Method, apparatus, and computer program product for encryption key management within a group-based communication system

Patent metadata

Field	Value
Publication number	US-12015699-B2
Application number	US-202016989452-A
Country	US
Kind code	B2
Filing date	Aug 10, 2020
Priority date	Jun 6, 2018
Publication date	Jun 18, 2024
Grant date	Jun 18, 2024

Abstract

Various embodiments are directed to systems and methods for encryption key management within a group-based communication platform.

First claim

What is claimed is:

1. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method of providing encryption key management, the method comprising the steps of:
receiving, from a server, an encrypt request, the encrypt request comprising an encryption key request data structure and encrypt request plaintext, wherein the encryption key request data structure comprises one or more keyscope components, and the encrypt request plaintext comprises one or more of a message plaintext, a file plaintext, or a search index plaintext;
upon determining that an encryption key associated with the encryption key request data structure is not stored in at least one local memory, transmitting an encryption key generation request to a key server, the encryption key generation request comprising the encryption key request data structure;
upon determining that the key server has not responded with one or more of the encryption key and encryption key ciphertext, transmitting an encrypt request error to the server, wherein the encrypt request error comprises an electronic message indicating that access to a requested encryption key is denied; and
revoking, on a per keyscope component basis, access to encryption keys associated with the one or more keyscope components.

2. The media of claim 1 , wherein the method further comprises the step of revoking access to data associated with a revoked keyscope component while maintaining access to other data owned by the key server.

3. The media of claim 2 , wherein the method further comprises the steps of:
transmitting, to the server, at least a part of the encryption key request data structure; and
storing the at least a part of the encryption key request data structure in a repository.

4. The media of claim 1 , wherein the encryption key associated with the encryption key request data structure is unique to an organization and not shared with other organizations.

5. The media of claim 4 , wherein the organization can revoke the encryption key associated with the encryption key request data structure at any time.

6. The media of claim 4 , wherein the one or more keyscope components include an organization identifier, a workspace identifier, a channel identifier, a timestamp, or a user identifier.

7. The media of claim 1 , wherein the method further comprises the step of refreshing the at least one local memory, and
wherein refreshing the at least one local memory occurs after lapsing of an encryption key management cache persistence period and prior to determining that the encryption key associated with the encryption key request data structure is not stored in the at least one local memory.

8. A method of providing encryption key management comprising the steps of:
receiving, from a server, an encrypt request, the encrypt request comprising an encryption key request data structure and encrypt request plaintext, wherein the encryption key request data structure comprises one or more keyscope components, and the encrypt request plaintext comprises one or more of a message plaintext, a file plaintext, or a search index plaintext;
upon determining that an encryption key associated with the encryption key request data structure is not stored in at least one local memory, transmitting an encryption key generation request to a key server, the encryption key generation request comprising the encryption key request data structure;
upon determining that the key server has not responded with one or more of the encryption key and encryption key cipher text, transmitting an encrypt request error to the server, wherein the encrypt request error comprises an electronic message indicating that access to a requested encryption key is denied; and
revoking, on a per keyscope component basis, access to encryption keys associated with the one or more keyscope components.

9. The method of claim 8 , further comprising the step of revoking access to data associated with a revoked keyscope component while maintaining access to other data owned by the key server.

10. The method of claim 8 , further comprising the steps of:
transmitting, to the server, at least a part of the encryption key request data structure; and
storing the at least a part of the encryption key request data structure in a repository.

11. The method of claim 8 , wherein the encryption key associated with the encryption key request data structure is unique to an organization, and not shared with other organizations.

12. The method of claim 11 , wherein the organization can revoke the encryption key associated with the encryption key request data structure at any time.

13. The method of claim 11 , wherein the one or more keyscope components include an organization identifier, a workspace identifier, a channel identifier, a timestamp, or a user identifier.

14. The method of claim 8 further comprising the step of refreshing the at least one local memory, and
wherein refreshing the at least one local memory occurs after lapsing of an encryption key management cache persistence period and prior to determining that the encryption key associated with the encryption key request data structure is not stored in the at least one local memory.

15. A system for providing encryption key management, comprising:
a server;
a key server; and
an encryption key management server,
wherein the encryption key management server is programmed to perform a method of providing encryption key management, the method comprising the steps of:
receiving, from the server, an encrypt request, the encrypt request comprising an encryption key request data structure and encrypt request plaintext, wherein the encryption key request data structure comprises one or more keyscope components, and the encrypt request plaintext comprises one or more of a message plaintext, a file plaintext, or a search index plaintext;
upon determining that an encryption key associated with the encryption key request data structure is not stored in at least one local memory, transmitting an encryption key generation request to the key server, the encryption key generation request comprising the encryption key request data structure;
upon determining that the key server has not responded with one or more of the encryption key and encryption key cipher text, transmitting an encrypt request error to the server, wherein the encrypt request error comprises an electronic message indicating that access to a requested encryption key is denied; and
revoking, on a per keyscope component basis, access to encryption keys associated with the one or more keyscope components.

16. The system of claim 15 , further comprising a repository and wherein the method further comprises the step of revoking access to data associated with a revoked keyscope component while maintaining access to other data owned by the key server.

17. The system of claim 15 , wherein the encryption key associated with the encryption key request data structure is unique to an organization and not shared with other organizations.

18. The system of claim 17 , wherein the organization can revoke the encryption key associated with the encryption key request data structure at any time.

19. The system of claim 17 , wherein the one or more keyscope components include an organization identifier, a workspace identifier, a channel identifier, a timestamp, or a user identifier.

20. The system of claim 15 , wherein the method further comprises the step of refreshin

Assignees

• Slack Tech Inc
• Salesforce Inc

Inventors

• Crowley Richard
• Drummond Audrei
• Fain Jessica
• Jones Leah
• Frank Ilan
• Kinkel Nikolas

Classifications

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/0861 Primary

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L9/0618

  Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title