# US 2014/0156991 A1 · Method and system for securing electronic data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156991 A1
- Document ID: US20140156991A1
- Status: Published application
- Kind: A1
- Application number: 13/689,847
- Filed: 2012-11-30
- Published: 2014-06-05
- Earliest claimed: 2012-11-30
- Assignees: Prakash Baskaran
- Inventors: PRAKASH BASKARAN
- Web page: https://patentgrep.com/patent/US20140156991A1

## CPC

- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0838: {using one-time-passwords}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The various embodiments herein provide a method for securing electronic data using an automatic key management technique to manage cryptographic keys. The method for securing electronic data comprises providing a data to a writer module, embedding a data usage policy, encrypting the data through a symmetric key encryption, creating a secure data file format for the data, accessing the secure data file format through a reader module, checking for a data file usage policy, dynamically updating the data file usage policy, if there is a change in the file usage policy on an application server, authenticating a user as per the file usage policy, decrypting the secure data file format, invoking one or more adapters and enforcing the data file usage policy. The secure data file format herein comprises data encrypted with a layered structure, instructions for computation of keys along with randomized data and instructions for de-randomizing of data.

## Claims

### Claim 1

A method for securing electronic data comprising steps of:
providing a data to a writer module;
embedding a data usage policy and encrypting the data through a symmetric key encryption;
creating a secure data file format for the data;
accessing the secure data file format through a reader module;
checking for a data file usage policy;
dynamically updating the data file usage policy if there is a change in the data file usage policy on an application server;
authenticating a user as per the data file usage policy;
authorizing the user to access the data based on the authentication status; decrypting the secure data file format;
invoking one or more adapters; and
enforcing the data file usage policy;
wherein the secure data file format comprises data encrypted with a layered structure, instructions for computation of keys along with randomized data and instructions for de-randomizing of data.

### Claim 2 (depends on 1)

The method of claim 1, wherein the writer module employs at least one of a standard algorithm for the symmetric key encryption.

### Claim 3 (depends on 1)

The method of claim 1, wherein the reader module uses a symmetric key decryption for accessing the secure data file format using at least one of a standard algorithm.

### Claim 4 (depends on 1)

The method of claim 1, wherein the data is extracted from a digital data source, where the digital data source comprises one of:
a dynamic data source comprising an application; and
a static data source comprising a computer, a smart phone, a PDA, or a data storage unit.

### Claim 5 (depends on 1)

The method of claim 1, wherein the data is any MIME (Multipurpose Internet Mail Extensions) Media type.

### Claim 6 (depends on 1)

The method of claim 1, wherein providing the symmetric key encryption comprising steps of:
creating a data file signature;
adding a Gateway Header Block (GHB) which comprises information to communicate with a server and for computing a first key, wherein the information for computing the first key comprises at least one of IP address, name of the server, port numbers, protocols and other communication information;
encrypting the GHB using a fixed key and a standard encryption algorithm;
creating a file icon block and a open header block;
creating a first data record block with a file policy and an information for computing a second key;
creating a second data record block with an adapter data and an information for computing a third key;
computing the third key;
creating a first random data block and a file data block;
creating a first encrypted block by encrypting the file data block with the third key and a standard encryption algorithm;
creating a second random data block;
creating the second encrypted block by encrypting the second data record block, first random data block, first encrypted block and the second random data block with the second key and the standard encryption algorithm; and
creating the third encrypted block by encrypting the first data record block and the second encrypted block with the first key and the standard encryption algorithm.

### Claim 7 (depends on 7)

The encryption of claim 7, wherein the standard algorithm is at least one of AES 256, or any other NSA standard symmetric key encryption algorithm.

### Claim 8 (depends on 1)

The method of claim 1, wherein the symmetric key decryption comprising steps of:
decrypting GHB using the fixed key;
computing the first key using the information for computing the first key in GHB;
decrypting the third encrypted block using the first key and extracting the file usage policy from the first data record block;
computing the second key using information in the first data record block;
decrypting the second encrypted block using the second key;
discarding the second random data block;
computing the third key using the information in the second data record block and extract the adapter data;
decrypting the first encrypted block using the third key;
discarding the first random data block; and
extracting the file content.

### Claim 9 (depends on 1)

The method of claim 1, wherein the reader module comprises intelligence to re-compute the first key using the information for computing the first key.

### Claim 10 (depends on 1)

The method of claim 1, wherein the reader module comprises intelligence to re-compute the second key using the information for computing the second key.

### Claim 11 (depends on 1)

The method of claim 1, wherein the reader module comprises intelligence to re-compute the third key using the information for computing the third key.

### Claim 12 (depends on 1)

The method of claim 1, wherein the reader module is adapted to collect and provide file usage information to the application server.

### Claim 13 (depends on 1)

The method of claim 1, wherein the keys are created through computation without requiring storage of any keys.

### Claim 14 (depends on 1)

The method of claim 1, wherein the secure data file format comprises:
a signature block;
a gateway header block encrypted with a fixed key and information to compute a first key;
a file icon block;
an open data block;
first data record block,
a second data record block;
a first random data block;
a file data block; and
a second random data block;
wherein the file data block forms a first encrypted block, the second encrypted block is formed by encrypting the second data record block, the first random data block, the first encrypted block and the second random data block and the third encrypted block is formed by encrypting the first data record block and the second encrypted block.

### Claim 15 (depends on 1)

The method of claim 1, wherein the size of data record blocks and the random data blocks varies from data file to data file.

### Claim 16 (depends on 1)

The method of claim 1, wherein the encrypted layers of the secure data file format further comprises embedded policies for controlling the data file usage based on the time, location and other file usage policies.

### Claim 17

A system for securing electronic data comprises:
a digital data source to provide a data;
an application server;
a writer module adapted to:
embed a data usage policy;
encrypt the data through a symmetric key encryption; and creates a secure data file format for the data;
a reader module adapted to:
access the secure data file format through a reader module;
check for the data file usage policy;
dynamically update the data file usage policy if there is a change in the data file usage policy in the application server;
authenticate a user based on file usage policy;
authorize the user to access the data based on the authentication status;
decrypt the secure data file format;
invoke one or more adapters; and
enforce the data file usage policy.

### Claim 18 (depends on 20)

The system of claim 20, wherein the digital data sources comprises at least one of:
a dynamic data source including an application; and
a static data source including a computer, a smart phone, a PDA, or a data storage unit.

### Claim 19 (depends on 20)

The system of claim 20, wherein the one or more adapters is a plug-in to the reader module to provide additional functionalities to the reader module.

### Claim 20 (depends on 20)

The system of claim 20, wherein the one or more adapters is invoked by embedding data required for execution of one or more adapters with the data file.