IP Library › Granted Patent US 10,965,653

Granted Patent B2

US 10,965,653 · App. 16/360,386 · Granted Mar 30, 2021

Scalable and secure message brokering approach in a communication system

Inventors: David Robinson Bild (Chicago, IL); Pradeep Srinivas Barthur (White Plains, NY); Irina Guberman (Buffalo Grove, IL); Zane Van Beckwith (Chicago, IL); Gary W. Grube (Barrington Hills, IL); Mario Frank DeRango (Cary, IL); Venkatakumar Srinivasan (Chicago, IL)

Assignee: Xaptum, Inc.

H04L63/045 H04L9/0833 H04L63/0471 H04L63/0478 H04L67/2809

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 10,965,653
App. No.: 16/360,386
Granted: Mar 30, 2021
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A method includes a first computing entity receiving a request for first data from an affiliated source device by a user device. When a re-encryption key of the user device is not based on a key pair of the first computing entity the method further includes decrypting the first encrypted data using a private key of the first computing entity and encrypting the recovered first data with a public key of a second computing entity to produce second encrypted data. The method further includes encrypting the second encrypted data with the re-encryption key of the user device to produce double encrypted data. The method further includes sending the double encrypted data to the user device, where the user device is capable of decrypting the double encrypted data to recover the first data using a private key of the user device based on a key pair of the second computing entity.

Claims (127)

1. A method comprises:

receiving, by a first computing entity of a secure data network, a request for first data from a data source device affiliated with the first computing entity by a user computing device of the secure data network, wherein the first data is encrypted using a first public key of a first key pair of the first computing entity to produce first encrypted data;

determining, by the first computing entity, whether a re-encryption key of the user computing device is based on the first key pair of the first computing entity; and

when the re-encryption key of the user computing device is not based on the first key pair of the first computing entity:

decrypting, by the first computing entity, the first encrypted data using a private key of the first key pair to recover the first data;

encrypting, by the first computing entity, the first data using a second public key of a second computing entity of the secure data network to produce second encrypted data, wherein the re-encryption key of the user computing device is based on a second key pair of the second computing entity;

encrypting, by the first computing entity, the second encrypted data with the re-encryption key of the user computing device to produce double encrypted data; and

sending, by the first computing entity, the double encrypted data to the user computing device, wherein the user computing device is capable of decrypting the double encrypted data using a private key of the user computing device to recover the first data, wherein the private key of the user computing device is paired with a public key of the user computing device, and wherein the re-encryption key of the user computing device is further based on the public key of the user computing device.

2. The method of claim 1 further comprises:

when the re-encryption key of the user computing device is based on the first key pair of the first computing entity:

encrypting, by the first computing entity, the first encrypted data with the re-encryption key of the user computing device to produce the double encrypted data; and

sending, by the first computing entity, the double encrypted data to the user computing device.

3. The method of claim 1 further comprises:

receiving, by the first computing entity, a second request for the first data by a second user computing device of the secure data network;

determining, by the first computing entity, whether a second re-encryption key of the second user computing device is based on the first key pair of the first computing entity; and

when the second re-encryption key of the second user computing device is not based on the first key pair of the first computing entity:

decrypting, by the first computing entity, the first encrypted data using the private key of the first key pair to recover the first data;

encrypting, by the first computing entity, the first data using a third public key of a third computing entity of the secure data network to produce third encrypted data, wherein the second re-encryption key of the second user computing device is based on a third key pair of the third computing entity;

encrypting, by the first computing entity, the third encrypted data with the second re-encryption key of the second user computing device to produce second double encrypted data; and

sending, by the first computing entity, the second double encrypted data to the second user computing device, wherein the second user computing device is capable of decrypting the second double encrypted data using a private key of the second user computing device to recover the first data, wherein the private key of the second user computing device is paired with a public key of the second user computing device, and wherein the second re-encryption key of the second user computing device is further based on the public key of the second user computing device.

4. The method of claim 3 further comprises:

when the second re-encryption key of the second user computing device is based on the first key pair of the first computing entity:

encrypting, by the first computing entity, the first encrypted data with the second re-encryption key of the second user computing device to produce the second double encrypted data; and

sending, by the first computing entity, the second double encrypted data to the second user computing device.

5. The method of claim 1 , wherein the determining whether the re-encryption key of the user computing device is based on the first key pair of the first computing entity comprises one of:

indicating that the re-encryption key of the user computing device is not based on the first key pair of the first computing entity when detecting at least one of:

a public key of the request for first data compares unfavorably to the first public key of the first key pair of the first computing entity;

an identifier of the user computing device compares unfavorably to an entry of a list of identifiers of user computing devices affiliated with the first computing entity; and

an identifier of a key generating authority utilized to generate the re-encryption key of the user computing device compares unfavorably to an identifier of the first computing entity; and

indicating that the re-encryption key of the user computing device is based on the first key pair of the first computing entity when detecting at least one of:

the public key of the request for first data compares favorably to the first public key of the first key pair of the first computing entity;

the identifier of the user computing device compares favorably to the entry of the list of identifiers of user computing devices affiliated with the first computing entity; and

the identifier of the key generating authority utilized to generate the re-encryption key of the user computing device compares favorably to the identifier of the first computing entity.

6. The method of claim 1 further comprises:

determining, by the first computing entity, that the re-encryption key of the user computing device is based on the second key pair of the second computing entity when detecting at least one of:

a public key of the request for first data compares favorably to the second public key of the second key pair of the second computing entity;

an identifier of the user computing device compares favorably to an entry of a list of identifiers of user computing devices affiliated with the second computing entity; and

an identifier of a key generating authority utilized to generate the re-encryption key of the user computing device compares favorably to an identifier of the second computing entity.

7. A computing device comprises:

an interface;

a local memory; and

a processing module operably coupled to the interface and the local memory, wherein the processing module functions to:

receive, via the interface, a request for first data from a data source device affiliated with a first computing entity of a secure data network by a user computing device of the secure data network, wherein the first data is encrypted using a first public key of a first key pair of the first computing entity to produce first encrypted data;

determine whether a re-encryption key of the user computing device is based on the first key pair of the first computing entity; and

when the re-encryption key of the user computing device is not based on the first key pair of the first computing entity:

decrypt the first encrypted data using a private key of the first key pair to recover the first data;

encrypt the first data using a second public key of a second computing entity of the secure data network to produce second encrypted data, wherein the re-encryption key of the user computing device is based on a second key pair of the second computing entity;

encrypt the second encrypted data with the re-encryption key of the user computing device to produce double encrypted data; and

send, via the interface, the double encrypted data to the user computing device, wherein the user computing device is capable of decrypting the double encrypted data using a private key of the user computing device to recover the first data, wherein the private key of the user computing device is paired with a public key of the user computing device, and wherein the re-encryption key of the user computing device is further based on the public key of the user computing device.

8. The computing device of claim 7 , wherein the processing module further functions to:

when the re-encryption key of the user computing device is based on the first key pair of the first computing entity:

encrypt the first encrypted data with the re-encryption key of the user computing device to produce the double encrypted data; and

send, via the interface, the double encrypted data to the user computing device.

9. The computing device of claim 7 , wherein the processing module further functions to:

receive, via the interface, a second request for the first data by a second user computing device of the secure data network;

determine whether a second re-encryption key of the second user computing device is based on the first key pair of the first computing entity; and

when the second re-encryption key of the second user computing device is not based on the first key pair of the first computing entity:

decrypt the first encrypted data using the private key of the first key pair to recover the first data;

encrypt the first data using a third public key of a third computing entity of the secure data network to produce third encrypted data, wherein the second re-encryption key of the second user computing device is based on a third key pair of the third computing entity;

encrypt the third encrypted data with the second re-encryption key of the second user computing device to produce second double encrypted data; and

send, via the interface, the second double encrypted data to the second user computing device, wherein the second user computing device is capable of decrypting the second double encrypted data using a private key of the second user computing device to recover the first data, wherein the private key of the second user computing device is paired with a public key of the second user computing device, and wherein the second re-encryption key of the second user computing device is further based on the public key of the second user computing device.

10. The computing device of claim 9 , wherein the processing module further functions to:

when the second re-encryption key of the second user computing device is based on the first key pair of the first computing entity:

encrypt the first encrypted data with the second re-encryption key of the second user computing device to produce the second double encrypted data; and

send, via the interface, the second double encrypted data to the second user computing device.

11. The computing device of claim 7 , wherein the processing module functions to determine whether the re-encryption key of the user computing device is based on the first key pair of the first computing entity by one of: