System and associated software for providing advanced data protections in a defense-in-depth system by integrating multi-factor authentication with cryptographic offloading

A client device comprising:

• a. a memory for storing an application, the application programmed to perform:
• i. encrypting content with an inner data container using a stored client cryptographic key, wherein the stored client cryptographic key is stored on the client device;
• and
• ii. sending encrypted content to a server wherein the encrypted content is encrypted with an outer data container using a unique server-generated and server-stored cryptographic key,
• b. wherein encrypting the content further comprises:
• (1) generating a globally unique-bit data identifier, a unique protected client data identifier, and additional cryptographic inputs, and storing the globally unique-bit data identifier, the unique protected client data identifier, and the additional cryptographic inputs in a protected data container stored in a client store using a client application;
• (2) storing an event to the client store, associated with the globally unique-bit data identifier;
• (3) generating an ephemeral encryption key, stored in a separate part of the client store;
• (4) encrypting the content a block at a time;
• (5) implementing a cryptographic algorithm and offloading schedule to encrypt content blocks and the additional cryptographic inputs to a server application, using secure networking components and a secure network channel negotiated as a result of the server application authentication and based on configuration data returned when the server application authentication succeeds;
• (6) using the additional cryptographic inputs, generating or retrieving the ephemeral encryption key associated with and unique and specific to current content, and encrypting a block of content in a data container in a secure server store, and storing the ephemeral encryption key in a separate, secure portion of the secure server store;
• and
• (7) returning results to the client application, using an encrypted channel, wherein each of the results are used as an input to continue block encryption, until all of the content is encrypted, at which point the encrypted content is added to the protected data container stored in the client store;
• and
• c. a processor for processing the application.

A system comprising:

• a. a client device configured for generating an encrypted content by encrypting content with an inner data container using a stored client cryptographic key, wherein the stored client cryptographic key is stored on the client device;
• and
• b. a server device configured for encrypting the encrypted content with an outer data container using a unique server-generated and server-stored cryptographic key,
• c. wherein encrypting the content further comprises:
• i. generating a globally unique-bit data identifier, a unique protected client data identifier, and additional cryptographic inputs, and storing the globally unique-bit data identifier, the unique protected client data identifier, and the additional cryptographic inputs in a protected data container stored in a client store using a client application;
• ii. storing an event to the client store, associated with the globally unique-bit data identifier;
• iii. generating an ephemeral encryption key, stored in a separate part of the client store;
• iv. encrypting the content a block at a time;
• v. implementing a cryptographic algorithm and offloading schedule to encrypt content blocks and the additional cryptographic inputs to a server application, using secure networking components and a secure network channel negotiated as a result of the server application authentication and based on configuration data returned when the server application authentication succeeds;
• vi. using the additional cryptographic inputs, generating or retrieving the ephemeral encryption key associated with and unique and specific to current content, and encrypting the block of content in a data container in a secure server store, and storing the ephemeral encryption key in a separate, secure portion of the secure server store;
• and
• vii. returning results to the client application, using an encrypted channel, wherein each of the results are used as an input to continue block encryption, until all of the content is encrypted, at which point the encrypted content is added to the protected data container stored in the client store.