Hidden link dynamic key manager for use in computer systems with database structure for storage of encrypted data and method for storage and retrieval of encrypted data

A method of facilitating the secure storage of information, the method comprising the steps of:

• at a repository computer system—
• receiving a key request for a session key from a requesting key exchange module associated with a remote computer system, the key request including a hidden link,
• accessing and decrypting the session key based on the hidden link using a system key,
• receiving an exchange public key from the requesting key exchange module,
• encrypting the session key using the exchange public key, resulting in an encrypted session key, and
• transmitting the encrypted session key to the requesting key exchange module;
• and
• at the remote computer system—
• decrypting the encrypted session key using an exchange private key corresponding to the exchange public key,
• encrypting a data entity with the session key, and associating the hidden link to the data entity, and
• storing the data entity.

A method of facilitating the secure retrieval of information, the method comprising the steps of:

• at a repository computer system—
• receiving identity information and a copy of a hidden link from a requester desiring to decrypt a data entity, wherein the data entity is associated with the hidden link,
• determining whether the requester has sufficient rights based on the identity information and the copy of the hidden link to decrypt the data entity,
• identifying a session key based on the hidden link, wherein the session key was used to encrypt the data entity,
• receiving an exchange public key from the requester,
• encrypting the session key using the exchange public key, resulting in an encrypted session key, and
• transmitting the encrypted session key to the requester;
• and
• at a remote computer system—
• decrypting the encrypted session key using a private key corresponding to the public key, and
• decrypting the encrypted data entity using the session key.

A method of encrypting and storing a data entity, the method comprising the steps of:

• transmitting a public component of a fifth encryption key from a first computer system to a second computer system;
• using the public component of the fifth encryption key to encrypt a first encryption key, resulting in an encrypted first encryption key;
• transmitting the encrypted first encryption key from the second computer system to the first computer system;
• decrypting the encrypted first encryption key using a private component of the fifth encryption key;
• encrypting the data entity using the first encryption key having a first encryption key identification;
• encrypting the first encryption key identification using a second encryption key having a second encryption key identification;
• encrypting the second encryption key identification using a third encryption key;
• storing the encrypted data entity, the encrypted first encryption key identification, and the encrypted second encryption key identification together on the first computer system;
• encrypting the first encryption key using a fourth encryption key having a fourth encryption key identification;
• encrypting the fourth encryption key identification using the third encryption key;
• encrypting the second and fourth encryption keys using the third encryption key;
• storing the unencrypted first encryption key identification, the encrypted fourth encryption key identification, and the encrypted first encryption key together on the second computer system;
• storing the unencrypted second encryption key identification and the encrypted second encryption key together on the second computer system;
• storing the unencrypted fourth encryption key identification and the encrypted fourth encryption key together on the second computer system;
• and
• securing the third encryption key.

A method of decrypting a data entity, the method comprising the steps of:

• at a second computer system—
• receiving identity information and a copy of a hidden link from a requester desiring to decrypt the data entity, wherein the data entity is stored on a first computer system in association with the hidden link and is encrypted by a first encryption key,
• confirming based on the identity information and the copy of the hidden link that the requester has authority to decrypt the data entity,
• accessing a third encryption key and using the third encryption key to decrypt a second encryption key identification and a fourth encryption key identification,
• identifying a second encryption key using the decrypted second encryption key identification,
• using the second encryption key to decrypt a first encryption key identification,
• identifying the first encryption key using the decrypted first encryption key identification,
• identifying a fourth encryption key using the decrypted fourth encryption key identification,
• using the fourth encryption key to decrypt the first encryption key,
• receiving a public component of a fifth encryption key,
• using the public component of the fifth encryption key to encrypt the first encryption key, resulting in an encrypted first key,
• transmitting the encrypted first encryption key from the second computer system to the first computer system;
• and
• at the first computer system—
• decrypting the encrypted first encryption key using a private component of the fifth encryption key, and
• decrypting the data entity using the first encryption key.