Systems and methods for providing information security using context-based keys

• US 10,095,874 B1
• Filed: 09/02/2015
• Issued: 10/09/2018
• Est. Priority Date: 06/14/2011
• Status: Active Grant

• Current Assignee: Ionic Security, Inc. (Twilio, Inc.)
• Original Assignee: Ionic Security, Inc. (Twilio, Inc.)
• Inventors: Ghetti, Adam
• Primary Examiner(s): Leung, Robert B
• Application Number:
  US14/843,504
• Time in Patent Office: 1,133 Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

Systems and methods for securing or encrypting data or other information arising from a user'"'"'s interaction with software and/or hardware, resulting in transformation of original data into ciphertext. Generally, the ciphertext is generated using context-based keys that depend on the environment in which the original data originated and/or accessed. The ciphertext can be stored in a user'"'"'s storage device or in an enterprise database (e.g., at-rest encryption), or shared with other users (e.g., cryptographic communication). Use of context-based encryption keys enables key association with individual data elements, as opposed to public-private key pairs, or use of conventional user-based or system-based keys. In scenarios wherein data is shared by a sender with other users, the system manages the rights of users who are able to send and/or access the sender'"'"'s data according to pre-defined policies/roles.

Claims

1. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing an electronic computing device with which the item of original data was created;

generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device; and

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information, wherein the device identifier uniquely representing the electronic computing device is subsequently used for purposes of decrypting the encrypted output of the item of original data by comparing the device identifier uniquely representing the electronic computing device with one or more access policies associated with a respective decryptor.

2. The method of claim 1, wherein the step of detecting the item of original data that is to be encrypted further comprises the step of detecting a predetermined trigger event indicating that the item of original data is to be encrypted.

3. The method of claim 2, wherein the predetermined trigger event is selected from the group comprising:

identification of data entry, identification of data submission, identification of data storage, user interaction with a user interface in a predetermined manner, predetermined movement of a computer control device associated with an electronic computing device, passage of a predetermined time period, user interaction with an application program command.

4. The method of claim 1, wherein the step of detecting the item of original data that is to be encrypted further comprises receiving an affirmative request for encryption of the item of original data.

5. The method of claim 1, further comprising the steps of:

temporarily diverting the item of original data from an expecting application program operating on the electronic computing device to a memory associated with the electronic computing device; and

upon generation of the encrypted output of the item of original data, reinserting the encrypted output into the expecting application program for subsequent use.

6. The method of claim 1, wherein the contextual information further comprises:

a user identifier associated with a user entering the item of original data, a user identifier of a user interacting with the item of original data, a session identifier, a time instant at which the item of original data was generated, a time instant at which the item of original data was accessed, or a network address.

7. The method of claim 1, wherein the contextual information further comprises data uniquely representing an application program with which the item of original data was created.

8. The method of claim 1, wherein the contextual information further comprises data uniquely representing a corporate organization associated with the electronic computing device.

9. The method of claim 1, wherein the contextual information further comprises data uniquely representing a role of a user of the electronic computing device.

10. The method of claim 1, wherein the unique cryptographic information includes a context-based key (CBK) and a context-based key identifier (CBK ID).

11. The method of claim 10, wherein the step of generating the encrypted output further comprises the step of processing the item of original data and the CBK through an encryption algorithm.

12. The method of claim 11, wherein the step of generating the encrypted output further comprises concatenating the CBK ID with an encrypted version of the item of original data.

13. The method of claim 10, wherein the CBK is generated by extracting a predetermined number of bits from an output of a cryptographic algorithm.

14. The method of claim 10, wherein the CBK and CBK ID are used for a subsequent auditing function.

15. The method of claim 1, further comprising the step of retrieving one or more predefined access control policies relating to the contextual information prior to generating unique cryptographic information.

16. The method of claim 15, further comprising the step of generating unique cryptographic information only upon determining that the predefined access control policies are satisfied.

17. The method of claim 1, wherein detecting an item of original data that is to be encrypted further comprises autonomously detecting an item of original data that is to be encrypted.

18. The method of claim 1, wherein the encrypted output of the item of original data further comprises a persistently encrypted output of the item of original data that is only accessible via local decryption in an electronic computing device having appropriate access authority.

19. The method of claim 1, wherein the unique cryptographic information is generated by processing an identifier comprising at least a portion of the identified contextual information through a cryptographic algorithm.

20. A method for decrypting contextually-encrypted data, comprising the steps of:

detecting a particular encrypted output corresponding to an item of original data that is to be decrypted, wherein the particular encrypted output comprises at least a first type of cryptographic information associated with one or more items of contextual information, wherein at least one of the one or more items of contextual information comprises a device identifier uniquely representing an electronic computing device with which the item of original data was created;

retrieving from a database one or more access control policies corresponding to the one or more items of contextual information, wherein the one or more access control policies define access to the item of original data based in part on the one or more items of contextual information;

determining, based on satisfaction of at least one of the one or more access policies, that a particular user is authorized to access the item of original data associated with the first type of cryptographic information;

upon determination that the particular user is authorized to access the item of original data, retrieving from the database a second type of cryptographic information associated with the first type of cryptographic information in the database; and

decrypting the item of original data from the particular encrypted output by processing the second type of cryptographic information via an encryption algorithm.

21. The method of claim 20, wherein the particular encrypted output further comprises an encrypted version of the item of original data.

22. The method of claim 21, wherein the step of decrypting the item of original data further comprises processing the encrypted version of the item of original data via the encryption algorithm.

23. The method of claim 20, further comprising the step of parsing the particular encrypted output to extract the first type of cryptographic information.

24. The method of claim 20, further comprising the step of reinserting the decrypted item of original data into an application program operating on an electronic device.

25. The method of claim 20, wherein the first type of cryptographic information comprises a context-based key (CBK) identifier embedded in the particular encrypted output.

26. The method of claim 20, wherein the second type of cryptographic information comprises a context-based key (CBK).

27. The method of claim 20, wherein the first type of cryptographic information comprises a string of predetermined length and position with respect to the particular encrypted output.

28. The method of claim 20, wherein detecting a particular encrypted output corresponding to an item of original data that is to be decrypted further comprises autonomously detecting a particular encrypted output corresponding to an item of original data that is to be decrypted.

29. The method of claim 20, wherein the decrypted item of original data further comprises a locally decrypted item of original data that is only locally accessible within an electronic computing device.

30. The method of claim 20, wherein the second type of cryptographic information was generated by processing the first type of cryptographic information through a cryptographic algorithm.

31. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

temporarily diverting the item of original data from an expecting application program operating on an electronic computing device to a memory associated with the electronic computing device;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing the electronic computing device with which the item of original data was created;

generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device;

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information;

upon generation of the encrypted output of the item of original data, reinserting the encrypted output into the expecting application program for subsequent use.

32. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing an electronic computing device with which the item of original data was created and data uniquely representing an application program with which the item of original data was created;

generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device and the data uniquely representing the application program; and

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.

33. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing an electronic computing device with which the item of original data was created and data uniquely representing a corporate organization associated with the electronic computing device;

generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device and the data uniquely representing the corporate organization; and

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.

34. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing an electronic computing device with which the item of original data was created and data uniquely representing a role of a user of the electronic computing device;

generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device and the data uniquely representing the role of the user of the electronic computing device; and

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.

35. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing an electronic computing device with which the item of original data was created;

generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device and wherein the unique cryptographic information includes a context-based key (CBK) and a context-based key identifier (CBK ID) that are used for a subsequent auditing function; and

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.

36. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing an electronic computing device with which the item of original data was created;

retrieving one or more predefined access control policies relating to the contextual information prior to generating unique cryptographic information;

only upon determining that the predefined access control policies are satisfied, generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device; and

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.

37. A method for contextually-encrypting data, comprising the steps of:

detecting an item of original data that is to be encrypted;

identifying contextual information relating to creation of the item of original data, wherein the contextual information comprises at least a device identifier uniquely representing an electronic computing device with which the item of original data was created;

generating unique cryptographic information for use in encrypting the item of original data, wherein the unique cryptographic information is generated by processing an identifier comprising at least a portion of the identified contextual information through a cryptographic algorithm and wherein the unique cryptographic information is stored in a database in association with data identifying the contextual information comprising at least the device identifier uniquely representing the electronic computing device; and

generating an encrypted output of the item of original data as a function of the item of original data and the unique cryptographic information.