# US 11,451,522 B2 · System and method for enabling the secure storage, transmission and access of genetic data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,522 B2 - Document ID: US11451522B2 - Status: Granted - Kind: B2 - Application number: 16/002,136 - Filed: 2018-06-07 - Published: 2019-12-12 - Granted: 2022-09-20 - Earliest claimed: 2018-06-07 - Assignees: City University of Hong Kong - Applicants: City University of Hong Kong - Inventors: Shuai Cheng Li; Wei Dong - Web page: https://patentgrep.com/patent/US11451522B2 ## CPC - G16H 10/40: for data related to laboratory analysis, e.g. patient specimen analysis - H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G16B 50/00: ICT programming tools or database systems specially adapted for bioinformatics - G16B 50/30: Data warehousing; Computing architectures - G16B 50/40: Encryption of genetic data - G16H 10/60: for patient-specific data, e.g. for electronic patient records - H04L 63/0478: {applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 2463/121: Timestamp - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G16B: BIOINFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR GENETIC OR PROTEIN-RELATED DATA PROCESSING IN COMPUTATIONAL MOLECULAR BIOLOGY ## Abstract A system and method for a computer system for the secure storage, transmittance and access of genetic data includes a coordinator server including a coordinator program arranged to update secure access information, the coordinator server being in communication with a genetic data sequencing server, a genetic data analysing server, and a genetic data storage server, whereby the coordinator server communicates the secure access information in a manner to allow the genetic data storage server to act as a proxy server between the genetic data sequencing server and the genetic data analysing server. ## Claims ### Claim 1 A computer system for secure storage, transmission, and access of genetic data comprising: a coordinator server arranged to communicate with a data owner server, a genetic data generating server, a genetic data analysing server, and a genetic data storage server, wherein the coordinator server includes a memory storing a coordinator program arranged to update secure access information to facilitate communication among the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, the secure access information including (i) public keys of asymmetric cryptographic key pairs generated by each of the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, and (ii) time stamps comprising encrypted time blocks, and assign unique identification number to each of the data owner server, the genetic data generating server, the genetic data analysing server, and the genetic data storage server, and to genetic data of the data owner; wherein the coordinator server is arranged to communicate the secure access information in a manner that allows the genetic data storage server to act as a proxy server between the genetic data generating server and the genetic data analysing server, wherein the coordinator server does not store, transmit, and access genetic data, wherein the coordinator server is arranged to provide the unique identification numbers and the time stamps to facilitate completion of a cryptographic key table, the cryptographic key table includes unique identification number of the genetic data, unique identification number of the data owner server, unique identification number of the genetic data analysing server, a time stamp specifying the time block during which the genetic data analysing server is allowed to decrypt encrypted genetic data provided by the genetic data storage server to the genetic data analysing server, a key for the cryptographic key table, and a hash result of a previous cryptographic key table, and wherein content of the cryptographic key table is arranged to be run through a secure hash algorithm to produce a decryption key for decrypting the encrypted genetic data so that the genetic data analysing server can analyse the genetic data, and the genetic data analysing server has to complete the cryptographic key table within the time block to obtain the decryption key. ### Claim 2 (depends on 1) The computer system in accordance with claim 1, wherein the genetic data generating server encrypts the genetic data using an encryption key created by the data owner server and transmits the encrypted data to the genetic data storage server. ### Claim 3 (depends on 2) The computer system in accordance with claim 2, wherein the genetic data storage server is instructed to re-encrypt the encrypted data using a re-encryption key created by the data owner server to produce the encrypted genetic data. ### Claim 4 (depends on 3) The computer system in accordance with claim 3, further comprising the genetic data storage server and the genetic data analysing server, wherein the genetic data storage server is arranged to transmit the encrypted genetic data to the genetic data analysing server. ### Claim 5 (depends on 1) The computer system in accordance with claim 1, wherein the coordinator program is arranged to instruct the genetic data analysing server to delete the genetic data after the genetic data is analysed. ### Claim 6 (depends on 1) The computer system of claim 1, further comprising the data owner server, wherein the data owner server is arranged to communicate with the coordinator server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server through the exchange of one or more digital signatures. ### Claim 7 (depends on 6) The computer system of claim 6, wherein each of the one or more digital signatures is generated by: encrypting a public key for a sender and a public key for a receiver using a secure hash algorithm; transferring the hashed publish keys into identifiers; adding a version identifier and a time mark to the identifiers to create a signature content; encrypting the signature content using a private key of the sender; combining the encrypted signature content with an identifier of the sender and a message to the communicated to the receiver; and encrypting the entire signature and message using the public key of the receiver. ### Claim 8 A computing network for the secure storage, transmission, and access of genetic data comprising: a coordinator server in communication with a data owner server and a genetic data generating server, the genetic data generating server is in communication with a genetic data storage server and the genetic data storage server is in communication with a genetic data analysing server, the coordinator server including a memory storing a coordinator program arranged to update secure access information to facilitate communication among the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, the secure access information including (i) public keys of asymmetric cryptographic key pairs generated by each of the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, and (ii) time stamps comprising encrypted time blocks, and assign unique identification number to each of the data owner server, the genetic data generating server, the genetic data analysing server, and the genetic data storage server and to genetic data of the data owner, wherein the genetic data of a data owner is encrypted by the genetic data generating server and decrypted by the genetic data analysing server, wherein the coordinator server does not store, transmit, and access genetic data, wherein the coordinator server is arranged to provide the unique identification numbers and the time stamps to facilitate completion of a cryptographic key table, the cryptographic key table includes unique identification number of the genetic data, unique identification number of the data owner server, unique identification number of the genetic data analysing server, a time stamp specifying the time block during which the genetic data analysing server is allowed to decrypt encrypted genetic data provided by the genetic data storage server to the genetic data analysing server, a key for the cryptographic key table, and a hash result of a previous cryptographic key table, and wherein content of the cryptographic key table is arranged to be run through a secure hash algorithm to produce a decryption key for decrypting the encrypted genetic data so that the genetic data analysing server can analyse the genetic data, and the genetic data analysing server has to complete the cryptographic key table within the time block to obtain the decryption key. ### Claim 9 (depends on 8) The computing network in accordance with claim 8, further comprising the data owner server, wherein the data owner server is arranged to generate a decryption key using a cryptographic operation. ### Claim 10 (depends on 9) The computing network in accordance with claim 9, wherein the cryptographic operation includes a series of one or more previous cryptographic operations. ### Claim 11 (depends on 10) The computing network in accordance with claim 10, wherein the series of one or more previous cryptographic operations are encrypted by a hash function. ### Claim 12 (depends on 9) The computing network in accordance with claim 9, wherein the decryption key is used to generate an encryption key through elliptic curve cryptography. ### Claim 13 (depends on 12) The computing network in accordance with claim 12, further comprising the genetic data generating server, wherein the genetic data generating server is arranged to encrypt the genetic data using the encryption key created by the data owner server and to transmit-a the encrypted data to the genetic data storage server. ### Claim 14 (depends on 8) The computing network in accordance with claim 8, further comprising the genetic data storage server, wherein the genetic data storage server is instructed to re-encrypt the encrypted genetic data using a re-encryption key created by the data owner server. ### Claim 15 (depends on 14) The computing network in accordance with claim 14, wherein the genetic data storage server is arranged to transmit the re-encrypted data to the genetic data analysing server. ### Claim 16 (depends on 8) The computing network in accordance with claim 8, wherein the coordinator program is arranged to instruct the genetic data analysing server to delete the genetic data after the genetic data is analysed. ### Claim 17 (depends on 8) The computer system of claim 8, further comprising the data owner server, wherein the data owner server is arranged to communicate with the coordinator server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server through the exchange of one or more digital signatures. ### Claim 18 (depends on 17) The computer system of claim 17, wherein each of the one or more digital signatures is generated by: encrypting a public key for a sender and a public key for a receiver using a secure hash algorithm; transferring the hashed publish keys into identifiers; adding a version identifier and a time mark to the identifiers to create a signature content; encrypting the signature content using a private key of the sender; combining the encrypted signature content with an identifier of the sender and a message to the communicated to the receiver; and encrypting the entire signature and message using the public key of the receiver. ### Claim 19 A computer system for secure storage, transmission, and access of genetic data comprising: a coordinator server in communication with a data owner server, a genetic data storage server, a genetic data generating server, and a genetic data analysing server, the coordinator server including a memory storing a coordinate program arranged to update secure access data that facilitates communication among the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, the secure access information including (i) public keys of asymmetric cryptographic key pairs generated by each of the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, and (ii) time stamps comprising encrypted time blocks, and assign unique identification number to each of the data owner server, the genetic data generating server, the genetic data analysing server, and the genetic data storage server and to genetic data of the data owner; wherein the genetic data storage server stores the encrypted genetic data transmitted from the genetic data generating server and re-encrypts the encrypted data prior to transmission of the encrypted genetic data to the genetic data analysing server whereby the genetic data analysing server can only unencrypt the genetic data upon receipt of the secure access information from the coordinator server, wherein the coordinator server does not store, transmit, and access genetic data, wherein the coordinator server is arranged to provide the unique identification numbers and the time stamps to facilitate completion of a cryptographic key table, the cryptographic key table includes unique identification number of the genetic data, unique identification number of the data owner server, unique identification number of the genetic data analysing server, a time stamp specifying the time block during which the genetic data analysing server is allowed to decrypt encrypted genetic data provided by the genetic data storage server to the genetic data analysing server, a key for the cryptographic key table, and a hash result of a previous cryptographic key table, and wherein content of the cryptographic key table is arranged to be run through a secure hash algorithm to produce a decryption key for decrypting the encrypted genetic data so that the genetic data analysing server can analyse the genetic data, and the genetic data analysing server has to complete the cryptographic key table within the time block to obtain the decryption key. ### Claim 20 (depends on 19) The computer system in accordance with claim 19, further comprising the data owner server, wherein the data owner server is arranged to generate a decryption key using a cryptographic operation. ### Claim 21 (depends on 20) The computer system in accordance with claim 20, wherein the cryptographic operation includes a series of one or more previous cryptographic operations. ### Claim 22 (depends on 21) The computer system in accordance with claim 21, wherein the series of one or more previous cryptographic operations are encrypted by a hash function. ### Claim 23 (depends on 20) The computer system in accordance with claim 20, wherein the decryption key is used to generate an encryption key through elliptic curve cryptography. ### Claim 24 (depends on 19) The computer system of claim 19, further comprising the data owner server, wherein the data owner server is arranged to communicate with the coordinator server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server through the exchange of one or more digital signatures. ### Claim 25 (depends on 24) The computer system of claim 24, wherein each of the one or more digital signatures is generated by: encrypting a public key for a sender and a public key for a receiver using a secure hash algorithm; transferring the hashed publish keys into identifiers; adding a version identifier and a time mark to the identifiers to create a signature content; encrypting the signature content using a private key of the sender; combining the encrypted signature content with an identifier of the sender and a message to the communicated to the receiver; and encrypting the entire signature and message using the public key of the receiver. ### Claim 26 A computer system for the secure storage, transmission, and access of genetic data comprising: a data owner server, a genetic data storage server, a genetic data generating server, a genetic data analysing server, and a coordinator server in communication with the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, wherein the coordinator server includes a memory storing a coordinator program arranged to update secure access information to facilitate communication among the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, the secure access information including (i) public keys of asymmetric cryptographic key pairs generated by each of the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, and (ii) time stamps comprising encrypted time blocks, and assign unique identification number to each of the data owner server, the genetic data generating server, the genetic data analysing server, and the genetic data storage server and to genetic data of the data owner; wherein the coordinator server is arranged to operate as a proxy server in a decentralised data sharing network by verifying the identity each of the genetic data storage server, the genetic data generating server, and the genetic data analysing server and facilitate the secure transmission and storage of the genetic data by updating the public keys generated by the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server, wherein the coordinator server does not store, transmit, and access genetic data, wherein the coordinator server is arranged to provide the unique identification numbers and the time stamps to facilitate completion of a cryptographic key table, the cryptographic key table includes unique identification number of the genetic data, unique identification number of the data owner server, unique identification number of the genetic data analysing server, a time stamp specifying the time block during which the genetic data analysing server is allowed to decrypt encrypted genetic data provided by the genetic data storage server to the genetic data analysing server, a key for the cryptographic key table, and a hash result of a previous cryptographic key table, and wherein content of the cryptographic key table is arranged to be run through a secure hash algorithm to produce a decryption key for decrypting the encrypted genetic data so that the genetic data analysing server can analyse the genetic data, and the genetic data analysing server has to complete the cryptographic key table within the time block to obtain the decryption key. ### Claim 27 (depends on 26) The computer system in accordance with claim 26, wherein the coordinator server is arranged to verify the identities of the data owner server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server. ### Claim 28 (depends on 26) The computer system in accordance with claim 26, wherein the data owner server is arranged to generate a decryption key using a cryptographic operation. ### Claim 29 (depends on 28) The computer system in accordance with claim 28, wherein the cryptographic operation includes a series of one or more previous cryptographic operations. ### Claim 30 (depends on 29) The computer system in accordance with claim 29, wherein the series of one or more previous cryptographic operations are encrypted by a hash function. ### Claim 31 (depends on 28) The computer system in accordance with claim 28, wherein the decryption key is used to generate an encryption key through elliptic curve cryptography. ### Claim 32 (depends on 26) The computer system in accordance with claim 26, wherein the genetic data generating server is instructed to encrypt the genetic data using an encryption key created by the data owner server and to transmit the encrypted data to the genetic data storage server. ### Claim 33 (depends on 32) The computer system in accordance with claim 32, wherein the coordinator program instructs the genetic data generating server to delete the genetic data after the genetic data is generated. ### Claim 34 (depends on 32) The computer system in accordance with claim 32, wherein the genetic data storage server is instructed to re-encrypt the encrypted data using a re-encryption key created by the data owner server to produce the encrypted genetic data. ### Claim 35 (depends on 34) The computer system in accordance with claim 34, wherein the genetic data storage server is arranged to transmit the encrypted genetic data to the genetic data analysing server. ### Claim 36 (depends on 26) The computer system in accordance with claim 26, wherein the coordinator program is arranged to instruct the genetic data analysing server to delete the genetic data after the genetic data is analysed. ### Claim 37 (depends on 26) The computer system in accordance with claim 26, wherein the genetic data storage server comprises of two or more genetic data storage servers. ### Claim 38 (depends on 37) The computer system in accordance with claim 37, wherein the genetic data storage server is instructed to re-encrypt the encrypted data using a re-encryption key created by the data owner server to produce re-encrypted genetic data. ### Claim 39 (depends on 38) The computer system in accordance with claim 38, wherein the first data storage server transmitting the re-encrypted genetic data to a second genetic data storage server designated by the data owner server. ### Claim 40 (depends on 39) The computer system in accordance with claim 39, wherein the coordinator program instructs the first genetic data storage server to delete the encrypted data after the second genetic data storage server has received the re-encrypted genetic data. ### Claim 41 (depends on 26) The computer system of claim 26, wherein the data owner server is arranged to communicate with the coordinator server, the genetic data storage server, the genetic data generating server, and the genetic data analysing server through the exchange of one or more digital signatures, and wherein each of the one or more digital signatures is generated by: encrypting a public key for a sender and a public key for a receiver using a secure hash algorithm; transferring the hashed publish keys into identifiers; adding a version identifier and a time mark to the identifiers to create a signature content; encrypting the signature content using a private key of the sender; combining the encrypted signature content with an identifier of the sender and a message to the communicated to the receiver; and encrypting the entire signature and message using the public key of the receiver.