SYSTEM AND APPARATUS FOR SECURELY STORING DATA

• US 20140331062A1
• Filed: 10/08/2012
• Published: 11/06/2014
• Est. Priority Date: 10/06/2011
• Status: Abandoned Application

• Current Assignee: Trinity College, University of Dublin (University of Melbourne)
• Original Assignee: The Provost Fellows Foundation Scholars & The Other Members of Board of The College of The Holy
• Inventors: Tewari, Hitesh, Ennis, Desmond, Reid, Karl
• Application Number:
  US14/348,288
• Publication Number:
  US 20140331062A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2125 Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Certain aspects of the invention pertain to the field of networked computing, and in particular to the field of data file security. Methods, systems and apparatuses are disclosed for encrypting and decrypting data stored and shared on networked data file storage devices such that the data may be accessed and manipulated by multiple users.

Claims

1. A computer-implemented method comprising:

receiving data to be inserted at a designated location of a data file;

encrypting the received data using a shared key and a seed string to produce encrypted data, wherein the encrypted data is a first encryption component and the seed string is a second encryption component;

generating one or more new data file elements collectively comprising all the encryption components, wherein the encryption components are individually identifiable, and wherein the one or more new data file elements further collectively comprise a signature that allows the one or more new data file elements to be categorized as an encrypted data file element set; and

making the one or more new data file elements available for insertion into the chronological history.

2. The method of claim 1 wherein the data file comprises a chronological history of revision elements, each of which in turn comprise said one or more chronologically ordered data file elements, and wherein the one or more new data file elements are embedded in a new revision element, and the new revision element is made available for insertion into the chronological history.

3. The method of claim 1 wherein encrypting further comprises using an arbitrary piece of data as additional authentication information, wherein the arbitrary data piece is a third encryption component.

4. The method of claim 3 wherein the encrypting is performed utilizing an authenticated encryption scheme such that encryption of the received data further produces an authentication tag, wherein the authentication tag is the arbitrary data piece.

5. The method of claim 4 therein the authenticated encryption scheme is any one of GCM, EAX or CCM.

6. The method of claim 1 wherein the one or more new data file elements further comprise flag data, wherein the flag data is a fourth encryption component, and wherein the signature in part comprises the flag data.

7. The method of claim 6 wherein the flag data comprises at least one non-base 64 character and is included as a delimiter in the one or more new data file elements immediately before the second encryption component.

8-19. -19. (canceled)

20. A computer-implemented method comprising:

retrieving, from a data file storage medium, a chronological history of one or more data file elements corresponding to a data file;

categorizing one or more data file elements collectively comprising the signature as an encrypted data file element set;

identifying the encryption components comprised in the encrypted data file element set; and

decrypting the encrypted data file element set using the encryption components and the secret key to produce a portion of unencrypted data.

21-23. -23. (canceled)

24. A system comprising one or more data processing apparatus programmed to perform operations comprising:

receiving data to be inserted at a designated location of a data file;

encrypting the received data using a shared key and a seed string to produce encrypted data, wherein the encrypted data is a first encryption component and the seed string is a second encryption component;

generating one or more new data file elements collectively comprising all the encryption components, wherein the encryption components are individually identifiable, and wherein the one or more new data file elements further collectively comprise a signature that allows the one or more new data file elements to be categorized as an encrypted data file element set; and

making the one or more new data file elements available for insertion into the chronological history.

25-45. -45. (canceled)