Abstract: In a method for decrypting persistent user cryptographic keys in a distributed cryptographically secured peer-to-peer filesystem, a primary input value is received from a first user on a first peer device. A symmetric user encryption key UK1 is generated for the first user from the primary input value on the first peer device. An encrypted private key ePrK1 is requested and received from a non-volatile memory of a data persistence server using the first peer device. The encrypted private key ePrK1 is decrypted using the symmetric user encryption key UK1 using a symmetric decryption algorithm on the first peer device, producing a private key PrK1=ESUK1?1(ePrK1). The private key PrK1 is used to reconstruct a distributed file.

Abstract: A unique identifier id(f) is generated for file f and is stored on a content address server. A symmetric encryption key KF is generated for file f. File f is divided into n segments. A unique identifier id(si) is generated for each segment si of the n segments. Each segment si of the n segments is encrypted using the symmetric key KF using a symmetric encryption algorithm, producing n encrypted segments esi=ESKF(si). Each encrypted segment esi is stored with its identifier id(si) on at least one peer device. For each encrypted segment esi, the identifier id(si) is stored on the content address server with the identifier id(f). A public key KU2 of a second user is retrieved, the symmetric key KF is encrypted with key KU2, producing wrapped key KW2=EAKU2(KF), and key KW2 is stored on the content address server with identifier id(f).

Abstract: A primary input value is received from a first user on a first peer device. A symmetric user encryption key UK1 is generated for the first user from the primary input value on the first peer device. One or more random numbers are requested and received from a random number generator server. A user asymmetric encryption key pair that includes a public key PuK1 and a private key PrK1 is generated for the first user from the one or more random numbers on the first peer device. The public key PuK1 is stored in a non-volatile memory on a public-key server. The private key PrK1 is encrypted using the symmetric user encryption key UK1 using a symmetric encryption algorithm on the first peer device, producing an encrypted private key ePrK1=ESUK1(PrK1). The private key ePrK1 is stored in non-volatile memory on a data persistence server.

Abstract: A first user saving a file f is detected. The file f is intercepted. A filename and one or more text strings entered as searchable metadata are also intercepted. An identifier id(f) is generated for the file f. The filename, the one or more text strings, and id(f) are stored together on a content address server. A symmetric encryption key KF is generated. File f is divided into n segments. An identifier id(si) is generated for each segment si. Each si is encrypted using KF, producing n encrypted segments esi=ESKF(Si). Each esi is stored with its id(si) on a peer device. For each esi, id(si) is stored on the content address server with id(f). A public key KU2 of a second user is retrieved, KF is encrypted with KU2, producing wrapped key KW2 EAKU2(KF), and KW2 is stored on the content address server with id(f).

Abstract: A unique identifier id(f) is generated for file f and stored on a content address server. A symmetric encryption key KF is generated for file f. File f is divided into n segments. A unique identifier id(si) is generated for each segment si. Each segment si of the n segments is encrypted using the symmetric key KF using a symmetric encryption algorithm, producing n encrypted segments esi. Each encrypted segment esi is stored with its identifier id(si) on the first peer device and at least one other peer device. For each encrypted segment esi, the identifier id(si) is stored on the content address server with the identifier id(f). A public key KU2 of a second user is retrieved, the symmetric key KF is encrypted with key KU2, producing wrapped key KW2=EAKU2(KF), and key KW2 is stored on the content address server with identifier id(f).