METHOD AND DEVICE FOR FILE ENCRYPTION

• US 20160021109A1
• Filed: 04/28/2015
• Published: 01/21/2016
• Est. Priority Date: 01/22/2007
• Status: Active Grant

• Current Assignee: New Kailung Gear Co Ltd.
• Original Assignee: Spyrus, Inc.
• Inventors: LINSENBARDT, Duane J., YOUNG, John N., CARLISLE, William Reid, TREGUB, Burton George, JUENEMAN, Robert R.
• Granted Patent: US 9,521,123 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

A method for encryption and sealing of a plaintext file by hashing the plaintext file to produce a plaintext hash, encrypting the plaintext file to produce ciphertext, hashing the ciphertext to produce a ciphertext hash, hashing the plaintext hash and the ciphertext hash to produce a result hash, and sealing the ciphertext together with the result hash. This provides verification for non-repudiation and protects against undetected malware corrupting the plaintext or ciphertext files.

Claims

1. A method for file encryption of a plaintext file, comprising the steps of:

hashing the plaintext file to produce a plaintext hash,

encrypting the plaintext file to create ciphertext,

hashing the ciphertext to produce a ciphertext hash,

hashing the plaintext hash and the ciphertext hash to produce a result hash, and

sealing the ciphertext together with the result hash, to produce an encrypted file.

2. The method of claim 1, further comprising steps for communicating the encrypted file to originator-selected optional recipients.

3. The method of claim 1, further comprising steps for an enforced mandatory recovery agent.

4. The method of claim 1, further comprising steps for breaking the encryption of the encrypted file at a pre-determined date.

5. The method of claim 1, the sealing step further comprising embedding forward error correction within the encrypted file.

6. The method of claim 1, the plaintext file having metadata, further comprising the step of separately encrypting the metadata, and the sealing step comprising sealing the ciphertext together with the result hash and the encrypted metadata.

7. The method of claim 6, further comprising steps for an independent key exchange mechanism to permit decrypting the metadata by a catalog agent.

8. The method of claim 1, further comprising use of a portable encryption device having a portable form factor and an on-board cryptographic processor to perform one or more of the steps.

9. An encryption device for encryption of a plaintext file, comprising an enclosure for the device providing a portable form factor, and a cryptographic processor within the enclosure configured to perform the steps of claim 1.

10. The method of claim 1, further comprising the step of compressing the plaintext file to produce a compressed plaintext file, and the encrypting step comprising encrypting the compressed plaintext file to create the ciphertext.

11. The method of claim 1, where the sealing step further comprises using a digital signature algorithm to produce the encrypted file.