System and method for enhanced data protection

• US 10,298,554 B2
• Filed: 04/06/2018
• Issued: 05/21/2019
• Est. Priority Date: 04/24/2015
• Status: Active Grant

• Current Assignee: Keyavi Data Corp.
• Original Assignee: Encryptics, LLC
• Inventors: Pollet, Cody, Burgess, Charles, Roach, Courtney, Hart, Brandon
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US15/946,965
• Publication Number:
  US 20180295108A1
• Time in Patent Office: 410 Days
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

In one embodiment, a method of secure network transmission is performed by a computer system. The method includes encrypting a payload via a first symmetric key and encrypting the first symmetric key via a second symmetric key. The method further includes encrypting an author header comprising the encrypted first symmetric key and a recipient list via a third symmetric key, wherein the recipient list comprises at least one recipient. The method also includes encrypting the third symmetric key via a public asymmetric key associated with an authentication server. Furthermore, the method includes transmitting the encrypted author header and the encrypted third symmetric key to the authentication server for use in recipient-initiated pre-access authentication. In addition, the method includes transmitting the encrypted payload and the second symmetric key over a computer network to the at least one recipient.

Claims

1. A method of secure network transmission comprising, by a computer system:

encrypting a payload via a first symmetric key;

encrypting the first symmetric key via a second symmetric key;

encrypting an author header comprising the encrypted first symmetric key and a recipient list via a third symmetric key that is distinct from the first symmetric key and the second symmetric key, wherein the recipient list comprises at least one recipient;

encrypting the third symmetric key via a public asymmetric key associated with an authentication server;

generating an authentication header comprising the encrypted author header, the encrypted third symmetric key, and metadata sufficient to identify the authentication header;

transmitting the authentication header to the authentication server for use in recipient-initiated pre-access authentication;

generating a container comprising the encrypted payload and the second symmetric key; and

transmitting the container over a computer network to the at least one recipient.

2. The method of claim 1, comprising generating the first symmetric key, the second symmetric key and the third symmetric key.

3. The method of claim 2, wherein the first symmetric key, the second symmetric key and the third symmetric key are generated together.

4. The method of claim 2, wherein the first symmetric key, the second symmetric key and the third symmetric key are individually generated when a respective symmetric key is used for encryption of particular data.

5. The method of claim 1, wherein the payload and the recipient list are user-specified.

6. The method of claim 1, comprising automatically generating the payload and the recipient list.

7. A computer system comprising a processor and memory, wherein the processor and memory in combination are operable to perform a method comprising:

encrypting a payload via a first symmetric key;

encrypting the first symmetric key via a second symmetric key;

encrypting an author header comprising the encrypted first symmetric key and a recipient list via a third symmetric key that is distinct from the first symmetric key and the second symmetric key, wherein the recipient list comprises at least one recipient;

encrypting the third symmetric key via a public asymmetric key associated with an authentication server;

generating an authentication header comprising the encrypted author header, the encrypted third symmetric key, and metadata sufficient to identify the authentication header;

transmitting the authentication header to the authentication server for use in recipient-initiated pre-access authentication;

generating a container comprising the encrypted payload and the second symmetric key; and

transmitting the container over a computer network to the at least one recipient.

8. The computer system of claim 7, the method comprising generating the first symmetric key, the second symmetric key and the third symmetric key.

9. The computer system of claim 8, wherein the first symmetric key, the second symmetric key and the third symmetric key are generated together.

10. The computer system of claim 8, wherein the first symmetric key, the second symmetric key and the third symmetric key are individually generated when a respective symmetric key is used for encryption of particular data.

11. The computer system of claim 7, wherein the payload and the recipient list are user-specified.

12. The computer system of claim 7, comprising automatically generating the payload and the recipient list.

13. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:

encrypting a payload via a first symmetric key;

encrypting the first symmetric key via a second symmetric key;

encrypting an author header comprising the encrypted first symmetric key and a recipient list via a third symmetric key that is distinct from the first symmetric key and the second symmetric key, wherein the recipient list comprises at least one recipient;

encrypting the third symmetric key via a public asymmetric key associated with an authentication server;

generating an authentication header comprising the encrypted author header, the encrypted third symmetric key, and metadata sufficient to identify the authentication header;

transmitting the authentication header to the authentication server for use in recipient-initiated pre-access authentication;

generating a container comprising the encrypted payload and the second symmetric key; and

transmitting the container over a computer network to the at least one recipient.

14. The computer-program product of claim 13, the method comprising generating the first symmetric key, the second symmetric key and the third symmetric key.

15. The computer-program product of claim 14, wherein the first symmetric key, the second symmetric key and the third symmetric key are generated together.

16. The computer-program product of claim 14, wherein the first symmetric key, the second symmetric key and the third symmetric key are individually generated when a respective symmetric key is used for encryption of particular data.

17. The computer-program product of claim 13, wherein the payload and the recipient list are user-specified.

18. The computer-program product of claim 13, comprising automatically generating the payload and the recipient list.