SELECTIVE ENCRYPTION OF PROFILE FIELDS FOR MULTIPLE CONSUMERS

• US 20170126644A1
• Filed: 10/30/2015
• Published: 05/04/2017
• Est. Priority Date: 10/30/2015
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Ullrich, Tobias, Pfannenschmidt, Lars, Wisniewski, Frank
• Granted Patent: US 10,230,701 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

The disclosed embodiments relate to a system that provides a selective encryption technique that encrypts all of the fields in a profile, and selectively enables consumers of the profile information to decrypt specific fields in the profiles. This is accomplished by encrypting each field in the profile using a randomly generated symmetric key, and then encrypting the symmetric key for each field with public keys belonging to individuals who are authorized to access each field. These encrypted public keys are stored in a header of the profile to enable individuals to use their corresponding private keys to decrypt symmetric keys for the specific fields that they are authorized to access.

Claims

1. A method for accessing encrypted fields in a profile, comprising:

retrieving the profile, wherein the profile includes the encrypted fields that have been encrypted using symmetric keys, and a header including encrypted versions of the symmetric keys, wherein the symmetric keys have been encrypted using public keys associated with consumers;

using a private key associated with a consumer to decrypt a subset of the symmetric keys, wherein the subset of the symmetric keys was used to encrypt a subset of the encrypted fields in the profile that the consumer is allowed to access; and

using the subset of the symmetric keys to decrypt values in the subset of encrypted fields that the consumer is allowed to access.

2. The method of claim 1, further comprising accessing encrypted fields in an update to the profile by:

retrieving the update, wherein the update includes the encrypted fields that have been encrypted using symmetric keys, and a header including encrypted versions of the symmetric keys, wherein the symmetric keys have been encrypted using public keys associated with consumers;

using a private key associated with a consumer to decrypt a subset of the symmetric keys, wherein the subset of the symmetric keys was used to encrypt a subset of the encrypted fields in the update that the consumer is allowed to access; and

using the subset of the symmetric keys to decrypt values in the subset of the encrypted fields that the consumer is allowed to access.

3. The method of claim 1, wherein each encrypted field in the profile is encrypted with a different symmetric key.

4. The method of claim 1, wherein the header includes multiple encrypted versions of a single symmetric key, which have been encrypted using public keys associated with different consumers.

5. The method of claim 4, wherein the header is organized to facilitate looking up encrypted versions of symmetric keys belonging to a given consumer.

6. The method of claim 1,

wherein the encrypted versions of symmetric keys for the consumer contained in the header are produced by,

generating a symmetric key for the consumer,

using the symmetric key for the consumer to encrypt symmetric keys for fields the consumer is allowed to access,

using a public key for the consumer to encrypt the symmetric key for the consumer, and

storing the encrypted symmetric keys for the fields the consumer is allowed to access and the encrypted symmetric key for the consumer in the header;

and

wherein using the private key associated with the consumer to decrypt the subset of symmetric keys for the fields the consumer is allowed to access includes,

using the private key for the consumer to decrypt the encrypted symmetric key for the consumer, and

using the decrypted symmetric key for the consumer to decrypt the subset of symmetric keys for the fields the consumer is allowed to access.

7. The method of claim 1, wherein the profiles in the profile store include:

personal profiles containing personal attributes associated with corresponding people; and

organizational profiles containing organizational attributes associated with corresponding organizations.

8. The method of claim 1, wherein the method further comprises revoking access by the consumer to one or more fields in the profile by updating the header of the profile to remove encrypted versions of symmetric keys that can be decrypted using a private key associated with the consumer.

9. The method of claim 1, wherein retrieving the profile includes retrieving the profile from a profile snapshot queue, wherein the profile snapshot queue is periodically populated by accessing each profile in the profile store while the profile store is being updated, and recording a snapshot of each accessed profile in the profile snapshot queue.

10. The method of claim 8, wherein the profile snapshot queue is accessible by multiple consumers, and each of the multiple consumers can read through the profile snapshot queue at a different speed.

11. The method of claim 1, wherein prior to accessing the profile, the method further comprises encrypting the profile by:

encrypting each field in the profile using an associated symmetric key in a set of symmetric keys;

using public keys associated with a set of consumers to encrypt the set of symmetric keys to produce a set of encrypted symmetric keys; and

storing the set of encrypted symmetric keys in the header for the profile.

12. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for accessing encrypted fields in a profile, the method comprising:

retrieving the profile, wherein the profile includes the encrypted fields that have been encrypted using symmetric keys, and a header including encrypted versions of the symmetric keys, wherein the symmetric keys have been encrypted using public keys associated with consumers;

using a private key associated with a consumer to decrypt a subset of the symmetric keys, wherein the subset of the symmetric keys was used to encrypt a subset of the encrypted fields in the profile that the consumer is allowed to access; and

using the subset of the symmetric keys to decrypt values in the subset of encrypted fields that the consumer is allowed to access.

13. The non-transitory computer-readable storage medium of claim 12, wherein the method further comprises accessing encrypted fields in an update to the profile by:

retrieving the update, wherein the update includes the encrypted fields that have been encrypted using symmetric keys, and a header including encrypted versions of the symmetric keys, wherein the symmetric keys have been encrypted using public keys associated with consumers;

using a private key associated with a consumer to decrypt a subset of the symmetric keys, wherein the subset of the symmetric keys was used to encrypt a subset of the encrypted fields in the update that the consumer is allowed to access; and

using the subset of the symmetric keys to decrypt values in the subset of the encrypted fields that the consumer is allowed to access.

14. The non-transitory computer-readable storage medium of claim 12, wherein each encrypted field in the profile is encrypted with a different symmetric key.

15. The non-transitory computer-readable storage medium of claim 12, wherein the header includes multiple encrypted versions of a single symmetric key, which have been encrypted using public keys associated with different consumers.

16. The non-transitory computer-readable storage medium of claim 15, wherein the header is organized to facilitate looking up encrypted versions of symmetric keys belonging to a given consumer.

17. The non-transitory computer-readable storage medium of claim 12,

wherein the encrypted versions of symmetric keys for the consumer contained in the header are produced by,

generating a symmetric key for the consumer,

using the symmetric key for the consumer to encrypt symmetric keys for fields the consumer is allowed to access,

using a public key for the consumer to encrypt the symmetric key for the consumer, and

storing the encrypted symmetric keys for the fields the consumer is allowed to access and the encrypted symmetric key for the consumer in the header;

and

wherein using the private key associated with the consumer to decrypt the subset of symmetric keys for the fields the consumer is allowed to access includes,

using the private key for the consumer to decrypt the encrypted symmetric key for the consumer, and

using the decrypted symmetric key for the consumer to decrypt the subset of symmetric keys for the fields the consumer is allowed to access.

18. The non-transitory computer-readable storage medium of claim 12, wherein the profiles in the profile store include:

personal profiles containing personal attributes associated with corresponding people; and

organizational profiles containing organizational attributes associated with corresponding organizations.

19. The non-transitory computer-readable storage medium of claim 12, wherein the method further comprises revoking access by the consumer to one or more fields in the profile by updating the header of the profile to remove encrypted versions of symmetric keys that can be decrypted using a private key associated with the consumer.

20. The non-transitory computer-readable storage medium of claim 12, wherein retrieving the profile includes retrieving the profile from a profile snapshot queue, wherein the profile snapshot queue is periodically populated by accessing each profile in the profile store while the profile store is being updated, and recording a snapshot of each accessed profile in the profile snapshot queue.

21. The non-transitory computer-readable storage medium of claim 20, wherein the profile snapshot queue is accessible by multiple consumers, and each of the multiple consumers can read through the profile snapshot queue at a different speed.

22. The non-transitory computer-readable storage medium of claim 12, wherein prior to accessing the profile, the method further comprises encrypting the profile by:

encrypting each field in the profile using an associated symmetric key in a set of symmetric keys;

using public keys associated with a set of consumers to encrypt the set of symmetric keys to produce a set of encrypted symmetric keys; and

storing the set of encrypted symmetric keys in the header for the profile.

23. A system that facilitates accessing encrypted fields in a profile, comprising:

at least one processor and at least one associated memory; and

a decryption mechanism that executes on the at least one processor, wherein during operation, the decryption mechanism;

retrieves the profile, wherein the profile includes the encrypted fields that have been encrypted using symmetric keys, and a header including encrypted versions of the symmetric keys, wherein the symmetric keys have been encrypted using public keys associated with consumers;

uses a private key associated with a consumer to decrypt a subset of the symmetric keys, wherein the subset of the symmetric keys was used to encrypt a subset of the encrypted fields in the profile that the consumer is allowed to access; and

uses the subset of the symmetric keys to decrypt values in the subset of encrypted fields that the consumer is allowed to access.

24. The system of claim 23, wherein while accessing encrypted fields in an update to the profile, the decryption mechanism:

retrieves the update, wherein the update includes the encrypted fields that have been encrypted using symmetric keys, and a header including encrypted versions of the symmetric keys, wherein the symmetric keys have been encrypted using public keys associated with consumers;

uses a private key associated with a consumer to decrypt a subset of the symmetric keys, wherein the subset of the symmetric keys was used to encrypt a subset of the encrypted fields in the update that the consumer is allowed to access; and

uses the subset of the symmetric keys to decrypt values in the subset of the encrypted fields that the consumer is allowed to access.

25. The system of claim 23, wherein each encrypted field in the profile is encrypted with a different symmetric key.

26. The system of claim 23, wherein the header includes multiple encrypted versions of a single symmetric key, which have been encrypted using public keys associated with different consumers.

27. The system of claim 26, wherein the header is organized to facilitate looking up encrypted versions of symmetric keys belonging to a given consumer.

28. The system of claim 23,

wherein the encrypted versions of symmetric keys for the consumer contained in the header are produced by an encryption mechanism that,

generates a symmetric key for the consumer,

uses the symmetric key for the consumer to encrypt symmetric keys for fields the consumer is allowed to access,

uses a public key for the consumer to encrypt the symmetric key for the consumer, and

stores the encrypted symmetric keys for the fields the consumer is allowed to access and the encrypted symmetric key for the consumer in the header;

and

wherein while using the private key associated with the consumer to decrypt the subset of symmetric keys for the fields the consumer is allowed to access, the decryption mechanism,

uses the private key for the consumer to decrypt the encrypted symmetric key for the consumer, and

uses the decrypted symmetric key for the consumer to decrypt the subset of symmetric keys for the fields the consumer is allowed to access.

29. The system of claim 23, wherein the profiles in the profile store include:

personal profiles containing personal attributes associated with corresponding people; and

organizational profiles containing organizational attributes associated with corresponding organizations.

30. The system of claim 23, further comprising a revocation mechanism that revokes access by the consumer to one or more fields in the profile by updating the header of the profile to remove encrypted versions of symmetric keys that can be decrypted using a private key associated with the consumer.

31. The system of claim 23, wherein while retrieving the profile, the decryption mechanism retrieves the profile from a profile snapshot queue, wherein the profile snapshot queue is periodically populated by accessing each profile in the profile store while the profile store is being updated, and recording a snapshot of each accessed profile in the profile snapshot queue.

32. The system of claim 31, wherein the profile snapshot queue is accessible by multiple consumers, and each of the multiple consumers can read through the profile snapshot queue at a different speed.

33. The system of claim 23, further comprising an encryption mechanism, wherein prior to the decryption mechanism accessing the profile, the encryption mechanism encrypts the profile by:

encrypting each field in the profile using an associated symmetric key in a set of symmetric keys;

using public keys associated with a set of consumers to encrypt the set of symmetric keys to produce a set of encrypted symmetric keys; and

storing the set of encrypted symmetric keys in the header for the profile.