Information processing apparatus, method and secure protocol for secure storage and transfer of data

The invention provides an information processing apparatus, method, and security protocol for secure storage and transfer of data using two-level encryption by combining RSA and AES keys. The apparatus includes circuitry (100) configured to receive encryption request, encrypt the data to generate first encryption data. The encryption of the data is based on an AES user key (103) and the received encryption request. The circuitry is further configured to encrypt the first encryption data to generate second encryption data, decrypt the second encryption data to generate first decryption data. The decryption of the second encryption data is based on a company AES key (107). The circuitry (100) is further configured to decrypt the first decryption data to generate the original data. The decryption of the first decryption data is based on an AES user key (103), and the second decryption data corresponds to the transmitted data.

FIELD OF INVENTION

The present invention generally relates to an information processing apparatus, method, and secure protocol for secure storage and transfer of data. More particularly, secure storage and transfer of data using two-level encryption and two-level decryption by combining RSA and AES keys.

BACKGROUND OF THE INVENTION

Encryption is the process of encoding/masking data (usually sensitive) so that the original information can only be recovered by authorized users.

AES (Advanced Encryption Standard) is the top choice for governments, financial institutions and many securities conscious organizations. The major problem with AES is that it is a symmetric algorithm which means that both encryption and decryption are performed using the same key which means that this is a security management nightmare.

RSA (Rivest, Shamir and Adleman) is an asymmetric algorithm that solves the problem of using the same key by using a public key for encryption and private key for decryption. But the major problem with RSA is that the maximum data size that can be encrypted using RSA is the size of the key minus any bits used for padding (e.g. if the key size used is 2048 bits then the max data size that can be encrypted=2048−(padding+header) bits). Additionally, RSA is computationally more intensive than AES which makes it much slower than RSA.

So, there is a need for an information processing apparatus for securely store and transfer the data by combining AES key and an RSA key pair.

OBJECT OF THE INVENTION

The principal object of the invention is to secure storage and transfer of data using two-level encryption and two-level decryption by combining AES key and RSA key pair.

Another object of the invention is to create a highly secure cyber security protocol by combining RSA and AES keys to encrypt user data.

Another object of the invention is to generate companywide AES+RSA key set.

Another object of the invention is to generate an AES and an RSA key pair for each user.

Another object of the invention is to encrypt AES user key and company AES key using user's RSA public key and company's RSA public key respectively before storing it in the database for providing high level data security.

Another object of the invention is to access the encrypted AES user key and encrypted company AES key using user's RSA private key and company's RSA priviate key respectively.

Another object of the invention is to encrypt the data to level1using decrypted AES user key and encrypt the data from level1to level2using decrypted company AES key.

Another object of the invention is to store the encrypted user AES key and encrypted company AES key in a user's column/row level secure database and company's column/row level secure database respectively.

These and other objects and characteristics of the present invention will become apparent from the further disclosure to be made in the detailed description given below.

SUMMARY OF THE INVENTION

The invention provides an information processing apparatus, method and security protocol for secure storage and transfer of data by combining AES key and RSA key pair. The apparatus includes a circuitry. The circuitry is configured to receive encryption request associated with the data to be transmitted. Upon receiving the encryption request, the circuitry encrypt the data to level-1, wherein the encryption of the data is based on an AES user key and the received encryption request. The used AES user key is based on an RSA private key associated with the user. The circuitry is further configured to encrypt the level-1data to generate level-2data, wherein the encryption of the level1-data is based on a company AES key. The used company AES key is based on an RSA private key associated with the company. The circuitry is further configured to decrypt the level-2data to generate level-1data, wherein the decryption of the level-2data is based on a company AES key. The used company AES key is based on the RSA private key associated with the company. The circuitry is further configured to decrypt the level-1data to generate the transmitted data, wherein the decryption of the level-1data is based on an AES user key. The AES user key is based on the RSA private key associated with the user.

DETAILED DESCRIPTION OF INVENTION

FIG.1illustrates components of an information processing apparatus for secure storage and transfer of data, according to one embodiment of the invention. Referring now to the drawings, in theFIG.1, the components of an information processing apparatus may include company's RSA key pair (105), company's AES key (107), user's RSA key pair (101), user's AES key (103), and database with column/row level security and control (109).

In an example embodiment, to generate company's RSA key pair (105), a cryptographically strong random seed (use this as the company's hash) using Java's security implementation of FIPS.140-2security requirements for cryptographic modules may be generated. A 2048-bits company's RSA keypair (105) may be generated using a KeyPairGenerator. The generated company's RSA key pair (105) includes company's RSA public key (105b), company's RSA private key (105a) and that may be stored in a company's column/row level secure database (109b).

In an example embodiment, to generate company's AES key (107), the company's public key (105b) from the company's column/row level secure database (109b) using the company's identifier may be retrieved. A cryptographically strong random seed (use this as the company's hash) using Java's security implementation of FIPS.140-2security requirements for cryptographic modules may be generated. A 128-bit company's AES key (107) may be generated using a KeyPairGenerator. The generated company's AES key (107) may be encrypted using the previously retrieved company's public key (105b). The encrypted company's AES key (107) may be stored in the company's column/row level secure database (109b).

In an example embodiment, to generate user's RSA key pair (101), a cryptographically strong random seed (use the user Id of the user logging in) using Java's security implementation of FIPS.140-2security requirements for cryptographic modules may be generated. A 2048-bits user's RSA keypair (101) is generated using a KeyPairGenerator. The generated user's RSA key pair (101) includes user's public key (101b), user's private key (101a) and that may be stored in the user's column/row level secure database (109a).

In an example embodiment, to generate user's AES key (103), the user's public key (101b) may be retrieved from the user's column/row level secure database (109a) using the user Id identifier. A cryptographically strong random seed (use the user Id of the user logging in) using Java's security implementation of FIPS.140-2security requirements for cryptographic modules may be generated. A 128-bit user's AES key (103) may be generated using a KeyPair Generator. The generated user's AES key (103) may be encrypted using the user's public Key (101b) retrieved earlier. The encrypted user's AES key (103) may be stored in the user's column/row level secure database (109a).

FIG.2illustrates working of encryption of data in an information processing apparatus for secure storage and transfer of data, according to one embodiment of the invention. Referring toFIG.2, in order to encrypt the input data for secure communication, a circuitry (100) may be configured to receive encryption request associated with the data to be transmitted. The circuitry (100) may be further configured to encrypt the data to generate first encryption data that is the input data to level-1, wherein the encryption of the data is based on an AES user key (103) associated with a user and the received encryption request, and the AES user key (103) is based on an RSA private key (101a) associated with the user. The circuitry (100) may be further configured to encrypt the first encryption data to generate second encryption data that is encrypt the data from level-1to level-2, wherein the encryption of the first encryption data is based on a company AES key (107), and the company AES key (107) is based on an RSA private key (105a) associated with the company.

FIG.3illustrates working of decryption of data in an information processing apparatus for secure storage and transfer of data, according to one embodiment of the invention. Referring toFIG.3, in order to decrypt the data, a circuitry (100) may be configured to decrypt the second encryption data to generate first decryption data that is decryption of data from level-2to level-1, wherein the decryption of the second encryption data is based on a company AES key (107), and the company AES key (107) is based on the RSA private key (105a) associated with the company. The circuitry (100) may be further configured to decrypt the first decryption data to generate the second decryption data that is decryption data from level-1to original input data, wherein the decryption of the first decryption data is based on an AES user key (103), the AES user key (103) is based on the RSA private key (101a) associated with the user, and the second decryption data corresponds to the transmitted data that is originally transmitted data.

FIG.4illustrates encryption flow of data in an information processing apparatus for secure storage and transfer of data, according to one embodiment of the invention. Referring toFIG.4, to encrypt the input data, step-1includes retrieving the private key of the RSA key pair of the user (101a) that is stored in the user's database (109a).

In an example embodiment, step-2includes retrieving the encrypted AES key of the user (103) from the user's database (109a)

In an example embodiment, step-3includes decrypting the user's AES key (103) using the user's private key (101a) from Step1.

In an example embodiment, step-4includes encrypting the input data to level-1or first encryption data using the decrypted user AES key (103).

In an example embodiment, step-5includes retrieving the private key of the RSA key pair of the company (105a) that is stored in the company's database (109b).

In an example embodiment, step-6includes retrieving the encrypted AES key of the Company (107) from the company's database (109b).

In an example embodiment, step-7includes decrypting the company's AES key (107) using the company's private key (105a) from the RSA key pair.

In an example embodiment, step-8includes encrypting the data from level-1to level-2that is from first encryption data to second encryption data using the company's decrypted AES key (107).

In an example embodiment, step-9includes storing the encrypted data in a database.

FIG.5illustrates decryption flow of data in an information processing apparatus for secure storage and transfer of data, according to one embodiment of the invention. Referring toFIG.5, to decrypt the data, step-1includes retrieving the private key of the RSA key pair of the Company (105a) that's stored in the company's database (109b).

In an example embodiment, step-2includes retrieving the encrypted AES key of the Company (107) from the company's database (109b).

In an example embodiment, step-3includes decrypting the company's AES key (107) using the company's private key (105a) from the RSA key pair.

In an example embodiment, step-4includes decrypting the data to level-1that is second encryption data to first decryption data using the decrypted company AES key (107).

In an example embodiment, step-5includes retrieving the private key of the RSA key pair of the user (101a) that's stored in the user's database (109a).

In an example embodiment, step-6includes retrieving the encrypted AES key of the user (103) from the user's database (109a).

In an example embodiment, step-7includes decrypting the user's AES Key (103) using the user's private key (101a).

In an example embodiment, step-8includes decrypting the data from level-1to level-2that is from first decryption data to second decryption data using user's AES key (103). Now this will give the original plain text decrypted data.

FIG.6A to6Billustrates a method for secure storage and transfer of data, according to one embodiment of the invention. In an example embodiment, at step601, the circuitry (100) may be configured to receive encryption request associated with the data to be transmitted.

In an example embodiment, at step603, the circuitry (100) may be configured to encrypt the data to generate first encryption data, wherein the encryption of the data is based on an AES user key (103) associated with a user and the received encryption request, and the AES user key (103) is based on an RSA private key (101a) associated with the user.

In an example embodiment, at step605, the circuitry (100) may be configured to encrypt the first encryption data to generate second encryption data, wherein the encryption of the first encryption data is based on a company AES key (107), and the company AES key (107) is based on an RSA private key (105a) associated with the company.

In an example embodiment, at step607, the circuitry (100) may be configured to decrypt the second encryption data to generate first decryption data, wherein the decryption of the second encryption data is based on a company AES key (107), and the company AES key (107) is based on the RSA private key (105a) associated with the company.

In an example embodiment, at step609, the circuitry (100) may be configured to decrypt the first decryption data to generate the second decryption data, wherein the decryption of the first decryption data is based on an AES user key (103), the AES user key (103) is based on the RSA private key (101a) associated with the user, and the second decryption data corresponds to the transmitted data.

Thus, the information processing apparatus and security protocol for secure storage and transfer of data creates a highly secure cyber security protocol by combining RSA and AES keys to encrypt user data.

The data encryption happens using the user's AES key and user's AES key will be encrypted before storing which adds a very high level of security to existing solutions, that is the reason the user's AES key is encrypted using the user's RSA public key and then encrypted AES key is stored.

This two-level encryption provides the highest level of encryption and also solves the security management nightmare that arises using only AES keys.