Computer method and apparatus for securely managing data objects in a distributed context

• US 20050008163A1
• Filed: 06/01/2004
• Published: 01/13/2005
• Est. Priority Date: 06/02/2003
• Status: Abandoned Application

• Current Assignee: Liquid Machines, Inc. (Check Point Software Technologies Limited)
• Original Assignee: Liquid Machines, Inc. (Check Point Software Technologies Limited)
• Inventors: Leser, Norbert, Smith, Michael D., Morgan, Robert, Kyne, Fajen, Gaudet, Edward J., Epstein, Arnold S., Schoonmaker, James, Barclay, Christopher B.
• Application Number:
  US10/858,827
• Publication Number:
  US 20050008163A1
• Time in Patent Office: Days
• US Class Current: 380/281
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

In a network of intermittently-connected computers, a method and apparatus for maintaining and managing control over data objects authored, accessed, and altered by users in dynamic, distributed, and collaborative contexts. The invention method and apparatus attach to each data object an identification of a respective control policy. Each control policy comprises at least an indication of a subset of the users who may access the data object, an indication of the privileges granted to each subset of users able to access the data object, and an indication of a subset of users who may define or edit the control policy. The invention method and apparatus separate the management of the control policies of data objects from the creation and use of the data objects. The invention method and apparatus automate common policy changes, distribution of policy changes to the enforcement agents, and propagation of control policies to derivative works.

Claims

1. A computer method of protecting data objects, said method comprising the steps of:

encrypting a data object with a content encryption key; and

encrypting the content encryption key with a key encryption key of a control policy associated with the data object.

2. The method of protecting data objects of claim 1, further comprising:

recording a control policy tag corresponding to the data object.

3. The method of protecting data objects of claim 2, further comprising:

storing the encrypted content encryption key in the control policy tag.

4. The method of protecting data objects of claim 3, further comprising:

decrypting the content encryption key stored in the control policy tag with a cached key encryption key; and

decrypting the data object with the decrypted content encryption key.

5. The method of protecting data objects of claim 2, wherein the control policy tag is attached to the data object.

6. The method of protecting data objects of claim 2, wherein the data object is read-only.

7. The method of protecting data objects of claim 2, wherein the control policy tag is constructed on a control policy server.

8. The method of protecting data objects of claim 2, wherein the control policy tag is constructed on a client.

9. The method of protecting data objects of claim 2, wherein the key encryption key of a control policy has an associated validity period.

10. The method of protecting data objects of claim 9, further comprising:

automatically replacing an expired key encryption key of a control policy.

11. The method of protecting data objects of claim 10, wherein automatically replacing an expired key encryption key of a control policy further comprises:

selecting a proper key from a set of decryption keys comprising at least one of;

a next future key, a current key, a recently expired key, and an old key received from a control policy server.

12. The method of protecting data objects of claim 2, further comprising:

storing a second copy of the content key encrypted with a second encryption key in the control policy tag.

13. The method of protecting data objects claim 12, wherein the second encryption key is a control policy server key encryption key.

14. The method of protecting data objects of claim 12, further comprising:

providing access to a data object with an expired key encryption key of the control policy using the control policy server key encryption key.

15. The method of protecting data objects of claim 2, further comprising:

protecting integrity of the control policy tag against tampering.

16. The method of protecting data objects of claim 15, wherein the step of protecting the integrity of the control policy tag against tampering further comprises using a secure hash over control policy tag fields.

17. The method of protecting data objects of claim 2, further comprising:

checking a control policy server for modifications to the control policy associated with the data object.

18. The method of protecting data objects of claim 17 wherein the control policy tag comprises a uniform resource locator of a control policy server and a control policy locator.

19. The method of protecting data objects of claim 17, further comprising:

revoking a user'"'"'s access to the data object upon detection of the changes to the control policy that prevent that user from further access to the data object.

20. The method of protecting data objects of claim 1, further comprising the step of:

storing the key encryption key of the control policy on a control policy server.

21. The method of protecting data objects of claim 20, wherein the control policy comprises at least an indication of a set of users who may access the data object, an indication of privileges granted to each user of the set, and an indication of a set of users who may define or edit the control policy, the method further comprising the steps of:

retrieving a decryption key for the key encryption key of the control policy and the indication of privileges for a user by the user if the user is indicated in the control policy to be in a set of users who may access the data object.

22. The method of protecting data objects of claim 21, wherein retrieving the key encryption key of a control policy further comprises determining if a user is authenticated.

23. The method of protecting data objects of claim 21, further comprising:

storing an indication of a duration of time for which the user may access the data object; and

revoking a user'"'"'s access to the data object upon expiration of the duration of time.

24. The method of protecting data objects of claim 23, further comprising:

decrypting the data object; and

allowing the user to access the data object.

25. The method of protecting data objects of claim 23, further comprising:

destroying the key encryption key of the control policy upon expiration of the duration of time.

26. The method of protecting data objects of claim 1 further comprising:

changing the content encryption key whenever the data object is modified.

27. The method of protecting data objects of claim 2 further comprising:

automatically replacing an expired control policy tag.

28. The method of protecting data objects of claim 27, wherein the control policy tag comprises at least one of:

a length field and a version field.

29. The method of protecting data objects of claim 28, wherein replacing the expired control policy tag further comprises:

sending the control policy tag to a control policy server if a control policy version does not match a current version.