Secure file sharing method and system
Systems and methods are provided for securely sharing data. A processor forms two or more shares of a data set encrypted with a symmetric key, the data set associated with a first user device, and causes the encrypted data set shares to be stored separately from each other in at least one remote storage location. The processor generates first and second encrypted keys by encrypting data indicative of the symmetric key with a first asymmetric key of first and second asymmetric key pairs associated with the first user device and a second user device, respectively, and causes the encrypted key to be stored in the at least one storage location. To restore the data set, a predetermined number of the two or more encrypted data set shares and at least one of the second asymmetric keys of the first and second asymmetric key pairs are needed.
1 . A computer-implemented method for securely storing data, the computer-implemented method comprising:
encrypting a dataset using a cryptographic key to generate an encrypted dataset;
generating a plurality of encrypted dataset shares of the encrypted dataset, wherein each of the plurality of encrypted dataset shares includes less than all of the encrypted dataset;
encrypting the cryptographic key with a key encryption key to generate an encrypted cryptographic key;
encrypting the encrypted cryptographic key with a first encryption key to generate a first encrypted key;
generating a plurality of first encrypted key shares of the first encrypted key, wherein each of the plurality of first encrypted key shares includes less than all of the first encrypted key;
encrypting the encrypted cryptographic key with a second encryption key to generate a second encrypted key;
generating a plurality of second encrypted key shares of the second encrypted key, wherein each of the plurality of second encrypted key shares includes less than all of the second encrypted key; and
storing a first one of the plurality of encrypted dataset shares with a first one of the plurality of first encrypted key shares and a first one of the plurality of second encrypted key shares in a first storage device.
2 . The computer-implemented method of claim 1 , wherein the first encryption key is a first public key of a first pair of public/private keys, the method further comprising:
decrypting the first encrypted key using the first private of the first pair of public/private keys to obtain the encrypted cryptographic key; and
decrypting the encrypted cryptographic key using the key encryption key-obtained by decrypting the first encrypted key to obtain the cryptographic key.
3 . The computer-implemented method of claim 2 , further comprising:
decrypting the encrypted dataset using the cryptographic key obtained by decrypting the encrypted cryptographic key.
4 . The computer-implemented method of claim 1 , wherein the cryptographic key is one of a split key, an encryption key, a session key, a workgroup key, a symmetric key, or an asymmetric key.
5 . The computer-implemented method of claim 1 , wherein the first encryption key is associated with a first user device, and the second encryption key is associated with a second user device.
6 . The computer-implemented method of claim 1 , further comprising:
obtaining the first encrypted key using the plurality of first encrypted key shares;
decrypting the obtained first encrypted key to obtain the encrypted cryptographic key; and
decrypting the obtained encrypted cryptographic key to obtain the cryptographic key.
7 . The computer-implemented method of claim 1 , further comprising:
storing a second one of the plurality of encrypted dataset shares with a second one of the plurality of first encrypted key shares and a second one of the plurality of second encrypted key shares in a second storage device.
8 . The computer-implemented method of claim 7 , wherein the first storage device is different than the second storage device.
9 . The computer-implemented method of claim 7 , wherein the first storage device is the same as the second storage device.
10 . The computer-implemented method of claim 1 , wherein the first encrypted key and the second encrypted key are distributed into a header of each of the plurality of encrypted dataset shares.
11 . A computer system for securely sharing data, the computer system comprising:
at least one hardware processor configured to:
encrypt a dataset using a cryptographic key to generate an encrypted dataset;
generate a plurality of encrypted dataset shares of the encrypted dataset, wherein each of the plurality of encrypted dataset shares includes less than all of the encrypted dataset;
encrypt the cryptographic key with a key encryption key to generate an encrypted cryptographic key;
encrypt the encrypted cryptographic key with a first encryption key to generate a first encrypted key;
generate a plurality of first encrypted key shares of the first encrypted key, wherein each of the plurality of first encrypted key shares includes less than all of the first encrypted key;
encrypt the encrypted cryptographic key with a second encryption key to generate a second encrypted key;
generate a plurality of second encrypted key shares of the second encrypted key, wherein each of the plurality of second encrypted key shares includes less than all of the second encrypted key; and
store a first one of the plurality of encrypted dataset shares with a first one of the plurality of first encrypted key shares and a first one of the plurality of second encrypted key shares in a first storage device.
12 . The computer system of claim 11 , wherein the first encryption key is a first public key of a first pair of public/private keys, and wherein the at least one hardware processor is further configured to:
decrypt the first encrypted key using the first private of the first pair of public/private keys to obtain the encrypted cryptographic key; and
decrypt the encrypted cryptographic key using the key encryption key obtained by decrypting the first encrypted key to obtain the cryptographic key.
13 . The computer system of claim 12 , wherein the at least one hardware processor is further configured to:
decrypt the encrypted dataset using the cryptographic key obtained by decrypting the encrypted cryptographic key.
14 . The computer system of claim 11 , wherein the cryptographic key is one of a split key, an encryption key, a session key, a workgroup key, a symmetric key, or an asymmetric key.
15 . The computer system of claim 11 , wherein the first encryption key is associated with a first user device, and the second encryption key is associated with a second user device.
16 . The computer system of claim 11 , wherein the at least one hardware processor is further configured to:
obtain the first encrypted key using the plurality of first encrypted key shares;
decrypt the obtained first encrypted key to obtain the encrypted cryptographic key; and
decrypt the obtained encrypted cryptographic key to obtain the cryptographic key.
17 . The computer system of claim 16 , wherein the at least one hardware processor is further configured to:
store a second one of the plurality of encrypted dataset shares with a second one of the plurality of first encrypted key shares and a second one of the plurality of second encrypted key shares in a second storage device.
18 . The computer system of claim 17 , wherein the first storage device is different than the second storage device.
19 . The computer system of claim 17 , wherein the first storage device is the same as the second storage device.
20 . The computer system of claim 11 , wherein the first encrypted key and the second encrypted key are distributed into a header of each of the plurality of encrypted dataset shares.