Multi-party cryptographic systems and methods
This disclosure relates to systems and methods for performing cryptographic operations in connection with the management of electronic content using multiple license services. In some circumstances, a content service may not wish to share unencrypted content keys with a single license service for a variety of security reasons. Embodiments of the disclosed systems and methods may use multi-party cryptographic methods in connection with the management of protected content keys and/or associated licenses and/or the distribution of content keys and/or licenses to authorized users and/or devices. In various embodiments, a content service may split a content key into a plurality of key shares and may transmit the key shares to a plurality of different license services. The license services may coordinate operations to generate a protected content key without revealing unencrypted content key to any of the participating license services.
1. A method for managing electronic data performed by a first service system comprising a processor and a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the first service system to perform the method, the method comprising:
receiving a public key from a device;
receiving a first padded decryption key share of a decryption key and first key identification information associated with the first padded decryption key share from a data management service managing the electronic data, the first padded decryption key share comprising a first padding string, the first key identification information identifying that the first padded key share is associated with the decryption key;
receiving a protected second padded decryption key share of the decryption key and second key identification information associated with the protected second padded decryption key share from a second service, the protected second padded decryption key share comprising a second padded decryption key share of the decryption key encrypted by the second service using the public key, the second padded decryption key share comprising a second padding string, the second key identification information identifying that the second padded key share is associated with the decryption key;
generating a protected first padded decryption key share of the decryption key by encrypting the first padded decryption key share using the public key;
determining that both the first padded decryption key share and the second padded decryption key share are associated with the decryption key based on determining that the first key identification information and the second key identification information match;
generating, at least in part responsive to the determining, a protected decryption key by multiplying the protected first padded decryption key share and the protected second padded decryption key share, the generated protected decryption key comprising the decryption key encrypted with the public key, wherein the first padding string and the second padding string being configured to allow for generation of the protected decryption key by the first service system without decrypting the protected first padded decryption key share and the protected second padded decryption key share; and
transmitting the protected decryption key to the device for use in accessing the electronic data through the device decrypting the protected decryption key using a private key corresponding to the public key.
2. The method of claim 1 , wherein the method further comprises receiving a request from the device for a license to access the electronic data.
3. The method of claim 2 , wherein the method further comprises generating an electronic license for the electronic data, the electronic license comprising the protected decryption key.
4. The method of claim 3 , wherein transmitting the protected decryption key to the device comprises transmitting the electronic license to the device.
5. The method of claim 1 , wherein the first service is separate from the second service.
6. The method of claim 1 , wherein the decryption key is generated by the data management service.
7. The method of claim 1 , wherein the first padded decryption key share is generated by the data management service.
8. The method of claim 1 , wherein the second padded decryption key share is generated by the data management service.
9. The method of claim 1 , wherein the first service system is an untrusted system with respect to the data management service.
10. The method of claim 1 , wherein the second service system is an untrusted system with respect to the data management service.
11. The method of claim 1 , wherein the protected decryption key comprises the decryption key encrypted with the public key using a homomorphic encryption algorithm.
12. The method of claim 1 , wherein the protected second padded decryption key share comprises the second padded decryption key share encrypted with the public key using a homomorphic encryption algorithm by the second service system.
13. The method of claim 1 , wherein the protected first padded decryption key share comprises the first padded decryption key share encrypted with the public key using a homomorphic encryption algorithm.
14. The method of claim 1 , wherein the protected decryption key comprises a protected padded decryption key.
15. The method of claim 1 , wherein the public key is associated with the device.
16. The method of claim 1 , wherein the public key is associated with a user of the device.
17. The method of claim 1 , wherein the private key is associated with the device.
18. The method of claim 1 , wherein the private key is associated with a user of the device.