Multiply-encrypting data requiring multiple keys for decryption

• US 10,484,176 B2
• Filed: 04/10/2018
• Issued: 11/19/2019
• Est. Priority Date: 11/18/2014
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Sullivan, Nicholas Thomas
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/950,088
• Publication Number:
  US 20190116039A1
• Time in Patent Office: 588 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A server receives a piece of data for encryption. The server encrypts the piece of data such that no single key can decrypt the encrypted piece of data and any combination of a first multiple of unique keys taken a second multiple at a time are capable of decrypting the encrypted piece of data. Each of the first multiple of unique keys is tied to account credentials of a different user. The second multiple is less than or equal to the first multiple. The encrypted piece of data is returned.

Claims

1. A method executed on a server, comprising:

receiving a request to encrypt a piece of data;

encrypting the piece of data such that no single key can decrypt the encrypted piece of data and any unique combination of a first plurality of unique keys taken a first number at a time are capable of decrypting the encrypted piece of data, wherein the first number is greater than one, wherein each one of the first plurality of unique keys is tied to account credentials of a particular user of a plurality of users respectively, and wherein the first number is less than or equal to the first plurality;

returning the encrypted piece of data;

receiving, at the server, account credentials of at least a second number of the plurality of users equivalent to the first number;

receiving, at the server, a delegation submission from at least the second number of the plurality of users that allows use of the account credentials of the at least the second number of plurality of users respectively for a limited number of decryptions or a limited amount of time;

receiving a request to decrypt the encrypted piece of data;

decrypting, for each particular one of at least the second number of the plurality of users equivalent to the first number, the one of the first plurality of unique keys that correspond to that particular one of the at least the second number of the plurality of users;

decrypting the encrypted piece of data using the decrypted ones of the first plurality of unique keys; and

returning the decrypted piece of data.

2. The method of claim 1, wherein the request to encrypt the piece of data indicates the following:

the piece of data to encrypt;

a list of a plurality of users that are associated with the first plurality of unique keys; and

a minimum number of the first plurality of unique keys that are required to decrypt the data, wherein the minimum number is equal to the first number, and wherein the minimum number is at least two.

3. The method of claim 1, wherein the step of encrypting the piece of data includes:

encrypting the piece of data with a data key;

generating a unique encrypted data key for each unique combination of the first plurality of unique keys taken the first number at a time by performing the following for each unique combination;

encrypting the data key multiple times each of which using a different one of the plurality of unique keys,

wherein the multiple times is equal to the first number;

encrypting each different one of the first plurality of unique keys with the account credentials of the corresponding particular user;

returning the encrypted piece of data, each unique encrypted data key, and each encrypted different unique keys; and

discarding the piece of data and the encrypted piece of data.

4. The method of claim 3, wherein the data key is a random symmetric key.

5. An apparatus for encrypting and decrypting data, comprising:

a set of one or more processors;

a non-transitory machine-readable storage medium that stores instructions that, when executed by the set of processors, generate the following;

an encryption module that is configured to encrypt a piece of data such that no single key can decrypt the encrypted piece of data and any unique combination of a first plurality of unique keys taken a first number at a time are capable of decrypting the encrypted piece of data, wherein the first number is greater than one, wherein each particular one of the first plurality of unique keys is tied to account credentials of a particular user of a plurality of users respectively, and wherein the first number is less than or equal to the first plurality;

a decryption module that is configured to decrypt the piece of data when there is access to at least one combination of the first plurality of unique keys taken the second plurality at a time; and

a delegation module that is configured to permit each of the different users to delegate use of their account credentials respectively for decrypting data for a limited number of decryptions or for a limited amount of time.

6. The apparatus of claim 5, wherein the encryption module is configured to encrypt the piece of data through performance of the following:

encrypt the piece of data with a data key;

generate a unique encrypted data key for each unique combination of the first plurality of unique keys taken the first number at a time by performing the following for each unique combination;

encrypt the data key multiple times each of which using a different one of the first plurality of unique keys, wherein the multiple times is equal to the first number;

store each of the unique encrypted data keys; and

discard the piece of data, the encrypted piece of data, and the data key.

7. The apparatus of claim 5, wherein the non-transitory machine-readable storage medium further stores instructions that, when executed by the set of processors, generate the following:

an account creation module that is configured to;

for each of the plurality of users,

create an account,

create a key pair including a public key and a private key,

encrypt the private key using a password key derived from a password, and

cause the encrypted private key to be stored in association with the account for that user.

8. A non-transitory machine-readable storage medium that stores instructions that, when executed by a set of one or more processors of a server, cause the server to perform operations, comprising:

receiving a request to encrypt a piece of data;

encrypting the piece of data such that no single key can decrypt the encrypted piece of data and any unique combination of a first plurality of unique keys taken a first number at a time are capable of decrypting the encrypted piece of data, wherein the first number is greater than one, wherein each one of the first plurality of unique keys is tied to account credentials of a particular user of a plurality of users respectively, and wherein the first number is less than or equal to the first plurality;

returning the encrypted piece of data;

receiving, at the server, account credentials of at least a second number of the plurality of users equivalent to the first number;

receiving, at the server, a delegation submission from at least the second number of the plurality of users that allows use of the account credentials of the at least the second number of plurality of users respectively for a limited number of decryptions or a limited amount of time;

receiving a request to decrypt the encrypted piece of data;

decrypting, for each particular one of at least the second number of the plurality of users equivalent to the first number, the one of the first plurality of unique keys that correspond to that particular one of the at least the second number of the plurality of users;

decrypting the encrypted piece of data using the decrypted ones of the first plurality of unique keys; and

returning the decrypted piece of data.

9. The non-transitory machine-readable storage medium of claim 8, wherein the request to encrypt the piece of data indicates the following:

the piece of data to encrypt;

a list of a plurality of users that are associated with the first plurality of unique keys; and

a minimum number of the first plurality of unique keys that are required to decrypt the data, wherein the minimum number is equal to the first number, and wherein the minimum number is at least two.

10. The non-transitory machine-readable storage medium of claim 8, wherein the step of encrypting the piece of data includes:

encrypting the piece of data with a data key;

generating a unique encrypted data key for each unique combination of the first plurality of unique keys taken the first number at a time by performing the following for each unique combination;

encrypting the data key multiple times each of which using a different one of the plurality of unique keys, wherein the multiple times is equal to the first number;

encrypting each different one of the first plurality of unique keys with the account credentials of the corresponding particular user;

returning the encrypted piece of data, each unique encrypted data key, and each encrypted different unique keys; and

discarding the piece of data and the encrypted piece of data.

11. The non-transitory machine-readable storage medium of claim 10, wherein the data key is a random symmetric key.