Key-based secure storage

• US 20060021064A1
• Filed: 09/07/2005
• Published: 01/26/2006
• Est. Priority Date: 10/26/1998
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: England, Paul, Lampson, Butler W., DeTreville, John D.
• Granted Patent: US 7,302,709 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A one-way hash function is applied to a seed supplied by an application to produce a hashed seed that is used to generate the application storage key. A one-way hash function is applied to a seed supplied by a user to produce a first hashed seed that is passed to a keyed hash function, which is keyed to an identity for the user, to produce a second hashed seed. The second hashed seed is used to generate the user storage key. An operating system storage key is generated from an unhashed seed. One of the storage keys is used to encrypt the downloaded content. An access predicate attached to the content when it is downloaded is associated with the storage key to enforce certain limitations on the access of the content.

Claims

1. A computer system comprising:

means for downloading information and an access predicate that specifies requirements for an application to access the information;

means for generating a seed value;

means for producing a hash seed value based on the seed value using a one-way hash function;

means for generating an application storage key from the hash seed value;

means for encrypting the information using the application storage key; and

means for associating the access predicate with the encrypted information.

2. One or more computer-readable media having stored thereon computer-executable instructions that, when executed by one or more processors of a computer, cause the computer to perform acts comprising:

downloading information and an access predicate that specifies requirements for an application to access the information;

obtaining a storage key;

encrypting the information using the storage key;

associating the access predicate with the encrypted information;

obtaining an operating system storage key;

encrypting the access predicate with the operating system storage key; and

encrypting a plurality of other storage keys using the operating system storage key, wherein the other storage keys are selected from the group consisting of application storage keys and user storage keys.

3. One or more computer-readable media having stored thereon computer-executable instructions that, when executed by one or more processors of a computer, cause the computer to perform acts comprising:

downloading information and an access predicate that specifies requirements for an application to access the information;

obtaining a storage key;

encrypting the information using the storage key;

associating the access predicate with the encrypted information;

storing the storage key in a key vault provided by a third-party; and

recovering the storage key from the key vault.

4. One or more computer-readable media as recited in claim 3, wherein recovering the storage key comprises:

requesting recovery of the storage key; and

providing information to the third-party to enable validation of the request.

5. One or more computer-readable media as recited in claim 3, the instructions further causing the computer to perform acts comprising:

selecting the key vault from a plurality of key vaults provided by a trusted operating system.

6. One or more computer-readable media as recited in claim 3, the instructions further causing the computer to perform acts comprising:

selecting the key vault designated by a provider of the information.