UPLOAD AND DOWNLOAD STREAMING ENCRYPTION TO/FROM A CLOUD-BASED PLATFORM

• US 20150381587A1
• Filed: 09/11/2015
• Published: 12/31/2015
• Est. Priority Date: 08/29/2012
• Status: Active Grant

• Current Assignee: Box Incorporated
• Original Assignee: Box Incorporated
• Inventors: Scharf, Yuval, Lyons, James P.
• Granted Patent: US 9,450,926 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Embodiments of the present disclosure include systems and methods for upload and/or download streaming encryption to/from an online service, or cloud-based platform or environment. The encryption process includes the following parts: Upload encryption, download decryption, and a central piece of infrastructure called the Interval Key Server (IKS). During both upload and download, the encryption and decryption processes are performed while the files are being uploaded/downloaded, (e.g., the files are being encrypted/decrypted as they are being streamed).

Claims

1. A computer-implemented encryption method for recovering from a compromised key from an encryption key pool in a cloud-based collaborative platform comprising:

identifying a plurality of data files, the data files encrypted with a first plurality of encryption keys;

determining a plurality of encryption key files, wherein the plurality of encryption key files comprise the first plurality of encryption keys encrypted with the compromised key;

determining a first plurality of corrective action criteria for an encryption key pool;

determining a second plurality of corrective action criteria for the plurality of encrypted data files;

determining a third plurality of corrective action criteria for the plurality of encryption key files;

adjusting the encryption key pool based on the first plurality of corrective action criteria;

adjusting the plurality of encrypted data files based on the second plurality of corrective action criteria; and

adjusting the plurality of encryption key files based on the third plurality of corrective action criteria;

wherein, the data files are accessed by and/or collaborated upon among multiple users or collaborators in the cloud-based encryption platform.

2. The computer-implemented method of claim 1, wherein adjusting the encryption key pool compromises removing the compromised key from the key pool and generating a new key in the encryption key pool.

3. The computer-implemented method of claim 2, wherein the new key is generated using a different method from the method used to generate the compromised key.

4. The computer-implemented method of claim 1, wherein adjusting the plurality of encrypted data files comprises decrypting the data files and reencrypting the data files with a new key.

5. The computer-implemented method of claim 2, wherein adjusting the plurality of encryption key files comprises decrypting the encryption key files using the comprised key and reencrypting the key files using the new key.