Secure, autonomous file encryption and decryption
AssigneeBank of America Corporation
InventorsShankar Ramasubramanian Iyer, Navanith R. Keerthi, Maria Auxilia Dominique
Life of this patent
Estimating the term…
Abstract
The disclosure includes novel encryption and/or decryption methods and systems that provide various security benefits. More specifically, the disclosure includes a description of a file encryption process and its ability to dynamically control permissions on who is allowed to decrypt the file. Moreover, the disclosed process permits an encrypted file to be freely distributed without losing the ability to govern/regulate decryption.
Claims20
A client computing machine communicatively coupled with a data store, wherein the data store holds a file encryption key that is symmetric, wherein the client computing machine comprises a processor and a memory storing computer-executable instructions that when executed by the processor cause the client computing machine to:
- a. encrypt a data file using the file encryption key;
- b. transmit, over a network, a portion of the encrypted data file to a central encryption server, wherein the portion is a first predetermined number of bytes of the encrypted data file;
- c. receive, over the network, a twice-encrypted portion of the data file, wherein the twice-encrypted portion is encrypted using a secret, central encryption key stored at the central encryption server;
- d. transmit, over the network, the file encryption key to the central encryption server;
- e. receive, over the network, the encrypted file encryption key;
- and
- f. construct a new file comprising the twice-encrypted portion of the data file, the encrypted file encryption key, and a remaining portion of the encrypted data file that was not sent to the central encryption server.
A computing device comprising a processor and a memory storing computer-executable instructions that when executed by the processor cause the computing device to perform steps comprising:
- a. extracting a new file to obtain a twice-encrypted portion of a data file, an encrypted file encryption key, and a remaining portion of the encrypted data file that was not twice encrypted, wherein the twice-encrypted portion of the data file is a first predetermined number of bytes of the data file;
- b. transmitting, over a network, the twice-encrypted portion of the data file to a central encryption server;
- c. receiving, over the network, in response to transmitting the twice-encrypted portion of the data file, a single-encrypted portion of the data file, wherein the twice-encrypted portion is decrypted using a secret, central encryption key stored only at the central encryption server;
- d. merging the single-encrypted portion of the data file with the remaining portion of the encrypted data file;
- e. transmitting, over the network, the encrypted file encryption key to the central encryption server;
- f. receiving, over the network, in response to transmitting the encrypted file encryption key, a file encryption key;
- and
- g. decrypting the merged data file using the file encryption key.
A method performed by a client computing machine and involving a data store, a network, a central encryption server machine, and the client computing machine;
- wherein the data store stores a plurality of data structures, wherein a first data structure of the plurality of data structures comprises an encrypted file encryption key (FEK), a twice-encrypted portion of a data file, and a remaining portion of the data file that is not twice-encrypted;
- and wherein the network communicatively couples the client computing machine with the central encryption server machine;
- and wherein the central encryption server machine comprises a central encryption key that is unknown to the client computing machine;
- and wherein the client computing machine communicatively couples with the data store, wherein the client computing machine comprises a processor and a memory storing computer-executable instructions, wherein the method comprises steps to:
- retrieve, from the data store, the first data structure;
- remove from the first data structure the encrypted FEK and the twice-encrypted portion of the data file;
- transmit, over the network to the central encryption server machine, the encrypted FEK and the twice-encrypted portion of the data file;
- receive, from the central encryption server machine, a single-encrypted portion of the data file corresponding to the twice-encrypted portion of the data file;
- receive, from the central encryption server machine, a plaintext file encryption (FEK) corresponding to encrypted FEK;
- concatenate, into a single new data file, the single-encrypted portion of the data file with the remaining portion of the data file;
- decrypt, using the plaintext FEK, the single new data file;
- and
- provide, by the client computing machine, the decrypted single new data file.
Dependencies are inferred from the claim text.