Secure file transfer
The present disclosure describes techniques for storing encrypted files in a secure file repository and transferring those encrypted files to one or more recipients. A user selects a file to upload to a secure file repository. A secure collaboration app on the user's device generates a first encryption key that is used to encrypt the file. The encrypted file is then uploaded to the secure file repository, which provides the secure collaboration app with a random file name and a location of the encrypted file. The secure collaboration app updates locally stored metadata of the first encrypted file. To securely transfer the file, the user generates a second encryption key, encrypts the metadata with the second encryption key, and transmits the encrypted metadata to one or more receivers. The one or more receivers decrypt the encrypted metadata and use the decrypted metadata to retrieve the file and decrypt it.
1. A system, comprising:
a processor configured to:
receive an encrypted communication comprising a header and a payload, wherein the header includes a first ephemeral public key;
decrypt a second encryption key using the first ephemeral public key and a second ephemeral private key;
decrypt the payload using the second encryption key to obtain metadata, wherein the metadata comprises a first encryption key;
retrieve, based on the metadata, an encrypted file from a secure file repository;
decrypt the encrypted file using the first encryption key; and
provide the decrypted file to a user; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the encrypted communication comprises information for retrieving the encrypted file from the secure file repository.
3. The system of claim 2 , wherein the information for retrieving the encrypted file from the secure file repository comprises a location of the encrypted file.
4. The system of claim 1 , wherein the first encryption key is a symmetric key.
5. The system of claim 1 , wherein the first ephemeral public key is included in a first ephemeral asymmetric key pair and the second ephemeral private key is included in a second ephemeral asymmetric key pair.
6. The system of claim 5 , wherein the second encryption key is encrypted using a key-encrypting key derived using a first ephemeral private key of the first ephemeral asymmetric key pair and a second ephemeral public key of the second ephemeral asymmetric key pair.
7. The system of claim 6 , wherein decrypting the second encryption key using the first ephemeral public key and the second ephemeral private key comprises:
deriving the key-encrypting key using the first ephemeral public key and the second ephemeral private key; and
decrypting the second encryption key using the key-encrypting key.
8. A method, comprising:
receiving, at a device, an encrypted communication comprising a header and a payload, wherein the header includes an ephemeral public key;
decrypting, by the device, a second encryption key using the ephemeral public key and an ephemeral private key;
decrypting, by the device, the payload using the second encryption key to obtain metadata associated with an encrypted file, wherein the metadata comprises a first encryption key;
retrieving, by the device and using the metadata, the encrypted file from a secure file repository;
decrypting, by the device, the encrypted file using the first encryption key; and
providing, by the device, the decrypted file to a user of the device.
9. The method of claim 8 , wherein the encrypted communication comprises information for retrieving the encrypted file from the secure file repository.
10. The method of claim 9 , wherein the information for retrieving the encrypted file from the secure file repository comprises a location of the encrypted file.
11. The method of claim 8 , wherein the first encryption key is a symmetric key.
12. The method of claim 8 , wherein the second encryption key is a local storage key.
13. A non-transitory computer-readable medium, comprising instructions that, when executed by at least one processor, perform the steps of:
receiving an encrypted communication comprising a header and a payload, wherein the header includes an ephemeral public key;
decrypting a second encryption key using the ephemeral public key and an ephemeral private key;
decrypting the payload using the second encryption key to obtain metadata associated with an encrypted file, wherein the metadata comprises a first encryption key previously used to encrypt the encrypted file;
retrieving, based on the metadata, the encrypted file from a secure file repository;
decrypting the encrypted file using the first encryption key; and
providing the decrypted file to a user.
14. The non-transitory computer-readable medium of claim 13 , wherein the encrypted communication comprises information for retrieving the encrypted file from the secure file repository.
15. The non-transitory computer-readable medium of claim 14 , wherein the information for retrieving the encrypted file from the secure file repository comprises a location of the encrypted file in the secure file repository.
16. The non-transitory computer-readable medium of claim 13 , wherein the first encryption key is a symmetric key.