System for protecting an encrypted information unit
This invention relates to system for securing an information unit and applications thereof. The system comprising at least one encrypting means for applying a first encryption key to the information unit thus provided an encrypted information unit, wherein said at least one encryption means is adapted to apply at least two second information encryption keys to the encrypted information unit, said at least two second encryption keys being calculated so as to decrypt the encrypted information unit when all of said first and second encryption keys have been applied to the information unit, the encryption keys being distributed to chosen users of the system.
1. A system, comprising:
a first node, a second node, and an intermediate node, the first node, the second node, and the intermediate node each comprising an electronic computing device configured to encrypt data using an Elliptic Curve Cryptography (ECC) encryption scheme and to handle a respective private key and public key for the ECC encryption scheme, the ECC encryption scheme defined by a base point (G) on an elliptic curve,
the system being configured to secure a data unit during a transfer from the first node to the second node via the intermediate node, wherein:
the electronic computing device of the first node is configured to encrypt the data unit using the ECC encryption scheme and k p G derived based on the private key of the first node and a random number, and to send the encrypted data unit to the intermediate node,
the electronic computing device of the intermediate node is configured to receive a request for the data unit from the second node, the request comprising the public key of the second node, and in response to the request send a further request to the first node for authorization to transfer the data unit to the second node, wherein the further request comprises the public key of the second node,
the electronic computing device of the first node is configured to derive k r and k u G satisfying the equation k p +k r =k u k a , where k u is associated with the private key k a of the second node, and to send k r and k u G to the intermediate node in response to the further request,
the electronic computing device of the intermediate node is configured to re-encrypt the encrypted data unit using the ECC encryption scheme and k r , and to send the re-encrypted data unit and k u G to the second node, and
the electronic computing device of the second node is configured to decrypt the re-encrypted data unit using the ECC encryption scheme and the private key k a of the second node.
2. A method, to be performed by a system comprising a first node, a second node, and an intermediate node for securing a data unit during a transfer from the first node to the second node via the intermediate node, the first node, the second node and the intermediate node each comprising an electronic computing device, the electronic computing device of each of the first node, the second node and the intermediate node configured to encrypt data, and the electronic computing device of each of the first node, the second node, and the intermediate node configured to handle a respective public-private key pair associated by a base point (G) for Elliptic Curve Cryptography (ECC), the method comprising:
the electronic computing device of the first node encrypting the data unit using the ECC encryption scheme and k p G being derived based on the private key of the first node and a random number;
the first node sending the encrypted data unit to the intermediate node;
the electronic computing device of the intermediate node receiving a request for the data unit from the second node, the request comprising the public key of the second node, and in response to the request sending a further request to the first node for authorization to transfer the data unit to the second node, the further request comprising the public key of the second node,
the electronic computing device of the first node deriving k r and k u G to satisfy the equation k p +k r =k u k a , where k u is associated with the private key k a of the second node, and sending k r and k u G to the intermediate node in response to the further request,
the electronic computing device of the intermediate node re-encrypting the encrypted data unit using the ECC encryption scheme and k r , and sending the re-encrypted data unit and k u G to the second node; and
the electronic computing device of the second node decrypting the re-encrypted data unit using the ECC encryption scheme and the private key of the second node.
3. The method according to claim 2 , wherein the system is a DRM system, the encrypted data unit is a media file, wherein the first node is related to a producer of the media file, the intermediate node is related to a reseller of the media file, and the second node is related to a consumer of the media file.
4. The method according to claim 2 ,
wherein the intermediate node is related to a cloud storage provider, and
the method further comprising:
the intermediate node storing the encrypted data unit in a central database.