Secure deferred file decryption
A method is provided that permits user to submit a password to the private key that is to be used to decrypt files either at the time of user account setup or at the time of submitting the files. The password is stored securely in the system, permanently or temporarily, and is used later to decrypt the files right before the system is ready to process the files.
1. A method of deferring decryption and processing of an encrypted file in a device with a data processor, the encrypted file encrypted according to a delivery public key of a delivery key pair and a password of a delivery private key, the delivery key pair comprising the delivery public key and the delivery private key, the method comprising:
receiving the password of the delivery private key;
generating a data package comprising the password of the delivery private key;
encrypting the data package according to a password protection key, the password protection key unique to a processor type; and
storing the encrypted data package and data processing job information referencing the encrypted file as a job record in persistent storage,
verifying the password of the delivery private key after receiving the password and before generating the data package, comprising:
generating random data;
encrypting random data according to the delivery public key;
decrypting the encrypted random data according to the delivery private key and the password of the delivery private key to produce derived random data; and
verifying the password of the delivery private key only if the random data equals the derived random data.
2. The method of claim 1 , wherein:
the generated data package further comprises a system-wide unique job reference, an identifier of the data processor and an expiration time stamp; and
the stored record further comprises the system-wide unique job reference.
3. The method of claim 1 , wherein the password of the delivery private key is encrypted according to a user account password and stored in persistent storage, the encrypted password of the delivery private key stored as a part of an account of a user and separate from accounts of other users.
4. The method of claim 3 , further comprising:
receiving the user account password from a user;
retrieving the password of the delivery private key encrypted by the user account password from persistent storage; and
decrypting encrypted password of the delivery private key according to the user account password to produce the password of the delivery private key.
5. The method of claim 1 , wherein receiving the password of the delivery private key comprises receiving the password of the delivery private key from an operator of the system.
6. The method of claim 1 , wherein:
encrypting the data package according to the password protection key comprises:
encrypting the data package according to a password protection public key of the data processor; and
the method further comprises deleting the password from a system manager memory.
7. The method of claim 1 , wherein:
the password protection key is a symmetric password protection key securely stored in a hardware security module; and
encrypting the data package according to a key comprises:
encrypting the data package in the hardware security module according to the password protection key.
8. The method of claim 1 where the encrypted data package is retrieved from persistent storage referenced by the data processing job information, and further comprising selectively performing the steps of:
decrypting the encrypted data package to retrieve the password associated with the delivery private key;
retrieving, the delivery private key protected by the password associated with the delivery private key from persistent storage;
recovering the delivery private key using the password associated with the delivery private key;
retrieving the file encrypted according to the delivery public key from persistent storage; and
decrypting the file encrypted according to the delivery public key using the delivery private key.
9. The method of claim 8 , wherein:
the generated data package further comprises a system-wide unique job reference, an identifier of the data processor and an expiration time stamp;
the stored record further comprises the system wide unique job reference;
decrypting the encrypted data package further retrieves the system wide unique job reference, the identifier of the data processor and the expiration time stamp and the password associated with the delivery private key; and wherein
the steps of claim 8 are selectively performed only if the system wide unique job reference matches the system wide unique job reference of the job record, the identifier of the data processor matches an identifier of the data processor, and the expiration time stamp is not in the past, otherwise scrubbing the password associated with the delivery private key and terminating processing.
10. The method of claim 8 , wherein:
encrypting the data package according to a password protection key comprises:
encrypting the data package according to a password protection public key of the data processor; and
decrypting the encrypted data package to retrieve the password associated with the delivery private key comprises:
decrypting the encrypted data package in a hardware security module [HSM] using a password protection private key securely stored in the hardware security module.
11. The method of claim 8 , wherein:
the password protection key is a symmetric password protection key securely stored in a hardware security module; and
encrypting the data package according to the password protection key comprises:
encrypting the data package in the hardware security module according to the password protection key;
decrypting the encrypted data package to retrieve the password associated with the delivery private key comprises:
decrypting the encrypted data package in the hardware security module using the password protection key securely stored in the hardware security module [HSM].
12. An apparatus for deferring decryption and processing of an encrypted file, encrypted according to a delivery public key of a delivery key pair and a password of a delivery private key, the delivery key pair comprising the delivery public key and the delivery private key, the apparatus comprising:
a first processor;
a first memory, communicatively coupled to the first processor, the first memory storing first processor instructions including first processor instructions for:
receiving the password of the delivery private key;
generating a data package comprising the password of the delivery private key;
encrypting the data package according to a password protection key, the password protection key unique to a processor type; and
storing the encrypted data package and data processing job information referencing the encrypted file as a job record in persistent storage;
verifying the password of the delivery private key after receiving the password and before generating the data package, comprising:
generating random data;
encrypting random data according to the delivery public key;
decrypting the encrypted random data according to the delivery private key and the password of the delivery private key to produce derived random data; and
verifying the password of the delivery private key only if the random data equals the derived random data.
13. The apparatus of claim 12 , wherein:
the generated data package further comprises a system-wide unique job reference, an identifier of a second processor processing the file and an expiration time stamp; and
the stored record further comprises the system-wide unique job reference.
14. The apparatus of claim 12 , wherein the first processor instructions further comprise first processor instructions for:
verifying the password of the delivery private key after receiving the password and before generating the data package, comprising first processor instructions for:
generating random data;
encrypt random data according to the delivery public key;
decrypting the encrypted random data according to the delivery private key and the password of the delivery private key to produce derived random data; and
verifying the password of the delivery private key only if the random data equals the derived random data.
15. The apparatus of claim 12 , wherein the password of the delivery private key is encrypted according to a user account password and stored in persistent storage, the encrypted password of the delivery private key stored as a part of an account of a user and separate from accounts of other users.
16. The apparatus of claim 15 , wherein the first processor instructions further comprise first processor instructions for:
receiving the user account password from a user;
retrieving the password of the delivery private key encrypted by the user account password from persistent storage; and
decrypting encrypted password of the delivery private key according to the UAP to produce the password of the delivery private key.
17. The apparatus of claim 12 , wherein the first processor instructions for receiving the password of the delivery private key comprises first processor instructions for receiving the password of the delivery private key from an operator of the first processor.
18. The apparatus of claim 12 , wherein:
the first processor instructions for encrypting the data package according to the password protection key comprise first processor instructions for:
encrypting the data package according to a password protection public key of a second processor; and
the first processor instructions further comprise first processor instructions for deleting the password from a system manager memory.
19. The apparatus of claim 12 , further comprising:
a second processor communicatively coupled to a second memory storing second processor instructions comprising second processor instructions for:
retrieving the encrypted data package from persistent storage referenced by the data processing job information;
decrypting the encrypted data package to retrieve the password associated with the delivery private key;
retrieving, the delivery private key protected by the password associated with the delivery private key from persistent storage;
recovering the delivery private key using the password associated with the delivery private key;
retrieving the file encrypted according to the delivery public key from persistent storage; and
decrypting the file encrypted according to the delivery public key using the delivery private key.