# US 12,192,335 B2 · Organized data storage system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,335 B2
- Document ID: US12192335B2
- Status: Granted
- Kind: B2
- Application number: 18/407,834
- Filed: 2024-01-09
- Published: 2024-10-24
- Granted: 2025-01-07
- Earliest claimed: 2021-09-23
- Assignees: Uab 360 It
- Applicants: Uab 360 It
- Inventors: Mindaugas Valkaitis
- Web page: https://patentgrep.com/patent/US12192335B2

## CPC

- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- G06F 3/0622: {in relation to access}
- G06F 3/0655: {Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices}
- G06F 3/0679: {Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 9/0822: {using key encryption key}
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 67/06: specially adapted for file transfer, e.g. file transfer protocol [FTP]
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- G06F 2221/2107: File encryption
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present disclosure discloses configuring a device to determine, for encrypted content, a content access key pair including a content access public key and a content access private key, the encrypted content being determined by encrypting content utilizing a symmetric key; configuring the device to determine, for a folder, a folder access key pair including a folder access public key and a folder access private key; configuring the device to encrypt the content access private key by utilizing the folder access public key; configuring the device to encrypt the symmetric key by utilizing the content access public key; configuring the device to transmit the encrypted content, the encrypted content access private key and the encrypted symmetric key to a stateless server for storage; and configuring the device to access the encrypted content by decrypting the encrypted content access private key and the encrypted symmetric key. Various other aspects are contemplated.

## Claims

### Claim 1

A method, comprising:
configuring a device to determine, for encrypted content, a content access key pair including a content access public key and a content access private key, the encrypted content being determined based at least in part on encrypting content by utilizing a symmetric key;
configuring the device to determine, for a folder, a folder access key pair including a folder access public key and a folder access private key;
configuring the device to encrypt the content access private key by utilizing the folder access public key to determine an encrypted content access private key;
configuring the device to encrypt the symmetric key by utilizing the content access public key to determine an encrypted symmetric key;
configuring the device to transmit the encrypted content, the encrypted content access private key and the encrypted symmetric key to a stateless server for storage, without the stateless server storing the content or keys associated with the device in unencrypted form; and
configuring the device to access the encrypted content based at least in part on decrypting the encrypted content access private key and the encrypted symmetric key.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
configuring the device to decrypt the encrypted content access private key by utilizing the folder access private key.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
configuring the device to determine an assigned key pair associated with the device, the assigned key pair including an assigned public key and an assigned private key; and
configuring the device to encrypt the folder access private key by utilizing the assigned public key to determine an encrypted folder access private key.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
configuring the device to determine an assigned key pair associated with the device, the assigned key pair including an assigned public key and an assigned private key; and
configuring the device to decrypt an encrypted folder access private key by utilizing the assigned private key.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
configuring the device to determine a master key based at least in part on a master string of alphanumeric characters;
configuring the device to encrypt the folder access private key by utilizing an assigned public key associated with the device to determine an encrypted folder access private key; and
configuring the device to encrypt an assigned private key associated with the device by utilizing the master key to determine an encrypted assigned private key.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
configuring the device to determine a master key based at least in part on a master string of alphanumeric characters;
configuring the device to decrypt an encrypted assigned private key associated with the device by utilizing the master key; and
configuring the device to decrypt an encrypted folder access private key by utilizing the assigned private key.

### Claim 7 (depends on 1)

The method of claim 1, wherein the folder is a virtual folder.

### Claim 8

An infrastructure device, comprising:
a memory; and
a processor communicatively coupled to the memory, the memory and the processor being configured to:
configure a user device to determine, for encrypted content, a content access key pair including a content access public key and a content access private key, the encrypted content being determined based at least in part on encrypting content by utilizing a symmetric key;
configure the user device to determine, for a folder, a folder access key pair including a folder access public key and a folder access private key;
configure the user device to encrypt the content access private key by utilizing the folder access public key to determine an encrypted content access private key;
configure the user device to encrypt the symmetric key by utilizing the content access public key to determine an encrypted symmetric key;
configure the user device to transmit the encrypted content, the encrypted content access private key, and the encrypted symmetric key to a stateless server for storage, without the stateless server storing the content or keys associated with the user device in unencrypted form; and
configure the user device to access the encrypted content based at least in part on decrypting the encrypted content access private key and the encrypted symmetric key.

### Claim 9 (depends on 8)

The infrastructure device of claim 8, wherein the memory and the processor are configured to:
configure the user device to decrypt the encrypted content access private key by utilizing the folder access private key.

### Claim 10 (depends on 8)

The infrastructure device of claim 8, wherein the memory and the processor are configured to:
configure the user device to determine an assigned key pair associated with the user device, the assigned key pair including an assigned public key and an assigned private key; and
configure the user device to encrypt the folder access private key by utilizing the assigned public key to determine an encrypted folder access private key.

### Claim 11 (depends on 8)

The infrastructure device of claim 8, wherein the memory and the processor are configured to:
configure the user device to determine an assigned key pair associated with the user device, the assigned key pair including an assigned public key and an assigned private key; and
configure the user device to decrypt an encrypted folder access private key by utilizing the assigned private key.

### Claim 12 (depends on 8)

The infrastructure device of claim 8, wherein the memory and the processor are configured to:
configure the user device to determine a master key based at least in part on a master string of alphanumeric characters;
configure the user device to encrypt the folder access private key by utilizing an assigned public key associated with the user device to determine an encrypted folder access private key; and
configure the user device to encrypt an assigned private key associated with the user device by utilizing the master key to determine an encrypted assigned private key.

### Claim 13 (depends on 8)

The infrastructure device of claim 8, wherein the memory and the processor are configured to:
configure the user device to determine a master key based at least in part on a master string of alphanumeric characters;
configure the user device to decrypt an encrypted assigned private key associated with the user device by utilizing the master key; and
configure the user device to decrypt an encrypted folder access private key by utilizing the assigned private key.

### Claim 14 (depends on 8)

The infrastructue device of claim 8, wherein the folder is a virtual folder.

### Claim 15

A non-transitory computer-readable medium configured to store instructions, which when executed by a processor associated with an infrastructure device, configure the processor to:
configure a user device to determine, for encrypted content, a content access key pair including a content access public key and a content access private key, the encrypted content being determined based at least in part on encrypting content by utilizing a symmetric key;
configure a user device to determine, for encrypted content, a content access key pair including a content access public key and a content access private key, the encrypted content being determined based at least in part on encrypting content by utilizing a symmetric key;
configure the user device to determine, for a folder, a folder access key pair including a folder access public key and a folder access private key;
configure the user device to encrypt the content access private key by utilizing the folder access public key to determine an encrypted content access private key;
configure the user device to encrypt the symmetric key by utilizing the content access public key to determine an encrypted symmetric key;
configure the user device to transmit the encrypted content, the encrypted content access private key, and the encrypted symmetric key to a stateless server for storage, without the stateless server storing the content or keys associated with the user device in unencrypted form; and
configure the user device to access the encrypted content based at least in part on decrypting the encrypted content access private key and the encrypted symmetric key.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the processor is configured to:
configure the user device to decrypt the encrypted content access private key by utilizing the folder access private key.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the processor is configured to:
configure the user device to determine an assigned key pair associated with the user device, the assigned key pair including an assigned public key and an assigned private key; and
configure the user device to encrypt the folder access private key by utilizing the assigned public key to determine an encrypted folder access private key.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the processor is configured to:
configure the user device to determine an assigned key pair associated with the user device, the assigned key pair including an assigned public key and an assigned private key; and
configure the user device to decrypt an encrypted folder access private key by utilizing the assigned private key.

### Claim 19 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the processor is configured to:
configure the user device to determine a master key based at least in part on a master string of alphanumeric characters;
configure the user device to encrypt the folder access private key by utilizing an assigned public key associated with the user device to determine an encrypted folder access private key; and
configure the user device to encrypt an assigned private key associated with the user device by utilizing the master key to determine an encrypted assigned private key.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the processor is configured to:
configure the user device to determine a master key based at least in part on a master string of alphanumeric characters;
configure the user device to decrypt an encrypted assigned private key associated with the user device by utilizing the master key; and
configure the user device to decrypt an encrypted folder access private key by utilizing the assigned private key.