Secure storage of and access to files through a web application

Patent metadata

Field	Value
Publication number	US-11675922-B2
Application number	US-201816958919-A
Country	US
Kind code	B2
Filing date	Dec 20, 2018
Priority date	Dec 31, 2017
Publication date	Jun 13, 2023
Grant date	Jun 13, 2023

Abstract

The invention relates to a method for cryptographically secure storing a file (101) using a web application executed by a web browser (106) on a user computer system (104, 162, 168) of a user (102, 160). The method comprises:encrypting the file (101) on the user computer system (104, 162, 168) by the web application,providing a distribution plan by the web application,fragmenting the encrypted file (101) on the user computer system (104, 162, 168) by the web application into a plurality of file fragments (F1-F4) according to the distribution plan,sending the resulting file fragments (F1-F4) by the web application over the network (178) to the storage services identified by the distribution plan (SD1-SD6).

First claim

The invention claimed is:

1. A method for cryptographically secure storing of a file using a web application executed by a web browser on a user computer system of a user, the method comprising
invoking the web application from a web server computer system over a network by the web browser on the user computer system,
encrypting the file with a cryptographic key locally on the user computer system using the web application,
providing a distribution plan by the web application, wherein the distribution plan comprises instructions for fragmenting the file into a plurality of file fragments by means of an error correction method and identifiers of a plurality of mutually independent storage services in whose non-volatile storage media the generated file fragments are to be stored,
fragmenting the encrypted file on the user computer system by the web application into a plurality of file fragments by the error correction method according to the distribution plan, wherein at least one of the file fragments includes error correction bits,
sending the resulting file fragments by the web application over the network to the storage services identified by the distribution plan, wherein an authorization token is provided by the web server computer system for each of the storage services as proof of authorization to store the corresponding file fragment.

2. The method of claim 1 , wherein the web server computer system provides a service via the web application, wherein the file to be stored comprises data generated and/or used in the course of executing the service.

3. The method of claim 1 , wherein the providing of the distribution plan comprises generating the distribution plan on the user computer system by the web application.

4. The method of claim 1 , wherein the providing of the distribution plan comprises receiving the distribution plan on the user computer system by the web application.

5. The method of claim 1 , the method further comprising sending the distribution plan from the web application over the network to a file management server computer system for storage, and/or
encrypting the distribution plan.

6. The method of claim 1 , wherein the authorization tokens are received by the web application on the user computer system from the file management server computer system, wherein the received authorization tokens comprise an authorization token of each of the plurality of storage services identified in the distribution plan, which were requested by the file management server computer system on command of the web server computer system and forwarded to the user computer system.

7. The method of claim 6 , wherein the receiving of the authorization tokens requires successful authentication of the web server computer system against the file management server computer system.

8. The method of claim 1 , wherein the sending of the file fragments by the web application to the identified storage services is performed bypassing the web server computer system and/or the file management server computer system, and/or
wherein the authorization tokens are implemented as URLs each enabling direct read access to a storage location identified by the URL on one of the storage media of one of the storage services.

9. The method of claim 1 , the method further comprising creating reference data, which are associated with the file, serve to reconstruct the file from the distributedly stored data fragments and are stored by the web server computer system.

10. The method of claim 1 , wherein the reference data comprises: an identifier of the user, an identifier of the file, an identifier of the distribution plan, an identifier of a cryptographic key for decrypting the encrypted file, an identifier of a cryptographic key for decrypting the encrypted distribution plan, a hash value of the complete file and/or hash values of the stored file fragments; and/or
wherein the reference data is stored by the web server computer system in a cryptographically secure form; and/or
wherein the web application communicates the reference data to a server module for managing reference data, which is executed by a processor of the web server computer system; and/or
wherein the reference data is stored by the web server computer system in a reference list comprising a plurality of reference data for a plurality of files of different users of the web application.

11. The method of claim 1 , the method further comprising authenticating the user against the web server computer system; and/or
wherein one or more modules for a distributed storage of the file on the storage services are integrated into the web application, and wherein the encryption, fragmentation and transmission are performed by executing the modules of the web application in the web browser by a processor of the user computer system.

12. The method of claim 1 , wherein the method for downloading the cryptographically secured stored file using the web application executed by the web browser on the user computer system further comprises:
invoking the web application from the web server computer system over the network by the web browser on the user computer system,
providing the distribution plan of the distributedly stored file by the web application, wherein the distribution plan comprises instructions for defragmenting the file from a plurality of file fragments by means of an error correction method and identifiers of the plurality of mutually independent storage services in whose non-volatile storage media the file fragments are stored,
providing by the web server computer system an authorization token of each of the storage services of at least a selection of the storage services in whose non-volatile storage media the file fragments are stored, wherein the file fragments included in the selection of the storage services are sufficient for a complete reconstruction of the file,
downloading the file fragments from the individual storage services using the authorization tokens as proof of authorization for downloading,
defragmenting the encrypted file from the file fragments on the user computer system by the web application using the error correction method in accordance with the distribution plan,
decrypting the encrypted file with a cryptographic key on the user computer system by the web application.

13. The method of claim 12 , wherein the web server computer system provides a service via the web application, and wherein data included in the downloaded file is used in the course of execution of the service by the web application; and/or
wherein the providing of the distribution plan comprises receiving the distribution plan from the file management server computer system on the user computer system by the web application, and/or
wherein the distribution plan is provided in encrypted form, and the providing further comprises decrypting the distribution plan on the user computer system by the web application.

14. The method of claim 12 , wherein the providing of the authorization tokens on the user computer system by the web application comprises receiving the authorization tokens from the file management server computer system, which were requested by the file management server computer system on command of the web server computer system and forwarded to the user computer system.

15. The method of claim 14 , wherein receiving the authorization tokens requires successful authentication of the web server computer system against the file management server computer system.

16. The method of claim 11 , wherein the downloading of the file fragments by the

Assignees

• Bundesdruckerei Gmbh
• neXenio GmbH

Inventors

• Hennig Patrick
• Schnjakin Maxim
• Berger Philipp
• Paeschke Manfred

Classifications

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F11/0727

  in a storage system, e.g. in a DASD or network based storage system (drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097) · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title