# US 2021/0344656 A1 · Systems and methods for smartkey information management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344656 A1
- Document ID: US20210344656A1
- Status: Published application
- Kind: A1
- Application number: 17/348,977
- Filed: 2021-06-16
- Published: 2021-11-04
- Earliest claimed: 2015-10-15
- Assignees: PKWARE, Inc.
- Applicants: Pkware, Inc.
- Inventors: Yuri Basin
- Web page: https://patentgrep.com/patent/US20210344656A1

## CPC

- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0822: {using key encryption key}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/302: {involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and method are provided for the secure sharing of information across and open network and for performing management of keys used for encrypting and decrypting data.

## Claims

### Claim at position 1

1-3. (canceled)

### Claim 4

A smartkey-based computer file access system, said system including:
a user computer system operating a smartkey encryption/decryption application, wherein said smartkey encryption/decryption application receives:
a smartkey team name data for a team;
a first user password data, wherein said first user is a member of said team;
a second user password data, wherein said second user is a member of said team;
a team public key data; and
a team private key data,
wherein said smartkey encryption/decryption application forms a smartkey electronic data structure including:
said smartkey team name data in unencrypted form;
a team encrypted master key data, wherein said team encrypted master key data is formed by said smartkey encryption/decryption application by determining a master key data derived from random data and encrypting said master key using said team public key data;
a first user password-accessible team encrypted master key data comprising:
said team public key data; and
said team private key data, encrypted by said first user password to form a first user encrypted team key data; and
a second user password-accessible team encrypted master key data comprising:
said team public key data; and
said team private key data, encrypted by said second user password to form a second user encrypted team key data,
wherein said smartkey encryption/decryption application receives an electronic data file,
wherein said smartkey encryption/decryption application forms a session key associated with said electronic data file and encrypts said data file to form an encrypted data file using said session key,
wherein said smartkey encryption/decryption application encrypts said session key using said team encrypted master key data and stores the result as a team encrypted session key data in said smartkey electronic data structure; and
a smartkey provider computer system, wherein said smartkey encryption/decryption application initiates the transmission of said smartkey electronic data structure from said user computer system to said smartkey computer provider system,
wherein said smartkey electronic data structure is stored at said smartkey computer provider system and a second user computer system operating an instance of said smartkey encryption/decryption application, wherein said second user computer system receives:
a target smartkey team name data;
said encrypted data file; and
a user password data representing a user to be allowed to decrypt said encrypted data file, wherein said user is a member of said team,
wherein said second computer system transmits said target smartkey team name data to said smartkey provider system,
wherein said smartkey provider system searches a plurality of stored smartkey electronic data structures, identifies a smartkey electronic data structure including smartkey team name data matching said target smartkey team name data, and transmits said smartkey data structure to said second computer system,
wherein said second computer system uses said user password data to decrypt said user password-accessible encrypted team key data to obtain said team private key data,
wherein said second computer system uses said team private key data to decrypt said team encrypted master key data to obtain said master key data,
wherein said second computer system uses said master key data to decrypt said team encrypted session key data to obtain said session key data, and
wherein said second computer system uses said session data to decrypt said encrypted data.

### Claim 5 (depends on 4)

The system of claim 4 wherein a plurality of data files are encrypted using a plurality of different session keys and said plurality of different session keys are stored in the smartkey electronic data structure.

### Claim 6 (depends on 5)

The system of claim 5 wherein the smartkey electronic data structure stores said plurality of session keys in a plurality of session key locations inside said smartkey electronic data structure, wherein each session key location is associated with a specific one of said plurality of data files.