US 12,015,699 B2
Method, apparatus, and computer program product for encryption key management within a group-based communication system
Richard Crowley, San Francisco, CA (US); Audrei Drummond, Oakland, CA (US); Jessica Fain, San Francisco, CA (US); Leah Jones, San Francisco, CA (US); Ilan Frank, Los Altos, CA (US); and Nikolas Kinkel, Oakland, CA (US)
Assigned to Salesforce, Inc., San Francisco, CA (US)
Filed by Slack Technologies, Inc., San Francisco, CA (US)
Filed on Aug. 10, 2020, as Appl. No. 16/989,452.
Application 16/989,452 is a continuation of application No. 16/434,097, filed on Jun. 6, 2019, granted, now 10,778,419.
Claims priority of provisional application 62/681,578, filed on Jun. 6, 2018.
Prior Publication US 2020/0374111 A1, Nov. 26, 2020
Int. Cl. H04L 9/08 (2006.01); H04L 9/06 (2006.01)
CPC H04L 9/0833 (2013.01) [H04L 9/0618 (2013.01); H04L 9/0861 (2013.01); H04L 9/0891 (2013.01)] 20 Claims
OG exemplary drawing
 
1. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method of providing encryption key management, the method comprising the steps of:
receiving, from a server, an encrypt request, the encrypt request comprising an encryption key request data structure and encrypt request plaintext, wherein the encryption key request data structure comprises one or more keyscope components, and the encrypt request plaintext comprises one or more of a message plaintext, a file plaintext, or a search index plaintext;
upon determining that an encryption key associated with the encryption key request data structure is not stored in at least one local memory, transmitting an encryption key generation request to a key server, the encryption key generation request comprising the encryption key request data structure;
upon determining that the key server has not responded with one or more of the encryption key and encryption key ciphertext, transmitting an encrypt request error to the server, wherein the encrypt request error comprises an electronic message indicating that access to a requested encryption key is denied; and
revoking, on a per keyscope component basis, access to encryption keys associated with the one or more keyscope components.