Patent ID: 8656179

Claim:
A system for securely encrypting and decrypting controlling secure access by a user to encrypted data stored on a computer system comprising: one or more secure volumes which are groups of encrypted data that share a common encryption key or cipher created on the computer by special software to store encrypted data; a security token device configured to enable the user to encrypt, decrypt and control the access by the user to the data being stored within the secure volume of the computer system, wherein the security token device does not store the volume encryption key; an interface configured to allow the security token device to communicate with the computer system; a primary secret associated with each security token device, wherein the primary secret is stored inside the security token device but is not accessible external to the security token device and never leaves the security token device, not even in encrypted form; and a hidden secret for each secure volume consisting of the encryption key for each secure volume which has been hidden by a cryptographic module within the security token device using the primary secret of the security token device to encrypt the volume encryption key, wherein the hidden secret is then stored in the open as part of the unencrypted header of the secure volume with which it is associated; and the cryptographic module configured to use the primary secret for (a) encrypting the secure volume encryption key, (b) sending the resulting hidden secret via the interface to the computer system, (c) storing the hidden secret in the open as part of the header of the secure volume, (d) receiving the hidden secret from the computer via the interface, (e) decrypting the hidden secret inside the security token using the primary secret as the decryption key, and (f) providing the decrypted secure volume encryption key, via the interface, to the computer to allow access to the encrypted data inside the secure volume by the user.