System and associated software for providing advanced data protections in a defense-in-depth system by integrating multi-factor authentication with cryptographic offloading

1. A method, implemented using hardware, comprising:

a. encrypting content with an inner data container using one or more unique client-generated and client-stored cryptographic keys to generate client-encrypted content; and

b. sending the client-encrypted content to a server where the client-encrypted content is encrypted with an outer data container using one or more unique server-generated and server-stored cryptographic keys, wherein encrypting the content further comprises:

implementing a cryptographic algorithm and offloading schedule to transmit client-encrypted data blocks and additional cryptographic inputs to a server application, using secure networking components and a secure network channel negotiated as a result of server application authentication and based on configuration data returned when authentication succeeds;

using the additional cryptographic inputs, generating or retrieving one or more unique content encryption keys associated with and specific to the client-encrypted content, and encrypting the client-encrypted content in a data container in a secure server store while also storing the one or more server-generated and server-stored cryptographic keys on the secure server store;

generating a globally unique data identifier and the additional cryptographic inputs, and storing the globally unique data identifier and the additional cryptographic inputs in a protected data container stored in a protected client store using a client application;

encrypting the content a block at a time; and

returning results to the client application, using an encrypted channel, where the results are used as input to continue block encryption, until all of the content is encrypted, at which point encrypted material is added to the protected data container in the client store, replacing plaintext input material.

2. The method of claim 1 wherein the one or more client-generated cryptographic keys are stored on the client device.

3. The method of claim 1 wherein encrypting the content further comprises:

storing an event to the client store, associated with the globally unique data identifier; and

generating one or more unique encryption keys, stored in a protected part of the client store.

4. The method of claim 3 further comprising removing original content, and destroying the secure network channel and cryptographic parameters.

5. The method of claim 3 wherein authentication further comprises:

(1) reading policy information from the client store, or from user input, to determine user identity;

(2) querying a user for a password, or using cached password data in the form of a salted hash and/or key-stretched derived value;

(3) optionally querying the user for secondary authentication information;

(4) using secure networking components to transmit the secondary authentication information to the server application which verifies the identity of the user, authorizes operation, and stores, to the server store, an event associated with authentication; and

(5) generating a protected communications channel for use during the remainder of a single encryption/decryption transaction.

6. The method of claim 5 wherein the secondary authentication factor uses an externally-connected device or software libraries that provide identity and/or authentication material.

7. The method of claim 6 wherein the externally-connected device comprises a USB token or other external device or software application, which requires human interaction to generate a One-Time Password or other authenticating material read from hardware or third-party software libraries.

8. The method of claim 3 further comprising decrypting the content comprising:

i. establishing a secure channel through authentication;

ii. delivering the server-stored cryptographic keys associated with a unique identifier of an encrypted item, to the client, using the secure channel;

iii. decrypting the content on the client first using the server-stored cryptographic key which is delivered, then using the locally client-stored cryptographic key, to obtain plaintext content; and

iv. removing all ciphertext and associated cryptographic material and acknowledging an operation with the server application using the client application and secure network channel.

9. The method of claim 8 wherein decrypting the content comprises using one or more keys from a client store together with keys delivered by the server, from the secure server store, in response to authentication and authorization.

10. A client device comprising:

a. a memory for storing an application, the application programmed to perform:

i. encrypting content with an inner data container using a stored client cryptographic key to generate client-encrypted content; and

ii. sending the client-encrypted content to a server where the client-encrypted content is encrypted with an outer data container using one or more unique server-generated and server-stored cryptographic keys, wherein encrypting the content further comprises:

implementing a cryptographic algorithm and offloading schedule to encrypt data blocks and additional cryptographic inputs to a server application, using secure networking components and a secure network channel negotiated as a result of a server application authentication and based on configuration data returned when authentication succeeds;

using the additional cryptographic inputs, generating or retrieving one or more unique content encryption keys associated with and specific to client-encrypted content, and encrypting the client-encrypted content in a data container in a secure server store while also storing the server-stored cryptographic key on the secure server store;

generating a globally unique data identifier and the additional cryptographic inputs, and storing the globally unique data identifier and the additional cryptographic inputs in a protected data container stored in a protected client store using a client application;

encrypting the content a block at a time; and

returning results to the client application, using an encrypted channel, where the results are used as input to continue block encryption, until all of the content is encrypted, at which point encrypted material is added to the protected data container in the client store, replacing plaintext input material; and

b. a processor for processing the application.

11. The client device of claim 10 wherein the client-generated cryptographic keys are stored on the client device.

12. The client device of claim 10 wherein encrypting the content further comprises:

storing an event to the client store, associated with the globally unique data identifier; and

generating one or more unique encryption keys, stored in a protected part of the client store.

13. The client device of claim 12 wherein the client device is configured for removing original content and destroying the secure network channel and cryptographic parameters.

14. The client device of claim 12 wherein authentication further comprises:

(1) reading policy information from the client store, or from user input, to determine user identity;

(2) querying a user for a password or using cached password data in the form of a salted hash and/or key-stretched derived value;

(3) optionally querying the user for secondary authentication information;

(4) using secure networking components to transmit the secondary authentication information to the server application which verifies the identity of the user, authorizes operation, and stores, to the server store, an event associated with authentication; and

(5) generating a protected communications channel for use during a remainder of a single encryption/decryption transaction.

15. The client device of claim 14 wherein the secondary authentication factor uses an externally-connected device or software libraries that provide identity and/or authentication material.

16. The client device of claim 15 wherein the externally-connected device comprises a USB token or other external device or software application, which requires human touch to generate a One-Time Password or other authenticating material read from hardware or third-party software libraries.

17. The client device of claim 10 wherein the client device is further configured for decrypting the content comprising:

i. establishing a secure channel through authentication;

ii. receiving the server-stored cryptographic keys associated with a unique identifier of an encrypted item, to the client, using the secure channel;

iii. decrypting the content on the client first using the server-stored and delivered cryptographic key, then using the locally client-stored cryptographic key, to obtain plaintext content; and

iv. removing all ciphertext and associated cryptographic material and acknowledging an operation with the server application using the client application and the secure network channel.

18. A server device comprising:

a. a memory for storing an application, the application programmed to perform:

i. receiving encrypted content with an inner data container using one or more stored client-generated cryptographic keys; and

ii. encrypting the content with an outer data container using one or more unique server-generated and server-stored cryptographic keys, wherein encrypting the content further comprises:

implementing a cryptographic algorithm and offloading schedule to receive client-encrypted data blocks and additional cryptographic inputs for the application, using secure networking components and a secure network channel negotiated as a result of a server application authentication and based on configuration data returned when authentication succeeds;

using the additional cryptographic inputs, generating or retrieving one or more unique content encryption keys associated with and specific to the client-encrypted content, and encrypting the client-encrypted content in a data container in a secure server store while also storing the server-generated and server-stored cryptographic keys on the secure server store;

generating a globally unique data identifier and the additional cryptographic inputs, and storing the globally unique data identifier and the additional cryptographic inputs in a protected data container stored in a protected client store using a client application;

encrypting the content a block at a time; and

returning results to the client application, using an encrypted channel, where the results are used as input to continue block encryption, until all of the content is encrypted, at which point encrypted material is added to the protected data container in the client store, replacing plaintext input material; and

b. a processor for processing the application.

19. The server device of claim 18 wherein the one or more client-generated cryptographic keys is stored on the client device.

20. The server device of claim 18 wherein encrypting the content further comprises:

returning results to a client application, using an encrypted channel, where the results are used as input to continue block encryption, until all of the content is encrypted, at which point encrypted material is added to the protected data container in a client store, replacing plaintext input material.

21. The server device of claim 18 wherein authentication further comprises:

using secure networking components to transmit secondary authentication information to a server application which verifies an identity of a user, authorizes operation, and stores, to a server store, an event associated with authentication; and

generating a protected communications channel for use during a remainder of a single encryption/decryption transaction.

22. The server device of claim 18 wherein the server device is configured for decrypting the content comprising:

establishing a secure channel through authentication; and

delivering the server-stored cryptographic keys associated with a unique identifier of an encrypted item, to the client, using the secure channel.

23. A system comprising:

a. a client device configured for encrypting content with an inner data container using one or more stored client cryptographic keys to generate client-encrypted content; and

b. a server device configured for encrypting the client-encrypted content with an outer data container using one or more unique server-generated and server-stored cryptographic keys, wherein encrypting the content further comprises:

implementing a cryptographic algorithm and offloading schedule to transmit client-encrypted data blocks and additional cryptographic inputs to a server application, using secure networking components and a secure network channel negotiated as a result of a server application authentication and based on configuration data returned when authentication succeeds;

using the additional cryptographic inputs, generating or retrieving one or more unique content encryption keys associated with and specific to client-encrypted content, and encrypting the client-encrypted content in a data container in a secure server store while also storing the one or more server generated and server-stored cryptographic keys of on the secure server store;

generating a globally unique data identifier and additional cryptographic inputs, and storing the globally unique data identifier and the additional cryptographic inputs in a protected data container stored in a protected client store using a client application;

encrypting the content a block at a time; and

returning results to the client application, using an encrypted channel, where the results are used as input to continue block encryption, until all of the content is encrypted, at which point encrypted material is added to the protected data container in the client store, replacing plaintext input material.

24. The system of claim 23 wherein the one or more client-generated cryptographic keys are stored on the client device.

25. The system of claim 23 wherein encrypting the content further comprises:

storing an event to the client store, associated with the globally unique data identifier; and

generating one or more unique encryption keys, stored in a protected part of the client store.

26. The system of claim 23 wherein the client device is configured for removing original content, and destroying the secure network channel and cryptographic parameters.

27. The system of claim 23 wherein authentication further comprises:

(1) reading policy information from the client store and receiving user identity information;

(2) querying a user for a password, or using cached password data in the form of a salted hash and/or key-stretched derived value;

(3) optionally querying the user for secondary authentication information;

(4) using secure networking components to transmit the secondary authentication information to the server application which verifies an identity of the user, authorizes operation, and stores, to the server store, an event associated with authentication; and

(5) generating a protected communications channel for use during a remainder of a single encryption/decryption transaction.

28. The system of claim 27 wherein the secondary authentication factor uses an externally-connected device or software libraries that provide identity and/or authentication material.

29. The system of claim 28 wherein the externally-connected device comprises a USB token or other external device or software application which requires human touch to generate a One-Time Password or other authenticating material read from hardware or third-party software libraries.

30. The system of claim 23 wherein the client device is configured for decrypting the content comprising:

i. establishing a secure channel through authentication;

ii. delivering the server-stored cryptographic keys associated with a unique identifier of an encrypted item, to the client, using the secure channel;

iii. decrypting the content on the client first using the server-stored cryptographic key which is delivered, then using the locally client-stored cryptographic key, to obtain plaintext; and

iv. removing all ciphertext and associated cryptographic material and acknowledging an operation with the server application using the client application and secure network channel.

31. The system of claim 23 wherein decrypting the content comprises using one or more keys from a client store delivered by the server in response to authentication and authorization.

32. A server device comprising:

a. a memory for storing an application, the application programmed to perform:

i. receiving encrypted content generated by encrypting a content with an inner data container using one or more stored client cryptographic keys, wherein the stored client cryptographic keys are stored on a client device; and

ii. encrypting the client-encrypted content with an outer data container using one or more unique server-generated and server-stored cryptographic keys, wherein encrypting the content further comprises:

implementing a cryptographic algorithm to transmit client-encrypted data blocks and additional cryptographic inputs to the application, using secure networking components and a secure network channel negotiated as a result of a server application authentication and based on configuration data returned when authentication succeeds; and

using the additional cryptographic inputs, generating or retrieving one or more ephemeral encryption keys associated with and unique and specific to the client-encrypted content, and encrypting the client-encrypted content in a data container in a secure server store, and storing the ephemeral keys in the secure server store

generating a globally unique data identifier, and storing the globally unique data identifier and the additional cryptographic inputs in a protected data container stored in a protected client store using a client application; and

returning results to the client application, using an encrypted channel, where the results are used as input to continue block encryption, until all of the content is encrypted, at which point encrypted material is added to the protected data container in the client store, replacing plaintext input material; and

b. a processor for processing the application.

33. The server device of claim 32 wherein authentication further comprises:

using the secure networking components to transmit secondary authentication information to a server application which verifies an identity of a user, authorizes operation, and stores, to the server store, an event associated with authentication; and

generating a protected communications channel for use during a remainder of a single encryption/decryption transaction.

34. The server device of claim 32 wherein the server device is configured for decrypting the content comprising:

establishing a secure channel through an authentication; and

delivering the server-stored cryptographic keys associated with a unique identifier of an encrypted item, to the client, using the secure networking channel.