Hierarchical encryption of data

Patent metadata

Field	Value
Publication number	US-10372930-B2
Application number	US-201615275287-A
Country	US
Kind code	B2
Filing date	Sep 23, 2016
Priority date	Jun 12, 2016
Publication date	Aug 6, 2019
Grant date	Aug 6, 2019

Abstract

Some embodiments provide a method for storing multiple data assets in a folder structure on a cloud services platform. The method stores a separate encrypted structure for each of the data assets on the cloud services platform. A same first key provides access to each of the encrypted structures. The method stores, on the cloud services platform, a folder structure with an encrypted copy of the first key. The method stores a parent structure of the folder on the cloud services platform. The parent structure includes an encrypted copy of a second key that provides access to the encrypted copy of the first key.

First claim

The invention claimed is:

1. A method comprising:
storing, by a cloud services computing platform, a separate encrypted structure for each of a plurality of data assets on the cloud services computing platform, wherein a first private key provides access to each of the encrypted structures, each of the encrypted structures encrypted with a first public key;
storing, on the cloud services computing platform, a folder structure with an encrypted copy of the first private key, the first private key encrypted with a second public key; and
storing a parent structure of the folder structure on the cloud services computing platform, the parent structure comprising an encrypted copy of a second private key that provides access to the encrypted copy of the first private key.

2. The method of claim 1 , wherein the second private key is accessible with another key associated with an entity that requires access to the plurality of data assets.

3. The method of claim 2 , wherein the entity is a user account of the cloud services computing platform, wherein the other key is derived from a password for the user account.

4. The method of claim 1 , further comprising:
receiving a command to share the plurality of data assets with a user account through the cloud services computing platform; and
adding to the folder structure a second copy of the first private key that is encrypted with another key associated with the user account.

5. The method of claim 4 , further comprising:
receiving a command to remove the user account from a list of users with which the plurality of data assets are shared;
removing, from the folder structure, the second encrypted copy of the first private key.

6. The method of claim 1 further comprising:
receiving addition of a new data asset to the folder structure;
encrypting the new data asset for decryption with the first private key; and
storing the encrypted new data asset on the cloud services computing platform with a reference to the folder structure.

7. The method of claim 1 , wherein the parent structure is a first parent structure, the method further comprising:
receiving input to move the plurality of data assets in the folder structure to a second parent structure;
removing the encrypted copy of the first private key from the folder structure; and
adding a second encrypted copy of the first private key to the folder structure, wherein the second parent structure comprises an encrypted copy of another key that provides access to the second encrypted copy of the first private key.

8. The method of claim 1 , wherein the folder structure represents a note document and the plurality of data assets are attachments to the note document.

9. The method of claim 1 , wherein the folder structure represents a file system folder stored on the cloud services computing platform and at least a subset of the plurality of data assets are files stored in the folder structure, wherein the parent structure represents a parent folder of the file system folder.

10. The method of claim 1 , wherein the folder structure represents a file system folder stored on the cloud services computing platform and at least one data asset is a sub-folder that stores a plurality of files, the method further comprising storing, on the cloud services computing platform, a second folder structure for the sub-folder with an encrypted another key that provides access to each of the files, the other key for decryption with the first private key.

11. The method of claim 1 , further comprising encrypting each of the plurality of data assets with the first public key, wherein encrypting a particular data asset comprises:
encrypting, with the first public key, a third private key in a structure record for the particular data asset; and
encrypting one or more content records for the particular data asset with a third public key.

12. The method of claim 11 , wherein the particular data asset is a document having multiple versions, wherein each version has a separate content record that stores the content of the corresponding version of the document.

13. A non-transitory machine readable medium storing a program which when executed by at least one processing unit causes the at least one processing unit to perform operations, the program comprising sets of instructions for:
storing a separate encrypted structure for each of a plurality of data assets on a cloud services platform, wherein a first key provides access to each of the encrypted structures;
storing, on the cloud services platform, a folder structure with an encrypted copy of the first key;
storing a parent structure of the folder structure on the cloud services platform, the parent structure comprising an encrypted copy of a second key that provides access to the encrypted copy of the first key;
adding to the folder structure a second copy of the first key that is encrypted with a third key associated with a user account, responsive to a request to share the plurality of data assets; and
removing the second encrypted copy of the first key from the folder structure responsive to a request to remove the user account from a list of user accounts with which the plurality of data assets are shared.

14. The non-transitory machine readable medium of claim 13 , wherein the second key is accessible with a fourth key associated with an entity that requires access to the plurality of data assets, wherein the entity is another user account of the cloud services platform, wherein the fourth key is derived from a password for the other user account.

15. The non-transitory machine readable medium of claim 13 , wherein the program further comprises sets of instructions for:
receiving input to move the plurality of data assets in the folder structure to a second parent structure;
removing the encrypted copy of the first key from the folder structure; and
adding a second encrypted copy of the first key to the folder structure, wherein the second parent structure comprises an encrypted copy of a fourth key that provides access to the second encrypted copy of the first key.

16. An electronic device comprising:
at least one hardware processor;
a non-transitory machine readable medium storing a program comprising sets of instructions for:
storing a separate encrypted structure for each of a plurality of data assets on a cloud services platform, wherein a first key provides access to each of the encrypted structures;
storing, on the cloud services platform, a folder structure with an encrypted copy of the first key;
storing a first parent structure of the folder structure on the cloud services platform, the first parent structure comprising an encrypted copy of a second key that provides access to the encrypted copy of the first key;
receiving input to move the plurality of data assets in the folder structure to a second parent structure;
removing the encrypted copy of the first key from the folder structure; and
adding a second encrypted copy of the first key to the folder structure, wherein the second parent structure comprises an encrypted copy of a third key that provides access to the second encrypted copy of the first key.

17. The electronic device of claim 16 , wherein:
the first key is a first private key, the second key is a second private key, and each of the data assets is encrypted with a first public key, and the first private key is encrypted with a second public key.

18. The electronic device of claim 16 , wherein the program further comprises sets of instructions for:
receiving a command to s

Assignees

• Apple Inc

Inventors

• Sharma Nihar
• Ma Xiaonan
• HONG Van
• Morard Jean-Gabriel
• Bonnet Olivier

Classifications

• H04L9/0836

  using tree structure or hierarchical structure · CPC title

• G06F2221/2107

  File encryption · CPC title

• G06F16/164

  File meta data generation · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title