Method, apparatus, and computer program product for encryption key management within a group-based communication system

Patent metadata

Field	Value
Publication number	US-10778419-B2
Application number	US-201916434097-A
Country	US
Kind code	B2
Filing date	Jun 6, 2019
Priority date	Jun 6, 2018
Publication date	Sep 15, 2020
Grant date	Sep 15, 2020

Abstract

Various embodiments are directed to systems and methods for encryption key management within a group-based communication platform.

First claim

What is claimed is:

1. An apparatus for providing encryption key management, the apparatus capable of communicating with one or more servers of a communication system, the apparatus comprising at least one processor and at least one non-transitory memory storing instructions that, when executed by the processor, configure the apparatus to:
provide, to the one or more servers, access to one or more encryption keys provided by a key material source, the encryption keys for accessing data managed by the communication system;
wherein access to encryption keys is revocable on a per keyscope component basis wherein any encryption key associated with a revoked keyscope component is rendered invalid by the key material source, wherein a keyscope component is associated with an encryption key and is one or more of a timestamp, a user identifier, a message identifier, a file identifier, group-based communication channel identifier, a group-based communication team identifier, or a group-based communication workspace identifier; and
provide encrypted plaintext or decrypted ciphertext to the one or more servers, using the one or more encryption keys provided by the key material source,
wherein the plaintext comprises one or more of group-based communication message plaintext, group-based communication file plaintext, or a group-based communication search index encryption key.

2. The apparatus of claim 1 , wherein the at least one processor and at least one non-transitory memory stores instructions that, when executed by the processor, further configure the apparatus to:
provide, to the one or more servers, access to one or more encryption keys stored in at least one local memory, the encryption keys for accessing data managed by the communication system.

3. The apparatus of claim 1 , wherein the decrypted ciphertext comprises one or more of decrypted group-based communication message ciphertext, decrypted group-based communication file ciphertext, or a decrypted group-based communication search index encryption key.

4. A computer implemented method for providing encryption key management, comprising:
providing, to one or more servers of a communication system, access to one or more encryption keys provided by a key material source, the encryption keys for accessing data managed by the communication system;
wherein access to encryption keys is revocable on a per keyscope component basis wherein any encryption key associated with a revoked keyscope component is rendered invalid by the key material source, wherein a keyscope component is associated with an encryption key and is one or more of a timestamp, a user identifier, a message identifier, a file identifier, group-based communication channel identifier, a group-based communication team identifier, or a group-based communication workspace identifier; and
providing encrypted plaintext or decrypted ciphertext to the one or more servers, using the one or more encryption keys provided by the key material source,
wherein the plaintext comprises one or more of group-based communication message plaintext, group-based communication file plaintext, or a group-based communication search index encryption key.

5. The computer implemented method of claim 4 , further comprising:
providing, to the one or more servers, access to one or more encryption keys stored in at least one local memory, the encryption keys for accessing data managed by the communication system.

6. The computer implemented method of claim 4 , wherein the decrypted ciphertext comprises one or more of decrypted group-based communication message ciphertext, decrypted group-based communication file ciphertext, or a decrypted group-based communication search index encryption key.

Assignees

• Slack Tech Inc

Inventors

• Crowley Richard
• Drummond Audrei
• Fain Jessica
• Jones Leah
• Frank Ilan
• Kinkel Nikolas

Classifications

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/0861 Primary

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title