US 12,438,717 B2
Selective data sharing
Ali Sajjad, London (GB); Mamun Abu-Tair, London (GB); and Syed Muhammad Unsub Zia, London (GB)
Assigned to BRITISH TELECOMMUNICATIONS public limited company, London (GB)
Appl. No. 18/577,182
Filed by BRITISH TELECOMMUNICATIONS PUBLIC LIMITED COMPANY, London (GB)
PCT Filed Jun. 16, 2022, PCT No. PCT/EP2022/066496
§ 371(c)(1), (2) Date Jan. 5, 2024,
PCT Pub. No. WO2023/280546, PCT Pub. Date Jan. 12, 2023.
Claims priority of application No. 2109926 (GB), filed on Jul. 9, 2021.
Prior Publication US 2024/0235832 A1, Jul. 11, 2024
Int. Cl. H04L 9/14 (2006.01)
CPC H04L 9/14 (2013.01) 14 Claims
OG exemplary drawing
 
1. A method of sharing data between a data source and one or more selected data recipients, the method, performed by a gateway router having a public key and a private key, comprising:
encrypting data provided by the data source using a data encryption key;
storing the encrypted data;
for each of the selected data recipients:
i) generating a dedicated key encryption key dedicated to sharing data between the data source and the selected data recipient;
ii) encrypting the data encryption key using the dedicated key encryption key to generate a dedicated wrapped encryption key dedicated to sharing data between the data source and the selected data recipient; and
iii) storing a data access authorisation authorising access to the provided data by the selected data recipient, the data access authorisation comprising the dedicated wrapped encryption key and an identifier of the selected data recipient;
wherein the data encryption key is later recovered for a selected data recipient by a data access controller having associated public and private keys and being operable to control access to decrypted data by requestors, using the same dedicated key encryption key to decrypt the dedicated wrapped encryption key found in the data access authorisation; and
the dedicated key encryption key is generated by applying a one-way hash function to a concatenation of an edge gateway ID of the gateway router, a client ID of the selected data recipient and a number computable by each of the gateway router and the data access controller using their private key and the public key of the other.