US 12,470,380 B2
Tertiary-level encryption key scheme
Jonathan Lee, Seattle, WA (US); Rajat Goel, San Jose, CA (US); Stas Ilinskiy, Seattle, WA (US); Wesley Rodriguez, San Francisco, CA (US); April King, Saint Paul, MN (US); and Joseph Eichenhofer, San Francisco, CA (US)
Assigned to Dropbox, Inc., San Francisco, CA (US)
Filed by Dropbox, Inc., San Francisco, CA (US)
Filed on Sep. 30, 2022, as Appl. No. 17/957,515.
Claims priority of provisional application 63/363,093, filed on Apr. 15, 2022.
Prior Publication US 2023/0336343 A1, Oct. 19, 2023
Int. Cl. H04L 9/14 (2006.01); H04L 9/08 (2006.01)
CPC H04L 9/14 (2013.01) [H04L 9/0877 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method comprising:
receiving a request to access a plurality of blocks making up an object by a service of a content management system;
determining whether a user account requesting the plurality of blocks making up the object possesses a namespace encryption key, wherein an encrypted version of the namespace encryption key is stored at the content management system, the encrypted version of the namespace encryption key is encrypted using a top-level encryption key;
sending the encrypted version of the namespace encryption key to a key management service;
in response to sending the encrypted version of the namespace encryption key, receiving, by the service associated with the content management system, a decrypted version of the namespace encryption key from the key management service;
storing the decrypted version of the namespace encryption key in a namespace encryption key database at the content management system;
requesting, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;
receiving, by the service associated with the content management system, the decrypted version of the namespace encryption key from the namespace encryption key database;
when the user account requesting the plurality of blocks making up the object also possesses access permissions for the object associated with the namespace encryption key, accessing the plurality of blocks making up the object from a storage system at the content management system and respective block encryption keys encrypting the plurality of blocks, wherein the respective block encryption keys are encrypted using the namespace encryption key;
decrypting the respective block encryption keys using the decrypted version of the namespace encryption key; and
decrypting the plurality of blocks using the respective block encryption keys.