Coordinating data access in multiple services

Abstract

Methods and systems for managing access to encrypted data and encryption keys are disclosed. A system stores, by a key management server, a first encryption key associated with a first service and a second encryption key associated with a second service. While the first service is performing the first function using the first encryption key, the system prevents the second service from accessing the second encryption key by the key management server, and the system determines that a first threshold time period associated with the first function has elapsed. In response to determining that a first threshold time period associated with the first function has elapsed, the system prevents, by the key management server, the first service from accessing the first encryption key while the second service is performing the second function using the second encryption key.

Description

[0001] Priority claim

[0002] This application claims the benefit of priority to Greek patent application serial number 20220100655 filed on August 5, 2022 and U.S. patent application serial number 18 / 046,381 filed on October 13, 2022, each of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates generally to providing encryption, and particularly to coordinating access to encrypted data. Background Art

[0004] Modern service providers usually collect various information from users to provide different services. The collected information can be used for specific transactions and auxiliary services that users intend to perform with service providers. For example, users can provide personal information (for example, sensitive data, including credentials such as credit card numbers, debit card numbers and bank account numbers, and personal identification information (PII) such as social security numbers, names and addresses) to access a given content delivery service, and such information can be used by content delivery services to run statistics or provide suggestions to users subsequently. Although the collection and analysis of such data is of great benefit not only to specific users of service providers but also to other users, it may also be the cause of a large amount of abuse (for example, providing information to third parties). Such abuse may prevent many users who were originally willing to collaborate from accessing information and providing information to service providers. For these reasons and privacy regulations or regulatory constraints, when personal information is stored in a database, the service provider who controls such data has the responsibility to protect the data from abuse. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] In the accompanying drawings (which are not necessarily drawn to scale), similar reference numerals may describe similar components in different views. To easily identify the discussion of any particular element or action, the most significant digit or digits in a reference numeral refer to the figure number in which the element is first introduced. Some non-limiting examples are shown in the accompanying drawings, in which:

[0006] Figure 1 is a pictorial representation of a networked environment in which the present disclosure may be deployed, according to some examples.

[0007] Figure 2 is a graphical representation of a messaging client application according to some examples.

[0008] Figure 3 is a graphical representation of data structures maintained in a database according to some examples.

[0009] Figure 4 is a graphical representation of the message according to some examples.

[0010] Figure 5 is a block diagram illustrating an example key management system according to some examples.

[0011] Figure 6 and Figure 7 is a flow diagram illustrating example operations of a key management system according to some examples.

[0012] Figure 8 is a diagrammatic representation of a machine in the form of a computer system according to some examples within which a set of instructions may be executed for causing the machine to perform any one or more of the methodologies discussed herein.

[0013] Fig. 9 is a block diagram illustrating a software architecture in which examples may be implemented. DETAILED DESCRIPTION

[0014] The following description includes systems, methods, techniques, instruction sequences, and computing machine program products that embody illustrative examples of the present disclosure. In the following description, for the purpose of illustration, many specific details are set forth to provide an understanding of various examples. However, it will be apparent to those skilled in the art that examples may be practiced without these specific details. Typically, it is not necessary to show in detail known instruction instances, protocols, structures, and techniques.

[0015] Typical systems store large amounts of data on various back-end servers to provide different services. For example, cloud storage services, which are becoming increasingly popular, maintain data from various service providers on back-end servers that can be accessed via network communications. As more and more data is stored on remote servers, the importance of protecting such data and ensuring the security of such data grows. For example, a certain level of security, protection, and assurance needs to be provided to ensure that the PII of a user or customer stored remotely is safe and will not be compromised. One way to ensure data is through encryption. However, single-level encryption using one key has been shown to be vulnerable to attack and may be cracked. Recently, data security using two levels of encryption (e.g., salting the data using a first key and then encrypting the data using a second key) can better protect such data. Even with this approach, if the two keys used in the two-level encryption are maliciously obtained, the data will lose its security. In this way, typical systems cannot provide significant protection to user data, which puts its overall ability to protect user data at risk. In the event of a data leak, a large amount of resources are usually required to determine what data has been leaked and to notify the associated user or customer. This may result in a waste of system resources and reduce the overall efficiency of operating services on the server.

[0016] The disclosed technology improves the security of using an electronic device by providing a key management server that manages two levels of security while ensuring that two encryption keys are not stored on the server at the same time or are not available to the server at the same time. In this way, if the server is leaked, only one of the keys may be obtained maliciously, and the encrypted data will still be protected by the other key. That is, the disclosed technology stores a first encryption key associated with a first service through a key management server, and stores a second encryption key associated with a second service in an encrypted form. When the first service is using the first encryption key to perform a first function, the disclosed technology prevents the second service from accessing the second encryption key through the key management server. In response to determining that a first threshold time period associated with the first function has passed (for example, when the key management server is able to successfully decrypt the second encryption key according to the time lock encryption technology), when the second service is using the second encryption key to perform a second function, the disclosed technology prevents the first service from accessing the first encryption key through the key management server.

[0017] In this way, the disclosed technology can increase the overall data security provided to different services, which improves the overall functionality of the device. This improves the user's overall experience in using the electronic device and reduces the total amount of system resources required to complete tasks.

[0018] Networked computing environment

[0019] Figure 1 1 is a block diagram illustrating an example messaging system 100 for exchanging data (e.g., messages and associated content) over a network. The messaging system 100 includes multiple instances of a client device 102, each of the multiple instances hosting a number of applications including a messaging client 104 and other external applications 109 (e.g., third-party applications). Each messaging client 104 is communicatively coupled to other instances of the messaging client 104 (e.g., hosted on corresponding other client devices 102), a messaging server system 108, and an external application server 110 via a network 112 (e.g., the Internet). The messaging client 104 may also communicate with locally hosted third-party applications such as the external application 109 using an application programming interface (API).

[0020] The client device 102 can operate as a stand-alone device, or can be coupled (e.g., networked) to other machines. In a networked deployment, the client device 102 can operate as a server machine or a client machine in a server-client network environment, or operate as a peer machine in a peer-to-peer (or distributed) network environment. The client device 102 may include, but is not limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), an entertainment media system, a cellular phone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web device, a network router, a network switch, a network bridge, or any machine capable of performing the disclosed operations. In addition, although only a single client device 102 is shown, the term "client device" should also be considered to include a collection of machines that perform the disclosed operations individually or jointly.

[0021] In some examples, client device 102 may include augmented reality (AR) glasses or an AR headset, wherein virtual content is displayed within the lenses of the glasses while the user views the real world environment through the lenses. For example, an image may be presented on a transparent display, which allows the user to view content presented on the display and real-world objects simultaneously.

[0022] The messaging clients 104 are able to communicate and exchange data with other messaging clients 104 and messaging server systems 108 via the network 112. The data exchanged between the messaging clients 104 and between the messaging clients 104 and messaging server systems 108 include functions (e.g., commands to invoke functions) and payload data (e.g., text, audio, video, or other multimedia data).

[0023] The messaging server system 108 provides server-side functionality to certain messaging clients 104 via the network 112. Although certain functions of the messaging system 100 are described herein as being performed by the messaging client 104 or by the messaging server system 108, the location of certain functions within the messaging client 104 or within the messaging server system 108 may be a design choice. For example, it may be technically preferred to initially deploy certain technologies and functions within the messaging server system 108, but later migrate the technologies and functions to the messaging client 104 where the client device 102 has sufficient processing power.

[0024] The messaging server system 108 supports various services and operations provided to the messaging clients 104. Such operations include sending data to the messaging clients 104, receiving data from the messaging clients 104, and processing data generated by the messaging clients 104. As examples, the data may include message content, client device information, geo-location information, media enhancements and overlays, message content persistence conditions, social network information, and live event information. The exchange of data within the messaging system 100 is invoked and controlled by functions available via the user interface (UI) of the messaging client 104. In some cases, certain data (e.g., PII) received by the messaging server system 108 is managed by the key management system 224 ( Figure 2 ) protect and ensure its safety.

[0025] Turning now specifically to the messaging server system 108, an API server 116 is coupled to and provides a programming interface to the application server 114. The application server 114 is communicatively coupled to a database server 120, which facilitates access to a database 126 that stores data associated with messages processed by the application server 114. Similarly, a web server 128 is coupled to and provides a web-based interface to the application server 114. To this end, the web server 128 processes incoming network requests via the Hypertext Transfer Protocol (HTTP) and several other related protocols.

[0026] The API server 116 receives and sends message data (e.g., commands and message payloads) between the client device 102 and the application server 114. Specifically, the API server 116 provides a set of interfaces (e.g., routines and protocols) that can be called or queried by the messaging client 104 to invoke the functions of the application server 114. The API server 116 exposes various functions supported by the application server 114, including: account registration; login functionality; sending messages from a particular messaging client 104 to another messaging client 104 via the application server 114; sending media files (e.g., images or videos) from a messaging client 104 to the messaging server 118 and for possible access by another messaging client 104; setting up a collection of media data (e.g., a story); retrieving a friend list of a user of a client device 102; retrieving such a collection; retrieving messages and content; adding entities (e.g., friends) to an entity graph (e.g., a social graph) and removing entities (e.g., friends) from an entity graph (e.g., a social graph); locating friends in a social graph; and opening application events (e.g., related to a messaging client 104).

[0027] The application server 114 hosts many server applications and subsystems, including, for example, a messaging server 118, an image processing server 122, and a social network server 124. The messaging server 118 implements many message processing techniques and functions, particularly those related to the aggregation and other processing of content (e.g., text and multimedia content) included in messages received from multiple instances of the messaging client 104. As will be described in further detail, text and media content from multiple sources can be aggregated into collections of content (e.g., called stories or galleries). These collections are then made available to the messaging client 104. In view of the hardware requirements for other processor and memory intensive processing of data, such processing can also be performed on the server side by the messaging server 118.

[0028] The application server 114 includes an image processing server 122 that is dedicated to performing various image processing operations, typically on images or videos within the payload of messages sent from or received at the messaging server 118 .

[0029] The image processing server 122 is used to implement ( Figure 2) enhanced system 208. The scanning function includes: when an image is captured by the client device 102, activating and providing one or more AR experiences on the client device 102. Specifically, the messaging client 104 on the client device 102 can be used to activate the camera. The camera displays one or more real-time images or videos and one or more icons or identifiers of one or more AR experiences to the user. The user can select a given identifier in the identifier to start the corresponding AR experience or perform the desired image modification (for example, replace the clothing worn by the user in the video or recolor the clothing worn by the user in the video or modify the clothing based on the gesture performed by the user).

[0030] The social network server 124 supports various social networking functions and services and makes them available to the messaging server 118. To this end, the social network server 124 maintains and accesses an entity graph 308 (e.g., Figure 3 ). Examples of functions and services supported by the social networking server 124 include identifying other users of the messaging system 100 that have a relationship with a particular user or that the particular user is "following," and also identifying interests and other entities of a particular user.

[0031] Returning to the messaging client 104, the features and functions of the external resource (e.g., a third-party application 109 or an applet) are available to the user via the interface of the messaging client 104. The messaging client 104 receives a user selection of an option for launching or accessing features of an external resource (e.g., a third-party resource) such as an external application 109. The external resource can be a third-party application (external application 109) installed on the client device 102 (e.g., a "local application"), or a small-scale version of a third-party application (e.g., a "applet") hosted on the client device 102 or remote from the client device 102 (e.g., on a third-party server 110). The small-scale version of the third-party application includes a subset of the features and functions of the third-party application (e.g., a full-scale, local version of a third-party standalone application), and a markup language document is used to implement the small-scale version of the third-party application. In one example, the small-scale version of the third-party application (e.g., a "applet") is a web-based markup language version of the third-party application and is embedded in the messaging client 104. In addition to using markup language documents (eg, .*ml files), applets may include scripting languages ​​(eg, .*js files or .json files) and style sheets (eg, .*ss files).

[0032] In response to receiving a user selection of an option for launching or accessing a feature of an external resource (external application 109), the messaging client 104 determines whether the selected external resource is a web-based external resource or a locally installed external application. In some cases, an external application 109 installed locally on the client device 102 can be launched independently of the messaging client 104 and separately from the messaging client 104, for example, by selecting an icon corresponding to the external application 109 on the home screen of the client device 102. A small-scale version of such an external application can be launched or accessed via the messaging client 104, and in some examples, any portion or limited portion of the small-scale external application cannot be accessed outside the messaging client 104. The small-scale external application can be launched by the messaging client 104 receiving a markup language document associated with the small-scale external application from the external application server 110 and processing such a document.

[0033] In response to determining that the external resource is a locally installed external application 109, the messaging client 104 instructs the client device 102 to launch the external application 109 by executing the locally stored code corresponding to the external application 109. In response to determining that the external resource is a web-based resource, the messaging client 104 communicates with the external application server 110 to obtain a markup language document corresponding to the selected resource. The messaging client 104 then processes the obtained markup language document to present the web-based external resource within the user interface of the messaging client 104.

[0034] The messaging client 104 may notify the user of the client device 102 or other users (e.g., "friends") associated with such a user of activities occurring in one or more external resources. For example, the messaging client 104 may provide a notification related to the current or recent use of an external resource by one or more members of a user group to a participant in a conversation (e.g., a chat session) in the messaging client 104. One or more users may be invited to join an active external resource or to start an external resource that has been recently used but is currently inactive (in the friend group). The external resource may provide the ability to share items, conditions, states, or locations in the external resource with one or more members of the user group entering the chat session to participants in the conversation who each use the corresponding messaging client 104. The shared item may be an interactive chat card that members of the chat may interact with, such as to start a corresponding external resource, view specific information in an external resource, or bring members of the chat to a specific location or state in an external resource. Within a given external resource, a response message may be sent to the user on the messaging client 104. The external resource may selectively include different media items in the response based on the current context of the external resource.

[0035] The messaging client 104 may present a list of available external resources (e.g., third-party or external applications 109 or applets) to the user to launch or access a given external resource. The list may be presented in a context-sensitive menu. For example, icons representing different external applications in the external applications 109 (or applets) may vary based on how the user launches the menu (e.g., from a conversation interface or from a non-conversation interface).

[0036] System Architecture

[0037] Figure 2 1 is a block diagram showing additional details about the messaging system 100 according to some examples. Specifically, the messaging system 100 is shown to include a messaging client 104 and an application server 114. The messaging system 100 contains a number of subsystems that are supported on the client side by the messaging client 104 and on the server side by the application server 114. These subsystems include, for example, a transient timer system 202, a collection management system 204, an enhancement system 208, a map system 210, a game system 212, and an external resource system 220.

[0038] The transient timer system 202 is responsible for implementing temporary or time-limited access to content by the messaging client 104 and the messaging server 118. The transient timer system 202 includes a number of timers that selectively enable access to messages and associated content (e.g., for presentation and display) via the messaging client 104 based on duration and display parameters associated with a message or collection of messages (e.g., a story). Additional details regarding the operation of the transient timer system 202 are provided below.

[0039] The collection management system 204 is responsible for managing collections or collections of media (e.g., collections of text, image video, and audio data). Collections of content (e.g., messages, including images, videos, text, and audio) can be organized into "event galleries" or "event stories." Such collections can be available for a specified time period (e.g., the duration of an event related to the content). For example, content related to a concert can be made available as a "story" for the duration of the concert. The collection management system 204 can also be responsible for publishing an icon that provides notification of the existence of a particular collection to the user interface of the messaging client 104.

[0040] In addition, the collection management system 204 also includes a curation interface 206, which allows the collection manager to manage and curate specific content collections. For example, the curation interface 206 enables an event organizer to curate a collection of content related to a specific event (e.g., to delete inappropriate content or redundant messages). In addition, the collection management system 204 uses machine vision (or image recognition technology) and content rules to automatically curate content collections. In some examples, compensation can be paid to users for including user-generated content in a collection. In such a case, the collection management system 204 operates to automatically pay such users for using their content.

[0041] The enhancement system 208 provides various functions that enable users to enhance (e.g., annotate or otherwise modify or edit) media content associated with a message. For example, the enhancement system 208 provides functions related to generating and publishing media overlays for messages processed by the messaging system 100. The enhancement system 208 is operable to provide media overlays or enhancements (e.g., image filters) to the messaging client 104 based on the geographic location of the client device 102. In another example, the enhancement system 208 is operable to provide media overlays to the messaging client 104 based on other information such as social network information of the user of the client device 102. The media overlay can include audio and visual content and visual effects. Examples of audio and visual content include pictures, text, logos, animations, and sound effects. Examples of visual effects include color overlays. Audio and visual content or visual effects can be applied to media content items (e.g., photos) at the client device 102. For example, the media overlay can include text, graphic elements, or images that can be overlaid on photos taken by the client device 102. In another example, the media overlay includes a location identification overlay (e.g., Venice Beach), the name of a live event, or a business name overlay (e.g., Beach Cafe). In another example, the enhancement system 208 uses the geographic location of the client device 102 to identify a media overlay that includes the name of the business at the geographic location of the client device 102. The media overlay may include other tags associated with the business. The media overlay may be stored in the database 126 and accessed through the database server 120.

[0042] In some examples, the enhancement system 208 provides a user-based publishing platform that enables a user to select a geographic location on a map and upload content associated with the selected geographic location. The user can also specify an environment in which a particular media overlay should be provided to other users. The enhancement system 208 generates a media overlay that includes the uploaded content and associates the uploaded content with the selected geographic location.

[0043] In other examples, the augmentation system 208 provides a merchant-based publishing platform that enables merchants to select specific media overlays associated with a geographic location via a bidding process. For example, the augmentation system 208 associates the media overlay of the highest bidding merchant with the corresponding geographic location for a predefined amount of time. The augmentation system 208 communicates with the image processing server 122 to obtain an AR experience and presents an identifier of such an experience in one or more user interfaces (e.g., as an icon on a real-time image or video, or as a thumbnail or icon in an interface dedicated to the identifier of the presented AR experience). Once the AR experience is selected, one or more images, videos, or AR graphical elements are retrieved and presented as an overlay on top of the image or video captured by the client device 102. In some cases, the camera is switched to a front view (e.g., the front camera of the client device 102 is activated in response to activation of a particular AR experience), and an image from the front camera of the client device 102, rather than the rear camera of the client device 102, begins to be displayed on the client device 102. One or more images, videos, or AR graphical elements are retrieved and rendered as an overlay on top of the image captured and displayed by the front-facing camera of the client device 102 .

[0044] In other examples, the augmentation system 208 can communicate and exchange data with another augmentation system 208 on another client device 102 and a server via the network 112. The exchanged data may include: a session identifier identifying the shared AR session; a transformation between the first client device 102 and the second client device 102 (e.g., the plurality of client devices 102 include the first device and the second device), the transformation being used to align the shared AR session to a common origin; a common coordinate system; functionality (e.g., commands for invoking functionality), and other payload data (e.g., text, audio, video, or other multimedia data).

[0045] The augmentation system 208 sends the transformation to the second client device 102 so that the second client device 102 can adjust the AR coordinate system based on the transformation. In this way, the first client device 102 and the second client device 102 synchronize their coordinate systems and frames to display the content in the AR session. Specifically, the augmentation system 208 calculates the origin of the second client device 102 in the coordinate system of the first client device 102. The augmentation system 208 can then determine an offset in the coordinate system of the second client device 102 based on the location of the origin in the coordinate system of the second client device 102 from the perspective of the second client device 102. The offset is used to generate a transformation so that the second client device 102 generates AR content according to a common coordinate system or frame with the first client device 102.

[0046] The augmentation system 208 can communicate with the client device 102 to establish a separate or shared AR session. The augmentation system 208 can also be coupled to the messaging server 118 to establish an electronic group communication session (e.g., group chat, instant messaging) for the client device 102 in the shared AR session. The electronic group communication session can be associated with a session identifier provided by the client device 102 to obtain access to the electronic group communication session and the shared AR session. In some examples, the client device 102 first obtains access to the electronic group communication session and then obtains a session identifier in the electronic group communication session that allows the client device 102 to access the shared AR session. In some examples, the client device 102 is able to access the shared AR session without the assistance of the augmentation system 208 in the application server 114 or without communicating with the augmentation system 208 in the application server 114.

[0047] The mapping system 210 provides various geolocation functions and supports the presentation of map-based media content and messages by the messaging client 104. For example, the mapping system 210 enables the display of user icons or avatars (e.g., stored in the profile data 316) on a map to indicate the current or past locations of the user's "friends" and media content (e.g., a collection of messages including photos and videos) generated by such friends within the context of the map. For example, a message posted by a user to the messaging system 100 from a particular geographic location can be displayed to a particular user's "friends" on the map interface of the messaging client 104 within the context of the particular location on the map. The user can also share his or her location and status information with other users of the messaging system 100 (e.g., using an appropriate status avatar) via the messaging client 104, where the location and status information is similarly displayed to the selected user within the context of the mapping interface of the messaging client 104.

[0048] The gaming system 212 provides various gaming functions within the context of the messaging client 104. The messaging client 104 provides a gaming interface that provides a list of available games (e.g., web-based games or web-based applications) that can be launched by a user within the context of the messaging client 104 and played with other users of the messaging system 100. The messaging system 100 also enables a particular user to invite other users to participate in playing a particular game by sending an invitation to such other users from the messaging client 104. The messaging client 104 also supports both voice messaging and text messaging (e.g., chatting) within the context of game play, provides leaderboards for games, and also supports providing in-game rewards (e.g., coins and items).

[0049] The external resource system 220 provides an interface for communicating with an external application server 110 to start or access external resources to the messaging client 104. Each external resource (application) server 110 hosts, for example, an application based on a markup language (e.g., HTML5) or a small-scale version of an external application (e.g., a game, utility, payment, or ride-sharing application external to the messaging client 104). The messaging client 104 can start the web-based resource (e.g., application) by accessing an HTML5 file from an external resource (application) server 110 associated with a web-based resource. In some examples, the application hosted by the external resource server 110 is programmed in JavaScript using a software development kit (SDK) provided by the messaging server 118. The SDK includes an API with functions that can be called or activated by a web-based application. In some examples, the messaging server 118 includes a JavaScript library that provides access to certain user data of the messaging client 104 to a given third-party resource. HTML5 is used as an example technology for programming games, but applications and resources programmed based on other technologies can be used.

[0050] In order to integrate the functionality of the SDK into a web-based resource, the SDK is downloaded from the messaging server 118 by the external resource (application) server 110 or received in other ways by the external resource (application) server 110. Once downloaded or received, the SDK is included as part of the application code of the web-based external resource. The code of the web-based resource can then call or activate certain functions of the SDK to integrate the features of the messaging client 104 into the web-based resource.

[0051] The SDK stored on the messaging server 118 effectively provides a bridge between external resources (e.g., third-party or external applications 109 or applets) and the messaging client 104. This provides users with a seamless experience of communicating with other users on the messaging client 104 while retaining the look and feel of the messaging client 104. In order to bridge the communication between the external resources and the messaging client 104, in some examples, the SDK facilitates the communication between the external resource server 110 and the messaging client 104. In some examples, the WebViewJavaScriptBridge running on the client device 102 establishes two one-way communication channels between the external resources and the messaging client 104. Messages are sent asynchronously between the external resources and the messaging client 104 via these communication channels. Each SDK function call is sent as a message and a callback. Each SDK function is implemented by constructing a unique callback identifier and sending a message with the callback identifier.

[0052] By using the SDK, not all information from the messaging client 104 is shared with the external resource server 110. The SDK limits which information is shared based on the needs of the external resource. In some examples, each external resource server 110 provides an HTML5 file corresponding to a web-based external resource to the messaging server 118. The messaging server 118 can add a visual representation (e.g., a block diagram or other graphic) of the web-based external resource in the messaging client 104. Once the user selects the visual representation or instructs the messaging client 104 to access the features of the web-based external resource through the graphical user interface (GUI) of the messaging client 104, the messaging client 104 obtains the HTML5 file and instantiates the resources required to access the features of the web-based external resource.

[0053] The messaging client 104 presents a GUI (e.g., a login page or title screen) for the external resource. During, before, or after presenting the login page or title screen, the messaging client 104 determines whether the launched external resource has been previously authorized to access the user data of the messaging client 104. In response to determining that the launched external resource has been previously authorized to access the user data of the messaging client 104, the messaging client 104 presents another GUI of the external resource, which includes the functions and features of the external resource. In response to determining that the launched external resource has not been previously authorized to access the user data of the messaging client 104, after a threshold time period (e.g., 3 seconds) of displaying the login page or title screen of the external resource, the messaging client 104 slides a menu for authorizing the external resource to access the user data (e.g., animating the menu to emerge from the bottom of the screen to the middle of the screen or other parts of the screen). The menu identifies the type of user data that the external resource will be authorized to use. In response to receiving a user selection of the accept option, the messaging client 104 adds the external resource to the list of authorized external resources and allows the external resource to access the user data from the messaging client 104. In some examples, external resources are authorized to access user data by messaging client 104 according to the OAuth 2 framework.

[0054] The messaging client 104 controls the type of user data shared with the external resource based on the type of external resource that is authorized. For example, access to a first type of user data (e.g., only a two-dimensional (2D) avatar of a user with or without different avatar characteristics) is provided to an external resource including a full-scale external application (e.g., a third party or external application 109). As another example, access to a second type of user data (e.g., payment information, a 2D avatar of a user, a three-dimensional (3D) avatar of a user, and an avatar with various avatar characteristics) is provided to an external resource including a small-scale version of an external application (e.g., a web-based version of a third-party application). Avatar characteristics include different ways to customize the look and feel of an avatar (e.g., different poses, facial features, clothing, etc.).

[0055] The key management system 224 can be used to protect and ensure the security of any data used by the messaging client 104 and / or the application server 114. In particular, the key management system 224 allows two services that operate on certain user data to perform corresponding functions in a mutually exclusive manner. That is, the key management system 224 allows the first service to use the first encryption key to perform the first function on the data set. When the first service is operating on the data set, the second service is prevented from performing the second function on the data set. In some examples, in order to prevent the second service from performing the second function, the key management system 224 prohibits the second service from being able to access the second encryption key required to decrypt the data set. For example, the second service can periodically monitor the file to detect the existence or existence of the second encryption key. As long as the second encryption key is not stored in the file, the second service is prevented from performing its function on the data. After a threshold time period (e.g., configured and / or defined by the first service and / or the second service), the first service is prevented from using the first encryption key (in a similar manner, by deleting the first encryption key from the storage in the temporary file), and the second service is enabled to perform the second function by storing the second encryption key in a certain file. In some cases, the threshold time period is set based on the amount of time it takes for the first service and / or the second service to complete executing the corresponding encryption process. In some examples, the threshold time period represents the amount of time it takes for the key management system 224 to successfully decrypt one of the keys (e.g., the second encryption key while the first service is performing a function using the decrypted first encryption key) according to the time-lock encryption technique.

[0056] The examples discussed herein relate to a key management system 224 that allows two services to operate on data in a mutually exclusive manner. Similar processes and operations can be extended to allow more than two services to operate on data in a mutually exclusive manner, where encryption / decryption and / or deletion of encryption keys are performed according to certain defined time intervals.

[0057] In this way, data security is maintained by ensuring that both sets of encryption keys are not stored by the same server or key management system 224 at any point in time. Therefore, if one of the keys is compromised, the data will still be protected by the other of the keys.

[0058] Data Architecture

[0059] Figure 3 is a schematic diagram illustrating a data structure 300 that may be stored in a database 126 of a messaging server system 108 according to some examples. Although the contents of the database 126 are illustrated as including a number of tables, it should be appreciated that data may be stored in other types of data structures (e.g., as an object-oriented database).

[0060] The database 126 includes message data stored in the message table 302. For any particular message, the message data includes at least message sender data, message recipient (or receiver) data, and payload. Figure 4 Additional details regarding information that may be included in a message and included within the message data stored in message table 302 are described.

[0061] The entity table 306 stores entity data and is linked (e.g., by reference) to the entity graph 308 and profile data 316. The entities whose records are maintained within the entity table 306 may include individuals, corporate entities, organizations, objects, places, events, etc. Regardless of the entity type, any entity about which the messaging server system 108 stores data may be an identified entity. Each entity is provided with a unique identifier as well as an entity type identifier (not shown).

[0062] The entity graph 308 stores information about relationships and associations between entities. By way of example only, such relationships may be social, professional (e.g., working in a common company or organization), interest-based, or activity-based.

[0063] Profile data 316 stores multiple types of profile data about a particular entity. Based on the privacy settings specified by the particular entity, profile data 316 can be selectively used and presented to other users of the messaging system 100. In the case where the entity is a person, profile data 316 includes, for example, a user name, phone number, address, and settings (e.g., notification and privacy settings) as well as an avatar representation (or a collection of such avatar representations) selected by the user. A particular user can then selectively include one or more of these avatar representations within the content of messages transmitted via the messaging system 100 and on a map interface displayed to other users by the messaging client 104. A collection of avatar representations can include a "status avatar" that presents a graphical representation of a status or activity that a user may choose to convey at a particular time.

[0064] Where the entity is a group, profile data 316 for the group may similarly include one or more avatar representations associated with the group, in addition to the group name, members, and various settings for the relevant group (eg, notifications).

[0065] The database 126 also stores enhancement data, such as overlays or filters, in an enhancement table 310. The enhancement data is associated with and applied to videos (data for videos is stored in the video table 304) and images (data for images is stored in the image table 312).

[0066] The database 126 may also store data related to individual and shared AR sessions. The data may include data transmitted between an AR session client controller of a first client device 102 and another AR session client controller of a second client device 102, and data transmitted between an AR session client controller and an augmented system 208. The data may include data used to establish a common coordinate system for a shared AR scene, transformations between devices, session identifiers, data depicting the body, skeletal joint positioning, wrist joint positioning, images of feet, and the like.

[0067] In one example, a filter is displayed as an overlay over an image or video during presentation to a recipient user. The filter can be of various types, including a user-selected filter from a set of filters presented to a sending user by the messaging client 104 when the sending user is composing a message. Other types of filters include geolocation filters (also referred to as geofilters), which can be presented to a sending user based on geographic location. For example, the messaging client 104 can present a geolocation filter specific to a nearby or specific location within a user interface based on geographic location information determined by a global positioning system (GPS) unit of the client device 102.

[0068] Another type of filter is a data filter that can be selectively presented to the sending user by the messaging client 104 based on other input or information collected during the message creation process by the client device 102. Examples of data filters include the current temperature at a particular location, the current speed the sending user is traveling, the battery life of the client device 102, or the current time.

[0069] Other augmented data that may be stored in the image table 312 include AR content items (eg, corresponding to an applied AR experience). AR content items or AR items may be real-time special effects and sounds that may be added to an image or video.

[0070] As described above, augmented data includes AR content items, overlays, image transformations, AR images, AR logos or badges, and similar items involving modifications that can be applied to image data (e.g., videos or images). This includes real-time modifications that modify the image when it is captured using the device sensor (e.g., one or more cameras) of the client device 102 and then displaying the image with the modifications on the screen of the client device 102. This also includes modifications to stored content (e.g., video clips in a gallery that can be modified). For example, in a client device 102 that has access to multiple AR content items, a user can use a single video clip with multiple AR content items to see how different AR content items will modify the stored clips. For example, by selecting different AR content items for the content, multiple AR content items that apply different pseudo-random movement models can be applied to the same content. Similarly, real-time video capture can be used with the modifications shown to show how the video image currently captured by the sensor of the client device 102 will modify the captured data. Such data may be displayed only on the screen and not stored in memory, or content captured by the device sensors may be recorded and stored in memory with or without modification (or both). In some systems, a preview feature may simultaneously show how different AR content items will look in different windows in the display. This may, for example, enable viewing of multiple windows with different pseudo-random animations on the display at the same time.

[0071] Thus, data and various systems using AR content items or other such transformation systems using the data to modify content may involve: detection of objects (e.g., faces, hands, bodies, cats, dogs, surfaces, objects, etc.) in video frames; tracking such objects as they leave, enter, and move around the field of view; and modifying or transforming such objects as they are tracked. In various examples, different methods for implementing such transformations may be used. Some examples may involve: generating a 3D mesh model of one or more objects, and using transformations and animated textures of the models within a video to implement the transformations. In other examples, tracking of points on an object may be used to place an image or texture (which may be 2D or 3D) at a tracked location. In yet another example, a neural network analysis of a video frame may be used to place an image, model, or texture in content (e.g., a frame of an image or video). Thus, an AR content item refers to both images, models, and textures used to create transformations in content, as well as additional modeling and analysis information required to implement such transformations using object detection, tracking, and placement.

[0072] Real-time video processing can be performed using any type of video data (e.g., video streams, video files, etc.) stored in the memory of any type of computerized system. For example, a user can load a video file and save it in the memory of the device, or a sensor of the device can be used to generate a video stream. In addition, computer animation models can be used to process any object, such as human faces and body parts, animals, or inanimate objects (e.g., chairs, cars, or other objects).

[0073] In some examples, when a specific modification is selected together with the content to be transformed, the elements to be transformed are identified by a computing device, and then if the elements are present in the frame of the video, they are detected and tracked. The elements of the object are modified according to the modification request, thereby transforming the frame of the video stream. For different types of transformations, the transformation of the frame of the video stream can be performed by different methods. For example, for the transformation of the frame that mainly involves changing the form of the elements of the object, the characteristic points of each element of the object are calculated (for example, using an active shape model (ASM) or other known methods). Then, a grid based on the characteristic points is generated for each element of at least one element of the object. The grid is used for the subsequent stage of tracking the elements of the object in the video stream. During the tracking process, the grid mentioned for each element is aligned with the positioning of each element. Then, additional points are generated on the grid. A first group of first points is generated for each element based on the modification request, and a group of second points is generated for each element based on the group of first points and the modification request. Then, the frame of the video stream can be transformed by modifying the elements of the object based on the group of first points, the group of second points and the grid. In such an approach, the background of the modified object may also be changed or distorted by tracking and modifying the background.

[0074] In some examples, a transformation that changes some areas of an object using elements of an object can be performed by calculating characteristic points of each element of the object and generating a grid based on the calculated characteristic points. Points are generated on the grid, and then various areas are generated based on the points. The elements of the object are then tracked by aligning the area for each element with the positioning for each element of at least one element, and the properties of the area can be modified based on the modification request, thereby transforming the frame of the video stream. Depending on the specific modification request, the properties of the mentioned area can be transformed in different ways. Such modifications may involve: changing the color of the area; removing at least some parts of the area from the frame of the video stream; including one or more new objects into the area based on the modification request; and modifying or distorting the elements of the area or object. In various examples, any combination of such modifications or other similar modifications may be used. For certain models to be animated, some characteristic points may be selected as control points for the entire state space to be used to determine options for model animation.

[0075] In some examples of computer animation models for transforming image data using face detection, faces are detected on images using a specific face detection algorithm (e.g., Viola-Jones). The ASM algorithm is then applied to the face region of the image to detect facial feature reference points.

[0076] Other methods and algorithms suitable for face detection can be used. For example, in some examples, landmarks are used to locate features, and the landmarks represent distinguishable points that are present in most of the images considered. For example, for facial landmarks, the location of the left pupil can be used. If the initial landmarks are not identifiable (for example, when a person wears an eye patch), secondary landmarks can be used. Such a landmark identification process can be used for any such object. In some examples, a set of landmarks forms a shape. The coordinates of the points in the shape can be used to represent the shape as a vector. A similarity transformation (which allows translation, scaling, and rotation) that minimizes the average Euclidean distance between the shape points is used to align one shape with another shape. The mean shape is the average value of the aligned training shapes.

[0077] In some examples, the landmark search begins with an average shape that aligns with the location and size of the face as determined by a global face detector. Such a search then repeats the steps of proposing tentative shapes by template matching the image texture around each point to adjust the position of the shape points, and then conforming the tentative shapes to the global shape model until convergence occurs. In some systems, template matching alone is unreliable, and the shape model pools the results of weak template matches to form a stronger overall classifier. The entire search is repeated at each level in the image pyramid, from coarse to fine resolution.

[0078] The transformation system can capture an image or video stream on a client device (e.g., client device 102) and perform complex image manipulations locally on the client device 102 while maintaining an appropriate user experience, computation time, and power consumption. Complex image manipulations can include size and shape changes, emotion transitions (e.g., changing a face from a frown to a smile), state transitions (e.g., aging a subject, reducing apparent age, changing gender), style transitions, application of graphical elements, and any other suitable image or video manipulations enabled by a convolutional neural network that has been configured to execute efficiently on the client device 102.

[0079] In some examples, a computer animation model for transforming image data can be used by a system in which a user can capture an image or video stream of the user (e.g., a selfie) using a client device 102 having a neural network, where the neural network operates as part of a messaging client 104 operating on the client device 102. A transformation system operating within the messaging client 104 determines the presence of a face within the image or video stream and provides a modification icon associated with the computer animation model for transforming the image data, or the computer animation model can exist in association with an interface described herein. The modification icon includes the following changes, which can be the basis for modifying the user's face within the image or video stream as part of the modification operation. Once the modification icon is selected, the transformation system initiates a process of transforming the user's image to reflect the selected modification icon (e.g., generating a smiling face for the user). Once the image or video stream is captured and the specified modification is selected, the modified image or video stream can be presented in a GUI displayed on the client device 102. The transformation system can implement a complex convolutional neural network on a portion of the image or video stream to generate and apply the selected modification. That is, a user can capture an image or video stream, and once a modification icon is selected, the modified result can be presented to the user in real time or near real time. In addition, the modification can be persistent while the video stream is being captured and the selected modification icon remains toggled. A machine-learned neural network can be used to implement such modification.

[0080] The GUI presenting the modifications performed by the transformation system can provide additional interactive options to the user. Such options can be based on the interface for initiating the selection of a particular computer animation model and content capture (e.g., initiated from a content creator user interface). In various examples, the modification can be persistent after the modification icon is initially selected. The user can switch the modification on or off by tapping or otherwise selecting the face being modified by the transformation system, and store it for later viewing or browsing to other areas of the imaging application. In the case where multiple faces are modified by the transformation system, the user can globally switch the modification on or off by tapping or selecting a single face modified and displayed in the GUI. In some examples, each face in a group of multiple faces can be modified individually, or such modifications can be switched individually by tapping or selecting a single face or a series of single faces displayed in the GUI.

[0081] The story table 314 stores data related to a collection of messages and associated images, videos, or audio data that are compiled into a collection (e.g., a story or gallery). The creation of a particular collection can be initiated by a particular user (e.g., each user whose record is maintained in the entity table 306). A user can create a "personal story" in the form of a collection of content that has been created and sent / broadcasted by the user. To this end, the user interface of the messaging client 104 may include a user-selectable icon to enable the sending user to add specific content to his or her personal story.

[0082] A collection may also constitute a "live story," which is a collection of content from multiple users created manually, automatically, or using a combination of manual and automatic techniques. For example, a "live story" may constitute a curated stream of user-submitted content from various locations and events. Users whose client devices have location services enabled and who are at a common location event at a particular time may be presented with the option of contributing content to a particular live story, for example, via the user interface of the messaging client 104. Live stories may be identified to the user by the messaging client 104 based on his or her location. The end result is a "live story" told from a community perspective.

[0083] Another type of content collection is called a "location story," which enables users whose client devices 102 are located in a particular geographic location (e.g., on a college or university campus) to contribute to a particular collection. In some examples, contributions to location stories may require secondary authentication to verify that the end user belongs to a particular organization or other entity (e.g., is a student on a university campus).

[0084] As mentioned above, the video table 304 stores video data, which in one example is associated with a message whose record is maintained within the message table 302. Similarly, the image table 312 stores image data associated with a message whose message data is stored in the entity table 306. The entity table 306 can associate various enhancements from the enhancement table 310 with the various images and videos stored in the image table 312 and the video table 304.

[0085] Data communication architecture

[0086] Figure 4is a schematic diagram illustrating the structure of a message 400 according to some examples, the message 400 being generated by a messaging client 104 for transmission to another messaging client 104 or a messaging server 118. The content of a particular message 400 is used to populate a message table 302 stored in a database 126 and accessible by a messaging server 118. Similarly, the content of the message 400 is stored in memory as "in-transit" or "in-flight" data of a client device 102 or application server 114. The message 400 is shown to include the following example components:

[0087] ●Message identifier 402: a unique identifier that identifies the message 400.

[0088] • Message text payload 404 : Text to be generated by a user via the user interface of the client device 102 and included in the message 400 .

[0089] • Message image payload 406 : Image data captured by a camera component of the client device 102 or retrieved from a memory component of the client device 102 and included in the message 400 . The image data for a sent or received message 400 may be stored in the image table 312 .

[0090] • Message video payload 408 : Video data captured by the camera component or retrieved from the memory component of the client device 102 and included in the message 400 . The video data for a message 400 that has been sent or received may be stored in the video table 304 .

[0091] • Message audio payload 410 : audio data captured by a microphone or retrieved from a memory component of the client device 102 and included in the message 400 .

[0092] Message enhancement data 412: Enhancement data (e.g., filters, stickers, or other annotations or enhancements) representing enhancements to be applied to the message image payload 406, message video payload 408, or message audio payload 410 of the message 400. The enhancement data for a sent or received message 400 may be stored in the enhancement table 310.

[0093] ●Message duration parameter 414: A parameter value indicating the amount of time in seconds that the content of the message (e.g., message image payload 406, message video payload 408, message audio payload 410) will be presented to the user via the messaging client 104 or made accessible to the user.

[0094] Message geolocation parameters 416: Geolocation data (e.g., latitude and longitude coordinates) associated with the content payload of the message. Multiple message geolocation parameter 416 values ​​may be included in the payload, each of which is associated with a content item included in the content (e.g., a specific image within a message image payload 406, or a specific video within a message video payload 408).

[0095] Message story identifier 418: An identifier value that identifies one or more content collections (e.g., a "story" identified in stories table 314) associated with a particular content item in message image payload 406 of message 400. For example, an identifier value may be used to associate multiple images within message image payload 406 with each of multiple content collections.

[0096] Message tags 420: Each message 400 may be tagged with a plurality of tags, each of which indicates the subject of the content included in the message payload. For example, where a particular image included in the message image payload 406 depicts an animal (e.g., a lion), a tag value indicating the relevant animal may be included within the message tags 420. The tag values ​​may be manually generated based on user input, or may be automatically generated using, for example, image recognition.

[0097] • Message sender identifier 422: An identifier (eg, a messaging system identifier, an email address, or a device identifier) ​​that indicates the user of the client device 102 on which the message 400 was generated and from which the message 400 was sent.

[0098] • Message recipient identifier 424: An identifier (eg, a messaging system identifier, an email address, or a device identifier) ​​that indicates the user of the client device 102 to which the message 400 is addressed.

[0099] The content (e.g., value) of each component of message 400 may be a pointer to a location in a table in which the content data value is stored. For example, the image value in message image payload 406 may be a pointer to a location in image table 312 (or the address of a location in image table 312). Similarly, the value in message video payload 408 may point to data stored in video table 304, the value stored in message enhancement data 412 may point to data stored in enhancement table 310, the value stored in message story identifier 418 may point to data stored in story table 314, and the values ​​stored in message sender identifier 422 and message recipient identifier 424 may point to user records stored in entity table 306.

[0100] Key Management System

[0101] Figure 5 is a block diagram illustrating an example key management system 500 according to some examples. The key management system 500 is an example implementation of the key management system 224 and can perform the same or different functions as the key management system 224. The key management system 500 includes a key management server 510, a first service module 520, and a second service module 530.

[0102] In some cases, the key management server 510, the first service module 520, and the second service module 530 are all implemented by the application server 114. In some cases, the key management server 510 is implemented by the application server 114, and the first service module 520 and the second service module 530 are implemented by other third-party servers. In some cases, the key management server 510 is implemented by one or more third-party servers, and the first service module 520 and the second service module 530 are implemented by the application server 114. Any other combination of implementations of the key management server 510, the first service module 520, and the second service module 530 may be provided.

[0103] In some examples, the key management system 500 stores a first encryption key associated with a first service (e.g., the first service module 520) through the key management server 510. The key management system 500 stores a second encryption key associated with a second service (e.g., the second service module 530) in encrypted form through the key management server 500. When the first service is using the first encryption key to perform a first function, the key management system 500 blocks the second service from accessing the second encryption key through the key management server 510. The key management system 500 determines through the key management server 510 that a first threshold time period associated with the first function has passed. In some examples, in response to the key management server 510 successfully decrypting the second encryption key according to the time lock encryption technique, the key management server 510 determines that the first threshold time period has passed. In response to determining that the first threshold time period associated with the first function has passed, when the second service is using the second encryption key that has been successfully decrypted according to the time lock encryption technique to perform a second function, the key management system 500 blocks the first service from accessing the first encryption key through the key management server 510. The first function may include anonymizing the PII, and the second function may include using the anonymized PII.

[0104] In some examples, the key management system 500 determines, via the key management server 510, that a second threshold time period associated with the second function has passed. In response to determining, via the key management server 510, that the second threshold time period associated with the second function has passed, the key management system 500 blocks the second service from accessing the second encryption key. In some cases, the first threshold time period and the second threshold time period are different. In some examples, in response to the key management server 510 successfully decrypting the first encryption key according to the time lock encryption technique, the key management server 510 determines that the second threshold time period has passed.

[0105] In some examples, key management system 500 receives, via key management server 510, a first communication specifying a first threshold time period from a first service (e.g., including parameters encrypted with a time lock associated with a first encryption key). Key management system 500 receives, via key management server 510, a second communication specifying a second threshold time period from a second service (e.g., including parameters encrypted with a time lock associated with a second encryption key). The first service may be implemented by a first server, and the second service may be implemented by a second server. The first server and the second server may be different from key management server 510.

[0106] In some examples, the key management system 500 decrypts the second encryption key in response to determining that a first threshold time period associated with the first function has passed. In some cases, while the first service is using the first encryption key, the key management system 500 continuously attempts to decrypt the second encryption key, but cannot successfully decrypt the second encryption key before the first threshold time period has passed according to the time lock encryption technique. Once the second encryption key is successfully decrypted, access to the second encryption key in decrypted form can be provided to the second service.

[0107] In some examples, the key management system 500 places the first encryption key in a first temporary file on the key management server 510. The key management system 500 periodically receives a request from the first service to obtain the first encryption key from the first temporary file. In response to determining that a first threshold time period associated with the first function has passed, the key management system 500 deletes the first temporary file including the first encryption key. The key management system 500 (e.g., the key management server 510) decrypts the second encryption key and generates a second temporary file including the second encryption key in decrypted form.

[0108] In some examples, key management system 500 periodically receives a request from a second service to obtain a second encryption key from a second temporary file. Key management system 500 encrypts the first encryption key before deleting the first temporary file to maintain the first encryption key in encrypted form on key management server 510.

[0109] In some examples, the key management system 500 determines that the time remaining before the first threshold time period elapses corresponds to a first delay amount (e.g., one minute or more). In such a case, in response to determining that the time remaining corresponds to the first delay amount, the key management system 500 restricts the first service from obtaining access to the first encryption key. In response to detecting that access to the first encryption key has been restricted by the key management server 510, the key management system 500 causes the first service to terminate execution of the first function.

[0110] In some examples, while the first service is performing a first function using the first encryption key, the key management system 500 periodically receives one or more communications from the second service to access a second encryption key from a specified file. In response to detecting that the second encryption key has been stored in the specified file within a specified time period controlled by an expiration time associated with the first encryption key, the second service is enabled to perform the second function.

[0111] In some examples, the key management system 500 performs an initialization operation in which a first encryption key is received in plain text from a first service and a second encryption key is received in plain text from a second service.

[0112] In some examples, the key management server 510 includes an encryption key module 512 and a key access control module 514. During a setup or initialization phase, the encryption key module 512 receives a first encryption key in plain text (unencrypted form) from the first service module 520. In some cases, the first encryption key may include multiple encryption keys that are used by multiple encryption engines implemented by the first service module 520. For example, the first service module 520 may include or perform one or more data anonymization functions, such as salting the data (using a first set of keys included in the first encryption key) and encrypting the salted data (using a second set of keys included in the first encryption key). After the first service module 520 provides the first encryption key to the encryption key module 512, the first service module 520 deletes any local version of the first encryption key. In this way, the first encryption key remains stored in only one location (e.g., stored on the key management server 510). This prevents the first service module 520 from performing one or more functions that require the use of the first encryption key without first retrieving the first encryption key from the key management server 510.

[0113] In some cases, as part of a setup or initialization phase, the encryption key module 512 receives configuration information including a first threshold time period, such as a time lock encryption parameter for a first encryption key, from the first service module 520. The first threshold time period may represent the amount of time required for the first service module 520 to complete the execution of one or more functions using the first encryption key. The first threshold time period may represent the amount of time it takes for the encryption key module 512 to decrypt a second encryption key used by the second service module 530. The encryption key module 512 may provide the first threshold time period to the key access control module 514 to control the generation and deletion of certain keys from the first temporary key file 516 and the second temporary key file 518.

[0114] During the initialization or setup phase, the encryption key module 512 receives the second encryption key in plain text (unencrypted form) from the second service module 530. In some cases, the second encryption key may include multiple encryption keys used by multiple encryption engines implemented by the second service module 530. For example, the second service module 530 may include or perform one or more functions associated with the anonymized data, such as encrypting the data. The second encryption key may include a usage token that may or may not be encrypted. The token is used to provide authorization information to the second service module 530 to perform one or more functions. After the second service module 530 provides the second encryption key to the encryption key module 512, the second service module 530 deletes any local version of the second encryption key. In this way, the second encryption key remains (in encrypted or plain text form) stored only in one location (e.g., stored on the key management server 510). This prevents the second service module 530 from performing one or more functions that require the use of the second encryption key without first retrieving the second encryption key from the key management server 510.

[0115] In some cases, as part of a setup or initialization phase, the encryption key module 512 receives configuration information including a second threshold time period from the second service module 530. The second threshold time period may be the same as or different from the first threshold time period received from the first service module 520. The second threshold time period may represent the amount of time required for the second service module 530 to complete the execution of one or more functions using the second encryption key (or a usage token included as part of the second encryption key). In some cases, the second threshold time period may represent the amount of time it takes for the encryption key module 512 to decrypt the first encryption key used by the first service module 520. The encryption key module 512 may provide the second threshold time period to the key access control module 514 to control the generation and deletion of certain keys from the first temporary key file 516 and the second temporary key file 518.

[0116] After completing the setup or initialization phase, the encryption key module 512 instructs the key access control module 514 to store the first encryption key or data associated with the first encryption key in plain text in the first temporary key file 516. The encryption key module 512 instructs the key access control module 514 to encrypt the second encryption key or data associated with the second encryption key to store the encrypted form of the second encryption key locally in the encryption key module 512. At this point, the second key file 518 remains empty and / or may include an encrypted version of the second encryption key.

[0117] The first service module 520 transmits a communication or request for obtaining the first encryption key or data representing the first encryption key to the key access control module 514. For example, the first service module 520 periodically reads the contents of the first temporary key file 516 to determine and detect the presence of the first encryption key or data representing the first encryption key. In response to detecting the first encryption key or data representing the first encryption key in the first temporary key file 516, the first service module 520 retrieves the first encryption key and begins performing one or more functions on the data stored or available to the first service module 520.

[0118] While performing one or more functions (e.g., the first function), the first service module 520 continues to poll or periodically access the first temporary key file 516 to determine whether the first encryption key or data representing the first encryption key is still stored in the temporary key file 516. In some examples, the first encryption key is associated with an expiration time (e.g., a one-minute expiration time). Once the expiration time is reached, the first service module 520 cannot perform additional operations without updating the expiration time of the first encryption key (e.g., by retrieving the first encryption key from the key access control module 514). If the first encryption key is successfully updated or can be retrieved from the key access control module 514, the first service module 520 continues to perform one or more functions on the data stored or available to the first service module 520, and also continues to update the first encryption key at the same interval associated with the expiration time (e.g., once a minute). If the first encryption key fails to be updated or cannot be retrieved from the key access control module 514, the first service module 520 continues to attempt at different periodic intervals (for example, a first attempt is made after five minutes, and if the first attempt still fails, a second attempt is made after ten minutes, and a third attempt and subsequent attempts are made every 15 minutes until the attempt is successful) to update the first encryption key or regain access to the first encryption key from the key access control module 514.

[0119] In some examples, when performing one or more functions (e.g., the first function), the key access control module 514 and / or the encryption key module 512 continuously attempts to decrypt the second encryption key according to the time lock encryption technique. The amount of time spent decrypting the second encryption key may correspond to a first threshold time period. In some examples, the key access control module 514 accesses the first threshold time period received from the first service module 520. The first threshold time period may be different from the duration of the expiration time of the first encryption key, and represents the length of time required for the first service module 520 to complete the execution of one or more functions. The key access control module 514 associates the first threshold time period with a deletion event associated with the first temporary key file 516. Specifically, once the time window before the first threshold time period is reached, the first temporary key file 516 is automatically deleted or its content is deleted. For example, the key access control module 514 sets a delay amount of, for example, 1 minute (which may represent the expiration time of the first encryption key). The key access control module 514 initializes a clock or timer to count down or count up until the first threshold time period passes or reaches the first threshold time period. The key access control module 514 monitors a clock or timer and compares the current amount of time on the clock or timer with the first threshold time period to determine the difference between the current amount of time on the clock or timer and the first threshold time period. This represents the time remaining before the first threshold time period elapses. The key access control module 514 determines whether the remaining time or the difference corresponds to the first delay amount. As another example, once the key access control module 514 and / or the encryption key module 512 successfully decrypts the second encryption key, the first temporary key file 516 is automatically deleted or its contents are deleted.

[0120] In response to determining that the remaining time or the difference corresponds to the first delay amount, the key access control module 514 encrypts the first encryption key or the data representing the first encryption key stored in the first temporary key file 516. The key access control module 514 stores the first encryption key or the data representing the first encryption key in encrypted form on the encryption key module 512. Then, the key access control module 514 deletes the first temporary key file 516 and / or removes the content stored in the first temporary key file 516. At this point, the next time the first service module 520 attempts to read the first temporary key file 516, the first service module 520 determines that the first encryption key or the data representing the first encryption key is no longer available or has expired and cannot be updated. In response, the first service module 520 interrupts or stops executing one or more functions such as the first function for the data, and / or deletes the local version of the first encryption key. In some cases, because the first encryption key required to perform one or more functions has expired and cannot be successfully updated, the first service module 520 cannot continue to perform one or more functions. This ensures that the first service module 520 cannot perform one or more functions while the second service module 530 is performing one or more functions using the second encryption key.

[0121] In some cases, the first service module 520 does not download the local version of the first encryption key stored in the first temporary key file 516. Instead, the first service module 520 continues to read and use the first encryption key stored in the first temporary key file 516 to perform one or more functions. In this way, once the first temporary key file 516 is deleted, the first service module 520 cannot read its contents, and the first service module 520 is prevented from performing one or more functions without having to delete any local version of the first encryption key on the storage device of the first service module 520.

[0122] While the first service module 520 is executing one or more functions, the second service module 530 reads or attempts to read the second temporary file 518 to determine whether the second encryption key is stored on the second temporary file 518 or is available on the second temporary file 518. As long as the second service module 530 does not detect the presence of the second encryption key in the second temporary file 518, the second service module 530 cannot and does not execute one or more functions such as the second function. The second service module 530 continues to attempt to access or read the second encryption key from the second temporary file 518 at different periodic intervals. For example, the second service module 530 performs a first attempt after one minute, and if the first attempt fails to obtain access to the second encryption key, a second attempt is performed five minutes after the first attempt. If the second attempt still fails, the second service module 530 performs a third attempt every ten minutes until the attempt successfully obtains access to the second encryption key.

[0123] In some cases, the key access control module 514 monitors a clock or timer and compares the current amount of time on the clock or timer to a first threshold time period to determine a difference between the current amount of time on the clock or timer and the first threshold time period. In response to the key access control module 514 determining that the current amount of time on the clock or timer reaches or corresponds to the first threshold time period (e.g., the first threshold time period has passed), the key access control module 514 decrypts the encrypted version of the second encryption key stored by the encryption key module 512. The key access control module 514 stores the decrypted or plaintext version of the second encryption key in the second temporary key file 518. In some examples, once the key access control module 514 successfully decrypts the second encryption key according to the time lock encryption technique, the key access control module 514 stores the decrypted or plaintext version of the second encryption key in the second temporary key file 518.

[0124] The second service module 530 transmits a communication or request for obtaining a second encryption key or data representing the second encryption key to the key access control module 514. For example, the second service module 530 periodically (e.g., at different periodic intervals until some threshold periodic intervals are reached) reads the contents of the first temporary key file 516 to determine and detect the presence of the second encryption key or data representing the second encryption key. In response to detecting the second encryption key or data representing the second encryption key in the second temporary key file 518, the second service module 530 retrieves or accesses the second encryption key and begins to perform one or more functions (e.g., the second function) on the data stored or available to the second service module 530. For example, the second service module 530 receives a data set previously processed by the first service module 520 using the first encryption key, and performs a second function on the data set using the second encryption key. The second encryption key can be associated with an expiration time (e.g., 2 minutes or 1 minute). Each time the expiration time is reached, the second service module 520 cannot continue to perform one or more functions without updating the expiration time of the second encryption key. Specifically, while executing one or more functions (e.g., the first function), the second service module 530 continues to poll or periodically access the second temporary key file 518 (e.g., once every minute or every two minutes based on when the second encryption key expires) to determine whether the second encryption key or data representing the second encryption key is still stored in the second temporary key file 518, and to update the expiration time of the key for another one or two minutes.

[0125] In some examples, when performing one or more functions (e.g., the first function), the key access control module 514 and / or the encryption key module 512 continuously attempt to decrypt the first encryption key according to the time lock encryption technique. In some examples, the key access control module 514 accesses the second threshold time period received from the second service module 530. The second threshold time period may be different from the duration of the expiration time of the second encryption key, and represents the length of time required for the second service module 530 to complete the execution of one or more functions. The key access control module 514 associates the second threshold time period with the deletion event associated with the second temporary key file 518. Specifically, once the time window before the second threshold time period is reached and / or once the first encryption key is successfully decrypted according to the time lock encryption technique, the second temporary key file 518 is automatically deleted or its content is deleted. For example, the key access control module 514 sets a delay amount of, for example, 1 minute (which may be based on the expiration time of the second encryption key). The key access control module 514 initializes a clock or timer to count down or count up until the second threshold time period passes or reaches the second threshold time period. The key access control module 514 monitors a clock or timer and compares the current amount of time on the clock or timer with a second threshold time period to determine the difference between the current amount of time on the clock or timer and the second threshold time period. This represents the time remaining before the second threshold time period passes. The key access control module 514 determines whether the remaining time or the difference corresponds to a second delay amount (which may be different from the first delay amount associated with deleting the first temporary key file 516). The delay amount (discussed above) is provided to ensure that before one of the first encryption key and the second encryption key becomes unencrypted and available for access via the corresponding temporary key file, the other of the first encryption key and the second encryption key expires, is encrypted and deleted. This ensures that only one of the first service module 520 and the second service module 530 performs the corresponding function at a certain time.

[0126] In response to determining that the remaining time or the difference corresponds to the second delay amount, the key access control module 514 encrypts the second encryption key or the data representing the second encryption key stored in the second temporary key file 518. The key access control module 514 stores the second encryption key or the data representing the second encryption key in encrypted form on the encryption key module 512. Then, the key access control module 514 deletes the second temporary key file 518 and / or removes the content stored in the second temporary key file 518. At this point, the next time the second service module 530 attempts to read the second temporary key file 518, the second service module 530 determines that the second encryption key or the data representing the second encryption key is no longer available. In response, the second service module 530 interrupts or stops executing one or more functions such as the second function for the data, and deletes the local version of the second encryption key. In some cases, because the second encryption key required to perform one or more functions has expired and cannot be successfully updated, the second service module 530 cannot continue to perform one or more functions. This ensures that the second service module 530 cannot perform one or more functions while the first service module 520 is performing one or more functions using the first encryption key.

[0127] Figure 6 is a flow chart of a process 600 performed by a key management system 500 according to some examples. Although the flow chart may describe the operations as a sequential process, many of the operations may be performed in parallel or simultaneously. In addition, the order of the operations may be rearranged. When the operations of the process are completed, the process is terminated. A process may correspond to a method, a process, etc. The steps of a method may be performed in whole or in part, may be performed in combination with some or all of the steps in other methods, and may be performed by any number of different systems or any part thereof (such as a processor included in any of the systems).

[0128] At operation 601 , the key management server 510 stores a first encryption key in a first temporary file, as discussed above.

[0129] At operation 602, the key management server 510 receives a request from the first service module 520 to access a first encryption key from a first temporary file, as discussed above.

[0130] At operation 603, the key management server 510 determines whether the first threshold time period has elapsed. In response to determining that the first threshold time period has elapsed, the process proceeds to operation 604. Otherwise, the process proceeds to operation 602, as discussed above.

[0131] At operation 604 , the key management server 510 deletes the first temporary file to prevent the first service module 520 from performing the first function, as discussed above.

[0132] At operation 605 , the key management server 510 generates a second temporary file including a second encryption key, as discussed above.

[0133] At operation 606, the key management server 510 receives a request for accessing a second encryption key from a second temporary file by the second service module 530, as discussed above.

[0134] At operation 607, the key management server 510 determines whether the second threshold time period has elapsed. In response to determining that the second threshold time period has elapsed, the process proceeds to operation 608. Otherwise, the process proceeds to operation 606, as discussed above.

[0135] At operation 608 , the key management server 510 (eg, the key management server 510 ) deletes the second temporary file to prevent the second service module 530 from performing the second function, as discussed above.

[0136] Figure 7 700 is a flow chart of a process 700 performed by the key management system 224 according to some examples. Although the flow chart may describe the operations as a sequential process, many of the operations may be performed in parallel or simultaneously. In addition, the order of the operations may be rearranged. When the operations of the process are completed, the process is terminated. A process may correspond to a method, a process, etc. The steps of a method may be performed in whole or in part, may be performed in combination with some or all of the steps in other methods, and may be performed by any number of different systems or any portion thereof (such as a processor included in any of the systems).

[0137] At operation 701 , the key management system 224 (eg, the client device 102 or a server) stores a first encryption key associated with a first service, as discussed above.

[0138] At operation 702, the key management system 224 stores a second encryption key associated with a second service in encrypted form, as discussed above.

[0139] At operation 703, while the first service is performing a first function using the first encryption key, the key management system 224 blocks the second service from accessing the second encryption key, as discussed above.

[0140] At operation 704 , the key management system 224 determines that a first threshold time period associated with the first function has elapsed, as discussed above.

[0141] At operation 705 , in response to determining that a first threshold time period associated with the first function has passed, the key management system 224 blocks the first service from accessing the first encryption key while the second service is performing the second function using the second encryption key, as discussed above.

[0142] Machine Architecture

[0143] Figure 8 800 within which instructions 808 (e.g., software, programs, applications, applet, app, or other executable code) may be executed for causing the machine 800 to perform any one or more of the methods discussed herein. For example, the instructions 808 may cause the machine 800 to perform any one or more of the methods described herein. The instructions 808 transform a general-purpose, unprogrammed machine 800 into a specific machine 800 that is programmed to perform the functions described and illustrated in the manner described. The machine 800 may operate as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the machine 800 may operate as a server machine or a client machine in a server-client network environment or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 800 may include, but is not limited to, a server computer, a client computer, a PC, a tablet computer, a laptop computer, a netbook, an STB, a PDA, an entertainment media system, a cellular phone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web appliance, a network router, a network switch, a network bridge, or any machine capable of sequentially or otherwise executing instructions 808 specifying actions to be taken by the machine 800. In addition, although only a single machine 800 is shown, the term "machine" should also be construed to include a collection of machines that individually or jointly execute instructions 808 to perform any one or more of the methods discussed herein. For example, the machine 800 may include a client device 102 or any of a number of server devices that form part of the messaging server system 108. In some examples, the machine 800 may also include both a client system and a server system, wherein certain operations of a particular method or algorithm are performed on the server side and certain operations of the particular method or algorithm are performed on the client side.

[0144] The machine 800 may include a processor 802, a memory 804, and an input / output (I / O) component 838 that may be configured to communicate with each other via a bus 840. In an example, the processor 802 (e.g., a CPU, a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a GPU, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 806 that executes instructions 808 and a processor 810. The term "processor" is intended to include multi-core processors, which may include two or more independent processors (sometimes referred to as "cores") that may execute instructions simultaneously. Although Figure 8 Multiple processors 802 are shown, but machine 800 may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0145] The memory 804 includes a main memory 812, a static memory 814, and a storage unit 816, which are all accessible by the processor 802 via the bus 840. The main memory 804, the static memory 814, and the storage unit 816 store instructions 808 that embody any one or more of the methods or functions described herein. The instructions 808 may also reside, completely or partially, within the main memory 812, within the static memory 814, within the machine-readable medium 818 within the storage unit 816, within at least one of the processors 802 (e.g., within a cache memory of a processor), or within any suitable combination thereof during execution thereof by the machine 800.

[0146] The I / O components 838 may include various components for receiving input, providing output, generating output, sending information, exchanging information, capturing measurements, etc. The specific I / O components 838 included in a particular machine will depend on the type of machine. For example, a portable machine such as a mobile phone may include a touch input device or other such input mechanism, while a headless server machine will most likely not include such a touch input device. It should be appreciated that the I / O components 838 may include Figure 8820 , and the like. In various examples, the I / O components 838 may include a user output component 824 and a user input component 826. The user output component 824 may include a visual component (e.g., a display such as a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT)), an acoustic component (e.g., a speaker), a tactile component (e.g., a vibration motor, a resistance mechanism), other signal generators, etc. The user input component 826 may include an alphanumeric input component (e.g., a keyboard, a touch screen configured to receive alphanumeric input, an optical keyboard, or other alphanumeric input component), a point-based input component (e.g., a mouse, a touch pad, a trackball, a joystick, a motion sensor, or other pointing instrument), a tactile input component (e.g., a physical button, a touch screen or other tactile input component that provides the location and force of a touch or touch gesture), an audio input component (e.g., a microphone), etc.

[0147] In other examples, the I / O component 838 may include a biometric component 828, a motion component 830, an environmental component 832, or a positioning component 834, as well as various other components. For example, the biometric component 828 includes components for detecting expressions (e.g., hand expressions, facial expressions, voice expressions, body postures, or eye tracking), measuring biosignals (e.g., blood pressure, heart rate, body temperature, sweating, or brain waves), identifying people (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition), etc. The motion component 830 includes an acceleration sensor component (e.g., an accelerometer), a gravity sensor component, and a rotation sensor component (e.g., a gyroscope).

[0148] Environmental components 832 include, for example, one or more cameras (with still image / photo and video capabilities), lighting sensor components (e.g., a photometer), temperature sensor components (e.g., one or more thermometers that detect ambient temperature), humidity sensor components, pressure sensor components (e.g., a barometer), acoustic sensor components (e.g., one or more microphones that detect background noise), proximity sensor components (e.g., an infrared sensor that detects nearby objects), gas sensors (e.g., a gas detection sensor that detects concentrations of hazardous gases for safety or measures pollutants in the atmosphere), or other components that can provide indications, measurements, or signals corresponding to the surrounding physical environment.

[0149] With respect to cameras, client device 102 may have a camera system including, for example, a front-facing camera on a front surface of client device 102 and a rear-facing camera on a rear surface of client device 102. The front-facing camera may, for example, be used to capture still images and videos of a user of client device 102 (e.g., “selfies”), which may then be enhanced with the enhancement data (e.g., filters) described above. For example, the rear-facing camera may be used to capture still images and videos in a more conventional camera mode, where the images are similarly enhanced with the enhancement data. In addition to the front-facing camera and the rear-facing camera, client device 102 may also include a 360° camera for capturing 360° photos and videos.

[0150] Additionally, the camera system of the client device 102 may include dual rear cameras (e.g., a main camera and a depth sensing camera), or even triple, quad, or quintuple rear camera configurations on the front and back sides of the client device 102. For example, these multiple camera systems may include a wide-angle camera, an ultra-wide-angle camera, a telephoto camera, a macro camera, and a depth sensor.

[0151] The positioning component 834 may include a position sensor component (e.g., a GPS receiver component), an altitude sensor component (e.g., an altimeter or barometer that detects air pressure, based on which the altitude can be obtained), an orientation sensor component (e.g., a magnetometer), and the like.

[0152] A variety of technologies can be used to achieve communication. The I / O component 838 also includes a communication component 836 that can operate to couple the machine 800 to the network 820 or device 822 via a corresponding coupling or connection. For example, the communication component 836 may include a network interface component or other suitable device for interfacing with the network 820. In other examples, the communication component 836 may include a wired communication component, a wireless communication component, a cellular communication component, a near field communication (NFC) component, Parts (e.g. Low energy consumption), Device 822 may be another machine or any of a variety of peripheral devices (eg, a peripheral device coupled via USB).

[0153] In addition, the communication component 836 can detect the identifier or include a component operable to detect the identifier. For example, the communication component 836 can include a radio frequency identification (RFID) tag reader component, an NFC smart tag detection component, an optical reader component (e.g., an optical sensor for detecting one-dimensional bar codes such as universal product code (UPC) bar codes, multi-dimensional bar codes such as quick response (QR) codes, Aztec codes, data matrix, data symbol (Dataglyph), MaxiCode, PDF417, Ultra Code, UCC RSS-2D bar codes and other optical codes) or an acoustic detection component (e.g., a microphone for identifying a tagged audio signal). In addition, various information can be obtained via the communication component 836, such as location via Internet Protocol (IP) geolocation, ... Signal triangulation to derive location, location via detection of NFC beacon signals that can indicate a specific location, etc.

[0154] Various memories (e.g., main memory 812, static memory 814, and memory of processor 802) and storage unit 816 can store one or more sets of instructions and data structures (e.g., software) implemented or used by any one or more of the methods or functions described herein. When executed by processor 802, these instructions (e.g., instructions 808) cause various operations to implement the disclosed examples.

[0155] The instructions 808 may be sent or received over the network 820 using a transmission medium via a network interface device (e.g., a network interface component included in the communication component 836) and using any of several well-known transmission protocols (e.g., HTTP). Similarly, the instructions 808 may be sent or received via a coupling (e.g., a peer-to-peer coupling) with the device 822 using a transmission medium.

[0156] Software Architecture

[0157] Fig. 9 900 is a block diagram illustrating a software architecture 904 that may be installed on any one or more of the devices described herein. The software architecture 904 is supported by hardware, such as a machine 902 including a processor 920, a memory 926, and an I / O component 938. In this example, the software architecture 904 may be conceptualized as a stack of layers, where each layer provides specific functionality. The software architecture 904 includes layers such as an operating system 912, a library 910, a framework 908, and an application 906. In operation, the application 906 invokes an API call 950 through the software stack and receives a message 952 in response to the API call 950.

[0158] The operating system 912 manages hardware resources and provides public services. The operating system 912 includes, for example, a kernel 914, a service 916, and a driver 922. The kernel 914 serves as an abstraction layer between the hardware and other software layers. For example, the kernel 914 provides functions such as memory management, processor management (e.g., scheduling), component management, networking, and security settings. The service 916 can provide other public services for other software layers. The driver 922 is responsible for controlling the underlying hardware or interfacing with the underlying hardware. For example, the driver 922 may include a display driver, a camera driver, or Low-power drivers, Flash drivers, Serial communication drivers (e.g., USB drivers), Drivers, audio drivers, power management drivers, etc.

[0159] The library 910 provides a common low-level infrastructure used by the application 906. The library 910 may include a system library 918 (e.g., a C standard library) that provides functions such as memory allocation functions, string manipulation functions, mathematical functions, etc. In addition, the library 910 may include an API library 924, such as a media library (e.g., a library for supporting the presentation and manipulation of various media formats, such as Moving Picture Experts Group-4 (MPEG4), Advanced Video Coding (H.264 or AVC), Moving Picture Experts Group Layer-3 (MP3), Advanced Audio Coding (AAC), Adaptive Multi-Rate (AMR) audio codec, Joint Photographic Experts Group (JPEG or JPG), or Portable Network Graphics (PNG)), a graphics library (e.g., an OpenGL framework for rendering in 2D and 3D in graphics content on a display), a database library (e.g., SQLite providing various relational database functions), a web library (e.g., WebKit providing web browsing functions), etc. The library 910 may also include various other libraries 928 to provide many other APIs to the application 906.

[0160] The framework 908 provides a common high-level infrastructure used by the applications 906. For example, the framework 908 provides various GUI functions, high-level resource management, and high-level location services. The framework 908 can provide a wide range of other APIs that can be used by the applications 906, some of which can be specific to a particular operating system or platform.

[0161] In an example, applications 906 may include a home application 936, a contacts application 930, a browser application 932, a book reader application 934, a location application 942, a media application 944, a messaging application 946, a game application 948, and a variety of other applications such as external applications 940. Application 906 is a program that executes the functions defined in the program. Various programming languages ​​can be used to create one or more of the applications 906 constructed in various ways, such as an object-oriented programming language (e.g., Objective-C, Java, or C++) or a procedural programming language (e.g., C or assembly language). In a specific example, external application 940 (e.g., an application created by an entity other than the vendor of a particular platform using ANDROID TM or IOS TM SDK developed applications) can be mobile operating systems such as IOS TM ANDROID TM , Phone, or another mobile operating system running on the mobile software. In this example, the external application 940 can activate the API call 950 provided by the operating system 912 to facilitate the functions described herein.

[0162] Glossary

[0163] "Carrier signal" refers to any intangible medium that can store, encode or carry instructions for execution by a machine, and includes digital or analog communications signals or other intangible media to facilitate communication of such instructions. Instructions may be sent or received over a network using a transmission medium via a network interface device.

[0164] "Client Device" refers to any machine that interfaces with a communications network to obtain resources from one or more server systems or other client devices. A client device may be, but is not limited to, a mobile phone, desktop computer, laptop computer, PDA, smart phone, tablet computer, ultrabook, netbook, laptop computer, multiprocessor system, microprocessor-based or programmable consumer electronics, game console, STB, or any other communications device that a user may use to access a network.

[0165] "Communications Network" means one or more parts of a network, which may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a part of the Internet, a part of the Public Switched Telephone Network (PSTN), a Plain Old Telephone Service (POTS) network, a cellular telephone network, a wireless network, A network, other type of network, or a combination of two or more such networks. For example, the network or a portion of the network may include a wireless network or a cellular network, and the coupling may be a code division multiple access (CDMA) connection, a global system for mobile communications (GSM) connection, or other type of cellular or wireless coupling. In this example, the coupling may implement any of various types of data transmission technologies, such as single carrier radio transmission technology (1xRTT), evolution data optimized (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rates for GSM evolution (EDGE) technology, the third generation partnership project (3GPP) including 3G, fourth generation wireless (4G) network, universal mobile telecommunications system (UMTS), high speed packet access (HSPA), world wide interoperability for microwave access (WiMAX), long term evolution (LTE) standards, other data transmission technologies defined by various standard setting organizations, other long distance protocols, or other data transmission technologies.

[0166] "Component" means a device, physical entity, or logic having boundaries defined by function or subroutine calls, branch points, APIs, or other techniques that provide partitioning or modularization of specific processing or control functions. Components can be combined with other components via their interfaces to perform a machine process. A component can be a packaged functional hardware unit designed for use with other components and is part of a program that typically performs a specific one of the related functions.

[0167] Components may constitute software components (e.g., code implemented on a machine-readable medium) or hardware components. A "hardware component" is a tangible unit that is capable of performing certain operations and that can be configured or arranged in some physical manner. In various examples, one or more computer systems (e.g., stand-alone computer systems, client computer systems, or server computer systems) or one or more hardware components of a computer system (e.g., a processor or group of processors) may be configured by software (e.g., an application or application portion) as hardware components that operate to perform certain operations described herein.

[0168] Hardware components can also be implemented mechanically, electronically, or in any suitable combination thereof. For example, a hardware component may include a dedicated circuit system or logic that is permanently configured to perform certain operations. A hardware component may be a dedicated processor, such as a field programmable gate array (FPGA) or an ASIC. A hardware component may also include a programmable logic or circuit system that is temporarily configured to perform certain operations by software. For example, a hardware component may include software executed by a general-purpose processor or other programmable processor. Once configured by such software, the hardware component becomes a specific machine (or a specific component of a machine) that is uniquely customized to perform the configured function, and is no longer a general-purpose processor. It will be recognized that it can be determined for cost and time considerations whether to implement the hardware component mechanically in a dedicated and permanently configured circuit system or in a temporarily configured (e.g., configured by software) circuit system. Therefore, the phrase "hardware component" (or "hardware-implemented component") should be understood to include a tangible entity, that is, an entity that is physically constructed, permanently configured (e.g., hardwired) or temporarily configured (e.g., programmed) to operate in some way or perform certain operations described herein.

[0169] Consider an example where hardware components are temporarily configured (e.g., programmed), without each of the hardware components being configured or instantiated at any one time. For example, where the hardware components include a general-purpose processor that is configured by software to become a special-purpose processor, the general-purpose processor can be configured as a respective different special-purpose processor (e.g., including different hardware components) at different times. The software configures one or more specific processors accordingly, for example, to constitute a specific hardware component at one time and to constitute a different hardware component at a different time.

[0170] Hardware components can provide information to other hardware components and receive information from other hardware components. Therefore, the described hardware components can be considered to be coupled in communication. In the case of multiple hardware components simultaneously, communication can be realized by signal transmission (for example, by appropriate circuits and buses) between or among two or more hardware components in the hardware components. In the example that multiple hardware components are configured or instantiated at different times, the communication between such hardware components can be realized, for example, by storing information in a memory structure to which multiple hardware components have access rights and retrieving information in the memory structure. For example, a hardware component can perform an operation and store the output of the operation in a memory device coupled in communication with it. Then, other hardware components can access the memory device at a subsequent time to retrieve the stored output and process it. The hardware component can also initiate communication with an input device or an output device, and can operate on resources (for example, a collection of information).

[0171] The various operations of the example methods described herein may be performed at least in part by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform related operations. Whether temporarily configured or permanently configured, such a processor may constitute a processor-implemented component that operates to perform one or more operations or functions described herein. As used herein, "processor-implemented components" refer to hardware components implemented using one or more processors. Similarly, the methods described herein may be implemented at least in part by a processor, wherein a specific one or more processors are examples of hardware. For example, at least some of the operations of the method may be performed by one or more processors 802 or processor-implemented components. In addition, one or more processors may also operate to support the execution of related operations in a "cloud computing" environment or as a "software as a service" (SaaS) operation. For example, at least some of the operations may be performed by a group of computers (as an example of a machine including a processor), wherein these operations may be accessed via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs). The execution of certain operations may be distributed between processors, not just residing in a single machine, but deployed across many machines. In some examples, the processor or processor-implemented components may be located in a single geographic location (e.g., in a home environment, an office environment, or a server farm). In other examples, the processor or processor-implemented components may be distributed across multiple geographic locations.

[0172] "Computer-readable storage media" refers to both machine storage media and transmission media. Thus, the term includes both storage devices / media and carrier / modulated data signals. The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" mean the same thing and may be used interchangeably in this disclosure.

[0173] "Transient message" refers to a message that is accessible for a limited duration. Transient messages can be text, images, videos, etc. The access time of a transient message can be set by the sender of the message. Alternatively, the access time can be a default setting or a setting specified by the recipient. Regardless of the setting technique, the message is transient.

[0174] "Machine storage media" refers to a single or multiple storage devices and media (e.g., centralized or distributed databases, and associated caches and servers) that store executable instructions, routines, and data. Thus, the term should be considered to include, but is not limited to, solid-state memory and optical and magnetic media, including memory internal or external to the processor. Specific examples of machine storage media, computer storage media, and device storage media include nonvolatile memory, including, for example, semiconductor memory devices, such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), FPGA, and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The terms "machine storage media," "device storage media," and "computer storage media" mean the same thing and may be used interchangeably in this disclosure. The terms "machine storage media," "computer storage media," and "device storage media" expressly exclude carrier waves, modulated data signals, and other such media, at least some of which are encompassed by the term "signal media."

[0175] “Non-transitory computer-readable storage medium” refers to tangible media capable of storing, encoding, or carrying instructions to be executed by a machine.

[0176] "Signal medium" refers to any intangible medium that is capable of storing, encoding or carrying instructions to be executed by a machine, and includes digital or analog communication signals or other intangible media that facilitate the communication of software or data. The term "signal medium" should be deemed to include any form of modulated data signals, carrier waves, etc. The term "modulated data signal" refers to a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. The terms "transmission medium" and "signal medium" refer to the same thing and may be used interchangeably in this disclosure.

[0177] Changes and modifications may be made to the disclosed examples without departing from the scope of the present disclosure. These and other changes or modifications are intended to be included within the scope of the present disclosure as expressed in the claims.

Claims

1. A method comprising: storing, by a key management server, a first encryption key associated with a first service; storing, by the key management server, in encrypted form, a second encryption key associated with a second service; When the first service is using the first encryption key to perform a first function, preventing the second service from accessing the second encryption key by the key management server; determining, by the key management server, that a first threshold time period associated with the first function has elapsed; as well as In response to determining that the first threshold time period associated with the first function has passed, the first service is blocked, by the key management server, from accessing the first encryption key while the second service is performing a second function using the second encryption key.

2. The method according to claim 1, further comprising: It is determined, by the key management server, that a second threshold time period associated with the second function has elapsed.

3. The method according to any one of claims 1 to 2, further comprising: In response to determining, by the key management server, that the second threshold time period associated with the second function has elapsed, the second service is blocked from accessing the second encryption key.

4. The method according to claim 3, wherein: The first threshold time period and the second threshold time period are different, and wherein the first threshold time period is determined according to a time lock encryption technique.

5. The method according to any one of claims 1 to 4, further comprising: receiving, by the key management server, from the first service a first communication specifying the first threshold time period; as well as A second communication is received, by the key management server, from the second service specifying the second threshold time period.

6. The method according to any one of claims 1 to 5, wherein: The first service is implemented by a first server and the second service is implemented by a second server, the first server and the second server being different from the key management server.

7. The method according to any one of claims 1 to 6, further comprising: In response to determining that the first threshold time period associated with the first function has elapsed, the second encryption key is decrypted, wherein access to the second encryption key in decrypted form is provided to the second service.

8. The method according to any one of claims 1 to 7, further comprising: placing the first encryption key in a first temporary file on the key management server; as well as A request is periodically received from the first service to obtain the first encryption key from the first temporary file.

9. The method according to claim 8, further comprising: In response to determining that the first threshold time period associated with the first function has elapsed, the first temporary file including the first encryption key is deleted.

10. The method according to any one of claims 1 to 9, further comprising: decrypting the second encryption key; as well as A second temporary file is generated that includes the second encryption key in decrypted form.

11. The method according to claim 10, further comprising: A request is periodically received from the second service to obtain the second encryption key from the second temporary file.

12. The method according to any one of claims 1 to 11, further comprising: The first encryption key is encrypted before deleting the first temporary file to maintain the first encryption key in encrypted form on the key management server.

13. The method according to any one of claims 1 to 12, further comprising: determining that a time remaining before the first threshold time period elapses corresponds to a first delay amount; as well as In response to determining that the remaining time corresponds to the first delay amount, the first service is restricted from gaining access to the first encryption key.

14. The method according to claim 13, further comprising: In response to detecting that the key management server has restricted access to the first encryption key, causing the first service to terminate performance of the first function.

15. The method according to any one of claims 1 to 14, further comprising: While the first service is performing the first function using the first encryption key, one or more communications are periodically received from the second service to access the second encryption key from a designated file, wherein, in response to detecting that the second encryption key has been stored in the designated file, the second service is enabled to perform the second function.

16. The method according to any one of claims 1 to 15, further comprising: An initialization operation is performed in which the first encryption key is received in plain text from the first service and the second encryption key is received in plain text from the second service.

17. The method according to any one of claims 1 to 16, wherein: The first function includes anonymizing personally identifiable information (PII).

18. The method according to claim 17, wherein: The second function includes using anonymized PII.

19. A system comprising: processor; as well as a memory component having stored thereon instructions which, when executed by the processor, cause the processor to perform operations comprising: storing, by a key management server, a first encryption key associated with a first service; storing, by the key management server, in encrypted form, a second encryption key associated with a second service; When the first service is using the first encryption key to perform a first function, preventing the second service from accessing the second encryption key by the key management server; determining, by the key management server, that a first threshold time period associated with the first function has elapsed; and In response to determining that the first threshold time period associated with the first function has passed, the first service is blocked, by the key management server, from accessing the first encryption key while the second service is performing a second function using the second encryption key.

20. A non-transitory computer-readable storage medium having stored thereon instructions, the instructions, when executed by a processor of a client device, causing the processor to perform operations comprising: storing, by a key management server, a first encryption key associated with a first service; storing, by the key management server, in encrypted form, a second encryption key associated with a second service; When the first service is using the first encryption key to perform a first function, preventing the second service from accessing the second encryption key by the key management server; determining, by the key management server, that a first threshold time period associated with the first function has elapsed; as well as In response to determining that the first threshold time period associated with the first function has passed, the first service is blocked, by the key management server, from accessing the first encryption key while the second service is performing a second function using the second encryption key.

Images