Updating and Validating Documents Secured Cryptographically

• US 20090019549A1
• Filed: 07/13/2007
• Published: 01/15/2009
• Est. Priority Date: 07/13/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Reid, Colin Wilson
• Granted Patent: US 8,887,298 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Aspects of the subject matter described herein relate to updating and validating documents secured cryptographically. In aspects, documents are encrypted to protect them from unauthorized access. An entity having write access to a document may create a new version of the document and sign the new version with a private key. Other entities may validate that the new version of the document was created by an authorized entity by using a public key available in security data associated with the version. The entities that are authorized to create a new version may change which security principals are allowed to create subsequent versions.

Claims

1. A computer-readable medium having computer-executable instructions, which when executed perform actions, comprising:

obtaining a document that includes encrypted data, the document including an identifier that identifies security data associated with the document, the security data including an encrypted field relating to an entity that is authorized to create a new version of the document;

creating a new version of the document; and

using the security data to indicate that the new version was created by the entity.

2. The computer-readable medium of claim 1, further comprising associating the new version of the document with the security data by placing the identifier in the new version of the document.

3. The computer-readable medium of claim 1, further comprising changing an access right in conjunction with creating a new version of the document.

4. The computer-readable medium of claim 3, wherein changing an access right in conjunction with creating a new version of the document comprises creating new security data and associating the new version of the document with the new security data by placing a new identifier that identifies the new security data in the new version of the document.

5. The computer-readable medium of claim 4, wherein changing an access right in conjunction with creating a new version of the document further comprises placing an encrypted private key associated with the access right in the new security data.

6. The computer-readable medium of claim 1, further comprising creating new security data and associating the new version of the document with the new security data by placing a new identifier that identifies the new security data in the new version of the document.

7. The computer-readable medium of claim 1, wherein the identifier comprises a hash of one or more fields of data included in the security data.

8. The computer-readable medium of claim 1, wherein using the security data to indicate that the new version was created by the entity comprises signing the new version with a key included in the encrypted field.

9. The computer-readable medium of claim 1, further comprising having another entity provide a signature to be placed in the new version of the document.

10. The computer-readable medium of claim 9, wherein the signature provided by the other entity indicates that the new version of the document is to be replicated during file replication activities.

11. A method implemented at least in part by a computer, the method comprising:

obtaining a document that identifies security data associated with the document, the document being an updated version of a previous version of the document, the security data including a field usable to determine whether the document was updated by an authorized entity;

obtaining data from the field; and

using at least the data to determine whether the document was updated by the authorized entity.

12. The method of claim 11, wherein the data from the field comprises a public key.

13. The method of claim 12, wherein the public key corresponds to a private key used to sign the security data.

14. The method of claim 12, wherein the data from the field comprises an identifier that identifies a prior version of the security data.

15. The method of claim 14, wherein the public key is available from the prior version of the security data.

16. The method of claim 14, wherein the document includes encrypted data that was changed from the previous version of the document.

17. The method of claim 11, wherein the security data includes another field that includes a signature of an observer, the signature of the observer created by a private key, further comprising using the signature and a public key corresponding to the observer to determine whether the document was updated by an entity authorized to update the document at a time the document was updated.

18. In a computing environment, an apparatus, comprising:

a document locator operable to determine a location of a document that includes encrypted data, the document including data that identifies security data associated with the document, the security data including an encrypted field relating to an entity that is authorized to create a new version of the document;

a cryptographic component operable to perform cryptographic operations; and

an updating component operable to use the cryptographic component and the encrypted field to create a new version of the document.

19. The apparatus of claim 18, further comprising a validating component operable to determine whether a new version of a document was created by an authorized entity.

20. The apparatus of claim 18, wherein the encrypted field includes a private key and wherein the updating component is further operable to use the cryptographic component to sign the new version of the document with the private key.