US 11,700,112 B2
Distributed key caching for encrypted keys
Alexandre Hersans, San Francisco, CA (US); John Bracken, San Francisco, CA (US); Assaf Ben Gur, San Francisco, CA (US); William Charles Mortimore, Jr., San Francisco, CA (US); and Swaroop Shere, San Francisco, CA (US)
Assigned to Salesforce, Inc., San Francisco, CA (US)
Filed by salesforce.com, inc., San Francisco, CA (US)
Filed on Apr. 30, 2020, as Appl. No. 16/863,402.
Application 16/863,402 is a continuation of application No. 15/716,677, filed on Sep. 27, 2017, granted, now 10,680,804.
Prior Publication US 2020/0322139 A1, Oct. 8, 2020
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/08 (2006.01); H04L 9/14 (2006.01); G06F 12/123 (2016.01); G06F 12/0813 (2016.01)
CPC H04L 9/0822 (2013.01) [G06F 12/0813 (2013.01); G06F 12/123 (2013.01); H04L 9/0894 (2013.01); H04L 9/14 (2013.01); G06F 2212/60 (2013.01); G06F 2212/62 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method for data encryption, comprising:
receiving, from an application server, a data encryption key request at a distributed cache;
receiving, from a central database and at the distributed cache, an encryption key parameter corresponding to a user based at least in part on the data encryption key request;
transmitting an additional data encryption key request to a key derivation server, the additional data encryption key request comprising the encryption key parameter and triggering a key derivation procedure;
receiving, at the distributed cache as a result of the key derivation procedure, a first encryption key that is encrypted by a second encryption key, wherein the second encryption key is inaccessible by the distributed cache;
transmitting the first encryption key that is encrypted by the second encryption key to an application server remote from the distributed cache based at least in part on receiving the data encryption key request;
receiving, from the application server, a destruction request message to destroy the encryption key parameter; and
removing, based at least in part on the destruction request message, the first encryption key that is stored at a key cache associated with the distributed cache and encrypted by the second encryption key.