# US 9,521,123 B2 · Method for file encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,521,123 B2
- Document ID: US9521123B2
- Status: Granted
- Kind: B2
- Application number: 14/697,900
- Filed: 2015-04-28
- Published: 2016-01-21
- Granted: 2016-12-13
- Earliest claimed: 2007-01-22
- Assignees: Spyrus, Inc.
- Applicants: Spyrus, Inc.
- Inventors: Robert R. Jueneman; Duane J. Linsenbardt; John N. Young; William Reid Carlisle; Burton George Tregub
- Web page: https://patentgrep.com/patent/US9521123B2

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/72: in cryptographic circuits
- H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use}
- H04L 9/0822: {using key encryption key}
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/06: Authentication
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- G06F 2221/2153: Using hardware token as a secondary aspect
- H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption
- H04L 2209/80: Wireless
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04W 12/63: Location-dependent; Proximity-dependent
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method for encryption and sealing of a plaintext file by hashing the plaintext file to produce a plaintext hash, encrypting the plaintext file to produce ciphertext, hashing the ciphertext to produce a ciphertext hash, hashing the plaintext hash and the ciphertext hash to produce a result hash, and sealing the ciphertext together with the result hash. This provides verification for non-repudiation and protects against undetected malware corrupting the plaintext or ciphertext files.

## Claims

### Claim 1

A method for file encryption of a plaintext file, comprising the steps of:
hashing the plaintext file to produce a plaintext hash,
encrypting the plaintext file to create ciphertext,
hashing the ciphertext to produce a ciphertext hash,
hashing the plaintext hash and the ciphertext hash to produce a result hash, and
sealing the ciphertext together with the result hash, to produce an encrypted file.

### Claim 2 (depends on 1)

The method of claim 1, further comprising steps for communicating the encrypted file to originator-selected optional recipients.

### Claim 3 (depends on 1)

The method of claim 1, further comprising steps for an enforced mandatory recovery agent.

### Claim 4 (depends on 1)

The method of claim 1, further comprising steps for breaking the encryption of the encrypted file at a pre-determined date.

### Claim 5 (depends on 1)

The method of claim 1, the sealing step further comprising embedding forward error correction within the encrypted file.

### Claim 6 (depends on 1)

The method of claim 1, the plaintext file having metadata, further comprising the step of separately encrypting the metadata, and the sealing step comprising sealing the ciphertext together with the result hash and the encrypted metadata.

### Claim 7 (depends on 6)

The method of claim 6, further comprising steps for an independent key exchange mechanism to permit decrypting the metadata by a catalog agent.

### Claim 8 (depends on 1)

The method of claim 1, further comprising use of a portable encryption device having a portable form factor and an on-board cryptographic processor to perform one or more of the steps.

### Claim 9 (depends on 1)

The method of claim 1, further comprising the step of compressing the plaintext file to produce a compressed plaintext file, and the encrypting step comprising encrypting the compressed plaintext file to create the ciphertext.

### Claim 10 (depends on 1)

The method of claim 1, where the sealing step further comprises using a digital signature algorithm to produce the encrypted file.