ABSTRACT
Abstract
Systems and methods for encrypted content management are provided and include generating a user private key, a user public key, and a symmetric encryption key. A group private key, a group public key, and a group symmetric encryption key are generated and the group private key is encrypted with the group symmetric encryption key. A first shared-secret key is generated based on the user public key and the group private key using a diffie-hellman exchange algorithm. The group symmetric encryption key is encrypted using the first shared-secret key to generate an escrow key. Plaintext data is encrypted using a content symmetric key. A second shared-secret key is generated based on an ephemeral private key and the group public key using a diffie-hellman exchange algorithm. The content symmetric key is encrypted using the second shared-secret key.
Description
CROSS-REFERENCE TO RELATED APPLICATIONS
This application is a continuation of U.S. patent application Ser. No. 17/704,065, filed Mar. 25, 2022, which is a continuation of U.S. patent application Ser. No. 17/507,199, filed on Oct. 21, 2021, now U.S. Pat. No. 11,316,685, which is a continuation of U.S. patent application Ser. No. 17/151,391, filed on Jan. 18, 2021, now U.S. Pat. No. 11,372,986. The entire disclosures of the above applications are incorporated herein by reference.
FIELD
The present disclosure relates to systems and methods for encrypted content management, including systems and methods that provide cryptographic key management.
BACKGROUND
This section provides background information related to the present disclosure which is not necessarily prior art.
Traditional information systems accomplish security by authenticating users and processes and then allowing or denying access to internal network resources based on the authentication result. This approach allows internal network resources to trust one another in addition to authenticated external users. These trust relationships, however, can be exploited. Once the network perimeter is breached by an unauthorized user, all internal data can be compromised, accessed, and modified.
Digital data generally exists in one of three states: an at-rest state, an in-process state, and an in-transit state. For example, data stored in an offline storage unit is in the at-rest state. Data currently being processed, modified, or updated is in the in-process state. Data being communicated, such as across a network or between internal nodes of a system, is in the in-transit state. Data protection within a network can consist of an ensemble of cybersecurity technologies that include encryption. Encryption technologies provide data confidentiality and data integrity. Traditional encryption systems encrypt data in the at-rest and/or in-transit states. Encrypting data in only one or two of the data states, however, can leave the data vulnerable to compromise when it is not in an encrypted state, which is most of the time in traditional encryption systems. In such systems, this vulnerability is in addition to other vulnerabilities to the encrypted data due to trust relationships and the specific encryption implementation. Encryption technologies require a secure cryptographic key management solution to assure the implementation of encryption processes.
Current systems protect data in the in-transit state by providing or utilizing transport layer security (TLS), virtual private networks (VPN), and/or secure shell (SSH). TLS systems secure communication over a distributed communications network using public key infrastructure (PKI). For example, a TLS system can encrypt application layer data that is segmented at the transport layer of the transmission control protocol/Internet protocol (TCP/IP) model of network communication. TLS is commonly used to secure hypertext transfer protocol (HTTP) web application layer communication traffic. VPN systems can secure/encrypt network traffic, but are generally used for extending a private network boundary securely over an unsecure/untrusted distributed communications network, such as the Internet. SSH is a cryptographic network protocol for operating network services over an unsecure/untrusted communications network. For example, SSH systems can provide a secure channel over an unsecured network by using a client-server architecture that connects an SSH client application with an SSH server. Systems utilizing these technologies ensure that data between two parties is encrypted while transiting an untrusted network such as the Internet. These in-transit protections, however, end at the terminating points of the connection and leave data vulnerable to the malicious access through internal and trusted network resources after termination. In addition, systems that rely on PKI for protection are reliant on an external entity, such as a certificate authority, that generates, issues, and maintains the certificates. Malicious actors can steal keys and/or issue forged keys ultimately resulting in the defeat or degradation of the encryption system or protocol being used.
Systems that provide encryption for data in the at-rest state provide confidentiality of data while the data is being stored in a storage system, such as a hard disk, flash, memory, database, etc. Current encryption systems for data in the at-rest state are implemented such that when the data is being stored in the storage medium, it can only be decrypted with the appropriate encryption key(s). These systems vary, however, with respect to how they are implemented and can provide attack surfaces from a range of trusted entities and resources. In addition, data is rarely actually in the at-rest state as databases and hard disks are in an unlocked/decrypted state most of the time.
Data in the in-process state is not generally protected by these systems or technologies. In other words, current encryption systems only protect data in the at-rest and in-transit states, leaving data vulnerable while in the in-process state, in addition to vulnerabilities created by segmented, single, or two-stage encryption approaches.
SUMMARY
This section provides a general summary of the disclosure, and is not a comprehensive disclosure of its full scope or all of its features.
The present disclosure includes a method comprising generating, with a client module, an asymmetric key pair for a user, including a user private key and a user public key. The method also includes generating, with the client module, a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user. The method also includes encrypting, with the client module, the user private key using the symmetric encryption key to generate a user escrow key. The method also includes transmitting, with the client module, the user public key and the user escrow key to an encrypted content management module over a network, the encrypted content management module storing the user public key and the user escrow key in an encrypted content management storage unit. The method also includes encrypting, with a client module, plaintext data into ciphertext data using a content symmetric key. The method also includes storing, with the client module, the ciphertext data in a data storage unit. The method also includes generating, with the client module, an ephemeral pair of keys including an ephemeral public key and an ephemeral private key. The method also includes receiving, with the client module, the user public key from the encrypted content management module. The method also includes generating, with the client module, a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm. The method also includes encrypting, with the client module, the content symmetric key using the shared-secret key. The method also includes communicating, with the client module, the encrypted content symmetric key and the ephemeral public key to the encrypted content management module, the encrypted content management module storing the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
In other features, the method includes requesting and receiving, with the client module, the user escrow key from the encrypted content management module. The method also includes generating, with the client module, the symmetric encryption key based on the unique information known only to the user. The method also includes decrypting, with the client module, the user escrow key with the symmetric encryption key to obtain the user private key. The method also includes requesting and receiving, with the client module, the ephemeral public key from the encrypted content management module. The method also includes generating, with the client module, the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm. The method also includes requesting and receiving, with the client module, the encrypted content symmetric key from the encrypted content management module. The method also includes decrypting the encrypted content symmetric key using the shared-secret key. The method also includes retrieving the ciphertext data from the data storage unit. The method also includes decrypting the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
In other features, the unique information known to the user is a password.
In other features, the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
In other features, the cryptographic hardware is at least one of a smart card and a hardware token.
In other features, the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.
In other features, code for the client module is communicated over the network to an application module in communication with the data storage unit.
In other features, the code for the client module and the client module are each secured and protected from modification by the application module.
In other features, the unique information known to the user is provided directly to the client module without being received by the application module.
In other features, the method further includes displaying, with the client module, the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibiting access to the plaintext data by the application module.
In other features, the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.
The present disclosure also includes a system comprising a client module configured to generate an asymmetric key pair for a user, including a user private key and a user public key. The client module is further configured to generate a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user. The client module is further configured to encrypt the user private key using the symmetric encryption key to generate a user escrow key. The client module is further configured to transmit the user public key and the user escrow key to an encrypted content management module over a network, the encrypted content management module storing the user public key and the user escrow key in an encrypted content management storage unit. The client module is further configured to encrypt plaintext data into ciphertext data using a content symmetric key. The client module is further configured to store the ciphertext data in a data storage unit. The client module is further configured to generate an ephemeral pair of keys including an ephemeral public key and an ephemeral private key. The client module is further configured to receive the user public key from the encrypted content management storage unit. The client module is further configured to generate a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm. The client module is further configured to encrypt the content symmetric key using the shared-secret key. The client module is further configured to communicate the encrypted content symmetric key and the ephemeral public key to the encrypted content management module, the encrypted content management module storing the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
In other features, the client module is further configured to request and receiver the user escrow key from the encrypted content management storage unit. In other features, the client module is further configured to generate the symmetric encryption key based on the unique information known to the user. In other features, the client module is further configured to decrypt the user escrow key with the symmetric encryption key to obtain the user private key. In other features, the client module is further configured to request and receive the ephemeral public key and the encrypted content symmetric key from the encrypted content management storage unit. In other features, the client module is further configured to generate the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm. In other features, the client module is further configured to decrypt the encrypted content symmetric key using the shared-secret key. In other features, the client module is further configured to retrieve the ciphertext data from the data storage unit. In other features, the client module is further configured to decrypt the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
In other features, the unique information known to the user is a password.
In other features, the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
In other features, the cryptographic hardware is at least one of a smart card and a hardware token.
In other features, the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.
In other features, code for the client module is communicated over the network to an application module in communication with the data storage unit.
In other features, the code for the client module and the client module are each secured and protected from modification by the application module.
In other features, the unique information known to the user is provided directly to the client module without being received by the application module.
In other features, the client module is further configured to display the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibiting access to the plaintext data by the application module.
In other features, the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.
The present disclosure also includes a method comprising generating, with a client module, an asymmetric key pair for a user, including a user private key and a user public key. The method also includes generating, with the client module, a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user. The method also includes encrypting, with the client module, the user private key using the symmetric encryption key to generate a user escrow key. The method also includes transmitting, with the client module, the user public key and the user escrow key to an encrypted content management module over a network, the encrypted content management module storing the user public key and the user escrow key in an encrypted content management storage unit. The method also includes generating, with the client module, a group asymmetric key pair including a group private key and a group public key. The method also includes generating, with the client module, a group symmetric encryption key. The method also includes encrypting, with the client module, the group private key with the group symmetric encryption key. The method also includes generating, with the client module, a first shared-secret key based on the user public key and the group private key using a diffie-hellman exchange algorithm. The method also includes encrypting, with the client module, the group
CROSS-REFERENCE TO RELATED APPLICATIONS
This application is a continuation of U.S. patent application Ser. No. 17/704,065, filed Mar. 25, 2022, which is a continuation of U.S. patent application Ser. No. 17/507,199, filed on Oct. 21, 2021, now U.S. Pat. No. 11,316,685, which is a continuation of U.S. patent application Ser. No. 17/151,391, filed on Jan. 18, 2021, now U.S. Pat. No. 11,372,986. The entire disclosures of the above applications are incorporated herein by reference.
FIELD
The present disclosure relates to systems and methods for encrypted content management, including systems and methods that provide cryptographic key management.
BACKGROUND
This section provides background information related to the present disclosure which is not necessarily prior art.
Traditional information systems accomplish security by authenticating users and processes and then allowing or denying access to internal network resources based on the authentication result. This approach allows internal network resources to trust one another in addition to authenticated external users. These trust relationships, however, can be exploited. Once the network perimeter is breached by an unauthorized user, all internal data can be compromised, accessed, and modified.
Digital data generally exists in one of three states: an at-rest state, an in-process state, and an in-transit state. For example, data stored in an offline storage unit is in the at-rest state. Data currently being processed, modified, or updated is in the in-process state. Data being communicated, such as across a network or between internal nodes of a system, is in the in-transit state. Data protection within a network can consist of an ensemble of cybersecurity technologies that include encryption. Encryption technologies provide data confidentiality and data integrity. Traditional encryption systems encrypt data in the at-rest and/or in-transit states. Encrypting data in only one or two of the data states, however, can leave the data vulnerable to compromise when it is not in an encrypted state, which is most of the time in traditional encryption systems. In such systems, this vulnerability is in addition to other vulnerabilities to the encrypted data due to trust relationships and the specific encryption implementation. Encryption technologies require a secure cryptographic key management solution to assure the implementation of encryption processes.
Current systems protect data in the in-transit state by providing or utilizing transport layer security (TLS), virtual private networks (VPN), and/or secure shell (SSH). TLS systems secure communication over a distributed communications network using public key infrastructure (PKI). For example, a TLS system can encrypt application layer data that is segmented at the transport layer of the transmission control protocol/Internet protocol (TCP/IP) model of network communication. TLS is commonly used to secure hypertext transfer protocol (HTTP) web application layer communication traffic. VPN systems can secure/encrypt network traffic, but are generally used for extending a private network boundary securely over an unsecure/untrusted distributed communications network, such as the Internet. SSH is a cryptographic network protocol for operating network services over an unsecure/untrusted communications network. For example, SSH systems can provide a secure channel over an unsecured network by using a client-server architecture that connects an SSH client application with an SSH server. Systems utilizing these technologies ensure that data between two parties is encrypted while transiting an untrusted network such as the Internet. These in-transit protections, however, end at the terminating points of the connection and leave data vulnerable to the malicious access through internal and trusted network resources after termination. In addition, systems that rely on PKI for protection are reliant on an external entity, such as a certificate authority, that generates, issues, and maintains the certificates. Malicious actors can steal keys and/or issue forged keys ultimately resulting in the defeat or degradation of the encryption system or protocol being used.
Systems that provide encryption for data in the at-rest state provide confidentiality of data while the data is being stored in a storage system, such as a hard disk, flash, memory, database, etc. Current encryption systems for data in the at-rest state are implemented such that when the data is being stored in the storage medium, it can only be decrypted with the appropriate encryption key(s). These systems vary, however, with respect to how they are implemented and can provide attack surfaces from a range of trusted entities and resources. In addition, data is rarely actually in the at-rest state as databases and hard disks are in an unlocked/decrypted state most of the time.
Data in the in-process state is not generally protected by these systems or technologies. In other words, current encryption systems only protect data in the at-rest and in-transit states, leaving data vulnerable while in the in-process state, in addition to vulnerabilities created by segmented, single, or two-stage encryption approaches.
SUMMARY
This section provides a general summary of the disclosure, and is not a comprehensive disclosure of its full scope or all of its features.
The present disclosure includes a method comprising generating, with a client module, an asymmetric key pair for a user, including a user private key and a user public key. The method also includes generating, with the client module, a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user. The method also includes encrypting, with the client module, the user private key using the symmetric encryption key to generate a user escrow key. The method also includes transmitting, with the client module, the user public key and the user escrow key to an encrypted content management module over a network, the encrypted content management module storing the user public key and the user escrow key in an encrypted content management storage unit. The method also includes encrypting, with a client module, plaintext data into ciphertext data using a content symmetric key. The method also includes storing, with the client module, the ciphertext data in a data storage unit. The method also includes generating, with the client module, an ephemeral pair of keys including an ephemeral public key and an ephemeral private key. The method also includes receiving, with the client module, the user public key from the encrypted content management module. The method also includes generating, with the client module, a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm. The method also includes encrypting, with the client module, the content symmetric key using the shared-secret key. The method also includes communicating, with the client module, the encrypted content symmetric key and the ephemeral public key to the encrypted content management module, the encrypted content management module storing the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
In other features, the method includes requesting and receiving, with the client module, the user escrow key from the encrypted content management module. The method also includes generating, with the client module, the symmetric encryption key based on the unique information known only to the user. The method also includes decrypting, with the client module, the user escrow key with the symmetric encryption key to obtain the user private key. The method also includes requesting and receiving, with the client module, the ephemeral public key from the encrypted content management module. The method also includes generating, with the client module, the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm. The method also includes requesting and receiving, with the client module, the encrypted content symmetric key from the encrypted content management module. The method also includes decrypting the encrypted content symmetric key using the shared-secret key. The method also includes retrieving the ciphertext data from the data storage unit. The method also includes decrypting the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
In other features, the unique information known to the user is a password.
In other features, the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
In other features, the cryptographic hardware is at least one of a smart card and a hardware token.
In other features, the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.
In other features, code for the client module is communicated over the network to an application module in communication with the data storage unit.
In other features, the code for the client module and the client module are each secured and protected from modification by the application module.
In other features, the unique information known to the user is provided directly to the client module without being received by the application module.
In other features, the method further includes displaying, with the client module, the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibiting access to the plaintext data by the application module.
In other features, the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.
The present disclosure also includes a system comprising a client module configured to generate an asymmetric key pair for a user, including a user private key and a user public key. The client module is further configured to generate a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user. The client module is further configured to encrypt the user private key using the symmetric encryption key to generate a user escrow key. The client module is further configured to transmit the user public key and the user escrow key to an encrypted content management module over a network, the encrypted content management module storing the user public key and the user escrow key in an encrypted content management storage unit. The client module is further configured to encrypt plaintext data into ciphertext data using a content symmetric key. The client module is further configured to store the ciphertext data in a data storage unit. The client module is further configured to generate an ephemeral pair of keys including an ephemeral public key and an ephemeral private key. The client module is further configured to receive the user public key from the encrypted content management storage unit. The client module is further configured to generate a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm. The client module is further configured to encrypt the content symmetric key using the shared-secret key. The client module is further configured to communicate the encrypted content symmetric key and the ephemeral public key to the encrypted content management module, the encrypted content management module storing the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
In other features, the client module is further configured to request and receiver the user escrow key from the encrypted content management storage unit. In other features, the client module is further configured to generate the symmetric encryption key based on the unique information known to the user. In other features, the client module is further configured to decrypt the user escrow key with the symmetric encryption key to obtain the user private key. In other features, the client module is further configured to request and receive the ephemeral public key and the encrypted content symmetric key from the encrypted content management storage unit. In other features, the client module is further configured to generate the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm. In other features, the client module is further configured to decrypt the encrypted content symmetric key using the shared-secret key. In other features, the client module is further configured to retrieve the ciphertext data from the data storage unit. In other features, the client module is further configured to decrypt the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
In other features, the unique information known to the user is a password.
In other features, the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
In other features, the cryptographic hardware is at least one of a smart card and a hardware token.
In other features, the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.
In other features, code for the client module is communicated over the network to an application module in communication with the data storage unit.
In other features, the code for the client module and the client module are each secured and protected from modification by the application module.
In other features, the unique information known to the user is provided directly to the client module without being received by the application module.
In other features, the client module is further configured to display the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibiting access to the plaintext data by the application module.
In other features, the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.
The present disclosure also includes a method comprising generating, with a client module, an asymmetric key pair for a user, including a user private key and a user public key. The method also includes generating, with the client module, a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user. The method also includes encrypting, with the client module, the user private key using the symmetric encryption key to generate a user escrow key. The method also includes transmitting, with the client module, the user public key and the user escrow key to an encrypted content management module over a network, the encrypted content management module storing the user public key and the user escrow key in an encrypted content management storage unit. The method also includes generating, with the client module, a group asymmetric key pair including a group private key and a group public key. The method also includes generating, with the client module, a group symmetric encryption key. The method also includes encrypting, with the client module, the group private key with the group symmetric encryption key. The method also includes generating, with the client module, a first shared-secret key based on the user public key and the group private key using a diffie-hellman exchange algorithm. The method also includes encrypting, with the client module, the group symmetric encryption key using the first shared-secret key to generate an escrow key. The method also includes communicating, with the client module, the group public key, the encrypted group private key, and the escrow key to the encrypted content management module, the encrypted content management module storing the group public key, the encrypted group private key, and the escrow key in the encrypted content management storage unit. The method also includes encrypting, with the client module, plaintext data into ciphertext data using a content symmetric key. The method also includes storing, with the client module, the ciphertext data in a data storage unit. The method also includes generating, with the client module, an ephemeral pair of keys including an ephemeral public key and an ephemeral private key. The method also includes receiving, with the client module, the group public key from the encrypted content management module. The method also includes generating, with the client module, a second shared-secret key based on the ephemeral private key and the group public key using a diffie-hellman exchange algorithm. The method also includes encrypting, with the client module, the content symmetric key using the second shared-secret key. The method also includes communicating, with the client module, the encrypted content symmetric key and the ephemeral public key to the encrypted content management module, the encrypted content management module storing the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
In other features, the method further includes requesting and receiving, with the client module, the user escrow key from the encrypted content management module. The method also includes generating, with the client module, the symmetric encryption key based on the unique information known to the user. The method also includes decrypting, with the client module, the user escrow key with the symmetric encryption key to obtain the user private key. The method also includes requesting and receiving, with the client module, the group public key from the encrypted content management module. The method also includes generating, with the client module, the first shared-secret key based on the user private key and the group public key. The method also includes requesting and receiving, with the client module, the escrow key from the encrypted content management module. The method also includes decrypting, with the client module, the escrow key using the first shared-secret key to recover the group symmetric encryption key. The method also includes requesting and receiving, with the client module, the encrypted group private key from the encrypted content management module. The method also includes decrypting, with the client module, the encrypted group private key using the group symmetric encryption key to recover the decrypted group private key. The method also includes requesting and receiving, with the client module, the encrypted content symmetric key and the ephemeral public key from the encrypted content management module. The method also includes generating, with the client module, the second shared-secret key based on the ephemeral public key and the decrypted group private key. The method also includes decrypting the encrypted content symmetric key using the second shared-secret key. The method also includes retrieving the ciphertext data from the data storage unit. The method also includes decrypting the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
In other features, the unique information known to the user is a password.
In other features, the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
In other features, the cryptographic hardware is at least one of a smart card and a hardware token.
The present disclosure also includes a system comprising a client module configured to generate an asymmetric key pair for a user, including a user private key and a user public key. The client module is further configured to generate a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user. The client module is further configured to encrypt the user private key using the symmetric encryption key to generate a user escrow key. The client module is further configured to transmit the user public key and the user escrow key to an encrypted content management module over a network, the encrypted content management module storing the user public key and the user escrow key in an encrypted content management storage unit. The client module is further configured to generate a group asymmetric key pair including a group private key and a group public key. The client module is further configured to generate a group symmetric encryption key. The client module is further configured to encrypt the group private key with the group symmetric encryption key. The client module is further configured to generate a first shared-secret key based on the user public key and the group private key using a diffie-hellman exchange algorithm. The client module is further configured to encrypt the group symmetric encryption key using the first shared-secret key to generate a group escrow key. The client module is further configured to communicate the group public key, the encrypted group private key, and the group escrow key to the encrypted content management module, the encrypted content management module storing the group public key, the encrypted group private key, and the group escrow key in the encrypted content management storage unit. The client module is further configured to encrypt plaintext data into ciphertext data using a content symmetric key. The client module is further configured to store the ciphertext data in a data storage unit. The client module is further configured to generate an ephemeral pair of keys including an ephemeral public key and an ephemeral private key. The client module is further configured to receive the group public key from the encrypted content management module. The client module is further configured to generate a second shared-secret key based on the ephemeral private key and the group public key using a diffie-hellman exchange algorithm. The client module is further configured to encrypt the content symmetric key using the second shared-secret key. The client module is further configured to communicate the encrypted content symmetric key and the ephemeral public key to the encrypted content management module, the encrypted content management module storing the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
In other features, the client module is further configured to request and receive the user escrow key from the encrypted content management module. The client module is further configured to generate the symmetric encryption key based on the unique information known to the user. The client module is further configured to decrypt the user escrow key with the symmetric encryption key to obtain the user private key. The client module is further configured to generate the first shared-secret key based on the user private key and the group public key. The client module is further configured to request and receive the group escrow key from the encrypted content management module. The client module is further configured to decrypt the group escrow key using the first shared-secret key to recover the group symmetric encryption key. The client module is further configured to request and receive the encrypted group private key from the encrypted content management module. The client module is further configured to decrypt the encrypted group private key using the group symmetric encryption key to recover the decrypted group private key. The client module is further configured to request and receive the encrypted content symmetric key and the ephemeral public key from the encrypted content management module. The client module is further configured to generate the second shared-secret key based on the ephemeral public key and the decrypted group private key. The client module is further configured to decrypt the encrypted content symmetric key using the second shared-secret key. The client module is further configured to retrieve the ciphertext data from the data storage unit. The client module is further configured to decrypt the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
In other features, the unique information known to the user is a password.
In other features, the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
In other features, the cryptographic hardware is at least one of a smart card and a hardware token.
Further areas of applicability will become apparent from the description provided herein. The description and specific examples in this summary are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure.
DRAWINGS
The drawings described herein are for illustrative purposes only of selected embodiments and not all possible implementations, and are not intended to limit the scope of the present disclosure.
FIG. 1 is a functional block diagram of an encrypted content management system according to the present disclosure.
FIG. 2 is a functional block diagram of a server of an encrypted content management system according to the present disclosure.
FIG. 3 is a functional block diagram of a client device of an encrypted content management system according to the present disclosure.
FIG. 4 is a flow diagram for a user key creation process of an encrypted content management method according to the present disclosure.
FIG. 5 is a flow diagram for a content encryption process using a user key of an encrypted content management method according to the present disclosure.
FIG. 6 is a flow diagram for a content decryption process using a user key of an encrypted content management method according to the present disclosure.
FIG. 7 is a flow diagram for a group key creation process of an encrypted content management method according to the present disclosure.
FIG. 8 is a flow diagram for a content encryption process using a group key of an encrypted content management method according to the present disclosure.
FIG. 9 A is a flow diagram for a content decryption process using a group key of another encrypted content management method according to the present disclosure.
FIG. 9 B is a continuation of the flow diagram from FIG. 9 A .
Corresponding reference numerals indicate corresponding parts throughout the several views of the drawings.
DETAILED DESCRIPTION
Example embodiments will now be described more fully with reference to the accompanying drawings.
The Encrypted Content Management (ECM) systems and methods of the present disclosure protect digital data end-to-end, across all states, including the at-rest, in-process, and in-transit states. The present disclosure implements a no-knowledge design with a repository of cryptographic material and resource locators that map the location of encrypted data and the location of the associated encryption keys. The no-knowledge design prevents any single system resource from accessing and/or identifying the correct key to decrypt any of the data. The no-knowledge design of the present disclosure is in contrast to other systems that store the information needed to decrypt data and accomplish security by authenticating users and processes and allowing access to internal network resources based on the authentication result. In addition, as discussed in further detail below, the no-knowledge design also utilizes a number of additional intermediary keys to derive the correct key to decrypt data and those additional intermediary keys are also protected and/or hidden by the ECM systems and methods of the present disclosure. This no-knowledge approach provides a clear advantage over previous approaches by ensuring that data can only be decrypted after it is delivered to an authenticated end-user, eliminating attack surfaces in the segmented encryption approach used today.
The ECM systems and methods of the present disclosure include software components that provide cryptographic key management functionality, including authentication, request handling, escrow keying, and an encrypted content database.
The cryptographic key management functionality enables external processes to encrypt data and allow future recovery of the encrypted data by some entity or entities in a secure manner. The encryption process functionally receives some plaintext (unencrypted) data as input, applies a transform (encryption algorithm), and outputs ciphertext (encrypted) data. Different cryptographic algorithms and processes are applied in a unique manner by ECM systems and methods of the present disclosure to protect the integrity of the data encryption processes utilized. The unique methods employed by the ECM systems of the present disclosure ensure secure data encryption across all three states of data.
The ECM systems and methods of the present disclosure utilize both symmetric and asymmetric cryptographic primitives. Symmetric encryption algorithms rely on a single key to both encrypt and decrypt data. The ECM systems and methods of the present disclosure utilize the Advanced Encryption Standard (AES) for symmetric encryption operations, although other symmetric encryption algorithms could be alternatively used. A symmetric encryption operation using AES is performed in a block mode such that the data is encrypted over a fixed unit of data. For example, using a 16 byte block size means the larger plaintext is divided into N/16 blocks where N is the size of the ciphertext. A padding function can be applied to data that is too short to fill a block completely. Cipher Block Chaining (CBC) and Galois Counter Mode (GCM) are the preferred AES block modes, although any mode is sufficient to work with the ECM systems and methods of the present disclosure. In addition, the ECM systems and methods of the present disclosure can support and utilize other symmetric encryption algorithms as the final symmetric key is derived from asymmetric keys external to the system, i.e., by a client on client hardware.
A symmetric key is of a specific bit-length, e.g., 128 or 256 bits in AES, referred to as the control vector (CV). When used as a block cipher in CBC mode, a secure random initialization vector (IV) is generated and must be provided along with the CV to decrypt the ciphertext. The encryption and decryption operation in CBC mode is performed over sequential blocks because each block depends on a predecessor IV, resulting in the need to store the first IV together with the CV. In GCM mode, a nonce is used as the IV and unlike CBC mode, blocks can be decrypted in parallel, i.e., each block is not dependent on the previous block to decrypt, although the initial IV nonce must still be stored with the CV for decryption operations to succeed.
A symmetric key must be protected from compromise as once it is revealed, any data that has been encrypted with the key can be decrypted. Within the context of a distributed communication network, one or more parties may need access to the symmetric key without revealing it to eavesdropping attacks or other unintended recipients. The ECM systems and methods of the present disclosure use properties of asymmetric cryptographic algorithms to generate symmetric keys while facilitating a safe way to communicate over an untrusted/unencrypted network.
Asymmetric cryptographic primitives use mathematical properties that result in two keys: a public key utilized in the encryption process and a private key utilized in the decryption process. Because only the private key can be used to decrypt data, it must be protected like a symmetric key, as discussed above. The public key however is unrestricted and may be sent over an untrusted/unsecure communications channel. Only the corresponding private key can be used to decrypt data that the public key was used to encrypt. In other words, once data is encrypted using the public key, it can only be encrypted using the corresponding private key.
As discussed in further detail below, the ECM systems and methods of the present disclosure use Elliptic-curve cryptography (ECC) asymmetric keys to derive symmetric encryption keys using the Diffie-Hellman key exchange algorithm known as Elliptic-curve Diffie-Hellman (ECDH). The Diffie-Hellman key exchange algorithm is described, for example, in U.S. Pat. No. 4,200,770, titled âCryptographic Apparatus and Method,â which is incorporated herein by reference in its entirety. The key exchange process starts with generating an ephemeral ECC key pair. The ephemeral pair's private key is exchanged with an entity's public key. The exchange process results in a shared-secret that is hashed to produce a CV (symmetric key) and IV. More specifically, the hash function generates a hash of the shared secret that is at least as long as the required CV plus IV length. The public key from the ephemeral pair is provide back to the entity who can then reverse the process to derive the same symmetric key for decryption. For example, the entity can utilize the ECDH algorithm to exchange the ephemeral pair's public key with the entity's private key to arrive at the same shared-secret, which can then be hashed to produce the same CV (symmetric key) and IV. In other words, the entity's private key is exchanged with the ephemeral public key, which results in the same shared-secret key thus enabling the final derivation of the CV and IV. In this way, the same shared-secret key can be derived using the ECDH algorithm based on (i) exchanging the ephemeral pair's public key with the entity's private key; or (ii) exchanging the ephemeral pair's private key with the entity's public key. Either combination of keys results in the same shared-secret, which can be used to derive the CV and IV.
With reference to FIG. 1 , an ECM system 10 is shown and includes an ECM module 100 in communication with a client module 102 over a communication network 104 . The communication network 104 can include a wide area network (WAN), such as the Internet, and/or a local area network (LAN). The ECM module 100 includes a request handler module 106 that receives and responds to requests from the client module 102 , an authentication module 108 that authenticates users who interact with the ECM module 100 via the client module (all interaction/communication with the ECM module 100 over the communication network 104 is authenticated), and an escrow keying module 110 that controls access to various cryptographic keys, as discussed in further detail below. The ECM module 100 is in communication with an ECM storage unit 112 . The client module 102 is in communication with one or more application modules 114 , which are in communication with a client data storage unit 116 . In this way, the client module 102 is in communication with both the ECM module 100 and with an application module 114 . The application module 114 , for example, can load the client module 102 utilizing protections to prevent the application module 114 from improperly modifying the client module 102 . The client module 102 can then communicate with the application module 114 to store and retrieve cipher text from the data storage unit 116 . The client module 102 can then decrypt the cipher text to recover the unencrypted data that is communicated back to the application module 114 for output/display by the application module 114 , as discussed in further detail below. While one client module 102 is shown in FIG. 1 for purposes of illustration, the ECM system 10 can utilize and include multiple client modules 102 with each client module 102 being in communication with the ECM module 100 over the communication network 104 and with each client module 102 being in communication with one or more application modules 114 .
With reference to FIG. 1 and FIG. 2 , the ECM module 100 , request handler module 106 , authentication module 108 , escrow keying module 110 , and ECM storage unit 112 are implemented by a server 200 . The server 200 includes a central processing unit (CPU) 202 , memory 204 , a network interface 206 , volatile storage 208 , and input/output interfaces 210 . The memory 204 stores executable code for applications 212 and for the server's operating system (OS) 214 . The memory 204 also stores executable ECM code 216 for the ECM module 100 , executable request handler code 218 for the request handler module 106 , executable authentication code 220 for the authentication module 108 , and executable escrow keying code 222 for the escrow keying module 110 . The memory 204 also includes a database 224 corresponding to the ECM storage unit 112 . In this way, the software components utilized by the ECM systems and methods of the present disclosure are compiled into binary distribution files that are executed by the CPU 202 of the server. The server's OS 214 handles coordinating the input/output of the hardware resources and executing the ECM system's binary executable files, including the ECM code 216 , the request handler code 218 , the authentication code 220 , and the escrow keying code 222 . The server 200 can be a physical device with dedicated hardware or can be a virtual machine that shares a part of dedicated hardware resources, such as a hypervisor.
With reference to FIGS. 1 , 2 , and 3 , the client module 102 and application module(s) 114 are implemented by a client device 300 . As noted above, while FIG. 1 and FIG. 3 show a single client module 102 and a single client device 300 , for purposes of illustration, the ECM system 10 can utilize and include multiple client modules 102 and multiple client devices 300 . The client device 300 includes a CPU 302 , a memory 304 , a network interface 306 , a volatile storage 308 , and input/output interfaces 301 . The memory 304 stores code for applications 312 and for the client's operating system (OS) 314 . The client device 300 is capable of communicating over the communication network 104 , i.e., distributed communications infrastructure such as a LAN, a WAN, the Internet, corporate Intranet, etc., via the network interface 306 .
The ECM module 100 running on the server 200 listens for requests over its network interface from one or more client modules 102 running on one or more client devices 300 . Communication over the communication network 104 between the ECM module 100 and the one or more client modules 102 are governed by the TCP/IP stack. The server OS 214 and the client device 300 OS 314 handle the underlying communication segmentation, which is transparent to the ECM software components that are only concerne
CLAIMS
Claims ( 22 )
What is claimed is:
1. A method comprising:
receiving, with an encrypted content management module, a user public key and a user escrow key transmitted from a client module, the client module having a processor and memory configured to (i) generate an asymmetric key pair for a user, including a user private key and the user public key, (ii) generate a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user, (iii) encrypt the user private key using the symmetric encryption key to generate the user escrow key, (iv) transmit the user public key and the user escrow key, (v) encrypt plaintext data into ciphertext data using a content symmetric key, (vi) store the ciphertext data in a data storage unit, and generate an ephemeral pair of keys including an ephemeral public key and an ephemeral private key;
storing, with the encrypted content management module, the user public key and the user escrow key;
transmitting, with the encrypted content management module, the user public key to the client module, the processor and memory of the client module being further configured to (vii) generate a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm, (viii) encrypt the content symmetric key using the shared-secret key, and (ix) communicate the encrypted content symmetric key and the ephemeral public key to the encrypted content management module;
receiving, with the encrypted content management module, the encrypted content symmetric key and the ephemeral public key from the client module and
storing, with the encrypted content management module, the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
2. The method of claim 1 , further comprising:
receiving, with the encrypted content management module, a request from the client module for the user escrow key;
transmitting, with the encrypted content management module, the user escrow key to the client module, the processor and memory of the client module being further configured to generate the symmetric encryption key based on the unique information known only to the user, and decrypt the user escrow key with the symmetric encryption key to obtain the user private key;
receiving, with the encrypted content management module, a request from the client module for the ephemeral public key;
transmitting, with the encrypted content management module, the ephemeral public key to the client module, the processor and memory of the client module being further configured to generate the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm;
receiving, with the encrypted content management module, a request from the client module for the encrypted content symmetric key;
transmitting, with the encrypted content management module, the encrypted content symmetric key to the client module, the processor and memory of the client module being further configured to decrypt the encrypted content symmetric key using the shared-secret key, retrieve the ciphertext data from the data storage unit, and decrypt the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
3. The method of claim 1 , wherein the unique information known to the user is a password.
4. The method of claim 1 , wherein the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
5. The method of claim 4 , wherein the cryptographic hardware is at least one of a smart card and a hardware token.
6. The method of claim 1 , wherein the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.
7. The method of claim 1 , wherein code for the client module is communicated over the network to an application module in communication with the data storage unit.
8. The method of claim 7 , wherein the code for the client module and the client module are each secured and protected from modification by the application module.
9. The method of claim 7 , wherein the unique information known to the user is provided directly to the client module without being received by the application module.
10. The method of claim 7 , wherein the processor and memory of the client module are further configured to display the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibiting access to the plaintext data by the application module.
11. The method of claim 1 , wherein the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.
12. A system comprising:
at least one processor and memory storing code for an encrypted content management module that, when executed by the at least one processor, causes the at least one processor to:
receive a user public key and a user escrow key transmitted from a client module, the client module having a processor and memory configured to (i) generate an asymmetric key pair for a user, including a user private key and the user public key, (ii) generate a symmetric encryption key for the user, the symmetric encryption key being generated based on unique information known to the user, (iii) encrypt the user private key using the symmetric encryption key to generate the user escrow key, (iv) transmit the user public key and the user escrow key, (v) encrypt plaintext data into ciphertext data using a content symmetric key, (vi) store the ciphertext data in a data storage unit, and generate an ephemeral pair of keys including an ephemeral public key and an ephemeral private key;
store the user public key and the user escrow key;
transmit the user public key to the client module, the processor and memory of the client module being further configured to (vii) generate a shared-secret key based on the ephemeral private key and the user public key using a diffie-hellman exchange algorithm, (viii) encrypt the content symmetric key using the shared-secret key, and (ix) communicate the encrypted content symmetric key and the ephemeral public key to the encrypted content management module;
receive the encrypted content symmetric key and the ephemeral public key from the client module and
store the encrypted content symmetric key and the ephemeral public key in the encrypted content management storage unit.
13. The system of claim 12 , wherein the code for the encrypted content management module, when executed by the at least one processor, further causes the at least one processor to:
transmit the user escrow key to the client module in response to receiving a request for the user escrow key from the client module, the processor and memory of the client module being further configured to generate the symmetric encryption key based on the unique information known to the user, and decrypt the user escrow key with the symmetric encryption key to obtain the user private key;
transmit the ephemeral public key and the encrypted content symmetric key to the client module in response to receiving a request for the ephemeral public key and the encrypted content symmetric key from the client module, the processor and memory of the client module being further configured to generate the shared-secret key based on the ephemeral public key and the user private key using the diffie-hellman exchange algorithm, decrypt the encrypted content symmetric key using the shared-secret key, retrieve the ciphertext data from the data storage unit, and decrypt the ciphertext data using the decrypted content symmetric key to obtain the plaintext data.
14. The system of claim 12 , wherein the unique information known to the user is a password.
15. The system of claim 12 , wherein the unique information known to the user is stored on cryptographic hardware that is in the possession of the user.
16. The system of claim 15 , wherein the cryptographic hardware is at least one of a smart card and a hardware token.
17. The system of claim 16 , wherein the plaintext data is encrypted into a plurality of different encrypted ciphertext versions of the plaintext data and the plurality of different encrypted ciphertext versions are stored in the data storage unit, each of the different encrypted ciphertext versions of the plaintext data being configured for decryption by a different decrypted content symmetric key associated with a different user.
18. The system of claim 16 , wherein code for the client module is communicated over the network to an application module in communication with the data storage unit.
19. The system of claim 18 , wherein the code for the client module and the client module are each secured and protected from modification by the application module.
20. The system of claim 18 , wherein the unique information known to the user is provided directly to the client module without being received by the application module.
21. The system of claim 18 , wherein the processor and memory of the client module are further configured to display the plaintext data after the ciphertext data is decrypted into the plaintext data on a display device and prohibit access to the plaintext data by the application module.
22. The system of claim 12 , wherein the encrypted content management module is configured such that access to the encrypted content management storage unit can be revoked.
US18/174,713
2021-01-18
2023-02-27
Systems and methods for encrypted content management
Active
US12003634B2
( en )
Priority Applications (1)
Application Number
Priority Date
Filing Date
Title
US18/174,713
US12003634B2
( en )
2021-01-18
2023-02-27
Systems and methods for encrypted content management
Applications Claiming Priority (4)
Application Number
Priority Date
Filing Date
Title
US17/151,391
US11372986B1
( en )
2021-01-18
2021-01-18
Systems and methods for encrypted content management
US17/507,199
US11316685B1
( en )
2021-01-18
2021-10-21
Systems and methods for encrypted content management
US17/704,065
US11595203B2
( en )
2021-01-18
2022-03-25
Systems and methods for encrypted content management
US18/174,713
US12003634B2
( en )
2021-01-18
2023-02-27
Systems and methods for encrypted content management
Related Parent Applications (1)
Application Number
Title
Priority Date
Filing Date
US17/704,065
Continuation
US11595203B2
( en )
2021-01-18
2022-03-25
Systems and methods for encrypted content management
Publications (2)
Publication Number
Publication Date
US20230231709A1
US20230231709A1 ( en )
2023-07-20
US12003634B2
true
US12003634B2 ( en )
2024-06-04
Family
ID=81259895
Family Applications (4)
Application Number
Title
Priority Date
Filing Date
US17/151,391
Active
2041-02-01
US11372986B1
( en )
2021-01-18
2021-01-18
Systems and methods for encrypted content management
US17/507,199
Active
US11316685B1
( en )
2021-01-18
2021-10-21
Systems and methods for encrypted content management
US17/704,065
Active
US11595203B2
( en )
2021-01-18
2022-03-25
Systems and methods for encrypted content management
US18/174,713
Active
US12003634B2
( en )
2021-01-18
2023-02-27
Systems and methods for encrypted content management
Family Applications Before (3)
Application Number
Title
Priority Date
Filing Date
US17/151,391
Active
2041-02-01
US11372986B1
( en )
2021-01-18
2021-01-18
Systems and methods for encrypted content management
US17/507,199
Active
US11316685B1
( en )
2021-01-18
2021-10-21
Systems and methods for encrypted content management
US17/704,065
Active
US11595203B2
( en )
2021-01-18
2022-03-25
Systems and methods for encrypted content management
Country Status (3)
Country
Link
US
( 4 )
US11372986B1
( en )
EP
( 1 )
EP4278556A4
( en )
WO
( 1 )
WO2022154843A1
( en )
Families Citing this family (27)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US12463828B2
( en )
*
2021-09-06
2025-11-04
Hyundai Motor Company
Method and device for installing certificate on basis of encryption and decryption of contract certificate private key
US12169587B2
( en )
*
2021-04-06
2024-12-17
Comcast Cable Communications, Llc
Systems and methods for data security on a mobile device
WO2023023821A1
( en )
*
2021-08-25
2023-03-02
Ric B Richardson
Method of transaction escrow using blockchain wallets
KR102568418B1
( en )
*
2021-08-26
2023-08-18
íì´íì´ë¸ë© 주ìíì¬
Electronic authentication system and method supporting multi-signature
US12261946B2
( en )
*
2021-09-15
2025-03-25
SafeMoon US, LLC
System and method of creating symmetric keys using elliptic curve cryptography
US11575507B1
( en )
*
2021-09-21
2023-02-07
Uab 360 It
Sharing access to data
US11502826B1
( en )
2021-09-21
2022-11-15
Uab 360 It
Stateless system to encrypt and decrypt data
US11526281B1
( en )
2021-09-23
2022-12-13
Uab 360 It
Sharing data in an organized storage system
US11646874B2
( en )
2021-09-23
2023-05-09
Uab 360 It
Organized data storage system
TWI868416B
( en )
*
2021-12-29
2025-01-01
æ°åç§æè¡ä»½æéå ¬å¸
Method and device for protecting and managing key
US12225130B2
( en )
*
2022-01-14
2025-02-11
Micron Technology, Inc.
Embedded TLS protocol for lightweight devices
US12225111B2
( en )
*
2022-03-08
2025-02-11
SanDisk Technologies, Inc.
Authorization requests from a data storage device to multiple manager devices
US20230300120A1
( en )
*
2022-03-15
2023-09-21
The United States Of America, As Represented By The Secretary Of The Navy
System and method for lattice-based cryptography
CN114785619B
( en )
*
2022-06-16
2022-08-26
æ¹åå·¥å大å¦
Dynamic missing encryption system
CN115225352B
( en )
*
2022-06-30
2024-04-23
å¦é¨èè¡åä¿¡æ¯ç§ææéå ¬å¸
Hybrid encryption method and system
US20220391494A1
( en )
*
2022-07-01
2022-12-08
Intel Corporation
Sharing container data inside a tenant's pod under different trusted execution environments (tees)
US20240020693A1
( en )
*
2022-07-14
2024-01-18
Shilpa Akunuri
Method and system for identifying, validating and transfering soft or hard physical asset using digital surrogate
CN115396099A
( en )
*
2022-08-31
2022-11-25
å京ç¥å·æ°ç æ¹åç§ææéå ¬å¸
Trusted trusting method and system, and obtaining method and system for asymmetric key
CN115580489B
( en )
*
2022-11-24
2023-03-17
å京ç¾åº¦ç½è®¯ç§ææéå ¬å¸
Data transmission method, device, equipment and storage medium
CN118118201A
( en )
*
2022-11-29
2024-05-31
å为ææ¯æéå ¬å¸
Video stream secure transmission method and device
CN117527284B
( en )
*
2022-12-30
2024-08-06
西å大å¦
Firewall filtering method for base Yu Qungong key encryption equivalence test
CN116388970B
( en )
*
2023-03-03
2023-11-28
京信æ°æ®ç§ææéå ¬å¸
Centralized cloud computing implementation method and device based on multiparty data
US12267307B2
( en )
*
2023-03-21
2025-04-01
International Business Machines Corporation
Secure console log interaction in a data center
CN116776346B
( en )
*
2023-06-08
2024-03-05
å京å¸è大å¦å¸¸å·åæ°åå±ç 究é¢
Data security management system
US20250097018A1
( en )
*
2023-09-19
2025-03-20
Apple Inc.
Secure Key Exchange
US12543038B2
( en )
2023-11-17
2026-02-03
Phoenix Technologies EMEA, Ltd.
Attestation process and system for wireless security
CN118199880B
( en )
*
2024-05-15
2024-08-02
ä¸æµ·é»ç³ä¿¡æ¯ææ¯æéå ¬å¸
Communication protocol, system, equipment and medium based on ECDH algorithm
Citations (23)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US4200770A
( en )
1977-09-06
1980-04-29
Stanford University
Cryptographic apparatus and method
US5142578A
( en )
*
1991-08-22
1992-08-25
International Business Machines Corporation
Hybrid public key algorithm/data encryption algorithm key distribution method based on control vectors
US5200999A
( en )
*
1991-09-27
1993-04-06
International Business Machines Corporation
Public key cryptosystem key management based on control vectors
US5204901A
( en )
*
1991-08-01
1993-04-20
General Electric Company
Public key cryptographic mechanism
US5265164A
( en )
*
1991-10-31
1993-11-23
International Business Machines Corporation
Cryptographic facility environment backup/restore and replication in a public key cryptosystem
US5481613A
( en )
*
1994-04-15
1996-01-02
Northern Telecom Limited
Computer network cryptographic key distribution system
US5799086A
( en )
*
1994-01-13
1998-08-25
Certco Llc
Enhanced cryptographic system and method with key escrow feature
US5850443A
( en )
*
1996-08-15
1998-12-15
Entrust Technologies, Ltd.
Key management system for mixed-trust environments
US20050069137A1
( en )
2001-12-10
2005-03-31
Peter Landrock
Method of distributing a public key
US20050091491A1
( en )
2003-10-28
2005-04-28
Dphi Acquisitions, Inc.
Block-level storage device with content security
US7469263B2
( en )
2002-07-12
2008-12-23
Fujitsu Limited
Content management system for archiving data, managing histories, validity of content registration certification wherein the management device encrypts the content in response to a content storage, encrypts the encryption key with the media ID
US20090136041A1
( en )
2007-11-28
2009-05-28
William Tsu
Secure information storage system and method
US20100174910A1
( en )
1999-06-23
2010-07-08
Research In Motion Limited
Public Key Encryption with Digital Signature Scheme
US20100325732A1
( en )
2009-06-19
2010-12-23
Hemant Mittal
Managing Keys for Encrypted Shared Documents
US20110064216A1
( en )
*
2009-09-15
2011-03-17
Compagnie Industrielle Et Financiere D'ingenierie Ingenico
Cryptographic message signature method having strengthened security, signature verification method, and corresponding devices and computer program products
US8031865B2
( en )
*
2004-01-08
2011-10-04
Encryption Solutions, Inc.
Multiple level security system and method for encrypting data within documents
US20110252234A1
( en )
*
2010-04-07
2011-10-13
Apple Inc.
System and method for file-level data protection
US20110252243A1
( en )
*
2010-04-07
2011-10-13
Apple Inc.
System and method for content protection based on a combination of a user pin and a device specific identifier
US20150220754A1
( en )
2014-02-04
2015-08-06
International Business Machines Corporation
Document Security in Enterprise Content Management Systems
WO2015195978A1
( en )
2014-06-18
2015-12-23
Visa International Service Association
Efficient methods for authenticated communication
US20180331829A1
( en )
2015-11-12
2018-11-15
Huawei International Pte. Ltd.
Method and system for session key generation with diffie-hellman procedure
US10579793B2
( en )
*
2017-06-12
2020-03-03
Daniel Maurice Lerner
Managed securitized containers and container communications
US11190358B2
( en )
*
2017-08-11
2021-11-30
Secure Open Systems, Inc.
Hash-based data verification system
Family Cites Families (1)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
TWI608361B
( en )
*
2016-09-23
2017-12-11
群æç§æè¡ä»½æéå ¬å¸
Electrionic device, server, communication system and communication method
2021
2021-01-18
US
US17/151,391
patent/US11372986B1/en
active
Active
2021-10-18
EP
EP21920046.6A
patent/EP4278556A4/en
active
Pending
2021-10-18
WO
PCT/US2021/055390
patent/WO2022154843A1/en
not_active
Ceased
2021-10-21
US
US17/507,199
patent/US11316685B1/en
active
Active
2022
2022-03-25
US
US17/704,065
patent/US11595203B2/en
active
Active
2023
2023-02-27
US
US18/174,713
patent/US12003634B2/en
active
Active
Patent Citations (23)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US4200770A
( en )
1977-09-06
1980-04-29
Stanford University
Cryptographic apparatus and method
US5204901A
( en )
*
1991-08-01
1993-04-20
General Electric Company
Public key cryptographic mechanism
US5142578A
( en )
*
1991-08-22
1992-08-25
International Business Machines Corporation
Hybrid public key algorithm/data encryption algorithm key distribution method based on control vectors
US5200999A
( en )
*
1991-09-27
1993-04-06
International Business Machines Corporation
Public key cryptosystem key management based on control vectors
US5265164A
( en )
*
1991-10-31
1993-11-23
International Business Machines Corporation
Cryptographic facility environment backup/restore and replication in a public key cryptosystem
US5799086A
( en )
*
1994-01-13
1998-08-25
Certco Llc
Enhanced cryptographic system and method with key escrow feature
US5481613A
( en )
*
1994-04-15
1996-01-02
Northern Telecom Limited
Computer network cryptographic key distribution system
US5850443A
( en )
*
1996-08-15
1998-12-15
Entrust Technologies, Ltd.
Key management system for mixed-trust environments
US20100174910A1
( en )
1999-06-23
2010-07-08
Research In Motion Limited
Public Key Encryption with Digital Signature Scheme
US20050069137A1
( en )
2001-12-10
2005-03-31
Peter Landrock
Method of distributing a public key
US7469263B2
( en )
2002-07-12
2008-12-23
Fujitsu Limited
Content management system for archiving data, managing histories, validity of content registration certification wherein the management device encrypts the content in response to a content storage, encrypts the encryption key with the media ID
US20050091491A1
( en )
2003-10-28
2005-04-28
Dphi Acquisitions, Inc.
Block-level storage device with content security
US8031865B2
( en )
*
2004-01-08
2011-10-04
Encryption Solutions, Inc.
Multiple level security system and method for encrypting data within documents
US20090136041A1
( en )
2007-11-28
2009-05-28
William Tsu
Secure information storage system and method
US20100325732A1
( en )
2009-06-19
2010-12-23
Hemant Mittal
Managing Keys for Encrypted Shared Documents
US20110064216A1
( en )
*
2009-09-15
2011-03-17
Compagnie Industrielle Et Financiere D'ingenierie Ingenico
Cryptographic message signature method having strengthened security, signature verification method, and corresponding devices and computer program products
US20110252234A1
( en )
*
2010-04-07
2011-10-13
Apple Inc.
System and method for file-level data protection
US20110252243A1
( en )
*
2010-04-07
2011-10-13
Apple Inc.
System and method for content protection based on a combination of a user pin and a device specific identifier
US20150220754A1
( en )
2014-02-04
2015-08-06
International Business Machines Corporation
Document Security in Enterprise Content Management Systems
WO2015195978A1
( en )
2014-06-18
2015-12-23
Visa International Service Association
Efficient methods for authenticated communication
US20180331829A1
( en )
2015-11-12
2018-11-15
Huawei International Pte. Ltd.
Method and system for session key generation with diffie-hellman procedure
US10579793B2
( en )
*
2017-06-12
2020-03-03
Daniel Maurice Lerner
Managed securitized containers and container communications
US11190358B2
( en )
*
2017-08-11
2021-11-30
Secure Open Systems, Inc.
Hash-based data verification system
Non-Patent Citations (1)
* Cited by examiner, â Cited by third party
Title
International Search Report and Written Opinion of the International Searching Authority regarding International Patent Application No. PCT/US2021/055390, dated Jan. 28, 2022.
Also Published As
Publication number
Publication date
US20220255732A1
( en )
2022-08-11
US11316685B1
( en )
2022-04-26
US11372986B1
( en )
2022-06-28
US11595203B2
( en )
2023-02-28
EP4278556A1
( en )
2023-11-22
US20220231840A1
( en )
2022-07-21
US20230231709A1
( en )
2023-07-20
WO2022154843A1
( en )
2022-07-21
EP4278556A4
( en )
2024-12-18
Similar Documents
Publication
Publication Date
Title
US11595203B2
( en )
2023-02-28
Systems and methods for encrypted content management
US12301563B2
( en )
2025-05-13
System and method for pre-shared key (PSK) based wireless access point authentication
US12015721B1
( en )
2024-06-18
System and method for dynamic retrieval of certificates with remote lifecycle management
US9847882B2
( en )
2017-12-19
Multiple factor authentication in an identity certificate service
US8059818B2
( en )
2011-11-15
Accessing protected data on network storage from multiple devices
KR100979576B1
( en )
2010-09-01
Method and computer readable medium for realizing a new password
US8813247B1
( en )
2014-08-19
Providing cryptographic security for objective-oriented programming files
US20130227286A1
( en )
2013-08-29
Dynamic Identity Verification and Authentication, Dynamic Distributed Key Infrastructures, Dynamic Distributed Key Systems and Method for Identity Management, Authentication Servers, Data Security and Preventing Man-in-the-Middle Attacks, Side Channel Attacks, Botnet Attacks, and Credit Card and Financial Transaction Fraud, Mitigating Biometric False Positives and False Negatives, and Controlling Life of Accessible Data in the Cloud
CN108809633B
( en )
2021-07-30
Identity authentication method, device and system
CN106104562A
( en )
2016-11-09
Safety of secret data stores and recovery system and method
EP3090520A1
( en )
2016-11-09
System and method for securing machine-to-machine communications
CN111191217B
( en )
2022-12-13
Password management method and related device
US12450385B2
( en )
2025-10-21
Integration of identity access management infrastructure with zero-knowledge services
US20050027979A1
( en )
2005-02-03
Secure transmission of data within a distributed computer system
US20240121083A1
( en )
2024-04-11
Secure restoration of private key
Das et al.
2022
A decentralized open web cryptographic standard
CN118821104A
( en )
2024-10-22
Data authorization management method and related equipment applied to trusted data space
US12052232B2
( en )
2024-07-30
Multiple relying parties in a single-sign-on environment
Xia et al.
2010
Design of secure FTP system
US12362914B1
( en )
2025-07-15
Network authentication with cryptographic corpocessors
Zhang et al.
2023
Improved CP-ABE Algorithm Based on Identity and Access Control
US20260134142A1