METHOD FOR PERFORMING CRYPTOGRAPHY OPERATIONS ON DATA IN A COMPUTER DEVICE IN ORDER TO ALLOW THE EXCHANGE OF ELECTRONIC DOCUMENTS BETWEEN USERS

Description

DESCRIPTION of the Industrial Invention entitled: “Method for performing cryptographic operations on data in a processing device in order to enable the exchange of electronic documents between users” 5 belonging to Nextage srl, of Italian nationality, with headquarters in Piazza della Vittoria 12 / 12, 16121 Genoa. DESCRIPTION 10 The present invention relates to a method to perform cryptographic operations on data in a processing device in order to enable the exchange of electronic documents between at least one user sender and at least one recipient user of a system. 15 In particular, the method provides for the following steps: a) registration of one or more users, b) uploading at least one electronic document, c) sharing of said electronic document with 20 at least one user. The present invention has the aim of facilitate document management and sharing encrypted, within computer systems where it is it is necessary to use some codes specifically to avoid 25 make the data entered within the visible documents. A typical example is related to systems of document management in the healthcare sector, in which such documents contain sensitive data that not only do not 30 must be disclosed, but of which we must have the certainty of sending from an appointed recipient user to a specific sending user. These documents, in order to meet the requirements GDPR stringent data must be encrypted for ensure the privacy of different users. The encryption process is simply a 5 mathematical algorithm that acts on a sequence of characters, transforming it. This transformation is based on the value of one or multiple secret keys, which are parameters of the algorithm of encryption / decryption. 10 Encryption systems work perfectly to make the data invisible interest, however, significant issues arise when two users need to share electronic documents. 15 It is in fact necessary to protect documents from share and encrypt them so that only users responsible people can share them, read them and, possibly, process them. Currently there are no known methods and systems of 20 encryptions that allow you to obtain a level of high security in sharing documents between users. In particular, there is a need not satisfied by the state-of-the-art systems known, of 25 to create a methodology to manage not simple textual data, but real electronic documents (files) that can be saved inside a platform, so as to encrypt them on the basis of the users and whose sharing can be managed 30 so that if a user shares a file that has been encrypted, there is a mechanism that also allows another user to be able to decrypt it, if necessary for a period of time and enjoy it. The present invention achieves the purposes of above by making a method as described in precedence, in which a generation step is foreseen of a system symmetric key, of a key 5 symmetric of each document, of a private key and of a public key of each user. Furthermore, steps a) to c) provide three different levels of encryption: - symmetric encryption for saving 10 keys on one storage unit, - asymmetric encryption for generation of the users' keys, - symmetric cryptography for encryption electronic document. 15 The method which is the subject of the present invention, therefore, it is based on different combinations of modalities of encryption linked to the fact that they are specific to one specific user and cannot be used by third parties. Unlike the state-of-the-art methods, 20 which require the use of a single symmetric key, the method which is the subject of the present invention, as will be described later, involves the use of a combination of keys, so that the document can be opened and / or processed by two 25 different users with different keys, so so that each user is aware of their own key, without the need to share it with others users. The keys are preferably generated in a 30 random. Starting from this generic concept, it is possible provide for different specifications of the object method of the present invention to improve safety documents shared by users of a system. These and further purposes of this invention are achieved by a method according to 5 the independent claims attached and the subclaims. Optional features of the method of the invention are contained in the attached dependent claims, which form part 10 integral to this description. These and other features and advantages of the the present invention will be more clearly apparent from the following description of some executive examples illustrated in the attached drawings where: 15 Figure 1 illustrates an exemplary scheme and of the principle of the method for performing operations cryptography which is the subject of the present invention according to a possible form of execution. It is specified that the figure attached to this document 20 patent application illustrates only some possible executive forms of the method which is the object of this present invention, to better understand its advantages and characteristics described. These executive forms are therefore to be understood as 25 purely illustrative purposes and not limiting the concept inventive of the present invention, namely that of to create an encryption method that allows the exchange of documents between users, using different combinations of encryption modes related to 30 fact that they are specific to a specific user and not they can be used by third parties. As described above, the object method of the present invention allows the exchange of electronic documents between at least one sending user and at least one recipient user of a system. As will be evident from the following description, preferably, the system is a system 5 of the computer type, which features units of processing, storage units and interfaces input / output. Each user is associated with a first code identifier, as is shown on each document 10 associated with a second identification code. Inside the storage units of the such identification codes are stored in the system, together with the system symmetric key, to symmetric keys of documents and keys 15 public and private for each user. Advantageously, such information is organized in databases. In particular, there is a first database in which contains user data, including data 20 regarding authentication and security (e.g. password change token, authentication type, etc.) and the public key of each user. There is also a second database aimed at define the association between each user and their 25 private key. The private key is first encrypted. through a system symmetric key then broken into multiple parts that will make up an array. The storage unit comprises a third database, where electronic documents are present 30 (files) that system users want to share and in which the associations between the documents are present uploaded and the first user identification code sender. According to a possible executive form, as storage for maintaining documents, it was selected “GridFs” from mongoDb. GridFs consists of two collection 5 ● files: containing file information and their metadata ● chunks: containing the actual content and typical of the file split into multiple parts (or chunks). A property will also be added inside 10 of the metadata section containing the first identification code of the sender user document. Based on the characteristics described above, the Figure 1 illustrates a possible embodiment of the 15 method which is the subject of the present invention. As will be evident from the following description, the user creation flow system provides for the generation of asymmetric keys for the management of sharing and exchange of 20 documents. The mechanism used is that of the hybrid asymmetric cryptography, for the encryption of documents. The process involves encrypting the document through a symmetric key, generated for each 25 document, the subsequent encryption of the key symmetric, through the user's public key sender of the document, and in case of sharing, the encryption at each sharing of the symmetric key through the recipient user's public key 30 with whom you want to share the document. With particular reference to figure 1, the The method which is the subject of this invention provides for the following steps: a) registration of one or more users, indicated with 1, b) uploading at least one electronic document, indicated with 2 5 c) sharing of said electronic document with at least one user, indicated by 2. Prior to these steps, a step is planned of generating a system symmetric key, of a symmetric key of each document, of a key 10 private and a public key of each user. Furthermore, steps indicated with 1, 2 and 3 foresee three different levels of encryption: - symmetric encryption for saving keys on a storage unit, 15 - asymmetric encryption for generation of the users' keys, - symmetric cryptography for encryption electronic document. It is specified that the steps that will be described 20 are the same for the sending user and for the user recipient, regardless of nature of the user. For example, within a healthcare system, the steps that will be described will be the same in 25 case of user "doctor" or in the case of user "patient". It will then be possible to diversify these users on the system login credentials base. In particular, during the process of 30 registration 1 of the user (whether sender or recipient), the method performs the following steps: generating an asymmetric key pair (public and private) for the management of the exchange documents, step 10, public key encryption through the 5 system symmetric key, already used for encrypt user private information, step 11, encryption of the private key through the system symmetric key, step 12, saving the public key inside the 10 first database, step 13 saving the private key inside the second database, step 14, and key splitting private two-part encrypted. Also, step 2 of uploading the document, 15 includes the following underpasses: generation of a symmetric key document, step 20 and document encryption with the generated symmetric key, uploading the document to the third database and 20 association between the uploaded document and the first sender user identification code, step 21, recovery of the encrypted public key of the sending user, step 22, decrypting the user's public key 25 sender through the system symmetric key, step 23, symmetric key encryption of the document electronic, step 24, through the public key, generation of a first association table, 30 step 25, containing the first identification code of the sending user, the second identification code and the encrypted symmetric key of the document electronic. If the method which is the subject of this invention is not essentially used for the file sharing, but also just as a method of encryption for electronic documents to be saved 5 inside one storage unit, you can provide that the first association table has also a reference to the possible sharing of the document, i.e. an indication of the fact that the document whether to share or not to share. 10 In case the document is to be shared, the first table can include the first identification code associated with the recipient user. Still referring to figure 1, step 3 of electronic document sharing, provides for the 15 following underpasses: identification of the first identification code of the sending user and of the receiving user and of the second identification code, step 30, recovering the document's symmetric key, 20 step 31, recovering the user's private key sender, step 32, encrypted by the symmetric key of system, recovering the user's public key 25 recipient, step 33, encrypted by symmetric key of the system, decrypting the user's private key sender and user's public key recipient, step 34, through the symmetric key 30 system, decryption, step 35, of the symmetric key of the document through the user's private key sender, symmetric key encryption of the document through the user's public key recipient, step 36, generation, step 37, of a second table 5 associative containing the second code identifier, the first identification code of the recipient user and the sender user, the symmetric key of the document encrypted with the key public of the recipient user. 10 Finally, it is specified that the method which is the object of the This invention may provide for setting a time limit for sharing the document electronic, after which the sharing of the document will no longer be possible. 15 In this case, it is possible to foresee the insertion of this time value within the second table associative. While the invention is susceptible of various modifications and alternative constructions, some forms of 20 favorite creations were shown in the drawings and described in detail. It must be understood, however, that there is no intention to limit the invention to the specification embodiment illustrated, but, on the contrary, 25 It is intended to cover all modifications, constructions alternatives, and equivalents that fall within the scope of the invention as defined in the claims. The use of “for example”, “etc.”, “or” indicates non-exclusive alternatives without limitation unless 30 unless otherwise indicated. The use of “include” means “include, but not limited to” unless otherwise indicated.

Claims

1. A method for performing cryptographic operations on data in a processing device in order to enable the exchange of electronic documents between at least one sending user and at least one receiving user of a system, which method involves the following steps: a) registration of one or more users, b) uploading at least one electronic document, c) sharing said electronic document with at least one user, characterized in that it includes a step for generating a system symmetric key, a symmetric key for each document, a private key, and a public key for each user, steps a) to c) involving three different levels of encryption: - symmetric encryption for saving the keys on a storage unit, - asymmetric encryption for generating the user keys, - symmetric encryption for encrypting the electronic document.

2. Method according to claim 1, wherein step a) comprises the following sub-steps: a1) generation of a pair of asymmetric keys per user, including a private key and a public key, a2) encryption of the public key using the system symmetric key, a3) encryption of the private key using the system symmetric key, - 12a3) saving the public key within a first database, a4) saving the private key within a second database.

3. Method according to claim 2, wherein step a4) provides for the division of the private key into multiple parts.

4. A method according to one or more of the preceding claims, wherein step b) comprises the following sub-steps: b1) identifying a first identification code associated with the sender user and a second identification code associated with the electronic document, b2) encrypting the document with the document's symmetric key, b3) uploading the document to a third database and associating the uploaded document with the sender user's first identification code, b4) recovering the sender user's encrypted public key, b5) decrypting the sender user's public key using the system's symmetric key, b6) encrypting the electronic document's symmetric key using the public key, b7) generating a first association table containing the sender user's first identification code, the second identification code, and the electronic document's encrypted symmetric key.

5. Method according to claim 4, wherein step b7) provides for the insertion of the first identification code of the recipient user into the first association table.

6. Method according to one or more of the preceding claims, wherein step c) comprises the following sub-steps: c1) identification of the first identification code of the sending user and the recipient user and of the second identification code, c2) recovery of the document's symmetric key, c3) recovery of the sender's private key encrypted by the system symmetric key, c4) recovery of the recipient's public key encrypted by the system symmetric key, c5) decryption of the sender's private key and the recipient's public key using the system symmetric key, c6) decryption of the document's symmetric key using the sender's private key, c7) encryption of the document's symmetric key using the recipient's public key, c8) generation of a second association table containing the second identification code,the first identification code of the recipient user and the sender user, the symmetric key of the document encrypted with the public key of the recipient user, 7. A method according to one or more of the preceding claims, wherein the determination of a time period within which the sharing of the electronic document must be carried out is provided.

8. Method according to one or more of the preceding claims, wherein the public key and / or the private key is saved on an electronic device removable from said processing device.