Systems and methods for managing multiple keys for file encryption and decryption

• US 20060179309A1
• Filed: 02/07/2005
• Published: 08/10/2006
• Est. Priority Date: 02/07/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gu, Jianrong, Bryce, Duncan G., Ene-Pietrosanu, Monica Ioana, Cross, David B., Yiu, Kelvin Shek
• Granted Patent: US 8,045,714 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation

Abstract

Systems and methods for managing multiple keys for file encryption and decryption may provide an encrypted list of previously used keys. The list itself may be encrypted using a current key. To decrypt files that are encrypted in one or more of the previous keys, the list can be decrypted, and the appropriate previous key can be retrieved. To re-key files, an automated process can decrypt any files using previous keys and encrypt them using the current key. If a new current key is introduced, the prior current key can be used to decrypt the list of keys, the prior current key can be added to the list, and the list can be re-encrypted using the new current key.

Claims

1. A method for managing multiple keys for file encryption and decryption, comprising:

decrypting a list of keys using a first key;

adding the first key to the list of keys;

encrypting the list of keys using a second key.

2. The method of claim 1, further comprising encrypting at least one file using said first key, and storing a pointer to the first key with at least one file.

3. The method of claim 1, further comprising decrypting at least one file using said first key, and encrypting said at least one file using said second key.

4. The method of claim 1, further comprising prompting a person to enter at least one key, and adding said at least one key to the list of keys.

5. The method of claim 1 wherein the list of keys is stored with a user profile.

6. The method of claim 1 wherein the second key is stored on a portable device.

7. The method of claim 1, further comprising storing a third key that is not available in said list of keys in a cache memory.

8. A computer readable medium bearing instructions for managing multiple keys for file encryption and decryption, comprising:

instructions for decrypting a list of keys using a first key;

instructions adding the first key to the list of keys;

instructions for encrypting the list of keys using a second key.

9. The computer readable medium of claim 8, further comprising instructions for encrypting at least one file using said first key, and instructions for storing a pointer to the first key with the at least one file.

10. The computer readable medium of claim 8, further comprising instructions for decrypting at least one file using said first key, and instructions for encrypting said at least one file using said second key.

11. The computer readable medium of claim 8, further comprising instructions for prompting a person to indicate at least one key, and instructions for adding said at least one key to the list of keys.

12. The computer readable medium of claim 8 wherein the list of keys is stored with a user profile.

13. The computer readable medium of claim 8 wherein the second key is stored on a portable device.

14. The computer readable medium of claim 8, further comprising instructions for storing a third key that is not available in said list of keys in a cache memory.

15. A computer comprising means for managing multiple keys for file encryption and decryption, said means comprising:

means for decrypting a list of keys using a first key;

means for adding the first key to the list of keys;

means for encrypting the list of keys using a second key.

16. The computer of claim 15, further comprising means for encrypting at least one file using said first key, and means for storing a pointer to the first key with the at least one file.

17. The computer of claim 15, further comprising means for decrypting at least one file using said first key, and means for encrypting said at least one file using said second key.

18. The computer of claim 15, further comprising means for prompting a person to enter at least one key, and means for adding said at least one key to the list of keys.

19. The computer of claim 15, wherein the second key is stored on a portable device.

20. The computer of claim 15, further comprising means for storing a third key that is not available in said list of keys in a cache memory.