System and method for accessing secure files

• US 10,496,848 B1
• Filed: 11/27/2018
• Issued: 12/03/2019
• Est. Priority Date: 01/13/2017
• Status: Active Grant

• Current Assignee: Parallels International GmbH (Corel Holdings LP)
• Original Assignee: Parallels International GmbH (Corel Holdings LP)
• Inventors: Lyadvinsky, Maxim, Gafa, Paul, Dobrovolskiy, Nikolay, Beloussov, Serguei M.
• Primary Examiner(s): Holder, Bradley W
• Application Number:
  US16/201,148
• Time in Patent Office: 371 Days
• Field of Search: None
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A system and method is provided for accessing secure files by local client devices. An exemplary method comprises receiving an access request to access an encrypted file on a client device, in response to the access request, transmitting a decryption request to decrypt a remote processing portion of a block of the encrypted file, receiving, in response to the decryption request, the decrypted remote processing portion of the block of the encrypted file, and receiving a local decryption key and applying the local decryption key to decrypt one or more local portions of the block of the encrypted file to obtain a fully decrypted block of the encrypted file.

Claims

1. A method for secure file access comprising:

receiving, by a client device, an access request to access an encrypted file on the client device;

in response to the access request, transmitting, to a server, a decryption request to decrypt a remote processing portion of a block of the encrypted file;

receiving, by the client device, in response to the decryption request, the decrypted remote processing portion of the block of the encrypted file, and receiving a local decryption key; and

applying, by the client device, the local decryption key to decrypt one or more local portions of the block of the encrypted file to obtain a fully decrypted block of the encrypted file.

2. The method of claim 1, further comprising:

transmitting a decryption request for each encrypted block of the encrypted file; and

receiving a local decryption key for each encrypted local portion of the encrypted file.

3. The method of claim 1, further comprising:

writing the decrypted remote processing portion of the block in place of the remote processing portion of the block on the client device.

4. The method of claim 1, further comprising:

receiving a save request for saving a new file for the first time on the client device; and

in response to the save request, transmitting an encryption request to encrypt a remote processing portion of a block of the new file.

5. The method of claim 4, further comprising

receiving, in response to the encryption request, the encrypted remote processing portion of the block of the new file, and receiving a local encryption key;

identifying a new memory address in a disk of the client device and saving the encrypted remote processing portion of the block to the new memory address on the disk; and

applying the local encryption key to the one or more local portions of the block of the new file to obtain a fully encrypted block of the new file.

6. The method of claim 5, wherein the local encryption key is generated by a symmetric encryption algorithm.

7. The method of claim 6, wherein the symmetric encryption algorithm is one of Twofish, Serpent, AES (Rijndael), Blowfish, CASTS, RC4, 3DES, Skipjack, Safer+/++(Bluetooth), IDEA, or GOST.

8. A system for secure file access comprising:

a hardware processor configured to;

receive, by a client device, an access request to access an encrypted file on the client device;

in response to the access request, transmit, to a server, a decryption request to decrypt a remote processing portion of a block of the encrypted file;

receive, by the client device, in response to the decryption request, the decrypted remote processing portion of the block of the encrypted file, and receiving a local decryption key; and

apply, by the client device, the local decryption key to decrypt one or more local portions of the block of the encrypted file to obtain a fully decrypted block of the encrypted file.

9. The system of claim 8, wherein the hardware processor is further configured to:

transmit a decryption request for each encrypted block of the encrypted file; and

receive a local decryption key for each encrypted local portion of the encrypted file.

10. The system of claim 8, wherein the hardware processor is further configured to:

write the decrypted remote processing portion of the block in place of the remote processing portion of the block on the client device.

11. The system of claim 8, wherein the hardware processor is further configured to:

receive a save request for saving a new file for the first time on the client device; and

in response to the save request, transmit an encryption request to encrypt a remote processing portion of a block of the new file.

12. The system of claim 11, wherein the hardware processor is further configured to:

receive, in response to the encryption request, the encrypted remote processing portion of the block of the new file, and receiving a local encryption key;

identify a new memory address in a disk of the client device and saving the encrypted remote processing portion of the block to the new memory address on the disk; and

apply the local encryption key to the one or more local portions of the block of the new file to obtain a fully encrypted block of the new file.

13. The system of claim 12, wherein the local encryption key is generated by a symmetric encryption algorithm.

14. The system of claim 13, wherein the symmetric encryption algorithm is one of Twofish, Serpent, AES (Rijndael), Blowfish, CASTS, RC4, 3DES, Skipjack, Safer+/++(Bluetooth), IDEA, or GOST.

15. A non-transitory computer-readable medium, storing instructions thereon for secure the access, the instructions comprising:

receiving, by a client device, an access request to access an encrypted the on the client device;

in response to the access request, transmitting, to a server, a decryption request to decrypt a remote processing portion of a block of the encrypted file;

receiving, by the client device, in response to the decryption request, the decrypted remote processing portion of the block of the encrypted file, and receiving a local decryption key; and

applying, by the client device, the local decryption key to decrypt one or more local portions of the block of the encrypted file to obtain a fully decrypted block of the encrypted file.

16. The medium of claim 15, wherein the instructions further comprise:

transmitting a decryption request for each encrypted block of the encrypted file; and

receiving a local decryption key for each encrypted local portion of the encrypted file.

17. The medium of claim 15, wherein the instructions further comprise:

writing the decrypted remote processing portion of the block in place of the remote processing portion of the block on the client device.

18. The medium of claim 15, wherein the instructions further comprise:

receiving a save request for saving a new file for the first time on the client device; and

in response to the save request, transmitting an encryption request to encrypt a remote processing portion of a block of the new file.

19. The medium of claim 18, wherein the instructions further comprise:

receiving, in response to the encryption request, the encrypted remote processing portion of the block of the new file, and receiving a local encryption key;

identifying a new memory address in a disk of the client device and saving the encrypted remote processing portion of the block to the new memory address on the disk; and

applying the local encryption key to the one or more local portions of the block of the new file to obtain a fully encrypted block of the new file.

20. The medium of claim 19, wherein the local encryption key is generated by a symmetric encryption algorithm.