Sharing encrypted items with participants verification

Abstract

A method and apparatus for establishing a trust relationship between users is disclosed. The apparatus includes at least two user devices containing the Application, a service provider server (SPS) comprising an application programming interface (API), a network communicably coupling the sender device, the receiver device and the SPS, and an out-of-band (OOB) channel, separate from the network, communicably coupling the sender device and the receiver device. The method includes obtaining a receiver's Public Key provided by an Application Programming Interface (API) on an service provider server, encrypting a verification message with the Receiver's Public key and the Sender's Private Key, sending the encrypted verification message from the Sender's device to the Receiver's device through the out-of-band channel, decrypting the encrypted verification message using Receiver's Private Key and Sender's Public Key, and communicating decrypted verification message via out-of-band channel.

What is claimed is: 
     
         1 . A method comprising:
 establishing, by a sender system, cryptographic trust with a receiver system, wherein establishing cryptographic trust includes:
 obtaining, from a service provider server, via a first electronic communication network, a public encryption key of the receiver system; 
 generating a verification message including first verification message content; 
 generating a signed, encrypted, verification message by encrypting the verification message using the public encryption key of the receiver system and a private encryption key of the sender system; 
 sending, via a second electronic communication network that differs from the first electronic communication network, the signed verification message to the receiver system; 
 receiving, from the receiver system, via a third electronic communication network that differs from the first electronic communication network, second verification message content; and 
 verifying that the first verification message content matches the second verification message content. 
   
     
     
         2 . The method of  claim 1 , wherein:
 the public encryption key of the receiver system is a part of a device-independent asymmetric key pair that includes a private encryption key of the receiver system; and   the private encryption key of the sender system is a part of a device-independent asymmetric key pair that includes a public encryption key of the sender system.   
     
     
         3 . The method of  claim 2 , wherein generating the signed, encrypted, verification message includes:
 generating an encrypted verification message by encrypting the verification message using the public encryption key of the receiver system; and   generating the signed, encrypted, verification message by encrypting the encrypted verification message using the private encryption key of the sender system.   
     
     
         4 . The method of  claim 2 , wherein establishing cryptographic trust includes:
 signing the public encryption key of the receiver system with the private encryption key of the sender system.   
     
     
         5 . The method of  claim 2 , wherein the third electronic communication network is the second electronic communication network, wherein the second electronic communication network excludes the service provider server. 
     
     
         6 . The method of  claim 2 , further comprising:
 sharing, by the sender system, an encrypted digital item with the receiver system, wherein sharing the encrypted digital item includes:
 obtaining an unencrypted digital item; 
 obtaining an item key for encrypting the digital item; 
 obtaining the encrypted digital item by encrypting the unencrypted digital item using the item key; 
 obtaining an encrypted item key by encrypting the item key with the public encryption key of the receiver system; and 
 outputting the encrypted digital item and the encrypted item key to the service provider server, such that the unencrypted digital item is accessible to the receiver system by:
 obtaining the encrypted digital item, the encrypted item key, and the public encryption key of the sender system from service provider server; 
 obtaining the item key by decrypting the encrypted item key using the private encryption key of the receiver system; and 
 obtaining the unencrypted digital item by decrypting the encrypted digital item using the item key. 
 
   
     
     
         7 . The method of  claim 6 , wherein obtaining the item key includes:
 generating a symmetric key for encrypting the digital item; and   using the symmetric key as the item key.   
     
     
         8 . The method of  claim 6 , wherein obtaining the public encryption key of the receiver system includes:
 receiving, from service provider server, the public encryption key of the receiver system in response to sending, to service provider server, a request to identify the receiver system.   
     
     
         9 . The method of  claim 6 , wherein obtaining the item key includes:
 obtaining a second encrypted item key, encrypted with the public encryption key of the sender system; and   obtaining the item key by decrypting the second encrypted item key using the private encryption key of the sender system.   
     
     
         10 . The method of  claim 9 , wherein sharing the encrypted digital item includes:
 obtaining a symmetric master key using a master password and a salt value;   generating the public encryption key of the sender system and the private encryption key of the sender system; and   encrypting the private encryption key of the sender system using the symmetric master key, such that the private encryption key of the sender system is unavailable in the absence of the symmetric master key.   
     
     
         11 . A system comprising:
 a memory storing instructions for establishing cryptographic trust;   a processor that executes the instructions to establish cryptographic trust between the system and an external system, wherein to establish cryptographic trust between the system and the external system, the processor executes the instruction to:
 obtain, from a service provider system, via a first electronic communication network, a public encryption key of the external system, wherein the public encryption key of the external system is a part of a device-independent asymmetric key pair that includes a private encryption key of the external system; 
 generate a verification message that includes first verification message content; 
 generate a signed, encrypted, verification message, wherein, to generate the signed, encrypted, verification message, the processor executes the instructions to use the public encryption key of the external system and a private encryption key of the system to encrypt the verification message, wherein the private encryption key of the system is a part of a device-independent asymmetric key pair that includes a public encryption key of the system; 
 send, to the external system, via a second electronic communication network that differs from the first electronic communication network, the signed verification message; 
 receive, from the external system, via a third electronic communication network that differs from the first electronic communication network, second verification message content; and 
 verify that the first verification message content matches the second verification message content. 
   
     
     
         12 . The system of  claim 11 , wherein to generate the signed, encrypted, verification message, the processor executes the instruction to:
 generate an encrypted verification message, wherein, to generate the encrypted verification message, the processor executes the instruction to use the public encryption key of the external system to encrypt the verification message; and   generate the signed, encrypted, verification message, wherein, to generate the signed, encrypted, verification message, the processor executes the instruction to use by the private encryption key of the system to encrypt the encrypted verification message.   
     
     
         13 . The system of  claim 11 , wherein, to establish cryptographic trust, the processor executes the instruction to:
 sign the public encryption key of the external system, wherein, to sign the public encryption key of the external system, the processor executes the instruction to use the private encryption key of the system to encrypt the public encryption key of the external system.   
     
     
         14 . The system of  claim 11 , wherein the third electronic communication network is the second electronic communication network, and wherein the second electronic communication network excludes the service provider server. 
     
     
         15 . The system of  claim 11 , wherein the processor executes the instruction to:
 share an encrypted digital item with the external system, wherein, to share the encrypted digital item, the processor executes the instruction to:
 obtain an unencrypted digital item; 
 obtain an item key for encrypting the digital item; 
 obtain the encrypted digital item, wherein, to obtain the encrypted digital item, the processor executes the instruction to use the item key to encrypt the unencrypted digital item; 
 obtain an encrypted item key, wherein, to obtain the encrypted item key, the processor executes the instruction to use the public encryption key of the external system to encrypt the item key; and 
 output the encrypted digital item and the encrypted item key to the service provider server, such that the unencrypted digital item is accessible to the external system by:
 obtaining the encrypted digital item, the encrypted item key, and the public encryption key of the system from service provider server; 
 obtaining the item key by decrypting the encrypted item key using the private encryption key of the external system; and 
 obtaining the unencrypted digital item by decrypting the encrypted digital item using the item key. 
 
   
     
     
         16 . The system of  claim 11 , wherein, to obtain the item key, the processor executes the instruction to:
 generate a symmetric key for encrypting the digital item; and   use the symmetric key as the item key.   
     
     
         17 . The system of  claim 11 , wherein, to obtain the public encryption key of the external system, the processor executes the instruction to:
 receive, from service provider server, the public encryption key of the external system in response to sending, to service provider server, a request to identify the external system.   
     
     
         18 . The system of  claim 11 , wherein, to obtain the item key, the processor executes the instruction to:
 obtain a second encrypted item key, encrypted with the public encryption key of the system; and   obtain the item key, wherein, to obtain the item key, the processor executes the instruction to use the private encryption key of the system to decrypt the second encrypted item key.   
     
     
         19 . The system of  claim 18 , wherein, to share the encrypted digital item, the processor executes the instruction to:
 use a master password and a salt value to obtain a symmetric master key;   generate the public encryption key of the system and the private encryption key of the system; and   use the symmetric master key to encrypt the private encryption key of the system, such that the private encryption key of the system is unavailable in the absence of the symmetric master key.   
     
     
         20 . A non-transitory computer-readable storage medium, comprising executable instructions that, are executed by a processor to perform:
 establishing, by a sender system, cryptographic trust with a receiver system, wherein establishing cryptographic trust includes:
 obtaining, from a service provider server, via a first electronic communication network, a public encryption key of the receiver system; 
 generating a verification message including first verification message content; 
 generating a signed, encrypted, verification message by encrypting the verification message using the public encryption key of the receiver system and a private encryption key of the sender system; 
 sending, via a second electronic communication network that differs from the first electronic communication network, the signed verification message to the receiver system; 
 receiving, from the receiver system, via a third electronic communication network that differs from the first electronic communication network, second verification message content; and 
 verifying that the first verification message content matches the second verification message content.