Cloud key escrow system

• US 9,667,599 B2
• Filed: 11/17/2014
• Issued: 05/30/2017
• Est. Priority Date: 06/17/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Pandey, Omkant, D'Souza, Roy Peter
• Primary Examiner(s): SCOTT, RANDY A
• Application Number:
  US14/542,904
• Publication Number:
  US 20150074401A1
• Time in Patent Office: 925 Days
• Field of Search: 713168, 713183, 713189, 713188, 726 1, 726 5, 726 27
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Embodiments are directed to allowing a user to store encrypted, third-party-accessible data in a data store and to providing third party data access to a user'"'"'s encrypted data according to a predefined policy. A data storage system receives encrypted data from a user at a data storage system. The data is encrypted using the user'"'"'s private key. The data storage system stores the received encrypted data according to a predefined policy. The encryption prevents the storage system from gaining access to the encrypted data, while the policy allows the encrypted data to be released upon receiving a threshold number of requests from verified third parties. The data storage system implements a verifiable secret sharing scheme to verify that the encrypted data can be reconstituted without the data storage system accessing the encrypted data. The data storage system synchronously acknowledges that the received encrypted data has been verified and successfully stored.

Claims

1. A computer program product for implementing a method for providing third party data access to a user'"'"'s encrypted data according to a predefined policy, the computer program product comprising one or more computer-readable storage devices having stored thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the method, the method comprising:

an act of receiving a request from a third party to access a user'"'"'s stored, encrypted data, the data being stored in a data storage system according to a predefined policy, the encryption preventing the storage system from gaining access to the encrypted data, the policy allowing the encrypted data to be released upon receiving a threshold number of requests from verified third parties;

an act of sending a query to a plurality of the verified third parties, requesting permission from the verified third parties to access the user'"'"'s stored, encrypted data according to the predefined policy;

an act of receiving permission from at least a threshold number of the verified third parties; and

an act of allowing the requesting third party to access the user'"'"'s stored, encrypted data according to the predefined policy;

wherein each verified third party publishes its own public key and encrypts its share of the encrypted data using its published public key.

2. The computer program product of claim 1, wherein the stored encrypted key is stored as a plurality of shares, the shares being mathematical transformations of the user'"'"'s private key, and wherein each share is provided to one of the verified third parties.

3. The computer program product of claim 1, wherein the request for permission to access the user'"'"'s stored, encrypted data comprises a request for each verified third party to provide their assigned share to the storage system.

4. The computer program product of claim 1, wherein the verified third party shares encrypted according to the third party'"'"'s public keys are stored in the data storage system, the encrypted shares preventing the data storage system from accessing the user'"'"'s data.

5. A computer implemented method for providing third party data access to a user'"'"'s encrypted data according to a predefined policy, the method performed by executing computer-executable instructions which, when executed upon one or more processors of a computing system, cause the computing system to perform a method comprising:

receiving a request from a third party to access a user'"'"'s stored, encrypted data, the data being stored in a data storage system according to a predefined policy, the encryption preventing the storage system from gaining access to the encrypted data, the policy allowing the encrypted data to be released upon receiving a threshold number of requests from verified third parties;

sending a query to a plurality of the verified third parties, requesting permission from the verified third parties to access the user'"'"'s stored, encrypted data according to the predefined policy;

receiving permission from at least a threshold number of the verified third parties; and

allowing the requesting third party to access the user'"'"'s stored, encrypted data according to the predefined policy;

wherein each verified third party publishes its own public key and encrypts its share of the encrypted data using its published public key.

6. The method of claim 5, wherein the stored encrypted key is stored as a plurality of shares, the shares being mathematical transformations of the user'"'"'s private key, and wherein each share is provided to one of the verified third parties.

7. The method of claim 5, wherein the request for permission to access the user'"'"'s stored, encrypted data comprises a request for each verified third party to provide their assigned share to the storage system.

8. The method of claim 5, wherein the verified third party shares encrypted according to the third party'"'"'s public keys are stored in the data storage system, the encrypted shares preventing the data storage system from accessing the user'"'"'s data.

9. A system for providing third party data access to a user'"'"'s encrypted data according to a predefined policy, the system comprising one or more computer processors and one or more computer readable storage devices having encoded thereon computer executable instructions which, when executed upon one or more processors, cause the system to perform a method comprising:

receiving a request from a third party to access a user'"'"'s stored, encrypted data, the data being stored in a data storage system according to a predefined policy, the encryption preventing the storage system from gaining access to the encrypted data, the policy allowing the encrypted data to be released upon receiving a threshold number of requests from verified third parties;

sending a query to a plurality of the verified third parties, requesting permission from the verified third parties to access the user'"'"'s stored, encrypted data according to the predefined policy;

receiving permission from at least a threshold number of the verified third parties; and

allowing the requesting third party to access the user'"'"'s stored, encrypted data according to the predefined policy;

wherein each verified third party publishes its own public key and encrypts its share of the encrypted data using its published public key.

10. The system of claim 9, wherein the stored encrypted key is stored as a plurality of shares, the shares being mathematical transformations of the user'"'"'s private key, and wherein each share is provided to one of the verified third parties.

11. The system of claim 9, wherein the request for permission to access the user'"'"'s stored, encrypted data comprises a request for each verified third party to provide their assigned share to the storage system.

12. The system of claim 9, wherein the verified third party shares encrypted according to the third party'"'"'s public keys are stored in the data storage system, the encrypted shares preventing the data storage system from accessing the user'"'"'s data.