Granted Patent B2

US 12,645,765 · App. 18/710,134 · Granted Jun 2, 2026

Inventor: Joseph Shannon Duncan (Conway, AR)

Assignee: LiveRamp, Inc.

G06F21/10H04L63/0281H04L63/0442H04L63/0807

Abstract

Claims (65)

1 . A method for securely delivering information in an untrusted environment, comprising the method steps of:

at an embedded transcoder hosted in a consumer cloud environment, generating an appliance public key and an appliance private key;

at a client application hosted in the consumer cloud environment, sending a set of customer credentials and an initialization (INIT) request to a proxy function hosted within the consumer cloud environment;

at the proxy function, requesting an application public key and an appliance token that comprises an appliance identifier (appliance ID) and the appliance public key from the embedded transcoder;

at the embedded transcoder, responding to the proxy function by sending to the proxy function the application public key and the appliance token;

at the proxy function, requesting from a generic authentication appliance system (GAAS) an authorization and INIT packet, and sending the application public key and appliance token to the GAAS;

at the GAAS, validating the application public key and returning to the proxy function an INIT token, wherein the INIT token comprises a payload comprising a public section and a private section;

at the proxy function, sending the INIT token to the embedded transcoder;

at the embedded transcoder, validating a signature on the INIT token using the appliance public key;

at the proxy function, sending a transcode request to the embedded transcoder;

at the embedded transcoder, receiving a transcode request and returning results; and

at the proxy function, validating the application public key and the appliance token received from the embedded transcoder, and sending the application public key and the appliance token to the client application.

2 . The method of claim 1 , wherein the appliance public key is signed by an application private key within the embedded transcoder and sent to the proxy function along with application public key, and wherein the proxy function forwards the signed appliance public key and the application public key to the GAAS.

3 . The method of claim 2 , wherein the step of validating the application public key comprises the step of calling a secrets manager from the GAAS and validating if the application public key exists within the secrets manager.

4 . The method of claim 3 , further comprising the step of, after the GAAS validates the appliance token with the application public key, extracting the appliance public key out of the appliance token and then storing the appliance public key in the secrets manager.

5 . The method of claim 4 , wherein the private section of the INIT token is encrypted with a private key.

6 . The method of claim 5 , wherein the INIT token comprises secret data for use by the embedded transcoder.

7 . The method of claim 6 , further comprising the step of, before returning to the proxy function the INIT token, validating at an identification application programming interface source of truth (IDAPI) the set of customer credentials by retrieving the secret data from the IDAPI at the GAAS.

8 . The method of claim 7 , further comprising the step of encrypting the secret data at the GAAS using the appliance public key.

9 . The method of claim 8 , further comprising the steps of:

signing the INIT token at the GAAS with an encode key and sending the INIT token to the proxy function;

at the proxy function, sending the INIT token to the embedded transcoder;

at the embedded transcoder, validating the INIT token with a decode key; and

the embedded transcoder enabling itself to serve requests after the INIT token validation is successful.

10 . The method of claim 9 , further comprising the steps of:

calling the proxy function from the client application with a SMART token and a set of transcode data;

calling the embedded transcoder from the proxy function to validate the SMART token and receive the set of transcode data;

processing the transcode data at the embedded transcoder and returning a set of transcode data results to the proxy function; and

sending the set of transcode data results from the proxy function to the client application.

11 . The method of claim 10 , further comprising the steps of:

sending a refresh request from the client application to the proxy function;

passing the refresh request from the proxy function to the GAAS;

sending a request from the GAAS to the IDAPI for a new IDAPI token and secret data;

returning the IDAPI token and secret data from the IDAPI to the GAAS;

creating a new SMART token using the IDAPI token and secret data within the GAAS;

sending the new SMART token from the GAAS to the proxy function; and

sending the new SMART token from the proxy function to the client application.

12 . The method of claim 11 , further comprising the steps of:

generating a metrics data request within the customer cloud environment, and sending the metrics data request to the proxy function;

sending the metrics data request from the proxy function to the embedded transcoder;

generating a set of metrics at the embedded transcoder;

embedding the set of metrics in a metrics token at the embedded transcoder;

encoding the metrics token with the appliance private key at the embedded transcoder, and sending the metrics token to the proxy function;

sending the metrics token from the proxy function to the GAAS, and decoding the metrics token at the GAAS with the appliance public key to recover the set of metrics; and

writing the set of metrics to an external logging service.

13 . A system for securing delivering information in an untrusted environment, comprising:

a consumer cloud computing environment comprising a plurality of hardware processors and associated memories;

a provider cloud computing environment comprising a plurality of hardware processors and associated memories, wherein the provider cloud computing environment is connected to the consumer cloud computing environment across an electronic communications network;

a client application hosted in the consumer cloud computing environment, wherein the client application is configured to process a set of client data and send a set of customer credentials and an initialization (INIT) request to a proxy function;

an embedded transcoder in the consumer cloud computing environment, wherein the embedded transcoder is positioned within a network isolated environment within the consumer cloud computing environment wherein the client application has restricted access, and wherein the embedded transcoder is configured to:

generate an appliance public key and an appliance private key;

provide an appliance token to the proxy function in response to a request, wherein the appliance token comprises an appliance identifier and the appliance public key;

validate a signature on an INIT token using a decode key;

receive a transcode request from the proxy function and return transcode results; and

house the decode key, the appliance public key, and the appliance private key;

a generic authentication appliance system (GAAS) hosted in the provider cloud computing environment, wherein the GAAS is configured to control access to one or more provider applications in the consumer cloud computing environment, receive the appliance public key and the appliance token from the proxy function, validate the application public key, and generate an INIT token comprising an INIT header, an INIT payload, and an INIT signature, wherein the INIT payload comprises a public section and a private section;

and

wherein the proxy function is configured to pass communications between the client application and the GAAS, request the application public key and the appliance token from the embedded transcoder, send the application public key and the appliance token to the GAAS, receive the INIT token from the GAAS and forward the INIT token to the embedded transcoder, send a transcode request to the embedded transcoder, validate a response from the embedded transcoder, and return the validated response to the client application.

14 . The system of claim 13 , wherein the GAAS comprises an application programming interface (API) configured to communicate with the client application and provide access to provider applications hosted at the consumer cloud computing environment.

15 . The system of claim 14 , wherein the embedded transcoder comprises a container housing provider source code, provider algorithms, or provider intellectual property, or some combination thereof, and wherein the network isolated environment restricts access to the embedded transcoder from the client application.

16 . The system of claim 15 , wherein the proxy function is further configured to submit an API request to the GAAS to receive an authentication token.

17 . The system of claim 16 , wherein the proxy function is further configured to send the authentication token and the set of client data to the embedded transcoder, and in response the embedded transcoder is further configured to process the set of client data and render a set of results.

18 . The system of claim 17 , further comprising an identification application programming interface source of truth (IDAPI) hosted in the provider cloud computing environment and in communication with the GAAS, wherein the IDAPI is configured to validate data from the GAAS as a source of truth for the system.

19 . The system of claim 18 , wherein the embedded transcoder houses the decode key, an application public key and an application private key.

20 . The system of claim 19 , further comprising a secrets manager, wherein the GAAS is configured to validate an existence of the application public key within the secrets manager in response to an INIT request generated by the proxy function.

Continuity (2)

References Cited (29)