Seamless secure private collaboration across trust boundaries

• US 8,572,757 B1
• Filed: 01/16/2013
• Issued: 10/29/2013
• Est. Priority Date: 11/30/2012
• Status: Active Grant

• Current Assignee: nCrypted Cloud, LLC
• Original Assignee: nCrypted Cloud, LLC
• Inventors: Stamos, Nicholas, Odnovorov, Igor
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): LEE, JASON T
• Application Number:
  US13/743,051
• Time in Patent Office: 286 Days
• Field of Search: 726/28, 713/193, 705/76, 380/278
• US Class Current: 726/28
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067

Abstract

Seamless, secure, private, collaborative file synchronization across trust boundaries, typically as a companion to a store and sync file service. Information needed to recover a file is stored within the file itself, without giving away secret data. User specific personal keys are preferably only stored on the users'"'"' device(s). A unique ID is also created for each protected file; a password is generated that depends on (a) a key value that can either be (i) the user'"'"'s personal key in the case of a file that is to be private or (ii) a shared key in the case of a file that is to be shared with other users, and (b) the unique file ID. The password is then encrypted using a recovery key and also stored in the file itself. The file is secured using a format that supports password-based content encryption.

Claims

1. A method for providing seamless, secure, private,

collaborative synchronization of a data file across trust boundaries comprising:

generating a key value that is either (i) a personal key unique to a single user who is to have private access to the file or (ii) a shared key if the file is to be shared among two or more users;

assigning a unique file identifier for the file to be secured;

generating a password for the file to be secured from both (a) the unique file key identifier and (b) the key value that is either (i) the personal key or (ii) the shared key, depending on whether access to the file is to be private to the single user or to be shared among two or more users;

encrypting content of the file using the password generated from the key value and the unique file identifier;

storing the unique file identifier with the file;

storing an identifier for the key value with the file;

storing the key value identifier and the ley key value in a local store;

determining a recovery key;

storing a recovery key identifier for the recovery key with the file;

storing the recovery key on a server; and

storing a password recovery Binary Large Object (“

blob”

) with the file comprising the recovery key encrypted with the personal key; and

storing the file and one or more of the unique file identifier, the identifier for the key value, the recovery key identifier, and the recovery Binary Large Object (“

blob”

), in a digital file container.

2. The method of claim 1 additionally comprising:

storing the file using a store and synchronization service.

3. The method of claim 1 wherein the personal key is derived from account credentials associated with the single user.

4. The method of claim 1 wherein the personal key is only stored locally on a device associated with the single user and is not forwarded to another networked device.

5. The method of claim 1 additionally comprising:

generating the personal key on a second device controlled by the single user;

reading the unique file identifier and a key identifier from the file;

retrieving the unique file key using the key identifier; and

generating the password for the file from the personal key and the unique file key; and

opening the file using the password.

6. The method of claim 1 additionally comprising:

storing the recovery key on a server; and

storing the recovery key identifier with the file to enable recovery of the file.

7. The method of claim 1 wherein the file and a metadata for the file are stored in a digital file container selected from a group consisting of .zip or .pdf file formats.

8. The method of claim 1 additionally comprising:

storing a metadata with the file wherein the metadata includes one or more of the unique file identifier, the recovery key identifier, and the recovery Binary Large Object (“

blob”

) that consists of the user'"'"'s personal key password for the file encrypted with the recovery key.

9. The method of claim 1 wherein the file is to be shared among two or more users, and the unique file identifier and the identifier for the key value thus relate to a shared file, and wherein the method further comprises:

receiving the identifier for the key value; and

returning the key value associated with the received identifier to a user device.

10. The method of claim 9 additionally comprising:

determining if an open enrollment period is closed wherein the open enrollment period is an initial timeframe during which any user having access to a folder in which the file is stored is also given access to the identifier for the key value; and

if so, then not returning the associated key value to a user device.

11. The method of claim 1 additionally comprising:

storing a configuration file in a folder associated with the file to be secured, the configuration file including information relating to a unique identifier for the folder;

a shared key identifier;

a recovery key identifier; and

an identifier for an owner of the folder.

12. The method of claim 1 additionally comprising:

presenting a view of a file folder contents that differs from a view of that same folder presented by the store and synchronization service.

13. The method of claim 1 additionally comprising:

upon a subsequent access to the file,

assigning a new unique file identifier for the file to be secured; and

generating an updated password for the file from (a) the new unique file identifier and (b) the key value that is either (i) the personal key or (ii) the shared key, depending on whether access to the file is to be private to the single user or to be shared among two or more users.