Granted Patent B2

US 12,393,720 · App. 17/938,711 · Granted Aug 19, 2025

Inventors: Ramarathnam Venkatesan (Redmond, WA); Nishanth Chandran (Bangalore, IN); Panagiotis Antonopoulos (Redmond, WA); Srinath T. V. Setty (Redmond, WA); Basil Cherian (Bellevue, WA); Daniel John Carroll, Jr. (Columbia, MD); Jason Sydney Barnwell (Seattle, WA)

Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC

G06F21/6227H04L9/085H04L9/3263

Abstract

Claims (97)

1. A system, comprising:

a processor circuit; and

a memory that stores program code that, when executed by the processor circuit, performs operations, the operations comprising:

receiving a respective digital access request from each of a plurality of entities, each access request comprising a respective proof;

for each digital access request:

obtaining a respective encrypted secret share from a respective first ledger database; and

validating the digital access request based at least on the respective encrypted secret share and the respective proof, without decrypting the respective encrypted secret share;

in response to validating all of the digital access requests, verifying that an access criteria of a security policy is met; and

in response to said verifying that the access criteria of the security policy is met, providing at least one of the entities with access to data protected by the security policy.

2. The system of claim 1 , wherein:

each digital access request further comprises a respective digest representative of a state of the respective first ledger database; and

for each digital access request, said obtaining the respective encrypted secret share from the respective first ledger database comprises:

providing the respective digest to the respective first ledger database; and

receiving, from the respective first ledger database, a response indicating the respective digest is valid and comprising the respective encrypted secret share.

3. The system of claim 1 , wherein:

each digital access request is signed by a respective private key of a respective one of the entities; and

the operations further comprise:

for each digital access request, obtaining a respective public key corresponding to the respective private key from a respective second ledger database; and

for each digital access request, said validating the digital access request further comprises validating a signature of the digital access request using the respective public key.

4. The system of claim 3 , wherein:

each digital access request further comprises a respective digest representative of a state of the respective second ledger database; and

for each digital access request, said obtaining the respective public key corresponding to the respective private key from the respective second ledger database comprises:

providing the respective digest to the respective second ledger database; and

receiving, from the respective second ledger database, a response indicating the respective digest is valid and comprising the respective public key.

5. The system of claim 1 , wherein said providing the at least one of the entities with access to the data protected by the security policy comprises:

decrypting the data protected by the security policy; and

providing the decrypted data to the at least one of the entities.

6. The system of claim 1 , wherein said providing the at least one of the entities with access to the data protected by the security policy comprises:

authorizing a data handler to decrypt the data protected by the security policy and provide the decrypted data to the at least one of the entities.

7. The system of claim 1 , the operations further comprising, prior to said receiving step:

receiving a digital validation request from a user, the digital validation request comprising a policy proof, an encrypted private key of the user, and the respective encrypted secret shares;

validating the digital validation request based at least on the policy proof, the encrypted private key, and the respective encrypted secret shares; and

in response to validating the digital validation request, storing the data protected by the security policy.

8. The system of claim 1 , the operations further comprising:

receiving a digital validation request from the at least one of the entities, the digital validation request comprising a policy proof;

for each respective encrypted secret share, obtaining the respective encrypted secret share from the respective first ledger database;

obtaining an encrypted private key from a key manager;

validating the digital validation request based at least on the policy proof, the respective encrypted secret shares, and the encrypted private key; and

in response to validating the digital validation request, notifying the at least one of the entities that the digital validation request is valid.

9. A computer-implemented method comprising:

receiving a respective digital access request from each of a plurality of entities, each access request comprising a respective proof;

for each digital access request:

obtaining a respective encrypted secret share from a respective first ledger database; and

validating the digital access request based at least on the respective encrypted secret share and the respective proof, without decrypting the respective encrypted secret share;

in response to validating all of the digital access requests, verifying that an access criteria of a security policy is met; and

in response to said verifying that the access criteria of the security policy is met, providing at least one of the entities with access to data protected by the security policy.

10. The computer-implemented method of claim 9 , wherein:

each digital access request further comprises a respective digest representative of a state of the respective first ledger database; and

for each digital access request, said obtaining the respective encrypted secret share from the respective first ledger database comprises:

providing the respective digest to the respective first ledger database; and

receiving, from the respective first ledger database, a response indicating the respective digest is valid and comprising the respective encrypted secret share.

11. The computer-implemented method of claim 9 , wherein:

each digital access request is signed by a respective private key of a respective one of the entities; and

the method further comprises:

for each digital access request, obtaining a respective public key corresponding to the respective private key from a respective second ledger database; and

for each digital access request, said validating the digital access request further comprises validating a signature of the digital access request using the respective public key.

12. The computer-implemented method of claim 11 , wherein:

each digital access request further comprises a respective digest representative of a state of the respective second ledger database; and

for each digital access request, said obtaining the respective public key corresponding to the respective private key from the respective second ledger database comprises:

providing the respective digest to the respective second ledger database; and

receiving, from the respective second ledger database, a response indicating the respective digest is valid and comprising the respective public key.

13. The computer-implemented method of claim 9 , wherein said providing the at least one of the entities with access to the data protected by the security policy comprises one of:

decrypting the data protected by the security policy and providing the decrypted data to the at least one of the entities; or

authorizing a data handler to decrypt the data protected by the security policy and provide the decrypted data to the at least one of the entities.

14. The computer-implemented method of claim 9 , further comprising, prior to said receiving step:

receiving a digital validation request from a user, the digital validation request comprising a policy proof, an encrypted private key of the user, and the respective encrypted secret shares;

validating the digital validation request based at least on the policy proof, the encrypted private key, and the respective encrypted secret shares; and

in response to validating the digital validation request, storing the data protected by the security policy.

15. The computer-implemented method of claim 9 , further comprising:

receiving a digital validation request from the at least one of the entities, the digital validation request comprising a policy proof;

for each respective encrypted secret share, obtaining the respective encrypted secret share from the respective first ledger database;

obtaining an encrypted decryption key from a key manager;

validating the digital validation request based at least on the policy proof, the respective encrypted secret shares, and the encrypted decryption key; and

in response to validating the digital validation request, notifying the at least one of the entities that the digital validation request is valid.

16. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor circuit:

receive a respective digital access request from each of a plurality of entities, each access request comprising a respective proof;

for each digital access request:

obtain a respective encrypted secret share from a respective first ledger database; and

validate the digital access request based at least on the respective encrypted secret share and the respective proof, without decrypting the respective encrypted secret share;

in response to validating all of the digital access requests, verify that an access criteria of a security policy is met; and

in response to said verifying that the access criteria of the security policy is met, provide at least one of the entities with access to data protected by the security policy.

17. The computer-readable storage medium of claim 16 , wherein:

each digital access request further comprises a respective digest representative of a state of the respective first ledger database; and

the program instructions, when executed by the processor circuit and for each digital access request, obtain the respective encrypted secret share from the respective first ledger database by:

providing the respective digest to the respective first ledger database; and

receiving, from the respective first ledger database, a response indicating the respective digest is valid and comprising the respective encrypted secret share.

18. The computer-readable storage medium of claim 16 , wherein:

each digital access request is signed by a respective private key of a respective one of the entities; and

the program instructions, when executed by the processor circuit and for each digital access request:

obtain a respective public key corresponding to the respective private key from a respective second ledger database; and

validate a signature of the digital access request using the respective public key.

19. The computer-readable storage medium of claim 16 , wherein the program instructions, when executed by the processor circuit, provide the at least one of the entities with access to the data protected by the security policy by:

authorizing a data handler to decrypt the data protected by the security policy and provide the decrypted data to the at least one of the entities.

20. The computer-readable storage medium of claim 16 , the program instructions, when executed by the processor circuit and prior to said receiving the respective digital access request from each of the plurality of entities:

receive a digital validation request from a user, the digital validation request comprising a policy proof, an encrypted private key of the user, and the respective encrypted secret shares;

validate the digital validation request based at least on the policy proof, the encrypted private key, and the respective encrypted secret shares; and

in response to validating the digital validation request, store the data protected by the security policy.

Assignments (2)

Continuity (1)

References Cited (81)