# US 10,454,906 B1 · Systems and methods for encryption and authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,454,906 B1
- Document ID: US10454906B1
- Status: Granted
- Kind: B1
- Application number: 16/263,815
- Filed: 2019-01-31
- Granted: 2019-10-22
- Earliest claimed: 2019-01-31
- Assignees: RE FormsNet, LLC
- Applicants: RE FormsNet, LLC
- Inventors: Joshua D. J. Sharfman; Mourad Zerroug
- Web page: https://patentgrep.com/patent/US10454906B1

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F 40/174: Form filling; Merging
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 2221/2107: File encryption
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods for encryption and authentication are disclosed. A system receives a document request over a network from a first computer system, the document comprising a plurality of fields configured to receive input data. The document is transmitted to the first computer system. Context data and the document, including field input data, are received from the first computer system. An encryption key is generated and used to encrypt the document field input data and the context data. A payload is generated including the encrypted document field input data, the encrypted context data, and a non-encrypted identifier linked to the key. The payload and an image of the document are provided to a second computer system. The document image is viewable using a portable document format viewer. A decryption key request including the identifier linked to the key is received. The decryption key is provided to the second computer system to decrypt the encrypted field input data and the encrypted context data.

## Claims

### Claim 1

An authentication and encryption computer system, the authentication and encryption computer system comprising:
one or more processing devices;
a network interface;
non-transitory memory that stores instructions that when executed by the one or more processing devices are configured to cause the computer system to perform operations comprising:
perform an authentication using at least an identifier associated with an instantiation of a first application hosted on a first user computer system associated with a first user;
receive a request for a first document over a network via the network interface from the first application hosted on the first user computer system, the first document comprising a form including a plurality of fields configured to receive input data and the first document comprising static text associated with the form;
provide, over the network via the network interface, the first document to the first application hosted on the first user computer system;
receive from the first application hosted on the first user computer system:
the first document including form field input data, wherein the form field input data is associated with respective form field identifiers, and
context data, the context data comprising textual data separate from data of the first document;
generate an encryption key;
encrypt:
the form field input data and respective form field identifiers as name-field input data sets, wherein at least a portion of the static text, associated with the form included in the first document, is excluded from encryption, and
the context data;
receive an indication that a Portable Document Format of the first document is to be provided to a second user computer system, the Portable Document Format including respective depictions of the form field input data;
provide a Portable Document Format of the first document comprising a payload to the second user computer system, the payload file comprising the encrypted form name-field input data sets, the encrypted context data, and a non-encrypted identifier assigned to the first document and/or a non-encrypted identifier assigned to a transaction associated with the first document, wherein the Portable Document Format of the first document is viewable using a standard Portable Document Format viewer;
receive a request for a key to decrypt the encrypted form name-field input data sets and the encrypted context data;
provide the key to decrypt the encrypted form name-field input data sets and the encrypted context data, wherein the decrypted form name-field input data sets and the decrypted context data are viewable using the standard Portable Document Format viewer and/or are computer readable as plaintext.

### Claim 2 (depends on 1)

The authentication and encryption computer system as defined in claim 1, wherein the encryption of the document field input data and respective field identifiers as name-field input data sets and the context data is performed using symmetrical encryption and the same key used to perform the symmetrical encryption is used to perform decryption.

### Claim 3 (depends on 1)

The authentication and encryption computer system as defined in claim 1, wherein the generation of the encryption key further comprises:
access a context element associated with the first document; and
generate the encryption key using at least the context element.

### Claim 4 (depends on 1)

The authentication and encryption computer system as defined in claim 1, the operations further comprising:
receive a plurality of documents and associated respective payload files, from the second user computer system to be decrypted, where the plurality of documents are associated with a first transaction and each of the payload files include a same transaction identifier and at least a portion of the encrypted context data is the same, and respective different document identifiers;
generate a decryption key using at least a portion of the context data that is the same for each of the plurality of documents; and
use the corresponding key to decrypt each of the plurality of documents.

### Claim 5 (depends on 1)

The authentication and encryption computer system as defined in claim 1, the operations further comprising:
access unencrypted version information from the payload file; and
determine other content of the payload file using the version information.

### Claim 6 (depends on 1)

The authentication and encryption computer system as defined in claim 1, wherein the payload file further includes an unencrypted link to a network resource that provides dynamically changing data.

### Claim 7 (depends on 1)

The authentication and encryption computer system as defined in claim 1, the operations further comprising:
provide a plurality of decryption key tokens to an operator of the first user computer system; and
provide the key to decrypt the encrypted name-field input data sets and the encrypted context data at least partly in response to receiving a first of the decryption key tokens.

### Claim 8 (depends on 1)

The authentication and encryption computer system as defined in claim 1, the operations further comprising:
perform an analysis as to whether the payload file has been tampered with.

### Claim 9 (depends on 1)

The authentication and encryption computer system as defined in claim 1, the plurality of fields comprising text entry fields and checkboxes or radio buttons.

### Claim 10 (depends on 1)

The authentication and encryption computer system as defined in claim 1, wherein:
the first document as provided to the first application hosted on the first user computer system is in a first format, and
the first document as received from the first user computer system is in a second format different than the first format.

### Claim 11 (depends on 1)

The authentication and encryption computer system as defined in claim 1, wherein:
the non-encrypted identifier assigned to the first document and/or the non-encrypted identifier assigned to a transaction associated with the first document are encoded into a computer readable optical code.

### Claim 12

A system comprising:
one or more processing devices;
a network interface;
non-transitory memory that stores instructions that when executed by the one or more processing devices are configured to cause the computer system to perform operations comprising:
authenticate a first user, the first user accessing the system using first user computer system;
provide a first document over a network via the network interface to a first application hosted on the first user computer system, the first document comprising a form including a plurality of fields configured to receive input data and the first document comprising static text;
receive from the first application hosted on the first user computer system:
the first document including form field input data, wherein the form field input data is associated with respective form field identifiers, and
context data, the context data comprising textual data separate from data of the first document;
generate an encryption key;
encrypt:
the document form field input data and respective form field identifiers as name-field input data sets, and
the context data;
enable a Portable Document Format of the first document to be provided to a second user computer system, the portable Document Format of the first document comprising a payload file,
the payload file comprising the encrypted document form name-field input data sets, the encrypted context data, and an item of non-encrypted text associated with the key, wherein the Portable Document Format of the first document is viewable using a standard Portable Document Format viewer;
receive a request for a key, the request comprising the item of non-encrypted text associated with the key included in the payload;
use the item of non-encrypted text associated with the key included in the payload to provide the key to the second user computer system, the key configured to decrypt the encrypted form name-field input data sets and the encrypted context data, wherein the decrypted form field input data is viewable using the standard Portable Document Format viewer and/or is computer readable as plaintext.

### Claim 13 (depends on 12)

The computer system as defined in claim 12, wherein the encryption of the document field input data and the context data is performed using symmetrical encryption and the same key used to perform the symmetrical encryption is used to perform decryption.

### Claim 14 (depends on 12)

The computer system as defined in claim 12, wherein the generation of the encryption key further comprises:
access a transaction identifier associated with the first document; and
generate the encryption key using the transaction identifier.

### Claim 15 (depends on 12)

The computer system as defined in claim 12, the operations further comprising:
receive a plurality of documents and associated respective payload files, from the second user computer system to be decrypted, where the plurality of documents are associated with a first transaction and each of the payload files include a same unencrypted item of plaintext;
use the unencrypted item of plaintext to access or generate a corresponding key; and
use the corresponding key to decrypt each of the plurality of documents.

### Claim 16 (depends on 12)

The computer system as defined in claim 12, the operations further comprising:
access unencrypted version information from the payload file; and
determine other content of the payload file using the version information.

### Claim 17 (depends on 12)

The computer system as defined in claim 12, wherein the payload file further includes an unencrypted link to a network resource that provides dynamically changing data.

### Claim 18 (depends on 12)

The computer system as defined in claim 12, the operations further comprising:
provide a plurality of decryption key tokens to an operator of the first user computer system; and
provide the key at least partly in response to receiving a first of the decryption key tokens.

### Claim 19 (depends on 12)

The computer system as defined in claim 12, the operations further comprising:
perform an analysis as to whether the payload file has been tampered with.

### Claim 20 (depends on 12)

The computer system as defined in claim 12, wherein the generation of the encryption key is performed using the item of non-encrypted text.

### Claim 21 (depends on 12)

The computer system as defined in claim 12, wherein:
the non-encrypted identifier assigned to the first document and/or the non-encrypted identifier assigned to a transaction associated with the first document are encoded into a computer readable optical code.

### Claim 22

A computer-implemented method comprising:
providing a first document over a network to a first user computer system, the first document comprising a form including a plurality of fields configured to receive input data and the first document comprising static text;
receiving from the first user computer system:
the first document including form field input data, wherein the form field input data is associated with respective form field identifiers, and
context data, the context data comprising textual data separate from data of the first document;
generating an encryption key;
encrypting:
the document form field input data and respective form field identifiers as name-field input data sets, and
the context data;
enabling a payload and an Portable Document Format of the first document to be provided to a second user computer system, the payload comprising the encrypted document form name-field input data sets, the encrypted context data, and an item of non-encrypted text associated with the key, wherein the Portable Document Format of the first document is viewable using a Portable Document Format viewer;
receiving a request for a key, the request comprising the identifier linked to the key;
providing the key to the second user computer system, the key configured to decrypt the encrypted form name-field input data sets and the encrypted context data, wherein the decrypted form field input data is viewable using the Portable Document Format viewer and/or is computer readable as plaintext.

### Claim 23 (depends on 22)

The method as defined in claim 22, wherein the encryption of the document field input data and the context data is performed using symmetrical encryption and the same key used to perform the symmetrical encryption is used to perform decryption.

### Claim 24 (depends on 22)

The method as defined in claim 22, wherein the generation of the encryption key further comprises:
accessing a transaction identifier associated with the first document; and
generating the encryption key using the transaction identifier.

### Claim 25 (depends on 22)

The method as defined in claim 22, the method further comprising:
receiving a plurality of documents and associated respective payloads, from the second user computer system to be decrypted, where the plurality of documents are associated with a first transaction and each of the payloads include a same transaction identifier;
using the transaction identifier to access a corresponding key;
using the corresponding key to decrypt each of the plurality of documents.

### Claim 26 (depends on 22)

The method as defined in claim 22, the method further comprising:
accessing unencrypted version information from the payload; and
determining other content of the payload using the version information.

### Claim 27 (depends on 22)

The method as defined in claim 22, wherein the payload further includes an unencrypted link to a network resource that provides dynamically changing data.

### Claim 28 (depends on 22)

The method as defined in claim 22, the method further comprising:
providing a plurality of decryption key tokens to an operator of the first user computer system; and
providing the key at least partly in response to receiving a first of the decryption key tokens.

### Claim 29 (depends on 22)

The method as defined in claim 22, the method further comprising:
performing an analysis as to whether the payload has been tampered with.

### Claim 30 (depends on 22)

The method as defined in claim 22, wherein the generation of the encryption key is performed using the item of non-encrypted text.