METHOD AND SYSTEM FOR FULLY ENCRYPTED REPOSITORY

• US 20120324242A1
• Filed: 06/15/2012
• Published: 12/20/2012
• Est. Priority Date: 06/16/2011
• Status: Active Grant

• Current Assignee: Neustar Incorporated
• Original Assignee: OneID Inc.
• Inventors: KIRSCH, STEVEN TODD
• Granted Patent: US 8,769,304 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/384 using social networks
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

According to an embodiment of the present invention, a method for using information in conjunction with a data repository includes encrypting data associated with the information with an encryption key, sending at least the encrypted data to the data repository, and possibly deleting the information. The method also includes receiving a request for the information from a remote device, and sending a request for the encrypted data to the data repository. The method further includes receiving the encrypted data from the data repository, decrypting the encrypted data using the encryption key, and sending the information to the remote device.

Claims

1. A method for using information in conjunction with a data repository, the method comprising:

encrypting data associated with the information with an encryption key;

sending at least the encrypted data to the data repository;

receiving a request for the information from a remote device;

sending a request for the encrypted data to the data repository;

receiving at least part of the encrypted data from the data repository;

decrypting the at least part of the encrypted data; and

sending the information to the remote device.

2. The method of claim 1 further comprising encrypting a field with the encryption key, wherein:

the request for the encrypted data comprises the encrypted field; and

the at least part of the encrypted data from the data repository comprises an encrypted value associated with the encrypted field.

3. The method of claim 1 further comprising:

receiving an authentication request from the data repository, wherein;

the data associated with the information comprises a first field and a second field;

the request for the encrypted data comprises the first field encrypted with the encryption key and the second field encrypted with the encryption key; and

the authentication request is associated with the second field; and

sending an authentication response to the data repository, wherein;

the at least part of the encrypted data comprises an encrypted first value associated with the encrypted first field; and

the at least part of the encrypted data comprises an encrypted second value associated with the encrypted second field only if the authentication response satisfies the authentication request.

4. The method of claim 1 wherein the information comprises a credit card number associated with a user.

5. The method of claim 1 wherein the data repository is remotely located.

6. The method of claim 1 wherein the data repository cannot decrypt the encrypted data.

7. The method of claim 1 further comprising deleting the encrypted data, such that the encrypted data stored at the data repository is not stored locally.

8. The method of claim 1 wherein the information is used in a transaction between a user and the remote device.

9. The method of claim 8 wherein the transaction comprises the user making a purchase from the remote device.

10. The method of claim 1 further comprising preventing a decryption key associated with the encrypted data from being stored in the data repository.

11. The method of claim 1 wherein the data repository comprises a fully encrypted data store.

12. A system for protecting information, the system comprising:

a data repository configured to;

receive encrypted data;

receive a first request for the encrypted data; and

send the encrypted data in response to the first request; and

a user module operating on a user device, configured to;

receive a second request for information from a remote device;

send the first request for the encrypted data to the data repository;

receive the encrypted data from the data repository;

recover the information from the encrypted data; and

send at least the information to the remote device.

13. The system of claim 12 wherein the user module comprises an app operating on a mobile device.

14. The system of claim 12 wherein the user module comprises code running in a web browser.

15. The system of claim 12 wherein the data associated with the information comprises a field and a value.

16. The system of claim 15 wherein the user module is further configured to encrypt the field using an encryption key, wherein the first request comprises the encrypted field.

17. The system of claim 16 wherein the user module is further configured to encrypt the field using deterministic encryption.

18. The system of claim 16 wherein the data repository is further configured to retrieve the encrypted data by comparing the encrypted data to the encrypted field.

19. The system of claim 12 wherein the user module is further configured to:

encrypt data associated with the information;

send the encrypted data to the identity repository prior to the first request; and

delete the information after encrypting the data associated with the information.

20. An information protection system comprising:

a user device coupled to a network and including a data processor and a non-transitory computer-readable storage medium comprising a plurality of computer-readable instructions tangibly embodied on the computer-readable storage medium, which, when executed by a data processor, provide encrypted data protection, the plurality of instructions comprising;

instructions that cause the data processor to encrypt data associated with the information with an encryption key;

instructions that cause the data processor to send at least the encrypted data to the data repository;

instructions that cause the data processor to receive a request for the information from a remote device;

instructions that cause the data processor send a request for the encrypted data to the data repository;

instructions that cause the data processor to receive the encrypted data from the data repository;

instructions that cause the data processor to decrypt the encrypted data using the encryption key; and

instructions that cause the data processor to send the information to the remote device.