/Patent Tracker
AmazonGranted patentSecurity & privacyInterest 6/10

Amazon patents cloud system that checks who can see your encrypted data

Amazon describes a method where user data is locked with a special key that is wrapped in two layers of encryption. A cloud service checks if a requester has permission to see the data before handing over the first layer of the key, allowing the user to unlock the file.

Why it mattersThis approach adds a layer of control so that only approved groups can access specific digital files, which is useful for companies managing sensitive customer information.

In the filing’s own words

Systems, devices, and methods are provided for cloud-based privacy controls. User content is encrypted using a content encryption key (CEK). The CEK may be double-encrypted by the data producer—the inner envelope is encrypted using keys associated with privacy domains that are authorized to access the user content. The outer envelope is encrypted using a cloud privacy control's public key. When a data consumer requests access the user content, the cloud privacy control evaluates privacy policies and determines whether access should be permitted. If permitted, the cloud privacy control decrypts the outer envelope and provides the inner envelope with CEK to the requestor. Upon receiving the inner envelope, the data consumer may then decrypt the inner envelope with its privacy domain private key to obtain the CEK. The CEK may then be used to perform a decryption and obtain the user content.

What exactly they claim (claim 1)

1. A method comprising: obtaining, by one or more processors of a cloud privacy control and from a computing entity, a request comprising: information associated with digital content to access; and a digital signature; validating, by the one or more processors, the digital signature to determine a first identity associated with the computing entity; determining, by the one or more processors, a manifest that encodes a plurality of double-encrypted content encryption keys (DECEKs) associated with the digital content; selecting, by the one or more processors, a first DECEK from the plurality of DECEKs that is associated with the first identity; decrypting, by the one or more processors and using a cryptographic key associated with the cloud privacy control, the first DECEK to produce a first encrypted content encryption key (ECEK); and providing, by the one or more processors, the first ECEK to the computing entity.

Facts

Company
Amazon (Amazon Technologies, Inc.)
Official title
Techniques for cloud-based privacy controls
Patent number
US12750348B1
Application number
19009361
Filed
Jan 3, 2025
Granted
Sep 29, 2026
Inventors
6
Claims
20

Classified under

H04L 63/0428 Electricity & electronicsH04L 9/0894 Electricity & electronicsH04L 9/14 Electricity & electronicsH04L 9/30 Electricity & electronics
Read the full filing (official PDF) ↗ Open in the Patent Tracker

More from Amazon in Security & privacy

Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.