Securing E-mail communications and encrypted file storage using yaksha split private key asymmetric cryptography

Claim 3

A method according to claim 1, further comprising the steps of: encrypting a first retrieve file request with the first private key portion of a second user crypto-key associated with a second user to form a first encrypted retrieve file request; encrypting the first encrypted retrieve file request with the second private key portion of the second user crypto-key to form a second encrypted retrieve file request; and obtaining the first retrieve file request by applying the public key portion of the second user crypto-key to decrypt the second encrypted retrieve file request; retrieving the encrypted file and the encrypted key message from storage responsive to said retrieve file request; obtaining the symmetric crypto-key by applying the first private key portion of the first user crypto-key to decrypt the retrieved encrypted key message; and obtaining the data by applying the symmetric crypto-key to decrypt the retrieved encrypted file.

Claim 4

A method according to claim 2, further comprising the steps of obtaining the first retrieve file request by applying the second private key portion of the second user crypto-key to the first encrypted retrieve file request, and directing the data to the second user.

Claim 5

A method according to claim 1, wherein said first user is a file server.

Claim 6

A method according to claim 1, wherein each said key portion has a bit length and the bit length of each first private key portion is smaller than the bit length of the associated second private key portion.

Claim 7

A method according to claim 1, wherein the bit length of each said first private key portion is between 56 and 72 bits.

Claim 8

A method according to claim 1, wherein (i) each said private key portion is comprised of a private exponent and modulus N which is a product of a plurality of numbers within a set of large prime numbers, (ii) each said public key portion is comprised of a public exponent and the modulus N and (iii) the modulus N has a bit length and the bit length of each said private key portion is no larger than fifteen percent of the bit length of the modulus N but not less than 56 bits.

Claim 11

A system according to claim 8, further comprising: a user processor configured to encrypt a first retrieve file request with the first private key portion of a user crypto-key to form a first encrypted retrieve file request; wherein, the security server encrypts the first encrypted retrieve file request with the second private key portion of the user crypto-key to form a second encrypted retrieve file request, and wherein, the file server (i) obtains the first retrieve file request by applying the public key portion of the user crypto-key to decrypt the second encrypted retrieve file request, (ii) directs the retrieval of the encrypted file and the encrypted key message from the storage media responsive to the retrieve file request, (iii) obtains the symmetric crypto-key by applying the first private key portion of the file server crypto-key to decrypt the retrieved encrypted key message, and (iv) obtains the data by applying the symmetric crypto-key to decrypt the retrieved encrypted file.

Claim 12

A system according to claim 9, wherein said security server obtains the first retrieve file request by applying the second private key portion of the user crypto-key to the first encrypted retrieve file request, and the file server directs the data to the user processor.

Claim 13

A system according to claim 8, wherein each said key portion has a bit length and the bit length of each first private key portion is smaller than the bit length of the associated second private key portion.

Claim 14

A system according to claim 8, wherein the bit length of each said first private key portion is between 56 and 72 bits.

Claim 15

A system according to claim 8, wherein (i) each said private key portion is comprised of a private exponent and modulus N which is a product of a plurality of numbers within a set of large prime numbers, (ii) each said public key portion is comprised of a public exponent and the modulus N and (iii) the modulus N has a bit length and the bit length of each said private key portion is no larger than fifteen percent of the bit length of the modulus N but not less than 56 bits.

Claim 16

An article of manufacture for securing stored files in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a security server, comprising: computer readable storage medium; and computer programming stored on said storage medium; wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to: decrypt a symmetric crypto-key encrypted with the second private key portion of a user crypto-key associated with a user of said computer by applying the first private key portion of the user crypto-key, to thereby obtain the symmetric crypto-key; encrypt data with the symmetric crypto-key to form an encrypted file; and store the encrypted file and the encrypted symmetric crypto-key.

Claim 17

An article of manufacture for securing stored files in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a security server, comprising: computer readable storage medium; and computer programming stored on said storage medium; wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to: decrypt a symmetric crypto-key encrypted with the second private key portion of a user crypto-key associated with a user of said computer by applying the first private key portion of the user crypto-key, to thereby obtain the symmetric crypto-key; encrypt data with the symmetric crypto-key to form an encrypted file; and store the encrypted file and the encrypted symmetric crypto-key.

Claim 18

An article of manufacture according to claim 14, wherein said stored computer programming is configured to be readable from said computer readable storage medium by the computer to thereby cause said computer to operate so as to: decrypt a retrieve file request encrypted with the first and the second private key portion of a second user crypto-key by applying the public key portion of said second user crypto-key to obtain the retrieve file request; retrieve the encrypted file and the encrypted symmetric crypto-key from storage responsive to said retrieve file request; decrypt the retrieved encrypted symmetric crypto-key by applying the first private key portion of the user crypto-key to obtain the symmetric crypto-key; and decrypt the retrieved encrypted file by applying the symmetric crypto-key to obtain the data.

Claim 19

An article of manufacture according to claim 15, wherein said stored computer programming is configured to be readable from said computer readable storage medium by the computer to thereby cause said computer to operate so as to direct the data to the second user.

Claim 20

A programmed computer for securing stored files in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a security server, comprising: a processor for decrypting a symmetric crypto-key encrypted with the second private key portion of a user crypto-key by applying the first private key portion of the user crypto-key, to thereby obtain the symmetric crypto-key, and encrypting data with the symmetric crypto-key to form an encrypted file; storage media for storing the encrypted file and the encrypted symmetric crypto-key.

Claim 21

A programmed computer for securing stored files in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a security server, comprising: a processor for decrypting a symmetric crypto-key encrypted with the second private key portion of a user crypto-key by applying the first private key portion of the user crypto-key, to thereby obtain the symmetric crypto-key, and encrypting data with the symmetric crypto-key to form an encrypted file; storage media for storing the encrypted file and the encrypted symmetric crypto-key.

Claim 22

A programmed computer according to claim 17, wherein: the processor is adapted to decrypt a retrieve file request encrypted with the first and the second private key portion of a second user crypto-key by applying the public key portion of said second user crypto-key to obtain the retrieve file request, to retrieve the encrypted file and the encrypted symmetric crypto-key from the storage media, to decrypt the retrieved encrypted symmetric crypto-key by applying the first private key portion of the user crypto-key to obtain the symmetric crypto-key, and to decrypt the retrieved encrypted file by applying the symmetric crypto-key to obtain the data; the storage media is adapted to store the first private key portion of the user crypto-key.

Claim 25

A method according to claim 19, wherein said (i) each said private key portion is comprised of a private exponent and modulus N which is a product of a plurality of numbers within a set of large prime numbers, (ii) each said public key portion is comprised of a public exponent and the modulus N and (iii) the modulus N has a bit length and the bit length of each said private key portion is no larger than fifteen percent of the bit length of the modulus N but not less than 56 bits.

Claim 28

A system according to claim 21, wherein (i) each said private key portion is comprised of a private exponent and modulus N which is a product of a plurality of numbers within a set of large prime numbers, (ii) each said public key portion is comprised of a public exponent and the modulus N and (iii) the modulus N has a bit length and the bit length of each said private key portion is no larger than fifteen percent of the bit length of the modulus N but not less than 56 bits.

Claim 29

An article of manufacture for session key distribution in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, the private key portion of a first user having a first private key portion known only to the first user and a corresponding second private key portion known only to a security server and the private key portion of a second user known only to the second user, comprising: computer readable storage medium; and computer programming stored on said storage medium; wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to: decrypt a first message encrypted with the first private key portion of the first user crypto-key by applying the second private key portion of the first user crypto-key to thereby obtain a session key request; encrypt a symmetric crypto-key with the second private key portion of the first user crypto-key to form a first encrypted key message; and encrypt the symmetric crypto-key with the public key portion of the second user crypto-key to form a second encrypted key message; wherein, the symmetric crypto-key is obtainable by the first user by applying the first private key portion of the first user crypto-key to the first encrypted key message and by the second user by applying the private key portion of the second user crypto-key to the second encrypted key message so that the symmetric crypto-key is available to encrypt and decrypt communications between said first and said second users.

Claim 30

An article of manufacture for session key distribution in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, the private key portion of a first user having a first private key portion known only to the first user and a corresponding second private key portion known only to a security server and the private key portion of a second user known only to the second user, comprising: computer readable storage medium; and computer programming stored on said storage medium; wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to: decrypt a first message encrypted with the first private key portion of the first user crypto-key by applying the second private key portion of the first user crypto-key to thereby obtain a session key request; encrypt a symmetric crypto-key with the second private key portion of the first user crypto-key to form a first encrypted key message; and encrypt the symmetric crypto-key with the public key portion of the second user crypto-key to form a second encrypted key message; wherein, the symmetric crypto-key is obtainable by the first user by applying the first private key portion of the first user crypto-key to the first encrypted key message and by the second user by applying the private key portion of the second user crypto-key to the second encrypted key message so that the symmetric crypto-key is available to encrypt and decrypt communications between said first and said second users.

Claim 31

A programmed computer for session key distribution in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, the private key portion of a first user having a first private key portion known only to the first user and a corresponding second private key portion known only to a security server and the private key portion of a second user known only to the second user, comprising: a processor for decrypting a first message encrypted with the first private key portion of the first user crypto-key by applying the second private key portion of the first user crypto-key to thereby obtain a session key request, for generating a symmetric crypto-key, for encrypting the symmetric crypto-key with the second private key portion of the first user crypto-key to form a first encrypted key message, and for encrypting the symmetric crypto-key with the public key portion of the second user crypto-key to form a second encrypted key message; and storage media for storing the second private key portion of the first user crypto-key and the public key portion of the second user crypto-key. wherein, the symmetric crypto-key is obtainable by the first user by applying the first private key portion of the first user crypto-key to the first encrypted key message and by the second user by applying the private key portion of the second user crypto-key to the second encrypted key message so that the symmetric crypto-key is available to encrypt and decrypt communications between said first and said second users.

Claim 32

A programmed computer for session key distribution in a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, the private key portion of a first user having a first private key portion known only to the first user and a corresponding second private key portion known only to a security server and the private key portion of a second user known only to the second user, comprising: a processor for decrypting a first message encrypted with the first private key portion of the first user crypto-key by applying the second private key portion of the first user crypto-key to thereby obtain a session key request, for generating a symmetric crypto-key, for encrypting the symmetric crypto-key with the second private key portion of the first user crypto-key to form a first encrypted key message, and for encrypting the symmetric crypto-key with the public key portion of the second user crypto-key to form a second encrypted key message; and storage media for storing the second private key portion of the first user crypto-key and the public key portion of the second user crypto-key. wherein, the symmetric crypto-key is obtainable by the first user by applying the first private key portion of the first user crypto-key to the first encrypted key message and by the second user by applying the private key portion of the second user crypto-key to the second encrypted key message so that the symmetric crypto-key is available to encrypt and decrypt communications between said first and said second users.