Systems and methods for cryptographic-chain-based group membership content sharing

• US 10,162,971 B2
• Filed: 04/13/2018
• Issued: 12/25/2018
• Est. Priority Date: 04/28/2014
• Status: Active Grant

• Current Assignee: Topia Technology, Inc.
• Original Assignee: Topia Technology, Inc.
• Inventors: Haager, John, Sandwith, Cody, Terrano, Janine, Saripalli, Prasad
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Kaplan, Benjamin A
• Application Number:
  US15/952,586
• Publication Number:
  US 20180232527A1
• Time in Patent Office: 256 Days
• Field of Search: 713165
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

In some embodiments, a first device may generate a data block for an ordered set of data blocks such that the data block is cryptographically chained to a given data block preceding the data block in the ordered set. The first device may obtain an encryption key used to encrypt information related to the data block, and use group members'"'"' keys to encrypt the encryption key to generate a group key. As an example, the group'"'"'s members may include a first member associated with the first device and other members. The keys used to encrypt the encryption key may include the other members'"'"' keys. The first device may transmit the ordered set and the group key to a communication resource (e.g., accessible by the members). Other devices (associated with the other members) may use the ordered set and the group key to obtain content related to the ordered set.

Claims

1. A first device for facilitating group membership content sharing, the first device comprising:

one or more processor programmed with computer program instructions that, when executed, cause the first device to;

generate a first data block for an ordered set of data blocks related to members of the group, the first data block being generated such that the first data block is cryptographically chained to a data block preceding the first data block in the ordered set, the group'"'"'s members comprising a first member associated with the first device, a second member associated with a second device, and one or more other members;

obtain an encryption key used to encrypt information related to the first data block;

use keys of two or more members of the group to encrypt the encryption key to generate a group key, the group key comprising the encrypted encryption key, the keys used to encrypt the encryption key comprising a key of the second member and one or more keys of the one or more other members; and

transmit the ordered set and the group key to a communication resource to which the second device has access, the second device being configured to use the ordered set and the group key to obtain content related to the ordered set.

2. The first device of claim 1, wherein the group'"'"'s members are users of a workspace to which the related content is associated, and the group corresponds to the workspace.

3. The first device of claim 1, wherein the encryption key comprises a workspace key associated with a workspace of which the group'"'"'s members are users.

4. The first device of claim 1, wherein the ordered set indicates a location of at least a portion of the content related to the ordered set.

5. The first device of claim 1, wherein the communication resource comprises a file server.

6. The first device of claim 1, wherein each of the first data block and one or more other data blocks of the ordered set comprises an encrypted portion of a file.

7. The first device of claim 6, wherein the second device is configured to (i) decrypt the encrypted portions of the file based on the group key to obtain corresponding non-encrypted portions of the file and (ii) combine the encrypted portions of the file to obtain the file.

8. A method of facilitating group membership content sharing, the method being implemented by a first computer system comprising one or more processors executing computer program instructions that, when executed, perform the method, the method comprising:

generating, by the first computer system, a first data block for an ordered set of data blocks related to members of the group, the first data block being generated such that the first data block is cryptographically chained to a data block preceding the first data block in the ordered set, the group'"'"'s members comprising a first member, a second member, and one or more other members;

obtaining, by the first computer system, an encryption key used to encrypt information related to the first data block;

using, by the first computer system, keys of two or more members of the group to encrypt the encryption key to generate a group key, the group key comprising the encrypted encryption key, the keys used to encrypt the encryption key comprising a key of the second member and one or more keys of the one or more other members; and

transmitting, by the first computer system, the ordered set and the group key to a communication resource to which a second computer system associated with the second member has access, the second computer system being configured to use the ordered set and the group key to obtain content related to the ordered set.

9. The method of claim 8, wherein the group'"'"'s members are users of a workspace to which the related content is associated, and the group corresponds to the workspace.

10. The method of claim 8, wherein the encryption key comprises a workspace key associated with a workspace of which the group'"'"'s members are users.

11. The method of claim 8, wherein the ordered set indicates a location of at least a portion of the content related to the ordered set.

12. The method of claim 8, wherein the communication resource comprises a file server.

13. The method of claim 8, wherein each of the first data block and one or more other data blocks of the ordered set comprises an encrypted portion of a file.

14. The method of claim 13, wherein the second device is configured to (i) decrypt the encrypted portions of the file based on the group key to obtain corresponding non-encrypted portions of the file and (ii) combine the encrypted portions of the file to obtain the file.