypting the encrypted identifier is inaccessible to the level-one-encryption entity.

24. The computer-implemented method of claim 13 wherein transmitting the level-one-encrypted data and associated encrypted identifier comprises:

transmitting the level-one-encrypted data and associated encrypted identifier to a level-two-encryption entity.

25. A computer program product comprising:

an article of manufacture including at least one non-transitory signal-bearing medium bearing at least;

(1) one or more instructions for accepting from an identifier encryption entity at least one encrypted identifier corresponding to at least one instance of data for encryption, including at least;

(a) one or more instructions for accepting from the identifier encryption entity at least one hash corresponding to at least one of a device identifier, a username, a real name, an alias, a unique identifier, a date, a date and time, or biometric data;

(2) one or more instructions for encrypting the at least one instance of data to produce level-one-encrypted data, wherein the one or more instructions for encrypting the at least one instance of data to produce level-one-encrypted data are configured to cause performance of the encrypting at least in part with circuitry that is separate and apart from the identifier encryption entity;

(3) one or more instructions for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the identifier encryption entity; and

(4) one or more instructions for transmitting the level-one-encrypted data and associated encrypted identifier.

26. The computer program product of claim 25, wherein the at least one non-transitory signal-bearing medium comprises:

at least one of;

a computer-readable medium;

a recordable medium;

or

a communications medium.