Method and system for secure data sharing

• US 10,637,833 B2
• Filed: 09/30/2014
• Issued: 04/28/2020
• Est. Priority Date: 09/30/2013
• Status: Active Grant

• Current Assignee: Cryptomill Incorporated
• Original Assignee: Cryptomill Incorporated
• Inventors: Tien, Chen Li, Ocol, Joseph Mari Villamor, Filji, Deepu, Niculescu, Cristian Sebastian, Serrao, Ivan Canute, Batty, Christian George, Jolly, Nandini
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US15/025,815
• Publication Number:
  US 20160241522A1
• Time in Patent Office: 2,037 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2127 Bluffing
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0822 using key encryption key

Abstract

A method of protecting data is disclosed herein. The method comprises: encrypting a data in a protected data item using a first encryption key; and encrypting the first encryption key in the protected data item using a second encryption key that is unique to the protected data item, wherein the unique second encryption key is derived from a third encryption key in the protected data item and to a plurality of protected data items comprising a common characteristic shared with the protected data item.

Claims

1. A method of protecting data, the method comprising:

encrypting a data in a protected data item using a first encryption key, the protected data item being associated with a trust boundary, where one or more other protection data items may also be associated with the trust boundary, the data encrypted in the protected data item being accessible to a defined set of users associated with the trust boundary by using a third encryption key and being inaccessible to users not associated with the trust boundary, the third encryption key being uniquely associated with the trust boundary; and

encrypting the first encryption key in the protected data item using a second encryption key that is unique to the protected data item,

wherein the unique second encryption key is derived from the third encryption key, and prior to encrypting the first encryption key, receiving the third encryption key at a computing device, associated with a user in the defined set of users associated with the trust boundary, from another computing device.

2. The method of claim 1, wherein the unique second encryption key is derived from both the third encryption key and a cryptographic salt that is randomly generated from the protected data item.

3. The method of claim 1, wherein the data is encrypted to a payload portion of the protected data item.

4. The method of claim 1, wherein the first encryption key is encrypted to a header portion of the protected data item.

5. The method of claim 1, wherein the data comprises a file.

6. The method of claim 1, wherein the data comprises a document.

7. The method of claim 1, wherein the data comprises a folder.

8. The method of claim 7, wherein the data further comprises the contents of the folder.

9. The method of claim 1, wherein the data comprises files, documents, or folders.

10. A system for protecting data, the system comprising:

a computer processor in combination with an encryption component for encrypting a data in a protected data item using a first encryption key, the protected data item being associated with a trust boundary, where one or more other protection data items may also be associated with the trust boundary, the data encrypted in the protected data item being accessible to a defined set of users associated with the trust boundary by using a third encryption key and being inaccessible to users not associated with the trust boundary, the third encryption key being uniquely associated with the trust boundary, and the processor and encryption component for encrypting the first encryption key in the protected data item using a second encryption key that is unique to the protected data item,

wherein the unique second encryption key is derived from the third encryption key, and a computing device, associated with a user in the defined set of users associated with the trust boundary, comprises the computer processor, and the computer processor is configured to receive from another computing device, prior to encrypting the first encryption key, the third encryption key.

11. The system of claim 10, wherein the unique second encryption key is derived from both the third encryption key and a cryptographic salt that is randomly generated from the protected data item.

12. The system of claim 10, wherein the data is encrypted to a payload portion of the protected data item.

13. The system of claim 10, wherein the data comprises a file.

14. The system of claim 10, wherein the data comprises a document.

15. The system of claim 10, wherein the data comprises a folder.

16. The system of claim 13, wherein the data further comprises the contents of the folder.

17. The system of claim 10, wherein the data comprises files, documents, or folders.