FIELD

This disclosure relates generally to cyber security, and more specifically to sharing protected content with multiple users.

BACKGROUND

Cryptography protects data with a cryptographic key. Modern cryptography generally uses a single cryptographic key to protect a large amount of data. It is important and valuable in the marketplace to increase security with stronger multiple keys, reducing the blast radius of data exposure, while preserving the ability to share data efficiently with authorized users. Using additional keys, in current security systems, is computationally expensive and difficult to administer and increases the time the data is in a vulnerable state.

Prior art defeats the combination of possible features. In one example, a security system might allow efficient sharing but only use a single key enabling a breach to expose all of the data. In a second example, a security system might use multiple keys thus limiting exposure but sharing becomes very expensive and requires significant user effort. Realistically, users will not normally accept stronger security if it is cumbersome to implement.

SUMMARY

With the above in mind, embodiments of the present invention are related to sharing protected content with multiple users. More particularly, the sharing the protected content between multiple users involves encryption and decryption using a shared secret.

These and other features, objectives and advantages of the present invention are provided by a non-transitory computer-readable medium for sharing protected content, comprising instruction stored thereon, that when executed on a processor perform the steps comprising deriving a shared secret using an elliptic curve Diffie-Hellman method, processing the shared secret using a secure hash algorithm 256 cryptographic hash to produce a primary encryption key, and encrypting a secondary encryption key using the primary encryption key. The shared secret is derived between a private component of an elliptic curve cryptography Diffie-Hellman key pair of a first user and one of a public component of the elliptic curve cryptography Diffie-Hellman key pair of the first user and a public component of an elliptic curve cryptography Diffie-Hellman key pair of a second user. When the shared secret is derived between the private component of the elliptic curve cryptography Diffie-Hellman key pair of the first user and the public component of the elliptic curve cryptography Diffie-Hellman key pair of the first user, encrypting the protected content using the secondary encryption key and transmitting the encrypted protected content to a server to be accessed by the second user. When the shared secret is derived between the private component of the elliptic curve cryptography Diffie-Hellman key pair of the first user and the public component of the elliptic curve cryptography Diffie-Hellman key pair of the second user, transmitting the secondary encryption key to the second user. The second user uses the secondary encryption key to decrypt the encrypted protected content on the server.

In other embodiments, the present invention may include a computer-implemented method for sharing protected content, comprising executing on a processor the steps comprising encrypting a private component of an elliptic curve cryptography Diffie-Hellman key pair of a first user using a password hashed by a Bcrypt algorithm using 8-cost and 16-byte salt, deriving a shared secret using an elliptic curve Diffie-Hellman method, processing the shared secret using a secure hash algorithm 256 cryptographic hash to produce a primary encryption key, and encrypting a secondary encryption key using the primary encryption key. The shared secret is derived between the private component of the elliptic curve cryptography Diffie-Hellman key pair of the first user and one of a public component of the elliptic curve cryptography Diffie-Hellman key pair of the first user and a public component of an elliptic curve cryptography Diffie-Hellman key pair of a second user. When the shared secret is derived between the private component of the elliptic curve cryptography Diffie-Hellman key pair of the first user and the public component of the elliptic curve cryptography Diffie-Hellman key pair of the first user, encrypting the protected content using the secondary encryption key and transmitting the encrypted protected content to a common point of access to be accessed by the second user. When the shared secret is derived between the private component of the elliptic curve cryptography Diffie-Hellman key pair of the first user and the public component of the elliptic curve cryptography Diffie-Hellman key pair of the second user, transmitting the secondary encryption key to the second user. The second user uses the secondary encryption key to decrypt the encrypted protected content at the common point of access.

In yet other embodiments, the present invention may include a computer-implemented method for sharing, by a first user, protected content with a plurality of trusted users, comprising executing on a processor the steps comprising deriving a first shared secret, processing the first shared secret using a secure hash algorithm 256 cryptographic hash to produce a first primary advanced encryption standard 256-bit key, encrypting a first secondary advanced encryption standard 256-bit key using the first primary advanced encryption standard 256-bit key, encrypting the protected content using the first secondary advanced encryption standard 256-bit key, and transmitting the encrypted protected content to a common point of access to be accessed by the plurality of trusted users. For each trusted user, deriving a second shared secret, processing the second shared secret using a secure hash algorithm 256 cryptographic hash to produce a second primary advanced encryption standard 256-bit key, encrypting a second secondary advanced encryption standard 256-bit key using the second primary advanced encryption standard 256-bit key, and transmitting the second secondary advanced encryption standard 256-bit key to the trusted user, wherein the trusted user uses the second secondary advanced encryption standard 256-bit key to decrypt the encrypted protected content.

