SECURE SERVER SIDE ENCRYPTION FOR ONLINE FILE SHARING AND COLLABORATION

1 . A method for storing and accessing documents on a server comprising:

receiving a data file from a remote computer operated by a user;

generating a public/private key pair associated with the user;

generating a public/private key pair associated with the received file;

encrypting the received file using the file public key;

encrypting the file private key using the user public key; and

encrypting the user private key.

2 . The method of claim 1 further comprising:

decrypting the user private key;

decrypting the file private key using the decrypted user private key; and

decrypting the file using the decrypted file private key.

3 . The method of claim 1 further comprising:

receiving a request from the user computer to share the file with an additional user, said additional user being associated with a public/private key pair unique to the additional user;

decrypting the requesting user private key;

decrypting the file private key using the user private key;

retrieving the additional user public key; and

encrypting the file private key with the additional user public key.

4 . The method of claim 3 further comprising:

receiving and access request from the additional user;

verifying the access request;

decrypting the additional user private key;

decrypting the file private key using the additional user private key; and

decrypting the file.

5 . A method for storing and accessing documents on a server comprising:

receiving a data file from a computer operated by a user to be stored in a folder, said user being associated with a user public/private key pair and said file having an associated public/private key pair;

creating a public/private key pair associated with directory folder;

encrypting the received file using the file public key;

encrypting the file private key using the folder public key; and

encrypting the folder private key using the user public key.

6 . The method of claim 5 further comprising:

encrypting the folder private key using a plurality of public keys, said public keys corresponding to associated private keys in a key pair, each said key pair associated with a corresponding plurality of users authorized to access files in the folder.

7 . The method of claim 6 further comprising:

receiving a request from a computer operated by an authorized user to access the file in the folder;

decrypting the authorized user private key;

decrypting the folder private key using the authorized user private key;

decrypting the file private key using the folder private key; and

decrypting the file.

8 . The method of claim 1 further comprising:

storing in a data structure for the user, a user identifier, the user's encrypted private key and the user's public key;

storing in a data structure for the file, a file identifier, the file's encrypted private key using the user's private key and the file's public key.

9 . The method of claim 7 further comprising:

storing in a data structure for the user, a user identifier, the user's encrypted private key and the user's public key;

storing in a data structure for the file, a file identifier, the file's encrypted private key using the user's private key and the file's public key; and

storing in a data structure for the folder, a folder identifier, the folder's encrypted private key using the user's private key and the folder's public key.

10 . The method of claim 1 where the step of encrypting the user private key is comprised of:

receiving a secret key from the user remote computer; and

encrypting the user private key using a symmetric encryption algorithm using the received secret key.

11 . The method of claim 1 where the encrypting the received file step is comprised of:

encrypting the received data file using a symmetric encryption algorithm with a pre-determined symmetric encryption key; and

encrypting the symmetric key using the file public key.

12 . The method of claim 2 where the decrypting the file step is comprised of:

decrypting the symmetric key using the file private key; and

decrypting the data file using a symmetric encryption algorithm with the decrypted symmetric key.

13 . The method of claim 8 further comprising storing data representing an access permission value associated with the file and with the user.

14 . The method of claim 1 where the encrypting the user private key step is further comprised of:

receiving a secret key from the user's computer; and

encrypting the user's private key using the received secret key.

15 . The method of claim 14 further comprising:

receiving from a user's remote computer the user secret key and a replacement user secret key; and

decrypting the user private key using the user secret key; and

re-encrypting the user private key using the replacement user secret key.

16 . The method of claim 1 further comprising:

encrypting the user private key using a public key of a public/private key pair associated with a permission level senior to the user; and

storing the encrypted private key in a database.

17 . A computer system adapted to perform any of the methods of claims 1 - 16 .

18 . A computer readable data storage device comprised of programming code, that when executed, causes the computer to execute any of the claims 1 - 16 .

19 . A system for storing and accessing documents on a server comprising:

a component adapted for receiving a data file from a remote computer operated by a user;

a component adapted for generating a public/private key pair associated with the user;

a component adapted for generating a public/private key pair associated with the received file;

a component adapted for encrypting the received file using the file public key;

a component adapted for encrypting the file private key using the user public key; and

a component adapted for encrypting the user private key.

20 . The system of claim 19 further comprising:

a component adapted for decrypting the user private key;

a component adapted for decrypting the file private key using the decrypted user private key; and

a component adapted for decrypting the file using the decrypted file private key.

21 . The system of claim 19 further comprising:

a component adapted for receiving a request from the user computer to share the file with an additional user, said additional user being associated with a public/private key pair unique to the additional user;

a component adapted for decrypting the requesting user private key;

a component adapted for decrypting the file private key using the user private key;

a component adapted for retrieving the additional user public key; and

a component adapted for encrypting the file private key with the additional user public key.

22 . The system of claim 21 further comprising:

a component adapted for receiving and access request from the additional user;

a component adapted for verifying the access request;

a component adapted for decrypting the additional user private key;

a component adapted for decrypting the file private key using the additional user private key; and

a component adapted for decrypting the file.