Method and system for fully encrypted repository

• US 8,769,304 B2
• Filed: 06/15/2012
• Issued: 07/01/2014
• Est. Priority Date: 06/16/2011
• Status: Active Grant

• Current Assignee: Neustar Incorporated
• Original Assignee: OneID Inc.
• Inventors: Kirsch, Steven Todd
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US13/524,432
• Publication Number:
  US 20120324242A1
• Time in Patent Office: 746 Days
• Field of Search: 713/189
• US Class Current: 713/189
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/384 using social networks
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

According to an embodiment of the present invention, a method for using information in conjunction with a data repository includes encrypting data associated with the information with an encryption key, sending at least the encrypted data to the data repository, and possibly deleting the information. The method also includes receiving a request for the information from a remote device, and sending a request for the encrypted data to the data repository. The method further includes receiving the encrypted data from the data repository, decrypting the encrypted data using the encryption key, and sending the information to the remote device.

Claims

1. A method for using information in conjunction with a data repository, the method comprising:

encrypting data associated with the information using an encryption key to generate encrypted data, wherein;

the data associated with the information comprises a field and a value; and

the encrypted data comprises an encrypted field and an encrypted value;

sending at least the encrypted data to the data repository;

receiving a request for at least the value from a remote device;

sending a request for at least the value to the data repository, wherein the request for at least the value comprises the encrypted field;

receiving at least the encrypted value from the data repository, wherein the data repository uses the encrypted field to identify the encrypted value;

decrypting the encrypted value; and

sending at least the value to the remote device.

2. The method of claim 1 further comprising:

receiving an authentication request from the data repository, wherein;

the request for at least the value comprises a second field encrypted with the encryption key; and

the authentication request is associated with the second field;

sending an authentication response to the data repository; and

receiving an encrypted second value associated with the encrypted second field only if the authentication response satisfies the authentication request.

3. The method of claim 1 wherein the information comprises a credit card number associated with a user.

4. The method of claim 1 wherein the data repository is remotely located.

5. The method of claim 1 wherein the data repository cannot decrypt the encrypted data.

6. The method of claim 1 further comprising deleting the encrypted data, such that the encrypted data stored at the data repository is not stored locally.

7. The method of claim 1 wherein the information is used in a transaction between a user and the remote device.

8. The method of claim 7 wherein the transaction comprises the user making a purchase from the remote device.

9. The method of claim 1 further comprising preventing a decryption key associated with the encrypted data from being stored in the data repository.

10. The method of claim 1 wherein the data repository comprises a fully encrypted data store.

11. A system for protecting information, the system comprising:

a data repository configured to;

receive encrypted data comprising an encrypted field and an encrypted value;

receive a first request for the encrypted data, wherein the first request comprises the encrypted field;

retrieve the encrypted data by comparing the encrypted data to the encrypted field; and

send the encrypted value in response to the first request; and

a user module operating on a user device, configured to;

receive a second request for information from a remote device;

encrypt a field using an encryption key to generate the encrypted field;

send the first request for the encrypted data to the data repository;

receive the encrypted value from the data repository;

recover a value from the encrypted value; and

send at least the value to the remote device.

12. The system of claim 11 wherein the user module comprises an app operating on a mobile device.

13. The system of claim 11 wherein the user module comprises code running in a web browser.

14. The system of claim 11 wherein the user module is further configured to encrypt the field using deterministic encryption.

15. The system of claim 11 wherein the user module is further configured to:

generate the encrypted data;

send the encrypted data to the identity repository prior to the first request; and

delete the information after encrypting the data associated with the information.

16. An information protection system comprising:

a user device coupled to a network and including a data processor and a non-transitory computer-readable storage medium comprising a plurality of computer-readable instructions tangibly embodied on the non-transitory computer-readable storage medium, which, when executed by a data processor, provide encrypted data protection, the plurality of instructions comprising;

instructions that cause the data processor to encrypt data associated with the information using an encryption key to generate encrypted data, wherein;

the data associated with the information comprises a field and a value; and

the encrypted data comprises an encrypted field and an encrypted value;

instructions that cause the data processor to send at least the encrypted data to the data repository;

instructions that cause the data processor to receive a request for at least the value from a remote device;

instructions that cause the data processor send a request for at least the value to the data repository, wherein the request for at least the value comprises the encrypted field;

instructions that cause the data processor to receive at least the encrypted value from the data repository, wherein the data repository uses the encrypted field to identify the encrypted value;

instructions that cause the data processor to decrypt the encrypted data using the encryption key

the encrypted value; and

instructions that cause the data processor to send at least the value to the remote device.