US 11,870,882 B2
Data processing permits system with keys
Yacov Salomon, Danville, CA (US); Seth Yates, Danville, CA (US); Maxwell Anderson, San Francisco, CA (US); Vivek Vaidya, San Francisco, CA (US); Anton Winter, San Mateo, CA (US); Samuel Alexander, San Francisco, CA (US); and Tom Chavez, San Francisco, CA (US)
Assigned to Salesforce, Inc., San Francisco, CA (US)
Filed by Ketch Kloud, Inc., San Francisco, CA (US)
Filed on Jun. 4, 2021, as Appl. No. 17/339,780.
Application 17/339,780 is a continuation of application No. 16/741,666, filed on Jan. 13, 2020, granted, now 11,032,062.
Claims priority of provisional application 62/901,648, filed on Sep. 17, 2019.
Prior Publication US 2021/0297236 A1, Sep. 23, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); H04L 9/06 (2006.01); H04L 9/08 (2006.01); G06F 21/60 (2013.01)
CPC H04L 9/0618 (2013.01) [G06F 21/602 (2013.01); H04L 9/0819 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method for managing data privacy for a system, comprising:
receiving, from a user device, an indication of consent to support a data processing activity for a set of data associated with a user operating the user device;
generating a plurality of data processing permits, wherein a data processing permit of the plurality of data processing permits is generated for the user based at least in part on the indication of consent, the data processing permit indicating permission to perform the data processing activity on the set of data;
storing the plurality of data processing permits, each data processing permit of the plurality of data processing permits indicating respective permission to perform a respective data processing activity on a respective set of data;
receiving a request to perform the data processing activity on a data object;
checking the plurality of data processing permits for permission to perform the data processing activity on the data object based on the request;
determining, based on the checking, that the data processing permit of the plurality of data processing permits supports the request based at least in part on the data processing permit indicating the permission to perform the data processing activity on the set of data and based at least in part on the set of data comprising the data object;
identifying, based on the determining that the data processing permit supports the request, a permit key comprising a pointer pointing to the data processing permit that supports the request, wherein the permit key permits access to a plaintext version of the data object;
decrypting an encrypted version of a cryptographic key using the permit key to obtain the cryptographic key; and
decrypting a ciphertext version of the data object using the cryptographic key to obtain the plaintext version of the data object.