Patent ID: 9165154
Filing Date: 2015-10-20
Classification: G06F,H04L,H04W

Abstract:
1. A method for subscribing to data by distributing trust across multiple entities to avoid a single point of data compromise, the method comprising: requesting a subset of searchably encrypted data from a data storage provider by at least one subscriber device, wherein the searchably encrypted data provides for selective access to the subset of encrypted data based on search or query functionality without allowing access beyond the subset of encrypted data; receiving cryptographic key information from a key generation component that generates the cryptographic key information in response to the request for the subset of searchably encrypted data, the cryptographic key information based on identity information associated with the at least one subscriber device, wherein the cryptographic key information includes capability information that defines access privileges with respect to the searchably encrypted data, the capability information is late bound so that up to date access privileges are granted to a given subscriber and data accessible to the given subscriber changes dynamically consistent with changes to the access privileges by a publisher since subscriber capabilities are encoded in the cryptographic key information, the key generation component being independent and separate from the data storage provider; receiving the requested subset of searchably encrypted data; decrypting the subset of encrypted data using the cryptographic key information as allowed by capabilities defined in the cryptographic key information; and validating that a correct subset of encrypted data consistent with the requesting is received by the at least one subscriber device.