Microsoft Technology Licensing, LLC

Dustyn J Tubbs

Lawrence Fubini Waldman

Paresh Lukka

Andrew Vincent Spiziri

Eric Scott Albright

Alexander Weiss

A system can control access to encrypted data shared by a group of users by the use of a vault key that is associated with a group of users. The encrypted data can include encrypted secret data generated from the secret data using a secret key, an encrypted secret key can be generated from the secret key by the use of a vault key, and an encrypted vault key generated from the vault key by the use of a public key associated with a user of the group of users. The system can allow users to store and access the encrypted data only if the user is a current member of the group. The system can verify the user's membership status from a group manager, such as a system managing a channel or chat session. Users added to the group are also granted permission to grant access to new users.

Dynamic change in administrative rights for controlling secret data stored for user groups

This disclosure provides enhanced management of access rights for dynamic groups of users sharing secret data. Instead of relying on traditional administrative techniques for modifying access rights for stored data, the techniques disclosed herein allow a storage service to communicate with a group management system to verify membership of user groups, e.g., channels, chat session, or meetings, and automatically change access rights to stored data as users leave or join a group. Encrypted data can be stored within a storage vault. The storage vault can be dedicated to storing encrypted data shared between a user group, e.g. a channel. A server managing the storage vault can receive membership data from a group management service. As users join the group or leave a group managed by the group management service, each user's access permissions to the storage vault can be added, removed or modified.

Enhanced management of access rights for dynamic user groups sharing secret data

A system can control access to encrypted data shared by a group of users by the use of a vault key that is associated with a group of users. The encrypted data can include encrypted secret data generated from the secret data using a secret key, an encrypted secret key can be generated from the secret key by the use of a vault key, and an encrypted vault key generated from the vault key by the use of a public key associated with a user of the group of users. The system can allow users to store and access the encrypted data only if the user is a current member of the group. The system can verify the user's membership status from a group manager, such as a system managing a channel or chat session.

Enhanced security of secret data for dynamic user groups

This disclosure provides enhanced management of encryption key updates based on user group activity. A system utilizes a vault key and a combination of other security keys to control access to secret data shared by members of a group who are participating in a collaborative session, such as a channel or chat session. The vault key allows a system to control access to secret data with users that join a particular group while immediately restricting access from users that leave the group. Updates to the keys are initiated based on the activity of the members of a group, which can include, but is not limited to, a threshold change in a number of group members, a total number of group members, an amount of data shared between the group members, and/or an age of one or more keys used to secure data shared by the group.

Growing community of inventors

Redmond, WA, United States of America

Dustyn J Tubbs