File protection for a network client

• US 20060277301A1
• Filed: 06/06/2005
• Published: 12/07/2006
• Est. Priority Date: 06/06/2005
• Status: Abandoned Application

• Current Assignee: NTT Multimedia Communications Laboratories, Inc. (Nippon Telegraph and Telephone Corporation)
• Original Assignee: NTT Multimedia Communications Laboratories, Inc. (Nippon Telegraph and Telephone Corporation)
• Inventors: Sun, Yi, Takanashi, Hitoshi
• Application Number:
  US11/145,833
• Publication Number:
  US 20060277301A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819

Abstract

A technique includes selectively preventing decryption of a file by a client based on whether a network connection exists between the client and a server.

Claims

1. A method comprising:

selectively preventing decryption of a file by a client based on whether a network connection exists between the client and a server.

2. The method of claim 1, wherein the act of selectively preventing comprises:

allowing the client to decrypt the file in response to the network connection; and

preventing the client from decrypting the file in response to the absence of the network connection.

3. The method of claim 1, further comprising:

permitting the client to encrypt a file regardless of whether the network connection exists.

4. The method of claim 1, wherein the act of selectively preventing comprises:

preventing the client from accessing a first key in response to the absence of the network connection.

5. The method of claim 4, wherein the first key is part of a pair of asymmetric keys.

6. The method of claim 5, further comprising:

receiving at least one of the pair of asymmetric keys from the server in the client in response to the existence of the network connection.

7. The method of claim 6, wherein the pair of asymmetric keys is one out of multiple asymmetric keys stored on the server for the client and other clients.

8. The method of claim 6, wherein the act of receiving comprises:

receiving a public key of the pair in the client.

9. The method of claim 5, further comprising:

generating a random key to encrypt the file to generate an encrypted file; and

attaching the encrypted key to the encrypted file.

10. The method of claim 9, further comprising:

in response to the resistance of the network connection, using the other of the pair of asymmetric keys to decrypt the encrypted key to reproduce the random key and use the random key to decrypt the file.

11. The method of claim 10, wherein the random key is deterministic, non-predictable and based on the file being encrypted.

12. The method of claim 5, wherein the pair of asymmetric keys is deterministic and non-predictable.

13. The method of claim 1, wherein the network connection ceases to exist when at least the client logs off of the network or loses physical network access to the server.

14. The method of claim 1, further comprising:

preventing decryption of the file by the client based on whether a predetermined number of log-in attempts between the client and the server has failed within a predetermined window of time.

15. The method of claim 14, further comprising:

removing a key in response to the predetermined number of log-in attempts failing within the predetermined window of time.

16. The method of claim 14, further comprising:

removing at least part of the file in response to the predetermined number of log-in attempts failing within the predetermined window of time.

17. A system comprising:

a server; and

a plurality of clients,

wherein at least one of the clients selectively prevents decryption of a file by the client based on whether a network connection exists between the client and the server.

18. The system of claim 17, wherein said at least one client allows the client to decrypt the file in response to the network connection and prevents the client from decrypting the file in response to the absence of the network connection.

19. The system of claim 17, wherein said at least one client encrypts the file regardless of whether the network connection exists.

20. The system of claim 17, wherein said at least one client is prevented from accessing a first key in response to the absence of the network connection.

21. The system of claim 20, wherein the first key is part of a pair of asymmetric keys.

22. The system of claim 21, wherein said at least one client generates a random key to encrypt the file to generate an encrypted file, uses one of the pair of asymmetric keys to encrypt the random key to produce an encrypted key, and attaches the encrypted key to the encrypted file.

23. The system of claim 17, wherein communications between the server and the clients use at least one of a secure sockets layer and an internet security protocol operating in a tunnel mode.

24. The system of claim 17, wherein the file is distributed on the client and at least one other entity separate from the client.

25. The system of claim 17, wherein the server comprises an access control module to authenticate a client by at least checking its identification against a value in a database.

26. The system of claim 17, wherein said at least one client is adapted to communicate at least its user identification to the server to be verified for the server for purposes of being enabled to decrypt the file.

27. An article comprising a computer readable storage medium storing instructions that when executed by a computer cause the computer to:

selectively prevent decryption of a file by a client based on whether a network connection exists between the client and a server.

28. The article of claim 27, the storage medium storing instructions to cause the computer to allow the client to decrypt the file in response to the network connection and prevent the client decrypting the file in response to the absence of the network connection.

29. The article of claim 27, the storage medium storing instructions to cause the client to encrypt a file regardless of whether the network connection exists.

30. The article of claim 27, the storage medium storing instructions that when executed prevent the client from accessing a first key in response to the absence of the network connection.

31. The article of claim 27, wherein the first key is part of a pair of asymmetric keys.

32. The article of claim 27, the storage medium storing instructions that when executed cause the client to generate a random key to encrypt the file to generate an encrypted file, use one of the pair of asymmetric keys to encrypt the random key to produce an encrypted random key, and attach the encrypted random key to the encrypted file.

33. The article of claim 32, the storage medium storing instructions that when executed cause the client to, in response to the existence of the network connection, use the other of the pair of asymmetric keys to decrypt the encrypted key to reproduce the random key to decrypt the file.

34. A method comprising:

receiving an indication in a server that a client associated with the server has been stolen; and

in response to the indication, communicating a command from the server to the client instructing the client to take protective action to protect a file stored on the client.

35. The method of claim 34, wherein the corrective action comprises deleting at least part of the file.

36. The method of claim 34, wherein the corrective action comprises removing a key used to decrypt the file by the client.