Protocol for Controlling Access to Encryption Keys
OwnerDavid H. MADDENinventor
Life of this patent
Estimating the term…
Abstract
A secure remote-data-storage system stores encrypted data and both plaintext and encrypted keys at a server, where data at the server is inadequate to recover the plaintext of the encrypted data; and stores at least one encrypted key at a client system. To decrypt the data, the client must obtain a copy of the encrypted data from the server, and a key to decrypt its locally-stored encrypted key. Once decrypted, the locally-stored key can be used to decrypt the encrypted data, or to decrypt an encrypted key from the server, which may then be used decrypt the encrypted data.
Claims21
1-8. (canceled)
A computer-readable medium containing instructions and data to cause a programmable processor to perform operations comprising:
- selecting an asymmetric encryption key pair (“public/private keypair”);
- selecting a key-encryption key;
- encrypting a private key of the public/private keypair using the key-encryption key;
- transmitting the key-encryption key to a server;
- transmitting a public key of the public/private keypair to the server;
- and
- discarding the key-encryption key.
A method comprising:
- transmitting an executable program to a browser at a client computer, the executable program containing instructions to cause the browser to perform operations including:
- a) opening a cache of usernames and passwords stored at the client computer;
- b) preparing a document-encryption key;
- c) encrypting contents of the cache using the document-encryption key;
- d) encrypting the document-encryption key using a public key of a public/private keypair;
- and
- e) transmitting the encrypted contents of the cache and the encrypted document-encryption key;
- receiving a the encrypted contents of the cache and the encrypted document-encryption key from the client computer;
- and
- storing the encrypted contents of the cache and the encrypted document-encryption key.
A method comprising:
- obtaining plaintext data for a plurality of fields of a database record;
- selecting a plurality of random symmetric encryption keys;
- encrypting at least one of the plaintext data for the plurality of database fields using at least one of the plurality of random symmetric encryption keys to produce a database record for storage, at least one of the fields of the database record for storage thus being encrypted;
- arranging the plurality of random symmetric encryption keys into a key block;
- padding the key block with zero or more padding bits to produce a padded key block, a total number of bits of the padded key block similar to but not exceeding a number of bits of a public/private key pair;
- encrypting the padded key block with a public key of the public/private key pair to produce an encrypted key block;
- and
- transmitting the database record for storage and the encrypted key block to a server.
Dependencies are inferred from the claim text.