Secure file transfer and notification server

• US 10,372,929 B1
• Filed: 09/13/2016
• Issued: 08/06/2019
• Est. Priority Date: 10/15/2013
• Status: Active Grant

• Current Assignee: Progress Software Corporation
• Original Assignee: Progress Software Corporation
• Inventors: Hensley, John Alan, Fischer, Robert
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US15/264,200
• Time in Patent Office: 1,057 Days
• Field of Search: 713165
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system, method and computer readable medium for secure file transfer is disclosed. In one embodiment, the system encrypts a file; sends, via a secure channel, a packet to a group having one or more members, the group authorized to access the encrypted file, the packet associated with the encrypted file and including access information for the encrypted file; receives a first request for the encrypted file from a first requestor; and sends the encrypted file to the first requestor via an unsecured channel that performs caching, wherein the first requestor is able to access the encrypted file using the packet when the first requestor is a member of the group authorized to access the encrypted file and received the packet via the secure channel and unable to access the encrypted file when the first requestor is not a member of the group authorized to access the encrypted file.

Claims

1. A method comprising:

encrypting, using one or more computing devices, a file;

sending, using the one or more computing devices, via a secure channel and separate from the encrypted file, a packet to a group having one or more members, the group authorized to access the encrypted file, the packet associated with the encrypted file and including access information for the encrypted file;

receiving, using the one or more computing devices, a first request for the encrypted file from a first requestor; and

sending, using the one or more computing devices, the encrypted file to the first requestor via an unsecured channel that performs caching of the encrypted file, wherein the first requestor is able to access the encrypted file using the packet when the first requestor is a member of the group authorized to access the encrypted file and received the packet via the secure channel and wherein the first requestor is unable to access the encrypted file when the first requestor is not a member of the group authorized to access the encrypted file.

2. The method of claim 1, further comprising:

generating, before providing the packet to the group, the packet, the access information comprising identification of the encrypted file with which the packet is associated and a shared key for decrypting the encrypted file with which the packet is associated.

3. The method of claim 1, further comprising:

sending a notification of an existence of the file to the first requestor, the first requestor located behind a network separation device.

4. The method of claim 3, wherein the file is a newly created file, the method including determining that the file is newly created and, responsive to determining that the file is newly created file, automatically sending the notification of the existence of the file.

5. The method of claim 3, wherein the file is a revised version of an existing file, the method including determining that the file is revised version of an existing file and, responsive to determining that the file is the revised version of the existing file, automatically sending the notification of the existence of the file.

6. The method of claim 3, further comprising:

subsequent to sending the notification of the file, establishing the secure channel for providing the packet to the first requestor located behind the network separation device.

7. The method of claim 1, wherein a copy of the encrypted file is obtained from a cache of the unsecured channel responsive to a second request for the encrypted file, the second request occurring subsequent to the first request for the encrypted file.

8. The method of claim 1, wherein the group includes one or more of a persistent group and a file specific group.

9. The method of claim 3, wherein the network separation device is one or more of a firewall and a network address translator.

10. A system, comprising:

one or more servers executing instructions that cause the one or more servers to;

encrypt a file;

send, via a secure channel and separate from the encrypted file, a packet to a group having one or more members, the group authorized to access the encrypted file, the packet associated with the encrypted file and including access information for the encrypted file;

receive a first request for the encrypted file from a first requestor; and

send the encrypted file to the first requestor via an unsecured channel that performs caching of the encrypted file, wherein the first requestor is able to access the encrypted file using the packet when the first requestor is a member of the group authorized to access the encrypted file and received the packet via the secure channel and unable to access the encrypted file when the first requestor is not a member of the group authorized to access the encrypted file.

11. The system of claim 10, wherein the one or more servers generate the packet before providing the packet to the group, the access information comprising identification of the encrypted file with which the packet is associated and a shared key for decrypting the encrypted file with which the packet is associated.

12. The system of claim 10, wherein the one or more servers send a notification of an existence of the file to the first requestor, the first requestor located behind a network separation device.

13. The system of claim 12, wherein the file is a newly created file, the one or more servers determining that the file is newly created and, responsive to determining that the file is newly created, automatically sending the notification of the existence of the file.

14. The system of claim 12, wherein the file is a revised version of an existing file, the one or more servers determining that the file is revised version of an existing file and, responsive to determining that the file is the revised version of the existing file, automatically sending the notification of the existence of the file.

15. The system of claim 12, wherein the one or more servers establish the secure channel for providing the packet to the first requestor located behind the network separation device subsequent to sending the notification of the existence of the file.

16. The system of claim 10, including a cache of the unsecured channel for caching content sent via the unsecured channel, and wherein a copy of the encrypted file is obtained from the cache of the unsecured channel responsive to a second request of the encrypted file, the second request occurring subsequent to the first request for the encrypted file.

17. The system of claim 10, wherein the group includes one or more of a persistent group and a file specific group.

18. The system of claim 12, wherein the network separation device is one or more of a firewall and a network address translator.

19. A non-transitory computing device usable medium including instructions that when executed on a computing device causes the computing device to:

encrypt a file;

send, via a secure channel and separate from the encrypted file, a packet to a group having one or more members, the group authorized to access the encrypted file, the packet associated with the encrypted file and including access information for the encrypted file;

receive a first request for the encrypted file from a first requestor; and

send the encrypted file to the first requestor via an unsecured channel that performs caching of the encrypted file, wherein the first requestor is able to access the encrypted file using the packet when the first requestor is a member of the group authorized to access the encrypted file and received the packet via the secure channel and unable to access the encrypted file when the first requestor is not a member of the group authorized to access the encrypted file.

20. The non-transitory computing device usable medium of claim 19, wherein the first requestor is located behind a network separation device, the computing device including instructions that when executed notify the first requestor located behind the network separation device of an existence of the file, receive a packet request from the first requestor and send the packet to the first requestor responsive to receiving the packet request and a determination that the first requestor is a member of the group.