Secure access method for digital data

Abstract

The invention relates to a method for securely accessing digital data, said digital data being encrypted with a public encryption key of a specific user and stored on a server. The method comprises the following steps: A. receiving at said server a request from said user to access said digital data; B. sending, via said server through a secure communication interface, a request to a secure user device to release a password stored on said user device; C. obtaining said password via said secure communication interface from said user device in response to a validated security test issued by said user device to a user; and D.retrieve, via said server, an encrypted private key of said user, said encrypted private key of said user being encrypted with said password, and decrypt said encrypted private key of said user with said password to obtain the private key of said user, and decrypt said digital data encrypted with said private key of said user, and present said digital data to said user.

Description

Title of the invention: Method for secure access to digital data FIELD OF THE INVENTION

[0001] The technical field of the present invention relates to the field of access to digital data, and in particular, access to digital data being encrypted with an encryption key. Prior art

[0002] Email encryption is difficult to achieve because it requires users of a system to exchange encryption keys and use passwords that can often be complex and / or compromised by attacks or hacks. A user password typically consists of eight simple characters that take between two and 21 days to crack, depending on the password's complexity. Furthermore, the more complex the password, the more difficult it is for users to remember. Additionally, passwords and encryption keys are stored on a server that can be accessed by system administration or data center personnel. There are open source systems that use Pretty Good Privacy (PGP) encryption technology. However, these are rarely used due to their complexity. Summary of the invention

[0003] The invention improves the situation by proposing a method for secure access to digital data, said digital data being encrypted with a public encryption key of a determined user and stored on a server, said method comprising the following steps: A. receive at said server a request from said user to access said digital data; B. issue, by said server via a secure communication interface, a request to a secure user device to release a password stored on said user device; C. obtaining said password via said secure communication interface, from said user device in response to a validated security test issued by said user device to a user; and D. retrieving, via said server, an encrypted private key of said user, said encrypted private key of said user being encrypted with said password, and decrypting said encrypted private key of said user with said password to obtain the private key of said user, and decrypting said encrypted digital data with said private key of said user, and present said digital data to said user.

[0004] In one embodiment, wherein step A constitutes the opening of a session, the method comprising a subsequent step of deleting said private key and said password from a memory of said server when the session is considered to be terminated.

[0005] Furthermore, the invention improves the situation by proposing a method for secure access to digital data, said digital data being encrypted with a public encryption key of a determined user and stored on a server, said method comprising the following steps: A. receiving at a secure user device via a secure communication interface a request to release a password stored on said user device, said request being issued in response to a receipt at said server of a request from said user to access said digital data; B. issuing, by said secure device, a security test to a user thereof, and in response to the validated security test, releasing by said secure user device said password to said secure communication interface for retrieval by said server, said password being used in decrypting an encrypted private key to obtain the private key of said user, and decrypting said digital data encrypted with said private key of said user, for presentation of said digital data to said user.

[0006] In one embodiment, said step of issuing a security test by said secure user device comprises comparing a biometric input with biometric data associated with said user stored on said secure user device, wherein said validated security test comprises determining whether said biometric input satisfies a predefined similarity criterion with respect to said biometric data associated with said user.

[0007] In one embodiment, the password is stored in a secure chip of said secure user device.

[0008] In one embodiment, said secure communication interface implements an SSL / TLS session via an application running on said secure user device.

[0009] In one embodiment, said secure communication interface further performs encryption and decryption of communications with a shared secret known to said secure user device and said interface.

[0010] In one embodiment, the method comprises an additional step, before step A, of transferring said shared secret to said secure user device.

[0011] In one embodiment, said step of transferring said shared secret to said secure user device includes scanning an optical, magnetic or radio readable code.

[0012] In one embodiment, said public encryption key of said determined user and said private key of said determined user comply with the S / MIME standard and are defined by an S / MIME certificate.

[0013] In one embodiment, said digital data comprises a primary encryption key, and is further associated with primary data encrypted with said primary encryption data, said method comprising a subsequent step of decrypting said primary encryption data with said primary encryption key.

[0014] In one embodiment, said digital data is further associated with an encrypted copy of said primary encryption key, said encrypted copy of said primary encryption key being encrypted with an escrow password.

[0015] Furthermore, the invention improves the situation by providing a computer program product comprising instructions which, when the program is executed by a computer, cause the computer to implement the method of the preceding embodiments.

[0016] In one embodiment, before said step A, said secure communication interface transmits said password to said secure user device via a secure channel.

[0017] Furthermore, the invention improves the situation by proposing a system allowing secure access to digital data, said digital data being encrypted with a public encryption key of a determined user, the system comprising: - a destination unit configured to receive the digital data; - a server configured to store the user's public encryption key and receive a request from said user to access said digital data; - a user device configured to store a password; - a secure communication interface configured to issue a request to the secure user device to release the password and obtain said password from said user device in response to a validated security test issued by said user device to a user, wherein the server is configured to retrieve an encrypted private key of said user, said encrypted private key of said user being encrypted with said password, and decrypt said encrypted private key of said user with said password to obtain the private key of said user, and decrypt said encrypted digital data with said private key of said user, and present said digital data to said user.

[0018] Furthermore, the invention improves the situation by proposing a system allowing secure access to digital data, said digital data being encrypted with a public encryption key of a determined user, the system comprising: - a server configured to store the user's public encryption key; and - a secure user device configured to receive via a secure communication interface a request to release a password stored on said user device, said request being issued in response to a reception at said server of a request from said user to access said digital data, issue a security test to a user thereof, and in response to the validated security test, release said password to said secure communication interface for retrieval by said server, said password being used in the decryption of an encrypted private key to obtain the private key of said user, and the decryption of said encrypted digital data with said private key of said user, for the presentation of said digital data to said user.

[0019] Further provided is a method for secure access to digital data allowing simple configuration and use, as well as simple integration into non-compliant systems. Brief description of the drawings

[0020] Other characteristics, details and advantages of the invention will emerge from reading the description given with reference to the appended drawings given by way of example and which represent, respectively:

[0021] [Fig-1] is a schematic representation of an example of a system allowing secure access to digital data;

[0022] [Fig.2] represents an example of a method for secure access to digital data; and

[0023] [Fig.3] represents an example of a method for secure access to digital data. DETAILED DESCRIPTION

[0024] [Fig.l] illustrates an example of a system 100 enabling secure access to digital data. The digital data is encrypted with a user's public encryption key. The digital data may be, for example, emails. The user's public encryption key may, for example, be S / MIME compliant and defined by an S / MIME certificate. The system 100 comprises a destination unit 102, a server 104, a secure communication interface 108, and a user device 106.

[0025] The destination unit 102 may be, for example, a user's computer allowing access to one or more electronic mailboxes. A computer includes a desktop or laptop computer, a smartphone, a tablet, or a smartwatch. Alternatively, the destination unit 102 may be an application on a user's computer, tablet, or phone, such as a smartphone, that provides access to one or more mailboxes. For example, a first user may receive one or more emails from a second user that are encrypted with the first user's public key.

[0026] The server 104 may be, for example, a computer or a group of computing devices. For example, the server may be a mainframe computer, a group of computers, or a group of servers operating as a unit. In one example, the server 104 may be a database server coupled to a web server. The server 104 may be coupled to a database and may include any hardware, software, other logic, or combination thereof to respond to requests from one or more computers. The server 104 may use a variety of computing structures, arrangements, and compilations to respond to requests from one or more user computers.

[0027] The user's public encryption key is stored on the server 104. Thus, the user, in order to access his digital data, sends a request to the server 104. For example, when the first user receives one or more emails from the second user that are encrypted with the first user's public key, the first user sends a request to the server 104 in order to access his emails. In addition, or alternatively, the receipt of the request by the server 104 may constitute the opening of a session.

[0028] The secure user device 106 may be a mobile device, for example, a smartphone, a laptop, a tablet, or a smart watch. In another example, the secure user device 106 and the destination unit 102 may be a single device including an application for accessing a mailbox and an application for storing and releasing a password. The password is randomly generated from the user device 106. Thus, being randomly generated means that it cannot be guessed with knowledge about the user (unlike passwords typically including a date of birth, the name of the person's dog, their favorite sports team, etc.).

[0029] The secure user device 106 for storing and releasing a password provides access to the secure communication interface 108. For example, the secure communication interface 108 may be a third-party server for securely transferring a password. In another example, the secure communication interface 108 implements an SSL / TLS session via an application executed on the secure user device 106 to securely transfer a password. When the secure user device 106 sends a request to the server 104, the server 104 issues a request to the secure communication interface 108 which in turn issues a request to the secure user device 106 to release a password stored on the secure user device 106. For example, the secure user device 106 may include a memory for storing the password. In another example, the password may be stored in a secure chip of the secure user device 106 which may be a cryptographic chip integrated into the motherboard of the secure user device 106. In one example, the secure communication interface 108 pre-transmits the password to the secure user device 106 via a secure channel in order to be stored in the secure user device 106.For example, the secure communication interface 108 and the secure user device 106 may communicate by encrypting the password for each other using a session key.

[0030] A security test issued by the secure user device 106 is used to release the password. For example, the user device 106 may include a device for generating biometric data such as a fingerprint, facial recognition, iris scanning, or voice analysis sensor. The secure user device 106 may request that the user enter their biometric data, for example, their fingerprint by placing their finger on the biometric sensor via their mobile phone. In another example, the biometric data may be facial recognition or a sign of life such as the user's pulse or respiration. The secure user device 106 verifies that the fingerprint matches that of the user.For example, the secure user device 106 may store biometric data associated with one or more users for comparison with biometric data generated during the security test. The test is validated when the secure user device 106 determines that the biometric input satisfies a predefined similarity criterion with respect to the biometric data associated with the user. For example, the similarity criterion may correspond to a similarity threshold between the biometric input and the biometric data associated with the user.

[0031] If the test is validated by the secure user device 106, the password is obtained via the secure communication interface 108, from the secure user device 106. The password is then transmitted to the server 104. The server 104 retrieves an encrypted private key of the user which is encrypted with the password. For example, the server 104 may include a memory for storing private keys corresponding to different users and encrypted with passwords stored in the secure user device 106. The server 104 may then de encrypt the user's private key with the password. Once the key is decrypted, the server 104 can decrypt the digital data and transmit it to the destination unit 102. The user can then access their digital data. For example, the user can access their emails. In one example, the user's encrypted private key may be S / MIME compliant and defined by an S / MIME certificate.

[0032] In one example, the digital data includes a primary encryption key, and is further associated with primary data encrypted with the primary encryption data. Primary encryption data may be decrypted with the primary encryption key. For example, the digital data may be further associated with an encrypted copy of the primary encryption key, the encrypted copy of the primary encryption key being encrypted with an escrow password. In particular, two different keys (e.g., the escrow private primary key and the user's private encryption key) may be used to decrypt the digital data. For example, the digital data may be encrypted with the primary encryption key (which is itself separately encrypted with an escrow password) and with the user's private key.Thus, in one example, the private primary key that allows the digital data to be decrypted is stored in escrow and the user's private key is stored on the server 104.

[0033] In one example, the secure communication interface 108 further performs encryption and decryption of the communications with a shared secret known to the secure user device 106 and the secure communication interface 108. For example, the transmission of the password between the secure user device 106 via the communication interface 108 and the server 104 may be encrypted and decrypted by the shared secret. The shared secret may be, for example, a passphrase, a password, a large number, or a random sequence of bits. In one example, before receiving at a secure user device 106 via a secure communication interface 108 the request to release the password on the destination unit 102, the shared secret may be transferred to the secure user device 106.For example, transferring the shared secret to the secure user device 106 may include scanning an optically, magnetically, or radio-readable code. In another example, the secure communications interface 108 or the secure user device 106 may generate the shared secret and transfer it to the secure user device 106 or the secure communications interface 108, respectively. In addition, transferring the shared secret to the secure user device 106 may be performed by the server 104 sending a request to the destination unit 102 to release the password, which is then transmitted to the user device 106, via . the secure communication interface 108.

[0034] [Fig. 2] illustrates a method 200 for secure access to digital data. The digital data is encrypted with a public encryption key of a determined user and stored on a server. For example, the method 200 may be implemented by the system 200 described above.

[0035] In block 202, the method 200 includes receiving at the server 104 a request from the user to access the digital data. For example, a user may send a request from their computer or mobile phone to the server 104 to access their emails that are encrypted with the public encryption key. In one example, receiving the request constitutes logging in.

[0036] In block 204, the method 200 comprises transmitting, by the server 104 via a secure communication interface 108, a request to a secure user device 106 to release a password stored on the user device 106. In one example, the password is stored in a secure chip of the secure user device 106. In one example, the secure communication interface 108 implements an SSL / TLS session via an application running on the secure user device 106.

[0037] In block 206, the method 200 includes obtaining the password via the secure communication interface 108, from the user device 106 in response to a validated security test issued by the user device 106 to a user. For example, issuing the test may include comparing a biometric input with biometric data associated with the user stored on the secure user device 106, where the validated security test includes determining whether the biometric input satisfies a predefined similarity criterion with respect to the biometric data associated with the user. In one example, the test includes comparing the user's fingerprint with a reference biometric data associated with the user stored on the secure user device 106. In another example, the test may include a facial check or a sign-of-life measurement (e.g., pulse or respiration).

[0038] In block 208, the method comprises retrieving, via the server 104, an encrypted private key of the user, the encrypted private key of the user being encrypted with the password, and decrypting the encrypted private key of the user with the password to obtain the private key of the user.

[0039] In block 210, the method comprises decrypting the encrypted digital data with the user's private key, and presenting the digital data to said user. For example, the user's emails may be decrypted with the user's decrypted private key and the user may access his or her emails.

[0040] [Fig. 3] illustrates a method 300 for secure access to digital data. digital data is encrypted with a public encryption key of a determined user and stored on a server. For example, the method 300 may be implemented by the system 100 described above, and in particular, the destination unit 102, the server 104, the secure communication interface 108 and the user device 106 illustrated in [Fig.l].

[0041] In block 302, the method 300 includes receiving at the secure user device 106 via the secure communication interface 108 a request to release a password stored on the secure user device 106. For example, the password is stored in a secure chip of the secure user device 106. The request is issued in response to a receipt at the server 104 of a request from the user to access the digital data. In one example, the secure communication interface 108 implements an SSL / TLS session via an application running on the secure user device 106.

[0042] In block 304, the method 300 comprises issuing, by the secure user device 108, a security test to a user thereof. For example, issuing the test may comprise comparing a biometric input with biometric data associated with the user stored on the secure user device 106, where the validated security test comprises determining whether the biometric input satisfies a predefined similarity criterion with respect to the biometric data associated with the user. In one example, the test comprises comparing the user's fingerprint with a reference biometric data associated with the user stored on the secure user device 106 (Adding facial control + measuring signs of life: pulse, respiration).

[0043] In block 306, the method 300 comprises, in response to the validated security test, releasing by the secure user device 106 the password to the secure communication interface 108 for retrieval by the server 104, the password being used in decrypting an encrypted private key to obtain the user's private key, and decrypting the encrypted digital data with the user's private key, for presentation of the digital data to the user.

[0044] In the example methods 200, 300 described above, the secure communication interface 108 may further perform encryption and decryption of the communications with a shared secret known to the secure user device 106 and the interface 108. For example, prior to receiving at the secure user device 106 via the secure communication interface 108 a request to release the password stored on the user device 106, the shared secret may be transferred to the secure user device 106. In addition, the transfer of the shared secret to the secure user device 106 may include scanning an optically, magnetically, or radio-readable code.

[0045] In one example, before receiving at the server a request from the user to access the digital data, the secure communication interface 108 transmits the password to the secure user device 106 via a secure channel.

[0046] Additionally, in the example methods 200, 300 described above, the public encryption key of the determined user and the private key of the determined user may, for example, be compliant with the S / MIME standard and defined by an S / MIME certificate.

[0047] Furthermore, in the exemplary methods 200, 300 described above, the digital data may comprise a primary encryption key, and may be further associated with primary data encrypted with the primary encryption data, the method 200, 300 comprising a subsequent step of decrypting the primary encryption data with the primary encryption key. In addition, the digital data is further associated with an encrypted copy of the primary encryption key, the encrypted copy of the primary encryption key being encrypted with an escrow password.

[0048] It should be understood that embodiments of the present invention may be implemented by a computer program product comprising instructions and being executed by a computer. For example, methods 200, 300 may be implemented using computing devices, software, and / or a combination thereof. For example, the computing devices may be implemented using processing circuitry such as, but not limited to, a processor, a central processing unit (CPU), a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a system on a chip (SoC), a programmable logic unit, a microprocessor, or any other device capable of responding to and executing instructions in a defined manner.The software may include a computer program, program code, instructions, or a combination thereof, for independently or collectively instructing or configuring a hardware device to operate as desired. The computer program and / or program code may include program or computer-readable instructions, software components, software modules, data files, data structures, and / or the like, implementable by one or more hardware devices, such as one or more of the hardware peripherals mentioned above. When a hardware device is a computer processing device (e.g., CPU, controller, ALU, digital signal processor, microcomputer, microprocessor, etc.), the computer processing device may be configured to execute program code by performing arith operations. metrics, logical and input / output operations, depending on the program code. The control unit 106 may also include one or more storage devices. The one or more storage devices may be tangible or non-transitory computer-readable storage media, such as random access memory (RAM), read-only memory (ROM), a permanent mass storage device (such as a disk drive), a (e.g., NAND flash) and / or any other similar data storage mechanism capable of storing and recording data. The one or more storage devices may be configured to store computer programs, program code, instructions, or a combination thereof, for one or more operating systems and / or to implement the example embodiments described herein.The computer programs, program code, instructions, or a combination thereof may also be loaded from a separate computer-readable storage medium into the storage device(s) and / or one or more computer processing devices using a drive mechanism. Such a separate computer-readable storage medium may include a Universal Serial Bus (USB) flash drive, a memory stick, a Blu-ray / DVD / CD-ROM drive, a memory card, and / or other computer-readable storage media.

[0049] As illustrated above, the invention allows the use of a simple system for accessing data in a highly secure manner. In addition, the invention does not require the use of a multi-factor authentication protocol. The method for securely accessing digital data allows for simple setup and use, as well as simple integration with non-compliant systems. The system described above does not use user passwords, eliminating the need for the user to remember a string of letters and numbers. In addition, a simple eight-character user password takes a brute-force computer from two hours to 21 days to crack depending on the complexity of the phrase. In contrast, the above system uses a 2048-bit hash that would take 15 billion years to crack using today's fastest computers.Furthermore, the system described above may use a secure hardware component such as a cryptographic chip to protect, store, and prevent any attempt to extract this hash without biometric verification of the user. In contrast, other systems store passwords and encryption keys on the server, which can be accessed by systems administration or data center personnel.

[0050] Although the invention has been illustrated and described in detail using preferred embodiments, the invention is not limited to the disclosed examples. Other variations may be deduced by those skilled in the art without departing from the scope of protection of the claimed invention. For example, the destination unit 102, the server 104, the secure communication interface 108 and the user device 106 have been described as being different units. In another example, two or more of these units may be a single unit. For example, the secure communication interface 108 and the destination unit 102 may be a single unit such as a user's smartphone or tablet. In another example, the server 104 and the secure communication interface 108 may be a single unit in which the transfers described above are automated.

Claims

Claims

1. A method for securely accessing digital data, said digital data being encrypted with a public encryption key of a determined user and stored on a server, said method comprising the following steps: A. receiving at said server a request from said user to access said digital data; B. transmitting, by said server via a secure communication interface, a request to a secure user device to release a password stored on said user device; C. obtaining said password via said secure communication interface, from said user device in response to a validated security test transmitted by said user device to a user; and D.retrieving, via said server, an encrypted private key of said user, said encrypted private key of said user being encrypted with said password, and decrypting said encrypted private key of said user with said password to obtain the private key of said user, and decrypting said encrypted digital data with said private key of said user, and presenting said digital data to said user.

2. Method according to the preceding claim, in which step A constitutes the opening of a session, the method comprising a subsequent step consisting of deleting said private key and said password from a memory of said server when the session is considered to be terminated.

3. A method for secure access to digital data, said digital data being encrypted with a public encryption key of a determined user and stored on a server, said method comprising the following steps: A. receiving at a secure user device via a secure communication interface a request to release a password stored on said user device, said request being issued in response to a reception at said server of a request from said user to access said digital data; B. issuing, by said secure device, a security test to a user thereof, and in response to the validated security test, releasing by said secure user device said password to said secure communication interface for retrieval by said server, said password being used in decrypting an encrypted private key to obtain the private key of said user, and decrypting said digital data encrypted with said private key of said user, for presentation of said digital data to said user.

4. A method according to any preceding claim, wherein said step of issuing a security test by said secure user device comprises comparing a biometric input with biometric data associated with said user stored on said secure user device, wherein said validated security test comprises determining whether said biometric input satisfies a predefined similarity criterion with respect to said biometric data associated with said user.

5. A method according to any preceding claim, wherein the password is stored in a secure chip of said secure user device.

6. A method according to any preceding claim, wherein said secure communication interface implements an SSL / TLS session via an application running on said secure user device.

7. A method according to any preceding claim, wherein said secure communication interface further performs encryption and decryption of communications with a shared secret known to said secure user device and said interface.

8. The method of claim 7, comprising an additional step, before step A, of transferring said shared secret to said secure user device.

9. The method of claim 8, wherein said step of transferring said shared secret to said secure user device comprises scanning an optically, magnetically or radio readable code.

10. A method according to any preceding claim, wherein said public encryption key of said determined user and said private key of said determined user are compliant with the S / MIME standard and defined by an S / MIME certificate.

11. A method according to any preceding claim, wherein said digital data comprises a primary encryption key, and is further associated with primary data encrypted with said primary encryption data, said method comprising a subsequent step of decrypting said primary encryption data with said primary encryption key.

12. The method of claim 11, wherein said digital data is further associated with an encrypted copy of said primary encryption key, said encrypted copy of said primary encryption key being encrypted with an escrow password.

13. A method according to any one of claims 1 to 9, wherein, prior to said step A, said secure communication interface transmits said password to said secure user device via a secure channel.

14. A computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method of any one of the preceding claims.

15. A system for providing secure access to digital data, said digital data being encrypted with a public encryption key of a given user, the system comprising: - a destination unit configured to receive the digital data; - a server configured to store the user's public encryption key and receive a request from said user to access said digital data; - a user device configured to store a password;and - a secure communication interface configured to issue a request to the secure user device to release the password and obtain said password from said user device in response to a validated security test issued by said user device to a user, wherein the server is configured to retrieve an encrypted private key of said user, said encrypted private key of said user being encrypted with said password, and decrypt said encrypted private key of said user with said password to obtain the private key of said user, and decrypt said encrypted digital data with said private key of said user, and present said nu- data; merics audit user.

16. A system for providing secure access to digital data, said digital data being encrypted with a public encryption key of a given user, the system comprising: - a server configured to store the user's public encryption key; and - a secure user device configured to receive via a secure communication interface a request to release a password stored on said user device, said request being issued in response to a reception at said server of a request from said user to access said digital data, issue a security test to a user thereof, and in response to the validated security test, release said password to said secure communication interface for retrieval by said server, said password being used in the decryption of an encrypted private key to obtain the private key of said user, and the decryption of said encrypted digital data with said private key of said user, for the presentation of said digital data to said user.

Images