Multiply-encrypting data requiring multiple keys for decryption
First Claim
Patent Images
1. A method executed on a server, comprising:
- receiving a request to encrypt a piece of data;
encrypting the piece of data such that no single key can decrypt the encrypted piece of data and any unique combination of a first plurality of unique keys taken a first number at a time are capable of decrypting the encrypted piece of data, wherein the first number is greater than one, wherein each particular one of the first plurality of unique keys is tied to account credentials of a particular user of a plurality of users respectively, wherein the first number is less than or equal to the first plurality, and wherein the step of encrypting the piece of data includes;
encrypting the piece of data with a data key,generating a unique encrypted data key for each unique combination of the first plurality of unique keys taken the first number at a time by performing the following for each unique combination;
encrypting the data key multiple times each of which using a different one of the first plurality of unique keys, wherein the multiple times is equal to the first number, andencrypting each different one of the first plurality of unique keys with the account credentials of the corresponding particular user;
returning the encrypted piece of data;
receiving, at the server, a delegation submission from at least a second number of the plurality of users equivalent to the first number that grants the server permission to use the account credentials of the at least second number of the plurality of users to decrypt data on their behalf;
receiving a request to decrypt the encrypted piece of data;
decrypting, for each particular one of at least the second number of the plurality of users equivalent to the first number that granted the server permission to use the account credentials of the at least second number of the plurality users, the one of the first plurality of unique keys that correspond to that particular one of the at least the second number of the plurality of users;
decrypting the encrypted piece of data using the decrypted ones of the first plurality of unique keys; and
returning the decrypted piece of data.
2 Assignments
0 Petitions
Accused Products
Abstract
A server receives a piece of data for encryption. The server encrypts the piece of data such that no single key can decrypt the encrypted piece of data and any combination of a first multiple of unique keys taken a second multiple at a time are capable of decrypting the encrypted piece of data. Each of the first multiple of unique keys is tied to account credentials of a different user. The second multiple is less than or equal to the first multiple. The encrypted piece of data is returned.
-
Citations
12 Claims
-
1. A method executed on a server, comprising:
-
receiving a request to encrypt a piece of data; encrypting the piece of data such that no single key can decrypt the encrypted piece of data and any unique combination of a first plurality of unique keys taken a first number at a time are capable of decrypting the encrypted piece of data, wherein the first number is greater than one, wherein each particular one of the first plurality of unique keys is tied to account credentials of a particular user of a plurality of users respectively, wherein the first number is less than or equal to the first plurality, and wherein the step of encrypting the piece of data includes; encrypting the piece of data with a data key, generating a unique encrypted data key for each unique combination of the first plurality of unique keys taken the first number at a time by performing the following for each unique combination; encrypting the data key multiple times each of which using a different one of the first plurality of unique keys, wherein the multiple times is equal to the first number, and encrypting each different one of the first plurality of unique keys with the account credentials of the corresponding particular user; returning the encrypted piece of data; receiving, at the server, a delegation submission from at least a second number of the plurality of users equivalent to the first number that grants the server permission to use the account credentials of the at least second number of the plurality of users to decrypt data on their behalf; receiving a request to decrypt the encrypted piece of data; decrypting, for each particular one of at least the second number of the plurality of users equivalent to the first number that granted the server permission to use the account credentials of the at least second number of the plurality users, the one of the first plurality of unique keys that correspond to that particular one of the at least the second number of the plurality of users; decrypting the encrypted piece of data using the decrypted ones of the first plurality of unique keys; and returning the decrypted piece of data. - View Dependent Claims (2, 3, 4)
-
-
5. An apparatus for encrypting and decrypting data, comprising:
-
a set of one or more processors; a non-transitory machine-readable storage medium that stores instructions that, when executed by the set of processors, generate the following; an encryption module that is configured to encrypt a piece of data such that no single key can decrypt the encrypted piece of data and any unique combination of a first plurality of unique keys taken a first number at a time are capable of decrypting the encrypted piece of data, wherein the first number is greater than one wherein each particular one of the first plurality of unique keys is tied to account credentials of a particular user of a plurality of users respectively, wherein the first number is less than or equal to the first plurality, and wherein the encryption module is configured to encrypt the piece of data through performance of the following; encrypt the piece of data with a data key, generate a unique encrypted data key for each unique combination of the first plurality of unique keys taken the first number at a time by performing the following for each unique combination; encrypt the data key multiple times each of which using a different one of the first plurality of unique keys, wherein the multiple times is equal to the first number, encrypt each different one of the first plurality of unique keys with the account credentials of the corresponding particular user, and return the encrypted piece of data; a delegation module that is configured to receive a delegation submission from at least a second number of the plurality of users equivalent to the first number that grants a decryption module of the apparatus permission to use the account credentials of the at least second number of the plurality of users to decrypt data on their behalf; and a decryption module that is configured to decrypt the encrypted piece of data through performance of the following; receive a request to decrypt the encrypted piece of data, decrypt, for each particular one of at least the second number of the plurality of users equivalent to the first number that granted the server permission to use the account credentials of the at least second number of the plurality users, the one of the first plurality of unique keys that correspond to that particular one of the at least the second number of the plurality of users, decrypt the encrypted piece of data using the decrypted ones of the first plurality of unique keys, and return the decrypted piece of data. - View Dependent Claims (6, 7, 8)
-
-
9. A method executed on a server for encrypting and decrypting data, comprising:
-
receiving a request to encrypt data from a requester, the request indicating at least the following; the data to encrypt, a list of a plurality of users, and a minimum number of the plurality of users whose credentials are required in order to decrypt the data, wherein the minimum number is at least two; encrypting the data with a data key; for each of the plurality of users, generating a unique data key encryption key;
for each unique combination of the minimum number of the plurality of users whose credentials are required in order to decrypt the data, generating a unique encrypted data key including encrypting the data key multiple times according to the minimum number of users in that unique combination, each time with a different unique data key encryption key of the minimum number of users in that unique combination;for each of the plurality of users, encrypting the unique data key encryption key of that user using account credentials of that user; returning to the requester the encrypted data, the unique encrypted data key for each unique combination, and the unique data key encryption key for each of the plurality of users; after encrypting the data with the data key, discarding the data and the data key; receiving, at the server, from at least a first number of users equivalent to the minimum number of users, permission to use the account credentials of the at least the first number of users equivalent to the minimum number of users to decrypt the unique data key encryption keys for the at least first number of users; receiving a request for decryption that includes the encrypted data; responsive to determining that there are at least the first number of users equivalent to the minimum number that have given permission to use the account credentials of the at least the first number of users to decrypt the unique data key encryption keys for the at least first number of users, performing the following; for each of the at least first number of users, decrypting the unique data key encryption key for that user using the account credentials of that user, and generating a decrypted unique encrypted data key including using those decrypted unique data key encryption keys to decrypt one of the unique encrypted data keys that correspond with that combination of the at least first number of users; decrypting the data key with the decrypted unique encrypted data key; and decrypting the encrypted data with the decrypted data key. - View Dependent Claims (10, 11, 12)
-
Specification