Granted Patent B2

US 12,401,630 · App. 17/937,098 · Granted Aug 26, 2025

Inventors: Ramarathnam Venkatesan (Redmond, WA); Michael James Zwilling (Bellevue, WA)

Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC

H04L63/0435H04L63/105H04L63/107

Abstract

Claims (95)

1. A system, comprising:

a processor; and

a memory that stores program code that, when executed by the processor, performs operations, the operations comprising:

receiving, from a computing device of a user, a request for decrypting a resource, the request specifying a policy identifier of a policy that specifies an attribute required to access the resource;

obtaining the policy corresponding to the policy identifier from a policy map;

determining the attribute required to access the resource based on the policy;

obtaining, from an attribute map, a public encryption key associated with the attribute and an encrypted shared secret associated with the attribute;

providing, to the computing device of the user, a request for a cryptographic proof;

receiving the cryptographic proof from the computing device of the user, the cryptographic proof generated based on the public encryption key associated with the attribute and an unencrypted version of the shared secret stored on the computing device of the user;

verifying the cryptographic proof that the user is associated with the attribute based on the public encryption key associated with the attribute and the encrypted shared secret associated with the attribute; and

responsive to determining that the cryptographic proof is valid, generating a decryption key for decrypting the resource.

2. The system of claim 1 , wherein the attribute comprises at least one of:

a clearance level of the user;

a rank of the user within an organization; or

a role of the user within the organization.

3. The system of claim 1 , the operations further comprising:

encrypting the decryption key using a public encryption key associated with at least one of the user or the computing device of the user; and

providing the encrypted decryption key to the computing device of the user.

4. The system of claim 1 , the operations further comprising:

decrypting the resource utilizing the decryption key; and

providing the decrypted resource to the computing device of the user.

5. The system of claim 1 , the operations further comprising:

determining that the user is at a location at which access to the resource is allowed in accordance with the policy;

verifying an identity of the user in accordance with the policy; and

responsive to determining that the cryptographic proof is valid, the user is at the location, and the identity of the user is verified, generating the decryption key for decrypting the resource.

6. The system of claim 1 , wherein the cryptographic proof comprises:

a zero-knowledge proof.

7. The system of claim 1 , wherein the operations further comprise:

providing, to the computing device of the user, a second request for a second cryptographic proof;

receiving the second cryptographic proof from the computing device of the user, the cryptographic proof generated based on the public encryption key associated with a second attribute and an unencrypted version of a second shared secret stored on the computing device of the user; and

verifying the second cryptographic proof that the user is associated with the second attribute based on the public encryption key associated with the second attribute and a second encrypted shared secret associated with the second attribute,

wherein generating the decryption key is further responsive to verifying the second cryptographic proof.

8. A method, comprising:

receiving, from a computing device of a user, a request for decrypting a resource, the request specifying a policy identifier of a policy that specifies an attribute required to access the resource;

obtaining the policy corresponding to the policy identifier from a policy map;

determining the attribute required to access the resource based on the policy;

obtaining, from an attribute map, a public encryption key associated with the attribute and an encrypted shared secret associated with the attribute;

providing, to the computing device of the user, a request for a cryptographic proof; and

receiving the cryptographic proof from the computing device of the user, the cryptographic proof generated based on the public encryption key associated with the attribute and an unencrypted version of the shared secret stored on the computing device of the user;

verifying the cryptographic proof that the user is associated with the attribute based on the public encryption key associated with the attribute and the encrypted shared secret associated with the attribute; and

responsive to determining that the cryptographic proof is valid, obtaining a decryption key for decrypting the resource.

9. The method of claim 8 , wherein the attribute comprises at least one of:

a clearance level of the user;

a rank of the user within an organization; or

a role of the user within the organization.

10. The method of claim 8 , further comprising:

encrypting the decryption key using a public encryption key associated with at least one of the user or the computing device of the user; and

providing the encrypted decryption key to the computing device of the user.

11. The method of claim 8 , further comprising:

decrypting the resource utilizing the decryption key; and

providing the decrypted resource to the computing device of the user.

12. The method of claim 8 , further comprising:

determining that the user is at a location at which access to the resource is allowed in accordance with the policy;

verifying an identity of the user in accordance with the policy; and

responsive to determining that the cryptographic proof is valid, the user is at the location, and the identity of the user is verified, obtaining the decryption key for decrypting the resource.

13. The method of claim 8 , wherein the cryptographic proof comprises:

a zero-knowledge proof.

14. The method of claim 8 , further comprising:

providing, to the computing device of the user, a second request for a second cryptographic proof;

receiving the second cryptographic proof from the computing device of the user, the cryptographic proof generated based on the public encryption key associated with a second attribute and an unencrypted version of a second shared secret stored on the computing device of the user; and

verifying the second cryptographic proof that the user is associated with the second attribute based on the public encryption key associated with the second attribute and a second encrypted shared secret associated with the second attribute,

wherein obtaining the decryption key is further responsive to verifying the second cryptographic proof.

15. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor, perform a method for recovering a decryption key comprising:

receiving, from a computing device of a user, a request for decrypting a resource, the request specifying a policy identifier of a policy that specifies an identity authorized to access the resource and an attribute required to access the resource;

obtaining the policy corresponding to the policy identifier from a policy map;

determining the identity authorized to access the resource and the first attribute required to access the resource based on the policy;

verifying that the user is associated with the identity;

responsive to verifying that the user is associated with the identity, obtaining, from an attribute map, a public encryption key associated with the attribute and an encrypted shared secret associated with the attribute;

providing, to the computing device of the user, a request for a cryptographic proof; and

receiving the cryptographic proof from the computing device of the user, the cryptographic proof generated based on the public encryption key associated with the attribute and an unencrypted version of the shared secret stored on the computing device of the user;

verifying the cryptographic proof that the user is associated with the attribute based on the public encryption key associated with the attribute and the encrypted shared secret associated with the attribute;

responsive to determining that the cryptographic proof is valid, obtaining a decryption key for decrypting the resource.

16. The computer-readable storage medium of claim 15 , wherein verifying the second identity comprises:

obtaining a public encryption key associated with the user from an identity map;

encrypting a nonce using the public encryption key;

providing the encrypted nonce to the computing device of the user;

receiving a decrypted nonce from the computing device of the user;

determining that the decrypted nonce is the same as the nonce; and

responsive to determining that the decrypted nonce is the same as the nonce, verifying that the user is associated with the identity.

17. The method of claim 15 , wherein the attribute comprises at least one of:

a clearance level of the user;

a rank of the user within an organization; or

a role of the user within the organization.

18. The computer-readable storage medium of claim 15 , further comprising:

encrypting the decryption key using a public encryption key associated with at least one of the user or the computing device of the user; and

providing the encrypted decryption key to the computing device of the user.

19. The computer-readable storage medium of claim 15 , further comprising:

decrypting the resource utilizing the decryption key; and

providing the decrypted resource to the computing device of the user.

20. The computer-readable storage medium of claim 15 , wherein the resource comprises at least one of:

a data file;

a database object;

structured data;

unstructured data; or

a data container.

Assignments (1)

Continuity (1)

References Cited (101)