Document security in enterprise content management systems

• US 10,380,353 B2
• Filed: 12/03/2014
• Issued: 08/13/2019
• Est. Priority Date: 02/04/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Avery, Kenytt D., Costecalde, Jean-Marc, Harnick-Shapiro, David B.
• Primary Examiner(s): King, John B
• Application Number:
  US14/559,481
• Publication Number:
  US 20150220754A1
• Time in Patent Office: 1,714 Days
• Field of Search: 713189
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Methods for enhancing the security of content in a records management system. A document is received to be stored as a record in the records management system. A unique combination of an encryption key and encryption parameters is selected for the document. The encryption key and encryption parameters are stored on a server that is different from a server upon which the document is to be stored in the records management system. The document is encrypted using the selected unique combination of encryption key and encryption parameters. The encrypted document is stored in the records management system.

Claims

1. A computer-implemented method for a records management system, comprising:

generating a unique encryption key for each document in a plurality of documents stored on a first server in a records management system, wherein each unique encryption key is generated in accordance with an assigned classification level for each document;

encrypting each document in the plurality of documents at the first server, using the unique encryption keys for each document and a set of encryption parameters for each document; and

storing the unique encryption keys and the sets of encryption parameters for each document on a second server.

2. The method of claim 1, wherein the first server and the second server are located in different physical locations.

3. The method of claim 1, further comprising:

in response to receiving a user request to access a document in the plurality of documents stored on the first server;

decrypting the document using the unique encryption key for the document; and

providing access to the document.

4. The method of claim 1, wherein the encryption parameters include one or more of:

an encryption algorithm, a block cipher mode, and a key length.

5. The method of claim 4, further comprising:

encrypting the document at the first server, using a different unique encryption key for the document and a different set of encryption parameters for the document; and

storing the different unique encryption key and the different set of encryption parameters for the document on the second server.

6. The method of claim 1, wherein the first server and the second server have different security settings and are managed by different administrators.