Granted Patent B2

US 12,395,331 · App. 17/931,733 · Granted Aug 19, 2025

Inventors: Ramarathnam Venkatesan (Redmond, WA); Nishanth Chandran (Bangalore, IN)

Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC

H04L9/0894H04L9/0825H04L9/085

Abstract

Claims (70)

1. A system, comprising:

a processor; and

a memory that stores program code that, when executed by the processor, performs operations to recover a decryption key, the operations comprising:

receiving a cryptographic proof that a user is associated with an attribute required to access a resource in accordance with a policy;

verifying that the cryptographic proof is valid using a zero-knowledge proof;

responsive to verifying that the cryptographic proof is valid, providing a first portion of the decryption key;

determining that the user is at a location at which access to the resource is allowed in accordance with the policy;

responsive to determining that the user is at the location, providing a second portion of the decryption key; and

combining the first portion and the second portion to generate the decryption key.

2. The system of claim 1 , wherein the attribute comprises at least one of:

a clearance level of the user;

a rank of the user within an organization; or

a role of the user within the organization.

3. The system of claim 1 , the operations further comprising:

encrypting the decryption key using a public encryption key of the user; and

providing the encrypted decryption key to a computing device associated with the user.

4. The system of claim 1 , wherein said combining comprises:

summing the first portion and the second portion.

5. The system of claim 1 , the operations further comprising:

decrypting the resource utilizing the decryption key; and

providing the decrypted resource to a computing device associated with the user.

6. The system of claim 1 , wherein the cryptographic proof is verified based on a public encryption key associated with the attribute and an encrypted shared secret associated with the attribute.

7. The system of claim 1 , the operations further comprising:

receiving a request to access the resource, the request specifying a policy identifier of the policy; and

obtaining the policy corresponding to the policy identifier.

8. A method for recovering a decryption key, comprising:

receiving a cryptographic proof that a user is associated with an attribute required to access a resource in accordance with a policy;

verifying that the cryptographic proof is valid using a zero-knowledge proof;

responsive to verifying that the cryptographic proof is valid, providing a first portion of the decryption key;

determining that the user is at a location at which access to the resource is allowed in accordance with the policy;

responsive to determining that the user is at the location, providing a second portion of the decryption key; and

combining the first portion and the second portion to generate the decryption key.

9. The method of claim 8 , wherein the attribute comprises at least one of:

a clearance level of the user;

a rank of the user within an organization; or

a role of the user within the organization.

10. The method of claim 8 , further comprising:

encrypting the decryption key using a public encryption key of the user; and

providing the encrypted decryption key to a computing device associated with the user.

11. The method of claim 8 , wherein said combining comprises:

summing the first portion and the second portion.

12. The method of claim 8 , further comprising:

decrypting the resource utilizing the decryption key; and

providing the decrypted resource to a computing device associated with the user.

13. The method of claim 8 , wherein the cryptographic proof is verified based on a public encryption key associated with the attribute and an encrypted shared secret associated with the attribute.

14. The method of claim 8 , further comprising:

receiving a request to access the resource, the request specifying a policy identifier of the policy; and

obtaining the policy corresponding to the policy identifier.

15. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor, perform a method for recovering a decryption key comprising:

receiving a cryptographic proof that a user is associated with an attribute required to access a resource in accordance with a policy;

verifying that the cryptographic proof is valid using a zero-knowledge proof;

responsive to verifying that the cryptographic proof is valid, providing a first portion of the decryption key;

determining that the user is at a location at which access to the resource is allowed in accordance with the policy;

responsive to determining that the user is at the location, providing a second portion of the decryption key; and

combining the first portion and the second portion to generate the decryption key.

16. The computer-readable storage medium of claim 15 , wherein the attribute comprises at least one of:

a clearance level of the user;

a rank of the user within an organization; or

a role of the user within the organization.

17. The computer-readable storage medium of claim 15 , the method further comprising:

encrypting the decryption key using a public encryption key of the user; and

providing the encrypted decryption key to a computing device associated with the user.

18. The computer-readable storage medium of claim 15 , wherein said combining comprises:

summing the first portion and the second portion.

19. The computer-readable storage medium of claim 15 , the method further comprising:

decrypting the resource utilizing the decryption key; and

providing the decrypted resource to a computing device associated with the user.

20. The computer-readable storage medium of claim 15 , the method further comprising:

receiving a request to access the resource, the request specifying a policy identifier of the policy; and

obtaining the policy corresponding to the policy identifier.

Assignments (1)

Continuity (1)

References Cited (89)