Method of encrypting information for remote access while maintaining access control

• US 20020029340A1
• Filed: 11/01/2001
• Published: 03/07/2002
• Est. Priority Date: 05/28/1999
• Status: Active Grant

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: Authentica, Inc. (Dell Technologies Inc.)
• Inventors: Singles, Steven J., Pensak, David A., Cristy, John J.
• Granted Patent: US 6,449,721 B1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

The invention provides for encrypting electronic information such as a document so that only users with permission may access the document in decrypted form. The process of encrypting the information includes selecting a set of policies as to who may access the information and under what conditions. A remote server stores a unique identifier for the information and associates an encryption/decryption key pair and access policies with the information. Software components residing on the author'"'"'s computer retrieve the encryption key from the remote server, encrypt the information, and store the encrypted information at a location chosen by the author. A user wishing to access the information acquires the encrypted information electronically. Software components residing on the viewing user'"'"'s computer retrieve the associated decryption key and policies, decrypt the information to the extent authorized by the policies, and immediately delete the decryption key from the viewing user'"'"'s computer upon decrypting the information and rendering the clear text to the viewing user'"'"'s computer screen. The software components are also capable of prohibiting functional operations by the viewing user'"'"'s computer while the clear text is being viewed.

Claims

1. A method of controlling distribution of electronic information comprising the steps of:

retrieving, at a user location, a segment of encrypted electronic information;

receiving, from a key server, (a) a copy of a decryption key for the segment, and (b) at least one user limitation assigned to the segment and associated with the decryption key;

accessing the segment using the copy of the decryption key at the user location for the segment and a control process, the control process responsive to a user limitation to control distribution of the electronic information; and

destroying the copy of the decryption key at the user location after accessing the segment.

2. The method of controlling distribution of electronic information of claim 1, wherein access to the decryption key is controlled by the key server subject to a unique segment identification associated with the segment and the user limitation associated with the segment.

3. A method of accessing first and second encrypted segments of an electronic document comprising the steps of:

retrieving, at the user location, a first encrypted segment of the electronic document;

receiving, from a key server, (a) a copy of a first decryption key for the first segment and (b) at least one user limitation assigned to the first segment and associated with the first decryption key;

accessing the first segment using the copy of the first decryption key for the first segment; and

at the user location, destroying the copy of the first decryption key for the first segment as a precondition to receiving a decryption key for accessing a second segment of the electronic document.