Granted Patent B2

US 12,671,583 · App. 17/567,161 · Granted Jun 30, 2026

Inventors: Mark S. O'Hare (Coto De Caza, CA); Rick L. Orsini (Flower Mound, TX); Don Martin (Chesterfield, VA)

Assignee: Security First Innovations, LLC

H04L9/321G06F21/31G06F21/32G06F21/33G06F21/606G06F21/6209G06F21/6218G06F21/645G06Q40/08H04L9/0822H04L9/0825H04L9/085H04L9/0894H04L9/3231H04L9/3247H04L63/0428H04L67/1097G06F2221/2107

Abstract

Claims (51)

1 . A computer-implemented method for securely storing data, the computer-implemented method comprising:

encrypting a dataset using a cryptographic key to generate an encrypted dataset;

generating a plurality of encrypted dataset shares of the encrypted dataset, wherein each of the plurality of encrypted dataset shares includes less than all of the encrypted dataset;

encrypting the cryptographic key with a key encryption key to generate an encrypted cryptographic key;

encrypting the encrypted cryptographic key with a first encryption key to generate a first encrypted key;

generating a plurality of first encrypted key shares of the first encrypted key, wherein each of the plurality of first encrypted key shares includes less than all of the first encrypted key;

encrypting the encrypted cryptographic key with a second encryption key to generate a second encrypted key;

generating a plurality of second encrypted key shares of the second encrypted key, wherein each of the plurality of second encrypted key shares includes less than all of the second encrypted key; and

storing a first one of the plurality of encrypted dataset shares with a first one of the plurality of first encrypted key shares and a first one of the plurality of second encrypted key shares in a first storage device.

2 . The computer-implemented method of claim 1 , wherein the first encryption key is a first public key of a first pair of public/private keys, the method further comprising:

decrypting the first encrypted key using the first private of the first pair of public/private keys to obtain the encrypted cryptographic key; and

decrypting the encrypted cryptographic key using the key encryption key-obtained by decrypting the first encrypted key to obtain the cryptographic key.

3 . The computer-implemented method of claim 2 , further comprising:

decrypting the encrypted dataset using the cryptographic key obtained by decrypting the encrypted cryptographic key.

4 . The computer-implemented method of claim 1 , wherein the cryptographic key is one of a split key, an encryption key, a session key, a workgroup key, a symmetric key, or an asymmetric key.

5 . The computer-implemented method of claim 1 , wherein the first encryption key is associated with a first user device, and the second encryption key is associated with a second user device.

6 . The computer-implemented method of claim 1 , further comprising:

obtaining the first encrypted key using the plurality of first encrypted key shares;

decrypting the obtained first encrypted key to obtain the encrypted cryptographic key; and

decrypting the obtained encrypted cryptographic key to obtain the cryptographic key.

7 . The computer-implemented method of claim 1 , further comprising:

storing a second one of the plurality of encrypted dataset shares with a second one of the plurality of first encrypted key shares and a second one of the plurality of second encrypted key shares in a second storage device.

8 . The computer-implemented method of claim 7 , wherein the first storage device is different than the second storage device.

9 . The computer-implemented method of claim 7 , wherein the first storage device is the same as the second storage device.

10 . The computer-implemented method of claim 1 , wherein the first encrypted key and the second encrypted key are distributed into a header of each of the plurality of encrypted dataset shares.

11 . A computer system for securely sharing data, the computer system comprising:

at least one hardware processor configured to:

encrypt a dataset using a cryptographic key to generate an encrypted dataset;

generate a plurality of encrypted dataset shares of the encrypted dataset, wherein each of the plurality of encrypted dataset shares includes less than all of the encrypted dataset;

encrypt the cryptographic key with a key encryption key to generate an encrypted cryptographic key;

encrypt the encrypted cryptographic key with a first encryption key to generate a first encrypted key;

generate a plurality of first encrypted key shares of the first encrypted key, wherein each of the plurality of first encrypted key shares includes less than all of the first encrypted key;

encrypt the encrypted cryptographic key with a second encryption key to generate a second encrypted key;

generate a plurality of second encrypted key shares of the second encrypted key, wherein each of the plurality of second encrypted key shares includes less than all of the second encrypted key; and

store a first one of the plurality of encrypted dataset shares with a first one of the plurality of first encrypted key shares and a first one of the plurality of second encrypted key shares in a first storage device.

12 . The computer system of claim 11 , wherein the first encryption key is a first public key of a first pair of public/private keys, and wherein the at least one hardware processor is further configured to:

decrypt the first encrypted key using the first private of the first pair of public/private keys to obtain the encrypted cryptographic key; and

decrypt the encrypted cryptographic key using the key encryption key obtained by decrypting the first encrypted key to obtain the cryptographic key.

13 . The computer system of claim 12 , wherein the at least one hardware processor is further configured to:

decrypt the encrypted dataset using the cryptographic key obtained by decrypting the encrypted cryptographic key.

14 . The computer system of claim 11 , wherein the cryptographic key is one of a split key, an encryption key, a session key, a workgroup key, a symmetric key, or an asymmetric key.

15 . The computer system of claim 11 , wherein the first encryption key is associated with a first user device, and the second encryption key is associated with a second user device.

16 . The computer system of claim 11 , wherein the at least one hardware processor is further configured to:

obtain the first encrypted key using the plurality of first encrypted key shares;

decrypt the obtained first encrypted key to obtain the encrypted cryptographic key; and

decrypt the obtained encrypted cryptographic key to obtain the cryptographic key.

17 . The computer system of claim 16 , wherein the at least one hardware processor is further configured to:

store a second one of the plurality of encrypted dataset shares with a second one of the plurality of first encrypted key shares and a second one of the plurality of second encrypted key shares in a second storage device.

18 . The computer system of claim 17 , wherein the first storage device is different than the second storage device.

19 . The computer system of claim 17 , wherein the first storage device is the same as the second storage device.

20 . The computer system of claim 11 , wherein the first encrypted key and the second encrypted key are distributed into a header of each of the plurality of encrypted dataset shares.

Assignments (2)

Continuity (6)

References Cited (400)