Data encryption system and method

A data encryption system in a multi-user environment for data access control and end-to-end data encryption comprising:

• a system server (1) configured for storing data;
• a user device (2) configured for providing the functions of the data encryption system to a user (16);
• wherein the user is associated to a unique username and password;
• user-system network (3) for communication and transmission of the data between the system server (1) and the user device (2);
• a system application (10) configured for creating, storing, transferring, reading, changing and searching the data, and for managing the access to the data;
• the system application (10) comprises:
• a client application (11), physically located and running on the user device (2);
• a server application (12), physically located and running on the system server (1) and communicating with the client application (11);
• the data of the data encryption system comprises documents (19) and encryption and decryption keys;
• the system application (10) is configured to define and to set:
• a company (15), which is an account in the system application (10), within which the documents (19) are stored and exchanged;
• a user account in the data encryption system;
• the client application (11) is configured to generate a symmetric document key (20) for encryption of the document (19),
• the client application (11) is configured to generate user keys (24) for encryption and decryption of the keys accessible for the specific user (16),
• each user (16) has an unique pair of asymmetric user keys (24), namely user public key (25) and user private key (26),
• each document (19) is stored on the system server (1) encrypted with the document key (20) and is transmittable to the user device (2) in encrypted form to be decrypted by document key (20) and made accessible to the user (16),
• the system application (10) is configured to define and to set:
• a position (17), which is a unit of the company (15) and a basic unit of the system application (10), on whose behalf all actions with documents (19) are performed;
• the user (16) is assignable to the position (17);
• access of the user (16) to the document (19) is provided via assigned position (17) only;
• each position (17) has a unique pair of asymmetric position keys (21), namely position public key (22) and position private key (23);
• the document key (20) is stored on the system server (1) encrypted with the position public key (22) and is transmittable to the user (16) in encrypted form;
• the position public key (22) is stored on the system server (1);
• the position private key (23) is stored encrypted on the system server (1) and is transmittable to the user (16) in encrypted form, to decrypt the encrypted document key (20),
• the user private key (26) is encrypted using a key derived from the user's unique password and stored on the system server (1);
• each document (19), document key (20), user private key (26) and position private key (23) are transmittable to and from the system server (1) and stored on the system server (1) in encrypted form only, wherein these data in original decrypted form are inaccessible to the system server (1),
• the system application (10) comprises an agent application (13), located, separately from the client application (11) and from the server application (12), on the company local server (4),
• to which only the company (15) has access and which is connected to the system server (1) via the company-system network (5),
• the agent application (13) is in communication with server application (12).