Cloud based multi-key authorization based system
View Patent ↗Using various embodiments, methods and systems for securing user data are described. In one embodiment, a system includes a server side application accessing a service key from a conventional key vault and an escrowed key which can then be used to compute a key to the key using which information can be encrypted. Other embodiments include using a timer service to further safeguard secure user information.
1. A system, comprising:
a memory device;
a processing system, comprising at least one hardware core coupled to the memory device, wherein the processing system is configured to:
retrieve a first key, the first key stored at first key management service;
retrieve a second key, the second key stored at a second key management service;
generate a third key, wherein the third key generated by associating the first key with the second key;
encrypt a key blob using the third key, the key blob including a user key, wherein the user key is used to encrypt sensitive information, the sensitive information is data that needs to be protected; and
store the key blob, wherein the key blob is indexed using a first identifier;
store a second identifier, wherein the second identifier includes the first identifier and identification information of the first and second keys; and
upon receiving a time identifier associated with the second identifier, transmit the second identifier to a requestor that requires decrypting the sensitive information.
2. The system of claim 1 , wherein the first key is a key related to a service or application, and wherein the second key is an escrowed key.
3. The system of claim 1 , wherein the first and second keys are associated by applying at least one of a logic operator or algorithm on the first and second keys to generate the third key.
4. The system of claim 1 , wherein the second identifier is transmitted
upon verification that the second identifier was requested within a predetermined period of time.
5. The system of claim 1 , wherein the third key is generated at least by applying an exclusive or (XOR) based logic operator on the first and second keys.
6. A method, comprising:
retrieving a first key, the first key stored at first key management service;
retrieving a second key, the second key stored at a second key management service;
generating a third key, wherein the third key generated by associating the first key with the second key;
encrypting a key blob using the third key, the key blob including a user key, wherein the user key is used to encrypt sensitive information, the sensitive information is data that needs to be protected; and
storing the key blob, wherein the key blob is indexed using a first identifier;
storing a second identifier, wherein the second identifier includes the first identifier and identification information of the first and second keys; and
upon receiving a time identifier associated with the second identifier, transmitting the second identifier to a requestor that requires decrypting the sensitive information.
7. The method of claim 6 , wherein the first key is a key related to a service or application, and wherein the second key is an escrowed key.
8. The method of claim 6 , wherein the first and second keys are associated by applying at least one of a logic operator or algorithm on the first and second keys to generate the third key.
9. The method of claim 6 , wherein the second identifier is transmitted:
upon verification that the second identifier was requested within a predetermined period of time.
10. The method of claim 6 , wherein the third key is generated at least by applying an exclusive or (XOR) based logic operator on the first and second keys.
11. A non-transitory computer readable medium comprising instructions, which when executed by a processing system having at least one core executes a method, comprising:
retrieving a first key, the first key stored at first key management service;
retrieving a second key, the second key stored at a second key management service;
generating a third key, wherein the third key generated by associating the first key with the second key;
encrypting a key blob using the third key, the key blob including a user key, wherein the user key is used to encrypt sensitive information, the sensitive information is data that needs to be protected; and
storing the key blob, wherein the key blob is indexed using a first identifier;
storing a second identifier, wherein the second identifier includes the first identifier and identification information of the first and second keys; and
upon receiving a time identifier associated with the second identifier, transmitting the second identifier to a requestor that requires decrypting the sensitive information.
12. The non-transitory computer readable medium of claim 11 , wherein the first key is a key related to a service or application, and wherein the second key is an escrowed key.
13. The non-transitory computer readable medium of claim 11 , wherein the first and second keys are associated by applying at least one of a logic operator or algorithm on the first and second keys to generate the third key.
14. The non-transitory computer readable medium of claim 11 ,
upon verification that the second identifier was requested within a predetermined period of time.