Secure data transfer system and method

• US 9,742,742 B1
• Filed: 11/18/2016
• Issued: 08/22/2017
• Est. Priority Date: 11/18/2016
• Status: Active Grant

• Current Assignee: Vaultara LLC
• Original Assignee: Vaultara LLC
• Inventors: Monk, David
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/355,651
• Time in Patent Office: 277 Days
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Secure transfer of electronic files containing confidential information is achieved by selecting and copying files to be transferred to an intended recipient and, prior to transfer, subjecting the copies to consolidation, compression, chunking and encryption. Decryption, unchunking and decompression of the transferred files can only be performed by a recipient who has also received a verification code, an encrypted and password protected sector file, and an encrypted password file. Decryption of the password file requires a private certificate available only to the intended recipient. Decryption of the other files requires a one-time random transaction password contained in the password file.

Claims

1. For securely transferring confidential electronic records from a first computer system at a source facility to a second computer system at a destination facility, a method comprising:

(a) employing the first computer system to select confidential electronic records to be sent from the source facility to the destination facility and select parameters to be employed to secure and control the transfer of the selected confidential electronic records;

(b) creating a copy of the selected confidential electronic records and storing the copy on a local storage device;

(c) compressing the copy into a single encrypted binary file using a one-time random transaction password having a password bit size, splitting the single binary file into a plurality of encrypted chunked files using a one-time random transaction password and performing a checksum for each of said plurality of encrypted chunked files;

(d) creating an encrypted sector file using the one-time random transaction password, the encrypted sector file comprising the password bit size, a transaction protocol, a transaction type, an address of the first computer, the name of each chunked file and the checksum of each chunked file;

(e) storing the one-time random transaction password in a password file and encrypting the password file using a public certificate associated with the destination facility; and

(g) sending the encrypted chunked files, the encrypted password file and the encrypted sector file from the first computer system to a second computer system at a destination facility.

2. The method of claim 1 wherein the second computer system, after receiving the encrypted chunked files and the encrypted sector file and the encrypted password file, decrypts the encrypted password file using a private certificate, decrypts the encrypted sector file and the encrypted chunked files using the one-time random transaction password, secures verification to process the chunked files, performs a checksum on the chunked files and compares the checksums for the chunked files to the checksum in the sector file to determine whether all of the chunked files have been received and none are damaged, combines the chunked files into a single encrypted binary file, decrypts the single encrypted binary file using the one-time random transaction password and decompresses the decrypted binary file back to the same format as the copy to create a second copy on the second computer system.

3. The method of claim 1 wherein said first computer system comprises a console accessible to authorized internal staff only and a portal adapted to communicate with the second computer system via the internet.

4. The method of claim 3 wherein the local storage device is accessible by the computer portal.

5. The method of claim 1 wherein a secure TCP/IP transport mechanism is employed to send the encrypted chunked files, the encrypted password file and the encrypted sector file from the first computer system at the source facility to the second computer system at the destination facility.

6. The method of claim 5 wherein a cloud-based service provides the public certificate associated with the destination facility to the first computer system.

7. The method of claim 2 wherein a verification code must be received by the second computer system to enable the second computer system to perform at least one of the steps recited in claim 2.

8. The method of claim 1 wherein the confidential electronic records are patient records and are selected using a DICOM query.

9. The method of claim 1 wherein said parameters comprise the email address of at least one administrator.

10. The method of claim 8 wherein the copy of the selected confidential records is stored in at least one file conforming to the standard DICOM standard.

11. The method of claim 2 further including the step of notifying at least one administrator via email that the secure transfer has been completed.

12. An apparatus for securely transferring confidential electronic records from a source facility to a destination facility comprising:

(a) a first computer system located at a source facility and comprising a console, a first local storage device adapted to store in a searchable fashion confidential files, a second local storage device, and a portal able to transmit and receive data via the internet, said console adapted to (i) restrict access to the confidential files to authorized personnel, (ii) select confidential files to be sent from the source facility to a destination facility, (iii) select parameters to be employed to secure and control the transfer of selected confidential files, (iv) create a first copy of selected confidential files and store the first copy on the second local storage device, said first computer system further adapted to (i) compress the first copy into a single binary file and encrypt the file using a one-time random transaction password having a password bit size, (ii) split the single encrypted binary file into a plurality of chunked files, encrypt the file using a one-time random transaction password and performing a checksum for each of said plurality of chunked files, (iii) create a sector file and encrypt the sector file using a one-time random transaction password, the encrypted sector file comprising the password bit size, a transaction protocol, a transaction type, an address of at least one of the portal and the console, the name of each encrypted chunked file, and the checksum of each encrypted chunked file, and (iv) create a password file containing the one-time random transaction password and encrypt the password file using a public certificate associated with the destination facility, said portal further adapted to transmit the encrypted chunk files, the encrypted sector files, and the encrypted password file over a secure transport mechanism;

(b) a second computer system located at a destination facility adapted to receive the encrypted chunked files, the encrypted sector file and the encrypted password file, decrypt the password file using a private certificate, decrypt the sector file and encrypted chunked files using the one-time random transaction password, secure a verification required to further process the encrypted chunked files, perform a checksum on the chunked files and compare the checksums for the chunked files to the checksums in the sector file, combine the chunked files into a single encrypted binary file, decrypt the single encrypted binary file using the one-time random transaction password, and decompress the decrypted binary file back to the same format as the copy to create and store a second copy on the second computer system; and

(c) a cloud-based apparatus adapted to provide the first computer system with the public certificate used to encrypt the password file, and the verification.