Differential client-side encryption of information originating from a client

• US 9,391,963 B2
• Filed: 04/02/2015
• Issued: 07/12/2016
• Est. Priority Date: 09/30/2011
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Manges, Daniel
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US14/677,867
• Publication Number:
  US 20150215294A1
• Time in Patent Office: 467 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method may include allocating a number of public keys, where each respective public key is allocated to a respective entity of a number of entities; storing a number of private keys, where each respective private corresponds to a respective public key; storing one or more decryption algorithms, where each respective decryption algorithm is configured to decrypt data previously encrypted using at least one encryption algorithm of the encryption algorithms. Each respective encryption algorithm may be configured to encrypt data using at least one public key. Each respective decryption algorithm may be configured to decrypt data using at least one private key. The method may include receiving encrypted data, where the encrypted data is encrypted using a first public key and a first encryption algorithm, and the encrypted data is provided over a network.

Claims

1. A system comprising:

a memory configured to store a plurality of private keys; and

one or more processors configured to communicate with the memory, the one or more processors being configured to;

receive encrypted data over a network, the encrypted data being encrypted by a client device using a public key allocated to an entity server;

determine, from the plurality of private keys, a private key corresponding to the public key allocated to the entity server;

decrypt the encrypted data using the private key to obtain decrypted data; and

provide a processing result based on at least a portion of the decrypted data to the entity server over the network.

2. The system of claim 1, wherein the one or more processors are further configured to:

receive unencrypted data over the network, the unencrypted data being related to the encrypted data,

wherein the encrypted data comprises sensitive information and the unencrypted data comprises non-sensitive information, and

wherein the processing result is further based on at least a portion of the unencrypted data.

3. The system of claim 1, wherein the one or more processors are further configured to:

provide at least a portion of the decrypted data to a processing server configured to process the decrypted data; and

receive the processing result from the processing server.

4. The system of claim 3, wherein the encrypted data comprises payment information, wherein the processing server comprises a server associated with a payment service provider, and wherein the processing result comprises an approval or a denial of a payment.

5. The system of claim 3, wherein the encrypted data comprises patient information, wherein the processing server comprises a server associated with a medical service provider, and wherein the processing result comprises an approval or a denial of a patient request for a service, procedure, or medication.

6. The system of claim 3, wherein the encrypted data comprises personal information, wherein the processing server comprises a server associated with a background investigation service provider, and wherein the processing result comprises a result of verified or unverified.

7. The system of claim 1, wherein the memory is further configured to store an association between the private key and the entity server, and wherein the one or more processors are further configured to:

allocate the public key to the entity server; and

identify the encrypted data as being associated with the entity server to determine the private key.

8. The system of claim 7, wherein the one or more processors are configured to determine the private key based, at least in part, on an identifier contained in a transmission of the encrypted data, a source of the transmission, the public key contained in the transmission, a source of the encrypted data, and/or a type of processing requested.

9. A method comprising:

receiving, by one or more processors over a network, encrypted data that is encrypted by a client device using a public key allocated to an entity server;

determining, by the one or more processors, a private key corresponding to the public key allocated to the entity server by accessing a plurality of private keys stored in a memory;

decrypting, by the one or more processors, the encrypted data using the private key to obtain decrypted data; and

providing, by the one or more processors over the network, a processing result based on at least a portion of the decrypted data to the entity server.

10. The method of claim 9, further comprising:

receiving, by the one or more processors over the network, unencrypted data that is related to the encrypted data,

wherein the encrypted data comprises sensitive information and the unencrypted data comprises non-sensitive information, and

wherein the processing result is further based on at least a portion of the unencrypted data.

11. The method of claim 9, further comprising:

providing, by the one or more processors, at least a portion of the decrypted data to a processing server configured to process the decrypted data; and

receiving, by the one or more processors, the processing result from the processing server.

12. The method of claim 11, wherein the encrypted data comprises payment information, and wherein the processing server comprises a server associated with a payment service provider.

13. The method of claim 11, wherein the encrypted data comprises patient information, and wherein the processing server comprises a server associated with a medical service provider.

14. The method of claim 11, wherein the encrypted data comprises personal information, and wherein the processing server comprises a server associated with a background investigation service provider.

15. The method of claim 9, wherein the memory is further configured to store an association between the private key and the entity server, and wherein the one or more processors are further configured to:

allocating, by the one or more processors, the public key to the entity server; and

identifying, by the one or more processors, the entity server associated with the encrypted data for the determining of the private key,

wherein the determining of the private key is further by accessing an association between the private key and the entity server stored in the memory.

16. The method of claim 9, wherein the determining and/or the identifying is based, at least in part, on an identifier contained in a transmission of the encrypted data, a source of the transmission, and/or the public key contained in the transmission.

17. A non-transitory machine-readable medium comprising a plurality of machine-readable instructions which when executed by one or more processors of a server are adapted to cause the server to perform a method comprising:

receiving encrypted data over a network, the encrypted data being encrypted by a client device using a public key allocated to an entity server;

determining a private key corresponding to the public key allocated to the entity server by accessing a plurality of private keys stored in a memory;

decrypting the encrypted data using the private key to obtain decrypted data; and

providing a processing result based on at least a portion of the decrypted data to the entity server over the network.

18. The non-transitory machine-readable medium of claim 17, wherein the method further comprises:

receiving unencrypted data over the network, the unencrypted data being related to the encrypted data,

wherein the encrypted data comprises sensitive information and the unencrypted data comprises non-sensitive information, and

wherein the processing result is further based on at least a portion of the unencrypted data.

19. The non-transitory machine-readable medium of claim 17, wherein the method further comprises:

providing at least a portion of the decrypted data to a processing server configured to process the decrypted data; and

receiving the processing result from the processing server.

20. The non-transitory machine-readable medium of claim 17, wherein the memory is further configured to store an association between the private key and the entity server, and wherein the method further comprises:

allocating the public key to the entity server; and

identifying the encrypted data as being associated with the entity server for the determining of the private key,

wherein the determining of the private key is further by accessing an association between the private key and the entity server stored in the memory.