Computational systems and methods for encrypting data for anonymous storage

• US 9,491,146 B2
• Filed: 03/14/2013
• Issued: 11/08/2016
• Est. Priority Date: 09/07/2011
• Status: Active Grant

• Current Assignee: Elwha LLC (Intellectual Ventures LLC)
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Lord, Richard T., Lord, Robert W., Davis, Marc E., Lu, Qi, Dyor, Matthew G., Malamud, Mark A., Gates, William, Myhrvold, Nathan P., Huang, Xuedong, Nadella, Satya, Hyde, Roderick A., Reed, Danny Allen, Jung, Edward K. Y., Shum, Harry, Kare, Jordin T., Tegreene, Clarence T., Levien, Royce A., Wood, JR., Lowell L.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US13/830,343
• Publication Number:
  US 20130290700A1
• Time in Patent Office: 1,335 Days
• Field of Search: 713/168, 713/153
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

Methods, apparatuses, computer program products, devices and systems are described that carry out accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption; encrypting the at least one instance of data to produce level-one-encrypted data; associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity; and transmitting the level-one-encrypted data and associated encrypted identifier.

Claims

1. A system comprising:

circuitry for accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption;

circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, the circuitry for encrypting configured to perform the encrypting of the at least one instance of data at least partly with a level-one asymmetric encryption key;

circuitry for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity, and wherein the level-one decryption key is an asymmetric decryption key that is not the same key as the level-one asymmetric encryption key; and

circuitry for transmitting the level-one-encrypted data and associated encrypted identifier.

2. The system of claim 1 wherein the circuitry for accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption comprises:

circuitry for accepting from a user identifier encryption entity an encrypted version of at least one of a device identifier, a username, a real name, an alias, a unique identifier, a date, a date and time, or biometric data as at least a portion of the at least one encrypted identifier corresponding to a human user.

3. The system of claim 2 wherein the circuitry for accepting from a user identifier encryption entity an encrypted version of at least one of a device identifier, a username, a real name, an alias, a unique identifier, a date, a date and time, or biometric data as at least a portion of the at least one encrypted identifier corresponding to a human user comprises:

circuitry for accepting from a user identifier encryption entity at least one hash corresponding to at least one of a device identifier, a username, a real name, an alias, a unique identifier, a date, a date and time, or biometric data.

4. The system of claim 1 wherein the circuitry for accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption comprises:

circuitry for accepting from a user identifier encryption entity at least one encrypted persona corresponding to a user having at least one instance of data for encryption.

5. The system of claim 1 wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, the circuitry for encrypting configured to perform the encrypting of the at least one instance of data at least partly with a level-one asymmetric encryption key comprises:

circuitry for encrypting the at least one instance of data via public key cryptography.

6. The system of claim 5 wherein the circuitry for encrypting the at least one instance of data via public key cryptography comprises:

circuitry for encrypting the at least one instance of data using a certificated public key.

7. The system of claim 6 wherein the circuitry for encrypting the at least one instance of data using a certificated public key comprises:

circuitry for encrypting the at least one instance of data using an RSA key.

8. The system of claim 1 wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, the circuitry for encrypting configured to perform the encrypting of the at least one instance of data at least partly with a level-one asymmetric encryption key comprises:

circuitry for encrypting the at least one instance of data using a public key that is not held by a certificating authority.

9. The system of claim 1 wherein the circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, the circuitry for encrypting configured to perform the encrypting of the at least one instance of data at least partly with a level-one asymmetric encryption key comprises:

circuitry for encrypting the at least one instance of data to produce level-one-encrypted data, wherein the circuitry for encrypting is further configured to delete the at least one instance of data subsequent to producing the level-one-encrypted data.

10. The system of claim 1 wherein the circuitry for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity, and wherein the level-one decryption key is an asymmetric decryption key that is not the same key as the level-one asymmetric encryption key comprises:

circuitry for associating as metadata the at least one encrypted identifier with the level-one-encrypted data, and wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity.

11. The system of claim 1 wherein the circuitry for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity, and wherein the level-one decryption key is an asymmetric decryption key that is not the same key as the level-one asymmetric encryption key comprises:

circuitry for associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the user identifier encryption entity, and further wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity.

12. The system of claim 11 wherein the circuitry for associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the user identifier encryption entity, and further wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity comprises:

circuitry for associating as descriptive metadata the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key is inaccessible to the user identifier encryption entity, and wherein the encrypted identifier functions as a key-pair designator for a level-one-encryption entity, and further wherein a decryption key for decrypting the encrypted identifier is inaccessible to the level-one-encryption entity.

13. The system of claim 1 wherein the circuitry for transmitting the level-one-encrypted data and associated encrypted identifier comprises:

circuitry for transmitting the level-one-encrypted data and associated encrypted identifier to a level-two-encryption entity.

20. The system of claim 1, wherein the asymmetric encryption key is a public key associated with asymmetric key cryptography.

21. The system of claim 20, wherein the asymmetric decryption key is a private key associated with asymmetric key cryptography.

22. The system of claim 1 wherein the asymmetric encryption key and the asymmetric decryption key together form a public-private key pair.

14. A computer-implemented method comprising:

accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption;

encrypting the at least one instance of data to produce level-one-encrypted data, the encrypting being performed on the at least one instance of data at least partly with a level-one asymmetric encryption key;

associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity, and wherein the level-one decryption key is an asymmetric decryption key that is not the same key as the level-one asymmetric encryption key; and

transmitting the level-one-encrypted data and associated encrypted identifier; and

wherein at least one of the accepting, the encrypting, the associating, or the transmitting is performed at least partly with one or more processing devices.

15. A computer program product comprising:

an article of manufacture including a non-transitory signal-bearing medium bearing;

(1) one or more instructions for accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption;

(2) one or more instructions for encrypting the at least one instance of data to produce level-one-encrypted data, the one or more instructions for encrypting configured to perform the encrypting of the at least one instance of data at least partly with a level-one asymmetric encryption key;

(3) one or more instructions for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity, and wherein the level-one decryption key is an asymmetric decryption key that is not the same key as the level-one asymmetric encryption key; and

(4) one or more instructions for transmitting the level-one-encrypted data and associated encrypted identifier.

16. The computer program product of claim 15, wherein the non-transitory signal-bearing medium comprises:

a computer-readable medium;

a recordable medium;

or

a communications medium.

17. A system comprising:

a computing device; and

instructions that when executed on the computing device cause the computing device to;

(1) accept from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption;

(2) encrypt the at least one instance of data to produce level-one-encrypted data, the encrypting of the at least one instance of data being at least partly performed with a level-one asymmetric encryption key;

(3) associate the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity, and wherein the level-one decryption key is an asymmetric decryption key that is not the same key as the level-one asymmetric encryption key; and

(4) transmit the level-one-encrypted data and associated encrypted identifier.

18. The system of claim 17 wherein the computing device comprises:

at least one of a personal digital assistant (PDA), a personal entertainment device, a mobile phone, a laptop computer, a tablet personal computer, a networked computer, a computing system comprised of a cluster of processors, a computing system comprised of a cluster of servers, a workstation computer, or a desktop computer.

19. A system comprising:

means for accepting from a user identifier encryption entity at least one encrypted identifier corresponding to a user having at least one instance of data for encryption;

means for encrypting the at least one instance of data to produce level-one-encrypted data, the means for encrypting configured to perform the encrypting of the at least one instance of data at least partly with a level-one asymmetric encryption key;

means for associating the at least one encrypted identifier with the level-one-encrypted data, wherein a level-one decryption key for the level-one-encrypted data is inaccessible to the user identifier encryption entity, and wherein the level-one decryption key is an asymmetric decryption key that is not the same key as the level-one asymmetric encryption key; and

means for transmitting the level-one-encrypted data and associated encrypted identifier.