Privacy enabled runtime

Patent metadata

Field	Value
Publication number	US-10769285-B2
Application number	US-201615157919-A
Country	US
Kind code	B2
Filing date	May 18, 2016
Priority date	May 18, 2016
Publication date	Sep 8, 2020
Grant date	Sep 8, 2020

Abstract

Technical solutions are described for securing data by a communication apparatus. An example computer-implemented method includes receiving, by an encryption engine, a request to apply cryptography to input data. The computer-implemented method also includes generating metadata for the input data, where the metadata identifies characteristics of content included in the input data. The method further includes applying a cryptographic technique to the input data to generate output data, and outputting the output data and metadata in response to the request.

First claim

What is claimed is:

1. An apparatus for securing data, the apparatus comprising:
a memory;
a communication interface; and
an encryption engine, having an encryption unit and an analytics unit, communicably coupled with the memory and the communication interface, the encryption engine configured to:
receive a request to apply cryptography to input data;
generate metadata for the input data using the analytics unit, wherein the metadata identifies characteristics of content included in the input data;
generate output data by applying a cryptographic technique to the input data;
return the output data and the metadata in response to the request, wherein the encryption unit and the analytics unit are on separate hardware units,
wherein the metadata includes a first metadata instance and a second metadata instance, the first metadata instance identifies a first set of characteristics in the input data, and the second metadata instance identifies a second set of characteristics in the input data, and
wherein the encryption engine applies a first cryptographic technique to the first metadata instance and a second cryptographic technique to the second metadata instance, the first cryptographic technique being distinct from the second cryptographic technique;

wherein the encryption engine further comprises a firewall, wherein the first metadata instance is decipherable by the firewall and the second metadata instance is not decipherable by the firewall.

2. The apparatus of claim 1 , wherein the cryptographic technique is a first cryptographic technique, and wherein the encryption engine is further configured to apply a second cryptographic technique to the metadata, the second cryptographic technique being distinct from the first cryptographic technique.

3. The apparatus of claim 1 , wherein the encryption engine is further configured to record a mapping between the metadata and an identity of an application that sent the request to apply cryptography to input data.

4. The apparatus of claim 1 , wherein the encryption engine is further configured to record a mapping between the metadata and an identity of a user executing an application that sent the request to apply cryptography to input data.

Assignees

• IBM

Inventors

• Alonzo Victor G
• Burns Zachary A
• Chan Yuk L
• Cheng Gisela C
• Choi Kin K
• Ng Kin

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L2209/80

  Wireless · CPC title