Method and system for the secure transfer of a dataset

1. A method for secure transfer of a dataset between a server and a user device via a cloud service, the method comprising:

obtaining, by the user device, a user-side Diffie Hellman key pair including a secret user key and a public user key;

obtaining, by the server, a server-side Diffie Hellman key pair including a secret server key and a public server key;

generating a server-side Diffie Hellman key on the server using the secret server key and the public user key;

encrypting a dataset on the server using the server-side Diffie Hellman key to obtain an encrypted dataset;

transferring the encrypted dataset to the cloud service;

retrieving, by the user device, the public server key and the encrypted dataset, the encrypted dataset being retrieved from the cloud service;

generating a user-side Diffie Hellman key on the user device using the secret user key and the public server key; and

decrypting the encrypted dataset on the user device using the user-side Diffie Hellman key.

2. The method of claim 1 , further comprising:

transferring the encrypted dataset and the public server key to the cloud service.

3. The method of claim 1 , further comprising:

transferring, by the user device, a user reference number to the server.

4. The method of claim 1 , wherein the server-side Diffie Hellman key pair corresponds to at least one of a plurality of datasets and a group of user devices.

5. The method of claim 1 , wherein the retrieving retrieves both the encrypted dataset and the public server key from the cloud service.

6. The method of claim 1 , further comprising:

performing, by the server, authentication of the user device in response to receiving the public user key from the user device,

wherein the obtaining a server-side Diffie Hellman key pair obtains the server-side Diffie Hellman key pair in response to the authentication of the user device being successful, the authentication of the user device being based on a challenge-response method.

7. The method of claim 1 , further comprising:

performing a key derivation before the encrypting, the key derivation being based on the dataset and using a PBKDF, a HKDF, or HMAC-SHA256.

8. The method of claim 1 , wherein

the transferring the encrypted dataset is initiated by the server; and

the transferring the encrypted dataset includes,

authenticating the cloud service via a certificate, and

authenticating the server with an individual proof of entitlement.

9. The method of claim 1 , wherein at least one of the transferring the encrypted dataset or the retrieving the encrypted dataset is performed via an https connection.

10. The method of claim 1 , further comprising:

subscribing, by the user device, to a publish/subscribe interface with the cloud service corresponding to the encrypted dataset, the encrypted dataset corresponding to a user reference number.

11. The method of claim 1 , further comprising:

informing the user device of the transferring the encrypted dataset after transferring the encrypted dataset.

12. A system for secure transfer of a dataset between a server and a user device via a cloud service, the system comprising:

a server;

a user device connected to the server; and

a data interface between a cloud service and both of the server and the user device, wherein

the user device is configured to obtain a user-side Diffie Hellman key pair including a secret user key and a public user key,

the server is configured to,

obtain a server-side Diffie Hellman key pair including a secret server key and a public server key,

generate a server-side Diffie Hellman key using

the secret server key and the public user key,

encrypt the dataset using the server-side Diffie Hellman key to obtain an encrypted dataset, and

transfer the encrypted dataset to the cloud service, and

the user device is configured to,

retrieve the public server key and the encrypted dataset, the encrypted dataset being retrieved from the cloud service,

generate a user-side Diffie Hellman key using the secret user key and the public server key, and

decrypt the encrypted dataset with the user-side Diffie Hellman key.

13. A medical system for capture or processing of medical images, comprising:

the server of the system of claim 12 .

14. A non-transitory computer program product, storing a computer program directly loadable into a memory storage facility of a medical system, the computer program including program sections to carry out a method when the computer program is executed in the medical system, the method comprising:

obtaining, by a user device, a user-side Diffie Hellman key pair including a secret user key and a public user key;

obtaining, by a server, a server-side Diffie Hellman key pair including a secret server key and a public server key;

generating a server-side Diffie Hellman key on the server using the secret server key and the public user key;

encrypting a dataset on the server using the server-side Diffie Hellman key to obtain an encrypted dataset;

transferring the encrypted dataset to a cloud service;

retrieving, by the user device, the public server key and the encrypted dataset, the encrypted dataset being retrieved from the cloud service;

generating a user-side Diffie Hellman key on the user device using the secret user key and the public server key; and

decrypting the encrypted dataset on the user device using the user-side Diffie Hellman key.

15. A non-transitory computer-readable medium storing program sections that, when executed by a computer unit, cause the computer unit to perform a method, the method comprising:

obtaining, by a user device, a user-side Diffie Hellman key pair including a secret user key and a public user key;

obtaining, by a server, a server-side Diffie Hellman key pair including a secret server key and a public server key;

generating a server-side Diffie Hellman key on the server using the secret server key and the public user key;

encrypting a dataset on the server using the server-side Diffie Hellman key to obtain an encrypted dataset;

transferring the encrypted dataset to a cloud service;

retrieving, by the user device, the public server key and the encrypted dataset, the encrypted dataset being retrieved from the cloud service;

generating a user-side Diffie Hellman key on the user device using the secret user key and the public server key; and

decrypting the encrypted dataset on the user device using the user-side Diffie Hellman key.

16. The method of claim 2 , wherein the encrypted dataset and the public server key are stored at least one of:

together in the cloud service; or

in reference to one another.

17. The method of claim 2 , further comprising:

digitally signing, by the server, the encrypted dataset and the public server key.

18. The method of claim 16 , further comprising:

digitally signing, by the server, the encrypted dataset and the public server key.

19. The method of claim 3 , wherein the transferring the encrypted dataset transfers the encrypted data set and the user reference number to the cloud service.

20. The method of claim 19 , wherein the user reference number and the encrypted dataset are stored at least one of:

together in the cloud service; or

in reference to one another.

21. The method of claim 1 , wherein

the transferring the encrypted dataset transfers the encrypted dataset from the server to the cloud service via a data interface; and

the retrieving the encrypted dataset retrieves the encrypted dataset from the cloud service via the data interface.

22. The method of claim 1 , wherein the cloud service is unable to decrypt the encrypted dataset.