Dynamic encryption/decryption of genomic information

Patent metadata

Field	Value
Publication number	US-12411960-B2
Application number	US-202017617906-A
Country	US
Kind code	B2
Filing date	Jun 10, 2020
Priority date	Jun 10, 2019
Publication date	Sep 9, 2025
Grant date	Sep 9, 2025

Abstract

Examples are described for dynamically encrypting and/or decrypting a file formed of multiple blocks of ordered data. In one example, a method of dynamically encrypting a file to enable partial decryption of the file includes generating, using a secret key and one or more initialization vectors, a keystream for the multiple blocks of ordered data, encrypting the multiple blocks of ordered data of the file by performing a logical operation of the keystream with the multiple blocks of ordered data in a one-to-one correspondence, and building a file index of the file to identify location information of the multiple blocks of ordered data. The method may further include dynamically decrypting at least a portion of the file by decrypting at least one selected block of encrypted data of the file using a portion of the keystream, the portion of the keystream corresponding to the at least one selected block.

First claim

We claim:

1. A method of dynamically encrypting a file formed of multiple blocks of ordered data to enable partial decryption of the file, the method comprising:
generating, using a secret key and one or more initialization vectors associated with the file, a keystream for the multiple blocks of ordered data of the file, wherein different portions of the keystream are subsequently used for decrypting respective portions of the file in respective decryption iterations without sharing the secret key;
encrypting the multiple blocks of ordered data of the file by performing a logical operation of the keystream with the multiple blocks of ordered data in a one-to-one correspondence, wherein the file is an ordered genomic data file, and wherein the ordered genomic data file is in a Blocked GNU Zip Format (BGZF), Binary Alignment Map (BAM) file storing genomic sequences, or a Variant Call Format (VCF) file storing genomic variation; and
simultaneously building a file index of the file as each block of the multiple blocks of ordered data of the file is encrypted, to identify location information of the multiple blocks of ordered data,
wherein the building of the file index of the file comprises writing values for each block including one or more of a leftmost position of a data grouping present in a respective block, a rightmost position of a data grouping present in the respective block, an offset of the respective block, or a length of the respective block to a file index file.

2. The method of claim 1 , wherein the keystream is formed of a plurality of blocks, each block of the keystream corresponding to an associated block of the file, and wherein each block of the keystream has a value that is a function of the secret key, the initialization vectors, and an offset of the respective associated block of the file from a beginning of the file, and wherein each block of the keystream has a length that is equal to a length of the respective associated block of the file, wherein the initialization vectors include a value that is combined with the secret key to generate the keystream.

3. The method of claim 1 , wherein building the index of the file comprises, for each block of the file as the block of the file is encrypted:
reading the block from the file, wherein the ordered data of the block includes one or more data groupings; identifying start and end positions for each data grouping of the block and saving the start and end positions with an associated read offset from a start of the block;
updating a block encryption index for the block, the block encryption index identifying the start and end positions of the data groupings for the block; and
updating the file index file for the file using the saved start and end positions and the associated read offsets identified in the block encryption index, the file index file storing the information from the block encryption index for each block of the file.

4. The method of claim 3 , wherein the data groupings include sorted genomic data.

5. The method of claim 4 , wherein the sorted genomic data is sorted by chromosome position.

6. The method of claim 3 , wherein each of the associated read offsets comprises a respective number of bits or a respective number of bytes indicating a distance from a beginning of the file.

7. The method of claim 1 , wherein the secret key and/or the keystream is generated using a stream cipher or a block cipher in a counter mode of operation.

8. The method of claim 1 , wherein the logical operation includes an XOR or an XNOR operation.

9. The method of claim 1 , wherein the secret key is a random number, and wherein dynamically encrypting the file includes encrypting only a portion of the file, encrypting different portions of the file at different times, encrypting only a portion of a block of the file, and/or re-encrypting at least a portion of the file after performing a prior encryption of the file.

10. The method of claim 1 , further comprising embedding information in the encrypted blocks of data, the policy information defining, for each data grouping of each block of the file, rules for decrypting the data grouping, and wherein the rules include time-based rules that define a time or time duration in which the data grouping is allowed to be decrypted, requesting party rules that define entities and/or users that are allowed to decrypt the data grouping, and/or usage rules that define one or more usages for which the data grouping is allowed to be decrypted.

11. The method of claim 10 , further comprising revising one or more of the rules for decrypting the data grouping responsive to receiving an associated request from an owner of the ordered data stored in the file.

12. The method of claim 11 , wherein revising one or more of the rules includes rescinding access to one or more portions of the keystream and/or rescinding, after at least a portion of the file is decrypted, access to decrypted data of the file.

13. The method of claim 1 , wherein encrypting the multiple blocks of ordered data generates multiple blocks of encrypted data corresponding to the file, the method further comprising dynamically decrypting at least a portion of the file, wherein dynamically decrypting at least the portion of the file includes decrypting at least one selected block of encrypted data of the file using a portion of the keystream, the portion of the keystream corresponding to the at least one selected block.

14. The method of claim 13 , wherein the at least one selected block of encrypted data comprises only a subset of the multiple blocks of encrypted data of the file, and wherein decrypting the at least one selected block includes performing a logical operation of the portion of the keystream with the encrypted data of the at least one selected block to generate plaintext data corresponding only to the at least one selected block.

15. A system for dynamically decrypting at least a portion of a file formed of multiple blocks of encrypted data, the system comprising:
a processor; and memory storing instructions executable by the processor to:
receive a request to decrypt at least one selected block of encrypted data of the file, wherein the file is an ordered genomic data file, wherein the encrypted data of the file includes ciphertext that is generated by a data owner of the file using a secret key, and wherein one or more attribute-based policies defining rules are embedded into the ciphertext, and wherein the rules include time-based rules that define a time or time duration in which a data grouping is allowed to be decrypted, requesting party rules that define entities and/or users that are allowed to decrypt the data grouping, and usage rules that define one or more usages for which the data grouping is allowed to be decrypted;
responsive to validating the request, retrieve a portion of a keystream for the file, the portion of the keystream corresponding to the at least one selected block, wherein the keystream is received from the data owner, and responsive to determining that the attribute-based policies are satisfied, decrypt the at least one selected block by performing a logical operation of the portion of the keystream with the encrypted data of the at least one selected block to generate plaintext data corresponding only to the at least one selected block.

16. The system of claim 15 , wherein the instructions are further executable to validate the request by comparing attributes of the request and a user making the request with one or more attributes associated with the user and/or policies bound with the encrypted data to determin

Assignees

• Los Angeles Childrens Hospital
• Univ Southern California

Inventors

• Gai Xiaowu
• Ryutov Alex
• Ryutov Tatyana

Classifications

• G06F16/13

  File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) · CPC title

• H04L9/3073

  involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L2209/88

  Medical equipments · CPC title