SYSTEM AND METHOD FOR ELECTRONIC CERTIFICATION AND AUTHENTICATION OF DATA

• US 20130179694A1
• Filed: 01/05/2012
• Published: 07/11/2013
• Est. Priority Date: 01/05/2012
• Status: Active Grant

• Current Assignee: Indorse Services Co.
• Original Assignee: Mohammed Alawi Geoffrey
• Inventors: GEOFFREY, Mohammed Alawi
• Granted Patent: US 8,799,675 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

A system and method for authenticating data. Data may be received that is individually encrypted in a first encryption layer by each of a plurality of users using user-specific private keys. The received data may be encrypted together in a second encryption layer to create multi-layered encrypted data. The multi-layered encrypted data may be transferred to a beneficiary device to determine if the encrypted data is authentic. At the beneficiary device, the second encryption layer may be decrypted to expose the first encryption layer. Then, the first encryption layer may be decrypted using public keys that only decrypt data encrypted by private keys assigned to a plurality of authorizers pre-designated to authenticate the data. If the first encryption layer is properly decrypted using the authorizers'"'"' decryption keys, it may be determined that the users are the pre-designated authorizers.

Claims

1. A method for authenticating data, the method comprising:

receiving data individually encrypted in a first encryption layer by each of a plurality of users using user-specific private keys;

encrypting the received data together in a second encryption layer to create multi-layered encrypted data; and

transferring the multi-layered encrypted data to a device that has public keys that only decrypt data encrypted by private keys assigned to a plurality of pre-designated authorizers to determine if the users are the pre-designated authorizers.

2. The method of claim 1, wherein the second encryption layer is encrypted using an organization-specific private key uniquely assigned to an organization and decrypted using a corresponding organization-specific public key.

3. The method of claim 1, wherein the plurality of authorizers are pre-designated by a data manager.

4. The method of claim 3, wherein changes to the pre-designated authorizers are able to be received from the data manager at any time prior to encrypting the second encryption layer.

5. The method of claim 4 comprising, if the data manager attempts to change the pre-designated authorizers after the request to authenticate the data is received, sending the data manager a message indicating a lock out from editing the pre-designated authorizers.

6. The method of claim 1, wherein the first layer encrypts hash functions of the original data to be authenticated and information associated with the authorizers and the second layer encrypts hash codes of the original data to be authenticated, hash codes output from the first layer encryption and information associated with an entity designated to encrypt the second layer.

7. The method of claim 1, wherein the authorizers define individuals, groups, ranks, security levels, departments, or types of authorizers.

8. The method of claim 1, wherein the encryption keys are asymmetric encryption keys.

9. The method of claim 1 comprising storing the multi-layered encrypted data at a secure server.

10. A method for authenticating original data, the method comprising:

receiving multi-layered encrypted data, wherein a first encryption layer is individually encrypted by a plurality of users using user-specific private keys, which is in turn combined and encrypted in a second encryption layer;

decrypting the second encryption layer to expose the first encryption layer;

attempting to decrypt the first encryption layer using public keys that only decrypt data encrypted by private keys assigned to a plurality of authorizers pre-designated to authenticate the data; and

determining that the users are the pre-designated authorizers only if the first encryption layer is properly decrypted using the authorizers'"'"' decryption keys.

11. The method of claim 10, wherein the second encryption layer is encrypted using an organization-specific private key uniquely assigned to an organization and decrypted using a corresponding organization-specific public key.

12. The method of claim 10, wherein the plurality of authorizers are pre-designated by a data manager.

13. The method of claim 12, wherein changes to the pre-designated authorizers are able to be received from the data manager at any time prior to encrypting the second encryption layer.

14. The method of claim 10, wherein the multi-layered encrypted data encrypts hash codes of the original data and comprising determining that the original data is not corrupted if decrypting the first encryption layer generates hash codes having substantially no errors.

15. A system for authenticating data, the systems comprising:

a memory to store multi-layered encrypted data, wherein a first encryption layer is individually encrypted by a plurality of users using user-specific private keys, which is in turn combined and encrypted in a second encryption layer; and

a processor to transfer the multi-layered encrypted data to a beneficiary device, wherein the beneficiary device is adapted to;

decrypt the second encryption layer to expose the first encryption layer, attempt to decrypt the first encryption layer using public keys that only decrypt data encrypted by private keys assigned to a plurality of authorizers pre-designated to authenticate the data, and determine that the users are the pre-designated authorizers only if the first encryption layer is properly decrypted using the authorizers'"'"' decryption keys.

16. The system of claim 15 comprising a certificate authority to issue each user their user-specific private keys and to issue the corresponding public keys for use by the beneficiary device.

17. The system of claim 15, wherein the second encryption layer is encrypted using an organization-specific private key uniquely assigned to an organization and the beneficiary device decrypts the second encryption layer using a corresponding organization-specific public key.

18. The system of claim 15 comprising a device operated by a data manager to pre-designate the plurality of authorizers.

19. The system of claim 18, wherein the device operated by a data manager is able to change the pre-designated authorizers at any time prior to the encryption of the second encryption layer.

20. The system of claim 15, wherein the multi-layered encrypted data comprises encrypted hash codes of the original data and the beneficiary device determines that the original data is not corrupted if decrypting the first encryption layer generates hash codes having substantially no errors.