System and method for securely storing and sharing information
The present application generally relates to systems, devices, and methods to conduct the secure exchange of encrypted data using a three-element-core mechanism consisting of the key masters, the registries and the cloud lockboxes with application programming interfaces providing interaction with a wide variety of user-facing software applications. Together the mechanism provides full lifecycle encryption enabling cross-platform sharing of encrypted data within and between organizations, individuals, applications and devices. Further the mechanism generates chains of encrypted blocks to provide a distributed indelible ledger and support external validation. Cross-verification among users, applications and the mechanism deliver both enterprise and business ecosystem cyber security features. Crowdsourcing of anomaly detection extends to users and to subjects of the data. Robust identity masking offers the benefits of anonymization while retaining accountability and enabling two-way communications. The mechanism may also provide high availability through multi-level fail over or operations to multiple instances of the core mechanism.
1. A system comprising:
a register programmed to manage identities and permissions;
a key master programmed to generate, manage and exchange keys, and providing encryption and decryption services; and
a cloud lockbox programmed to store encrypted data and enable retrieval of protected data;
a three-element-core mechanism configured to interface with one or more software applications to enable a plurality of participants to securely share data stored in a vault abstractions via the software application, using cross-verification of privileges comprising: a 1st factor authentication to the software application, a 2nd factor authentication directly to the registry, bypassing the software application, and an authenticated application programming interface call from the software application to the key master, such that unauthorized access to the protected data is prevented by the three-element-core mechanism.
2. The system of claim 1 , wherein the 2nd factor authentication employs at least one of a: one-time, periodic or continuous biometric input, password, and texted session code; to identify a participant of the plurality of participants.
3. The system of claim 1 , wherein the software application cross-verifies the 1st factor authentication by querying the registry regarding the status of 2nd factor authentication to the registry to prevent unauthorized access to the software application.
4. The system of claim 1 , further comprising an identity management software configured to control the 1st factor authentication for access to the software application, wherein the identity management software utilizes the 2nd factor authentication directly to the registry to prevent unauthorized access to the protected data in a vault abstraction created by the three-element-core mechanism.
5. The system of claim 1 , wherein biometric factors are utilized for the 2nd factor authentication with biometric profiles stored in one of the register and the cloud lockbox to enable device-independent biometric authentication.
6. The system of claim 1 , wherein unauthorized use of the application programming interface is detected and blocked due to the cross-verification.
7. The system of claim 4 , wherein unauthorized use of the identity management software is detected and blocked due to the cross-verification.
8. The system of claim 1 , wherein a systems administrator of the software application adheres to the 1st factor and 2nd factor authentication and whose access to the data stored in one or more vault abstractions created by the three-element-core mechanism is limited to privileges controlled by the authenticated application programming interface call from the software application to the key master.
9. The system of claim 1 , wherein different organizations, or different departments within a single organization, separately manage the register and the key master in order to improve operational security by minimizing access by a participant, department or organization to the three-element-core mechanism.
10. A system for use by a plurality of participants within a community of interest for purposes of data integrity, privacy, security, confidentiality and non-repudiation, the system comprising: a tightly-coupled, distributed three-element-core mechanism comprising:
one or more registries managing identities and permissions;
one or more key masters generating, managing and exchanging keys, and providing encryption and decryption services based on third-party encryption libraries; and
one or more cloud lockboxes configured to store encrypted data and enable retrieval of protected data;
wherein the three-element-core mechanism is configured to interface with one or more software applications, for generating a vault abstraction that spans the three-element-core mechanism for securing the data, wherein elements of control are split across the registry, the key master, and the cloud lockbox, the elements of control including identity assertion by the registry, cryptography key pairs by the key master, unique file identifiers in the registry, and encrypted files in the cloud lockbox.
11. The system of claim 10 , wherein multiple vaults abstractions are generated for different sub-categories or purposes of data about one of a person, a project, a case or a mission to provide additional granularity for sharing access to the protected data by using numerous encryption key pairs including specialized purposes for containing chains of encrypted blocks to serve as a distributed ledger.
12. The system of claim 11 , wherein a plurality of vaults are generated to represent a given person and are mapped to generate a unified view relative to a role of an individual for accessing the data associated with the given person.
13. The system of claim 11 , wherein a plurality of vaults are generated to represent a given project and are mapped to generate a unified view relative to a role an individual for accessing the data associated with the given project.
14. The system of claim 10 , wherein access to a vault abstraction is restricted by individual files or file groupings of the data or to one of deposit-only, read-only or metadata-only privileges.
15. The system of claim 10 , wherein the interfaced software application is configured to retrieve the data from a vault abstraction and deliver the data directly to a workstation using the interfaced software application.
16. The system of claim 10 , further comprising hash values for the encrypted files stored in the registry, wherein the hash values enable verification that file contents are unaltered upon retrieval from a vault abstraction.
17. The system of claim 10 , wherein the data stored in a vault abstraction in the cloud lockbox is replicated based on settings in the registry to another location.
18. The system of claim 10 , wherein the system is configured to provision the vault abstraction on at least one of a public cloud, a private cloud, an on-premise operating environment, and a mobile operating environment.
19. The system of claim 10 , wherein the key master is configured to encrypt a file of the data to be deposited in a vault abstraction by generating a unique file identifier, wherein the unique file identifier refrains from providing an indication of a key required for decryption.
20. The system of claim 10 , wherein the system is configured to use symmetric encryption either in place of or in combination with asymmetric encryption.