Back to results
US 11,387,987 B2Granted
Method and system for digital health data encryption
AssigneeGinger.io, Inc.
InventorsJoshua Carver, Puneet Thapliyal, Alex Boisvert
Life of this patent
Estimating the term…
Abstract
A system for data encryption includes any or all of: a set of items, a set of keys, and a server. A method for data encryption includes any or all of: encrypting items, sharing items, and reading items. The method can optionally additionally or alternatively include any or all of: performing a registration process, creating items, restricting access of users and/or supplementary systems to items, and/or any other suitable processes.
Claims15
A system for enabling the secure sharing of confidential information among a set of users of a digital health program, the system comprising:
- a first computer comprising a first server, wherein the first server comprises:
- a set of data items stored at the first server, wherein each of the set of data items is a portion of a larger data piece, wherein each of the set of data items is encrypted with an item key, and wherein each item key is encrypted with a public encryption key associated with a user of the set of users;
- for each of the set of users:
- an encrypted public-private encryption keypair stored at the first server, wherein the public-private encryption keypair is encrypted with a master encryption key of the user, and wherein the encrypted public-private encryption keypair comprises:
- an encrypted public encryption key;
- and
- an encrypted private encryption key;
- an unencrypted public encryption key;
- and
- an unencrypted public signing key;
- an audit log associated with the set of users' actions of the set of data items, wherein entries to the audit log are automatically recorded and triggered based on the users' actions;
- wherein a user of the set of users can access a data item of the set of data items in the first server based on satisfaction of at least one of:
- the public encryption key encrypting the item key is a public encryption key of the user;
- the public encryption key encrypting the item key is a public encryption key of a group assigned to the user;
- a second computer comprising a second server, wherein the second server comprises:
- a decrypted duplicate of each of the set of data items;
- wherein no user of the set of users is provided with access to the second server;
- and
- a set of databases in communication with the second server and absent of communication with the first server, wherein each of the set of databases comprises processed versions of the decrypted duplicate of each of the set of data items, and wherein the set of databases comprises:
- a first database, wherein a de-identification process and an anonymization process are performed to produce data in the first database;
- and
- a second database, wherein a sampling process is performed to produce data in the second database.
19 more elements
A method for securely sharing confidential information among a set of users of a digital health program, the method comprising:
- at a first user device associated with a first user of the set of users:
- encrypting an item with an item key to form an encrypted item, wherein the item comprises a portion of a larger data piece;
- encrypting the item key with a first public encryption key, the first public encryption key associated with the first user, to form an encrypted item key;
- signing the encrypted item and the encrypted item key with a first private signing key associated with the first user to form a signed encrypted item and a signed encrypted item key;
- transmitting the signed encrypted item and the signed encrypted item key to a first remote server;
- uploading the encrypted item with the encrypted item key to the first remote server;
- at the first remote server:
- verifying the signed encrypted item and the signed encrypted item key with a public signing key of the user, wherein the public signing key of the user is stored at the remote server;
- recording an entry in an audit log based on verifying the signed encrypted item and the signed encrypted item key;
- producing a decrypted duplicate of the encrypted item;
- uploading the decrypted duplicate of the encrypted item to a second remote server, wherein the second remote server is in communication with a set of databases, the set of databases absent of communication with the first remote server and wherein the first user is unable to access the decrypted duplicate of the encrypted item in the second remote server, wherein:
- producing data in the first database comprises a de-identification process and an anonymization process;
- and
- producing data in the second database comprises a sampling process.
11 more elements
Dependencies are inferred from the claim text.