Granted Patent B2

US 12,438,883 · App. 18/319,023 · Granted Oct 7, 2025

Inventors: Ramarathnam Venkatesan (Redmond, WA); Nishanth Chandran (Bangalore, IN); Srinath T. V. Setty (Redmond, WA); Christoph Berlin (Bellevue, WA); Ulrich Homann (Kirkland, WA); Michael James Zwilling (Bellevue, WA)

Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC

H04L63/107H04L63/102H04L63/20

Abstract

Claims (75)

1. A system, comprising:

a processor circuit; and

a memory that stores program code that, when executed by the processor circuit, performs operations, the operations comprising:

receiving a resource request from an entity to access an encrypted resource;

determining the encrypted resource is assigned to a first region and is protected by a region-based security policy;

receiving a proof of a region attribute from the entity, the proof indicating the entity possesses the region attribute, the region attribute indicating the entity is associated with the first region;

obtaining an encrypted attribute from a ledger database, the encrypted attribute being an encrypted version of the region attribute;

validating the resource request based at least on the encrypted attribute and the proof of the region attribute;

verifying an access criteria of the region-based security policy is met; and

providing the entity with access to the encrypted resource.

2. The system of claim 1 , wherein the encrypted resource is stored in a datacenter located in a second region separate from the first region.

3. The system of claim 2 , wherein the first region is a first country, the entity is associated with the first country, and the second region is a second country.

4. The system of claim 1 , wherein the region attribute indicates at least one of:

the entity is located in the first region;

the entity is a citizen of the first region;

the entity is an organization headquartered in the first region;

the entity is a service assigned to the first region; or

the entity is a government entity of the first region.

5. The system of claim 1 , wherein said providing the entity with access to the encrypted resource comprises:

providing a decryption key to the entity for decrypting the resource.

6. The system of claim 1 , wherein the system comprises a trusted verification system, the trusted verification system authorized by an authority of the first region to perform said verifying the access criteria of the region-based security policy is met.

7. The system of claim 1 , wherein:

the encrypted resource is associated with a user associated with the first region; and

the operations further comprise:

receiving a storage request from a computing device on behalf of the user, the storage request comprising the encrypted resource;

verifying the user is associated with the first region;

assigning the encrypted resource to the first region; and

storing the encrypted resource.

8. A computer-implemented method comprising:

receiving a resource request from an entity to access an encrypted resource;

determining the encrypted resource is assigned to a first region and is protected by a region-based security policy;

receiving a proof of a region attribute from the entity, the proof indicating the entity possesses the region attribute, the region attribute indicating the entity is associated with the first region;

obtaining an encrypted attribute from a ledger database, the encrypted attribute being an encrypted version of the region attribute;

validating the resource request based at least on the encrypted attribute and the proof of the region attribute;

verifying that an access criteria of the region-based security policy is met; and

providing the entity with access to the encrypted resource.

9. The computer-implemented method of claim 8 , wherein the encrypted resource is stored in a datacenter located in a second region separate from the first region.

10. The computer-implemented method of claim 9 , wherein the first region is a first country, the entity is associated with the first country, and the second region is a second country.

11. The computer-implemented method of claim 8 , wherein the region attribute indicates at least one of:

the entity is located in the first region;

the entity is a citizen of the first region;

the entity is an organization headquartered in the first region;

the entity is a service assigned to the first region; or

the entity is a government entity of the first region.

12. The computer-implemented method of claim 8 , wherein the proof of the region attribute is included in the resource request.

13. The computer-implemented method of claim 8 , wherein said receiving the proof of the region attribute from the entity comprises:

transmitting a proof request to a computing device associated with the entity, the proof request prompting the entity to provide the proof of the region attribute; and

receiving a response from the computing device associated with the entity, the response comprising the proof of the region attribute.

14. The computer-implemented method of claim 8 , wherein said verifying that the access criteria of the region of the region-based security policy is met comprises verifying that the access criteria is met by a verification system trusted by an authority of the first region.

15. The computer-implemented method of claim 8 , wherein the request is validated without decrypting the encrypted attribute.

16. The computer-implemented method of claim 8 , wherein said providing the entity with access to the encrypted resource comprises one of:

decrypting the encrypted resource and providing the decrypted resource to the entity;

providing a decryption key to the entity for decrypting the resource; or

authorizing a resource handler to decrypt the resource and provide the decrypted resource to the entity.

17. The computer-implemented method of claim 8 , wherein:

the encrypted resource is associated with a user associated with the first region; and

the method further comprises:

receiving a storage request from a computing device on behalf of the user, the storage request comprising the encrypted resource;

verifying the user is associated with the first region;

assigning the encrypted resource to the first region; and

storing the encrypted resource.

18. The computer-implemented method of claim 8 , wherein said determining the encrypted resource is assigned to a first region and is protected by a region-based security policy comprises determining encrypted resource is encrypted by an encryption key of the region-based security policy.

19. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor circuit perform a method, the method comprising:

receiving a resource request from an entity to access an encrypted resource;

determining the encrypted resource is assigned to a first region and is protected by a region-based security policy;

receiving a proof of a region attribute from the entity, the proof indicating the entity possesses the region attribute, the region attribute indicating the entity is associated with the first region;

obtaining an encrypted attribute from a ledger database, the encrypted attribute being an encrypted version of the region attribute;

validating the resource request based at least on the encrypted attribute and the proof of the region attribute;

verifying that an access criteria of the region-based security policy is met; and

providing the entity with access to the encrypted resource.

20. The computer-readable storage medium of claim 19 , wherein said determining the encrypted resource is assigned to a first region and is protected by a region-based security policy comprises determining encrypted resource is encrypted by an encryption key of the region-based security policy; and

said providing the entity with access to the encrypted resource comprises one of:

decrypting the encrypted resource and providing the decrypted resource to the entity,

providing a decryption key to the entity for decrypting the resource, or

authorizing a resource handler to decrypt the resource and provide the decrypted resource to the entity.

Assignments (1)

Continuity (1)

References Cited (9)

Cited By (1)

US 12,695,744