Method for encrypting and storing data

• US 10,044,509 B1
• Filed: 08/14/2017
• Issued: 08/07/2018
• Est. Priority Date: 08/14/2017
• Status: Active Grant

• Current Assignee: FMR LLC
• Original Assignee: FMR LLC
• Inventors: Kirshner, Jake
• Primary Examiner(s): Henning, Matthew T
• Application Number:
  US15/676,673
• Time in Patent Office: 358 Days
• Field of Search: 713176
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for securely uploading a data file are presented. A client generates a symmetric encryption key and an initialization vector; encrypts the data file using the symmetric encryption key and the initialization vector; places an upload request with a server to upload the encrypted data file to a first storage device; receives from the server via the communications network, asymmetric encryption components, a signed data file upload URL accessible by the communications network, and a signed key data upload URL accessible by the communications network; encrypts, using the asymmetric encryption components, the symmetric encryption key and the initialization vector, thereby creating encrypted key information; sends, via the signed data file upload URL, the encrypted data file to the first storage device; and sends, via the signed key data upload URL, the encrypted key information to a second storage device.

Claims

1. A computer-implemented method of securely uploading a data file using a computing device, the method comprising:

generating, by the computing device, a symmetric encryption key and an initialization vector;

encrypting, by the computing device, the data file using the symmetric encryption key and the initialization vector, thereby creating an encrypted data file;

placing an upload request, by the computing device, to upload the encrypted data file to a first computer-readable data storage device, the upload request placed with a server computing device in electronic communication with the computing device via a data communications network;

receiving, by the computing device, from the server computing device via the data communications network, asymmetric encryption components, a signed data file upload URL accessible by the data communications network, and a signed key data upload URL accessible by the data communications network;

encrypting, by the computing device, using the asymmetric encryption components, the symmetric encryption key and the initialization vector, thereby creating encrypted key information;

sending, by the computing device, via the signed data file upload URL, the encrypted data file to the first computer-readable data storage device; and

sending, by the computing device, via the signed key data upload URL, the encrypted key information to a second computer-readable data storage device.

2. The method of claim 1 wherein encrypting the symmetric encryption key and the initialization vector further comprises:

serializing, by the computing device, the symmetric encryption key and the initialization vector, thereby creating a serialized key data object; and

structure padding, by the computing device, the serialized key data object to a predetermined length based on a size of an asymmetric key pair included in the asymmetric encryption components, thereby creating a byte padded key data object.

3. The method of claim 2 wherein the serialized key data object is structure padded with nondeterministic random data.

4. The method of claim 2 wherein the serialized key data object is created prior to placing the upload request.

5. The method of claim 2 wherein the serialized key data object is in key-value format.

6. The method of claim 1 further comprising creating, by the server computing device, a record associating the computing device with the upload request, the record including a key-value map of asymmetric encryption components.

7. The method of claim 6 wherein the record is specific to the upload request.

8. The method of claim 1 further comprising storing, by the first computer-readable data storage device, a copy of the encrypted data file, and storing, by the second computer-readable data storage device, a copy of the encrypted key information.

9. The method of claim 1 wherein the symmetric encryption key includes a block cipher that utilizes the initialization vector to randomize repeated sequences in the data file.

10. The method of claim 1 wherein the initialization vector is unique to the upload request.

11. The method of claim 1 wherein the initialization vector is generated independently of the encrypted data file or the encrypted key information.

12. The method of claim 1 wherein the initialization vector is generated independently of previous encryption requests.

13. The method of claim 1 wherein the server computing device does not read or receive either the symmetric encryption key or the initialization vector in either encrypted or unencrypted form, and wherein the server computing device does not read or receive the data file or the encrypted data file.

14. The method of claim 1 wherein the asymmetric encryption components include an asymmetric key pair including a private exponent and a public exponent, a modulus, prime factors, and precomputed remainders.

15. The method of claim 14 wherein the asymmetric key pair is unique to the upload request.

16. The method of claim 14 wherein the server computing device does not sign the asymmetric key pair.

17. The method of claim 14 wherein the server computing device does not use the asymmetric key pair for any purpose other than to associate the asymmetric encryption components with the upload request.

18. The method of claim 1 wherein the server computing device provides only asymmetric key information required for encryption associated with the upload request.

19. The method of claim 1 wherein the first computer-readable data storage device is independent of, and remote from, the server computing device, and the second computer-readable data storage device is independent of, and remote from, the server computing device.

20. The method of claim 1 wherein the first computer-readable data storage device is independent of the second computer-readable data storage device.

21. The method of claim 1 wherein the signed data file upload URL includes only write-only access to the first computer-readable data storage device and the signed key data upload URL includes only write-only access to the second computer-readable data storage device.

22. The method of claim 1 wherein the server computing device generates the signed key data upload URL with a first predetermined timeout threshold and the signed data file upload URL with a second predetermined timeout threshold.

23. The method of claim 1 wherein the signed data file upload URL and the signed key data upload URL are each encoded with a timeout parameter and address restrictions.

24. The method of claim 1 wherein the encrypted data file and the encrypted key information are cacheable locally on the computing device in an encrypted format.

25. The method of claim 1 wherein the asymmetric encryption components are delivered in an unencoded format.

26. A computer-implemented system for uploading securely a data file, the computer-implemented system comprising:

a computing device generating a symmetric encryption key and an initialization vector;

encrypting the data file using the symmetric encryption key and the initialization vector, thereby creating an encrypted data file;

placing an upload request to upload the encrypted data file;

receiving asymmetric encryption components, a signed data file upload URL, and a signed key data upload URL;

encrypting, using the asymmetric encryption components, the symmetric encryption key and the initialization vector, thereby creating encrypted key information; and

transmitting data over a data communications network in electronic communication with the computing device;

a server computing device in electronic communication with the data communications network, the server computing device receiving the upload request;

creating a record associating the computing device with the upload request; and

providing to the computing device the asymmetric encryption components, the signed data file upload URL, and the signed key data upload URL;

a first computer-readable data storage device in electronic communication with the data communications network, the first computer-readable data storage device receiving and storing a copy of the encrypted data file; and

a second computer-readable data storage device in electronic communication with the data communications network, the second computer-readable data storage device receiving and storing a copy of the encrypted key information.

27. The system of claim 26 wherein the first computer-readable data storage device is independent of, and remote from, the server computing device, and the second computer-readable data storage device is independent of, and remote from, the server computing device.

28. The system of claim 26 wherein the first computer-readable data storage device is independent of the second computer-readable data storage device.

29. The system of claim 26 wherein the server computing device does not read or receive either the symmetric encryption key or the initialization vector in either encrypted or unencrypted form.

30. The system of claim 26 wherein the server computing device does not read or receive the data file or the encrypted data file.