Secure file transfer

• US 10,242,217 B1
• Filed: 09/26/2017
• Issued: 03/26/2019
• Est. Priority Date: 04/14/2016
• Status: Active Grant

• Current Assignee: Wickr Inc. (Amazon.com, Inc.)
• Original Assignee: Wickr Inc. (Amazon.com, Inc.)
• Inventors: Leavy, Thomas Michael, Howell, Christopher, Sugar, David A., Kasabwala, Dipakkumar R., Grzybowski, Ernest W.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/715,774
• Time in Patent Office: 546 Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 12/1827 Network arrangements for conference optimisation or adaptation
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

The present disclosure describes techniques for storing encrypted files in a secure file repository and transferring those encrypted files to one or more recipients. A user selects a file to upload to a secure file repository. A secure collaboration app on the user'"'"'s device generates a first encryption key that is used to encrypt the file. The encrypted file is then uploaded to the secure file repository, which provides the secure collaboration app with a random file name and a location of the encrypted file. The secure collaboration app updates locally stored metadata of the first encrypted file. To securely transfer the file, the user generates a second encryption key, encrypts the metadata with the second encryption key, and transmits the encrypted metadata to one or more receivers. The one or more receivers decrypt the encrypted metadata and use the decrypted metadata to retrieve the file and decrypt it.

Claims

1. A method for transmitting an encrypted file, the method comprising:

obtaining, by a first device, a first file to transmit to one or more second devices;

generating, by the first device, a first encryption;

encrypting, by the first device, the first file using the first encryption key;

transmitting, by the first device, the encrypted first file to a first server;

receiving, at the first device, a location of the encrypted first file from the first server;

generating, by the first device, a first ephemeral asymmetric key pair, wherein the first ephemeral asymmetric key pair includes a first ephemeral public key and a first ephemeral private key;

encrypting, by the first device, a plurality of information associated with the first file using a second encryption key, wherein the plurality of information includes the first encryption key and the location of the first encrypted file; and

transmitting, from the first device, a first communication to one or more second devices that includes the plurality of encrypted information, wherein a header of the first communication includes the first ephemeral public key.

2. The method of claim 1, further comprising:

encrypting, by the first device, the first second encryption key using a key-encrypting key derived, in part, from the first ephemeral private key and a second ephemeral public key.

3. The method of claim 2, further comprising:

transmitting, by the first device, the encrypted second encryption key with the first communication.

4. The method of claim 1, further comprising:

generating, by the first device, a random file name; and

assigning, by the first device, the random file name to the first file prior to transmitting the encrypted first file to the first server.

5. The method of claim 4, wherein the random file name is a universally unique identifier.

6. The method of claim 1, further comprising:

retrieving, by the first device, the encrypted first file from the first server;

decrypting, by the first device, the encrypted first file using the first encryption key; and

providing, by the first device, the decrypted first file to a user.

7. The method of claim 1, further comprising:

storing metadata associated with the encrypted first file in a secure database in the memory of the first device.

8. The method of claim 1, wherein the first encryption key is generated from a first set of pseudorandom bytes derived from one or more operations of the first device.

9. A system, comprising:

a processor configured to;

obtain a first file to transmit to one or more second devices;

generate a first encryption key,

encrypt the first file using the first encryption key;

transmit the encrypted first file to a first server;

receive a location of the encrypted first file from the first server;

generate a first ephemeral asymmetric key pair, wherein the first ephemeral asymmetric key pair includes a first ephemeral public key and a first ephemeral private key;

encrypt a plurality of information associated with the first file using a second encryption key, wherein the plurality of information includes the first encryption key and the location of the first encrypted file; and

transmit a first communication that includes the plurality of encrypted information to one or more second devices, wherein a header of the first communication includes the first ephemeral public key; and

a memory coupled to the processor and configured to provide the processor with instructions.

10. The system of claim 9, wherein the processor is further configured to:

encrypt the second encryption key using a key-encrypting key derived, in part, from the first ephemeral private key and a second ephemeral public key; and

transmit the encrypted second encryption key in the first communication.

11. The system of claim 9, wherein the processor is further configured to:

generate a random file name, wherein the random file name is a universally unique identifier; and

assign the random file name to the first file prior to transmitting the encrypted first file to the first server.

12. The system of claim 9, wherein the processor is further configured to:

retrieve the encrypted first file from the first server;

decrypt the encrypted first file using the first encryption key; and

provide the decrypted first file to a user.

13. The system of claim 9, wherein the memory stores metadata associated with the encrypted first file in a secure database.

14. A non-transitory computer-readable medium comprising instructions that when, executed by at least one processor, perform the steps of:

obtaining a first file to transmit to one or more second devices;

generating a first encryption key,

encrypting the first file using the first encryption key;

transmitting the encrypted first file to a first server;

receiving a location of the encrypted first file from the first server;

generating a first ephemeral asymmetric key pair, wherein the first ephemeral asymmetric key pair includes a first ephemeral public key and a first ephemeral private key;

encrypting a plurality of information associated with the first file using a second encryption key, wherein the plurality of information includes the first encryption key and the location of the first encrypted file; and

transmitting a first communication that includes the plurality of encrypted information to one or more second devices, wherein a header of the first communication includes the first ephemeral public key.

15. The non-transitory computer-readable medium of claim 14, further comprising instructions for:

encrypting the second encryption key using a key-encrypting key derived, in part, from the first ephemeral private key and a second ephemeral public key.

16. The non-transitory computer-readable medium of claim 15, further comprising instructions for:

transmitting the encrypted second encryption key in the first communication.

17. The non-transitory computer-readable medium of claim 14, further comprising instructions for:

generating a random file name, wherein the random file name is a universally unique identifier; and

assigning the random file name to the first file prior to transmitting the encrypted first file to the first server.

18. The non-transitory computer-readable medium of claim 14, further comprising instructions for:

retrieving the encrypted first file from the first server;

decrypting the encrypted first file using the first encryption key; and

providing the decrypted first file to a user.

19. The non-transitory computer-readable medium of claim 14, further comprising instructions for:

storing metadata associated with the encrypted first file in a secure database.