Granted Patent B2

US 12,450,385 · App. 18/124,326 · Granted Oct 21, 2025

Inventors: Ludovic Widmer (Paris, FR); Corentin Mors (Lyons, FR); Cyril Leclerc (Paris, FR); Tony Oreglia (Lisbon, PT); Guillaume Maron (Paris, FR); Frédéric Rivain (Brooklyn, NY)

Assignee: Dashlane SAS

G06F21/6245H04L9/0894H04L9/3213H04L9/3218

Abstract

Claims (102)

1. A method for protecting user data, comprising:

establishing a secure enclave on a parent server;

receiving, at the secure enclave, an enclave local key;

storing the enclave local key;

establishing a channel between a client application and the secure enclave;

receiving, at the secure enclave and from the client application, proof of authentication for a user;

verifying, by the secure enclave, the proof of authentication;

decrypting, by the secure enclave, a domain master key for a domain of the user using the enclave local key;

determining, by the secure enclave, a user's secret data based on the domain master key; and

providing to the client application the user's secret data via the channel.

2. The method of claim 1 , wherein determining, by the secure enclave, the user's secret data comprises:

retrieving the user's secret data from storage, wherein the user's secret data is encrypted; and

decrypting the user's secret data based on the domain master key.

3. The method of claim 1 , wherein determining, by the secure enclave, the user's secret data comprises:

generating the user's secret data;

encrypting the user's secret data based on the domain master key; and

storing the encrypted user's secret data.

4. The method of claim 1 , wherein receiving, at the secure enclave, the enclave local key comprises:

requesting, by the secure enclave, the enclave local key from a key management service;

establishing a secure channel between the key management service and the secure enclave;

receiving the enclave local key from the key management service via the secure channel; and

receiving an encrypted enclave local key, wherein the encrypted enclave local key is encrypted based on an enclave master key stored by the key management service.

5. The method of claim 4 , wherein storing the enclave local key comprises:

requesting, by the secure enclave, storage of the encrypted enclave local key on a data store external the secure enclave.

6. The method of claim 1 , wherein verifying, by the secure enclave, the proof of authentication comprises:

receiving, in the proof of authentication, an Identity Provider (IdP) certificate and domain associated with an Identity Access Management (IAM) system;

accessing a stored IdP certificate and domain associated with the IAM system; and

verifying the proof authentication using the stored IdP certificate and domain associated with the IAM system.

7. The method of claim 6 , further comprising verifying a signature of the signed IdP certificate and domain based on the enclave local key.

8. The method of claim 1 , further comprising:

receiving, at the secure enclave, a set of System for Cross-domain Identity Management (SCIM) sharing keys including a bearer token and a signature key;

storing the bearer token and signature key;

establishing a secure channel between a client application and the secure enclave;

receiving, at the secure enclave and from the IAM system, a request to sign a user or group event;

verifying, by the secure enclave, a token included in the request using the bearer token; and

signing the user or group event using the signature key.

9. A system for protecting user data, wherein the system includes:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the system to:

establish a secure enclave on a parent server;

receive, at the secure enclave, an enclave local key;

store the enclave local key;

establish a channel between a client application and the secure enclave;

receive, at the secure enclave and from the client application, proof of authentication for a user;

verify, by the secure enclave, the proof of authentication;

decrypt, by the secure enclave, a domain master key for a domain of the user using the enclave local key;

determine, by the secure enclave, a user's secret data based on the domain master key; and

provide to the client application the user's secret data via the channel.

10. The system of claim 9 , wherein in determining, by the secure enclave, the user's secret data, the instructions cause the system to:

retrieve the user's secret data from storage, wherein the user's secret data is encrypted; and

decrypt the user's secret data based on the domain master key.

11. The system of claim 9 , wherein in determining, by the secure enclave, the user's secret data, the instructions cause the system to:

generate the user's secret data;

encrypt the user's secret data based on the domain master key; and

store the encrypted user's secret data.

12. The system of claim 9 , wherein in receiving, at the secure enclave, the enclave local key, the instructions cause the system to:

request, by the secure enclave, the enclave local key from a key management service;

establish a secure channel between the key management service and the secure enclave;

receive the enclave local key from the key management service via the secure channel; and

receive an encrypted enclave local key, wherein the encrypted enclave local key is encrypted based on an enclave master key stored by the key management service.

13. The system of claim 12 , wherein in storing the enclave local key, the instructions cause the system to:

request, by the secure enclave, storage of the encrypted enclave local key on a data store external the secure enclave.

14. The system of claim 9 , wherein in verifying, by the secure enclave, the proof of authentication, the instructions cause the system to:

receive, in the proof of authentication, an Identity Provider (IdP) certificate and domain associated with an Identity Access Management (IAM) system;

access a stored IdP certificate and domain associated with the IAM system; and

verify the proof authentication using the stored IdP certificate and domain associated with the IAM system.

15. The system of claim 14 , wherein the instructions further cause the system to verify a signature of the signed IdP certificate and domain based on the enclave local key.

16. The system of claim 9 , wherein the instructions further cause the system to:

receive, at the secure enclave, a set of System for Cross-domain Identity Management (SCIM) sharing keys including a bearer token and a signature key;

store the bearer token and signature key;

establish a secure channel between a client application and the secure enclave;

receive, at the secure enclave and from the IAM system, a request to sign a user or group event;

verify, by the secure enclave, a token included in the request using the bearer token; and

sign the user or group event using the signature key.

17. A non-transitory computer-storage medium including instructions that, when executed by a computing device, cause the computing device to:

establish a secure enclave on a parent server;

receive, at the secure enclave, an enclave local key;

store the enclave local key;

establish a channel between a client application and the secure enclave;

receive, at the secure enclave and from the client application, proof of authentication for a user;

verify, by the secure enclave, the proof of authentication;

decrypt, by the secure enclave, a domain master key for a domain of the user using the enclave local key;

determine, by the secure enclave, a user's secret data based on the domain master key; and

provide to the client application the user's secret data via the channel.

18. The non-transitory computer-storage medium of claim 17 , wherein in determining, by the secure enclave, the user's secret data, the instructions cause the computing device to:

retrieve the user's secret data from storage, wherein the user's secret data is encrypted; and

decrypt the user's secret data based on the domain master key; or

generate the user's secret data;

encrypt the user's secret data based on the domain master key; and

store the encrypted user's secret data.

19. The non-transitory computer-storage medium of claim 17 , wherein in receiving, at the secure enclave, the enclave local key, the instructions cause the computing device to:

request, by the secure enclave, the enclave local key from a key management service;

establish a secure channel between the key management service and the secure enclave;

receive the enclave local key from the key management service via the secure channel; and

receive an encrypted enclave local key, wherein the encrypted enclave local key is encrypted based on an enclave master key stored by the key management service.

20. The non-transitory computer-storage medium of claim 17 , wherein the instructions further cause the computing device to:

receive, at the secure enclave, a set of System for Cross-domain Identity Management (SCIM) sharing keys including a bearer token and a signature key;

store the bearer token and signature key;

establish a secure channel between a client application and the secure enclave;

receive, at the secure enclave and from the IAM system, a request to sign a user or group event;

verify, by the secure enclave, a token included in the request using the bearer token; and

sign the user or group event using the signature key.

Assignments (1)

Continuity (2)

References Cited (50)