Systems and methods for secure data sharing

• US 9,264,224 B2
• Filed: 04/08/2014
• Issued: 02/16/2016
• Est. Priority Date: 09/20/2010
• Status: Expired due to Fees

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Landau, Gabriel D., Staker, Matthew, Yakamovich, William
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US14/247,971
• Publication Number:
  US 20140298012A1
• Time in Patent Office: 679 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Systems and methods are provided for creating and using a sharable file-level key to secure data files. The file-level key is generated based on a workgroup key associated with the data file and unique information associated with the data file. The file-level key may be used to encrypt and split data. Systems and methods are also provided for sharing data without replicating the data on an end user machine. Data is encrypted and split across an external/consumer network and an enterprise/producer network. Access to the data is provided using a computing image generated by a server in the enterprise/producer network and then distributed to end users of the external/consumer network. This computing image may include preloaded files that provide pointers to the data. No access or replication of the data on the enterprise/producer network is needed in order for a user of the external/consumer network to access the data.

Claims

1. A method for encrypting data, comprising:

receiving, using a hardware processor, a request to encrypt the data;

retrieving a workgroup key associated with the data;

generating a file-level key based on unique information associated with the data and the workgroup key, wherein the data is encrypted based on the file-level key;

receiving a request from an entity to access the encrypted data, wherein the entity is not a member of a workgroup associated with the workgroup key; and

sharing the file-level key with the entity.

2. The method of claim 1, wherein the workgroup key does not contain the unique information associated with the data.

3. The method of claim 1, wherein the unique information associated with the data comprises at least one of:

a name of the data, a time and date the data was created, a time the data was last modified, a pointer to the location of the data within the file system of a storage device, a size of the data, and a type associated with the data.

4. The method of claim 1, further comprising computing a hash value of the unique information associated with the data, wherein generating the file-level key based on the unique information associated with the data and the workgroup key comprises combining the hash value of the unique information and the workgroup key using a substantially-randomized technique.

5. The method of claim 1, wherein encrypting the data based on the file-level key further comprises:

encrypting the data using the file-level key and the workgroup key;

generating a random or pseudo-random value;

distributing, based, at least in part, on the random or pseudorandom value, encrypted data of the encrypted data into two or more shares; and

storing the two or more shares separately on at least one data depository.

6. The method of claim 1, wherein sharing the file-level key comprises sharing the file-level key without sharing the workgroup key.

7. The method of claim 1, wherein generating the file-level key comprises computing a hash value of the workgroup key.

8. The method of claim 1, further comprising transmitting the data to the entity.

9. The method of claim 1, further comprising computing a hash value of the workgroup key, and wherein generating the file-level key based on the unique information associated with the data and the workgroup key comprises combining the hash value of the workgroup key and the unique information associated with the data using a substantially-randomized technique.

10. A system for encrypting data, comprising a hardware processor configured to:

receive a request to encrypt the data;

retrieve a workgroup key associated with the data;

generate a file-level key based on unique information associated with the data and the workgroup key, wherein the data is encrypted based on the file-level key;

receive a request from an entity to access the encrypted data, wherein the entity is not a member of a workgroup associated with the workgroup key; and

share the file-level key with the entity.

11. The system of claim 10, wherein the workgroup key does not contain the unique information associated with the data.

12. The system of claim 10, wherein the unique information associated with the data comprises at least one of:

a name of the data, a time and date the data was created, a time the data was last modified, a pointer to the location of the data within the file system of a storage device, a size of the data, and a type associated with the data.

13. The system of claim 10, wherein the hardware processor is further configured to compute a hash value of the unique information associated with the data, and wherein the hardware processor is configured to generate the file-level key based on the unique information associated with the data and the workgroup key by combining the hash value of the unique information and the workgroup key using a substantially-randomized technique.

14. The system of claim 10, wherein the hardware processor is configured to encrypt the data based on the file-level key by:

encrypting the data using the file-level key and the workgroup key;

generating a random or pseudo-random value;

distributing, based, at least in part, on the random or pseudorandom value, encrypted data of the encrypted data into two or more shares; and

storing the two or more shares separately on at least one data depository.

15. The system of claim 10, wherein the hardware processor is configured to share the file-level key by sharing the file-level key without sharing the workgroup key.

16. The system of claim 10, wherein the hardware processor is further configured to generate the file-level key by computing a hash value of the workgroup key.

17. The system of claim 10, wherein the hardware processor is further configured to transmit the data to the entity.

18. The system of claim 10, wherein the hardware processor is further configured to compute a hash value of the workgroup key, and wherein the hardware processor is configured to generate the file-level key based on the unique information associated with the data and the workgroup key by combining the hash value of the workgroup key and the unique information associated with the data using a substantially-randomized technique.

19. A non-transitory computer-readable medium comprising instructions that, when executed by processing circuitry, cause a computer system to carry out a method for secure workgroup communication, the method comprising:

receiving, using a hardware processor, a request to encrypt the data;

retrieving a workgroup key associated with the data;

generating a file-level key based on unique information associated with the data and the workgroup key, wherein the data is encrypted based on the file-level key;

receiving a request from an entity to access the encrypted data, wherein the entity is not a member of a workgroup associated with the workgroup key; and

sharing the file-level key with the entity.