PORTABLE SECURE DATA FILES

• US 20100235649A1
• Filed: 03/13/2009
• Published: 09/16/2010
• Est. Priority Date: 03/13/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Grass, Michael J., Setzer, Matthew C., Bharadwaj, Vijay G., Sinha, Gaurav, Ellison, Carl M., Jeffries, Charles G.
• Granted Patent: US 8,364,984 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2151 Time stamp

Abstract

A portable secure data file includes an encrypted data portion and a metadata portion. When a request associated with a current user of a device to access a portable secure data file is received, one or more records in the metadata portion are accessed to determine whether the current user is permitted to access the file data in the encrypted data portion. If a record indicates the user is permitted to access the file data, a content encryption key in that record is used to decrypt the encrypted data portion.

Claims

1. One or more computer storage media having stored thereon multiple instructions that, when executed by one or more processors of a device, cause the one or more processors to:

receive a request associated with a current user of the device to access a portable secure data file including an encrypted data portion and a metadata portion;

access a service record in the metadata portion;

access a remote service associated with the service record; and

receive, from the remote service, an indication of whether the current user of the device can access the encrypted data portion.

2. One or more computer storage media as recited in claim 1, wherein the indication comprises a content encryption key to be used to decrypt the encrypted data portion, and a policy encryption key to be used to decrypt an encrypted access control policy in the metadata portion.

3. One or more computer storage media as recited in claim 1, wherein the indication comprises an additional record including both a content encryption key to be used to decrypt the encrypted data portion and a policy encryption key to be used to decrypt an encrypted access control policy in the metadata portion, the additional record being encrypted with a public key of the current user of the device.

4. One or more computer storage media as recited in claim 3, the multiple instructions further causing the one or more processors to store the additional record in the metadata portion.

5. One or more computer storage media as recited in claim 4, the multiple instructions further causing the one or more processors to store the additional record in the metadata portion only if the access control policy indicates that the additional record can be stored in the metadata portion.

6. One or more computer storage media as recited in claim 4, the multiple instructions further causing the one or more processors to:

receive a subsequent request associated with the current user of the device to access the portable secure data file;

access the additional record in the metadata portion;

use the content encryption key in the additional record to decrypt the encrypted data portion; and

use the policy encryption key in the additional record to decrypt the access control policy in the metadata portion.

7. One or more computer storage media as recited in claim 1, the multiple instructions further causing the one or more processors to, prior to accessing the remote service:

determine whether a recipient record in the metadata portion permits the current user to access file data in the encrypted data portion; and

use a content encryption key in the recipient record to obtain the file data by decrypting the encrypted data portion without accessing the remote service.

8. One or more computer storage media as recited in claim 1, the metadata portion including a signature record, the signature record storing:

an identifier of an originator of the portable secure data file;

an identifier of file data in the encrypted data portion;

a first cryptographic hash or MAC value of the file data, digitally signed using a private key of a public/private key pair of the originator or a subsequent user of the portable secure data file;

a second cryptographic hash or MAC value of an access control policy in the metadata portion, digitally signed using the private key of the public/private key pair of the originator or the subsequent user of the portable secure data file; and

one or more timestamps indicating when the digital signatures resulting from the digital signing were created.

9. One or more computer storage media as recited in claim 8, the metadata portion including a file modification record digitally signed using a second private key of a second public/private key pair of an additional user modifying the portable secure data file, the file modification record storing:

an identifier of the additional user;

the identifier of the file data in the encrypted data portion;

a third cryptographic hash value of the file data in the encrypted data portion as modified;

a fourth cryptographic hash value of the access control policy as modified; and

a timestamp indicating when the portable secure data file was modified.

10. A method implemented in a computing device, the method comprising:

obtaining a portable secure data file including an encrypted data portion and a metadata portion;

identifying whether a record in the metadata portion permits a user of the computing device to decrypt both the encrypted data portion and an encrypted access control policy in the metadata portion; and

allowing the user to have a desired access privilege to the encrypted data portion only if the record is present in the metadata portion and the encrypted access control policy indicates that the user is to have the desired access privilege to the encrypted data portion.

11. A method as recited in claim 10, wherein the record is a recipient record encrypted with a public key of a public/private key pair of the user.

12. A method as recited in claim 11, wherein the recipient record includes both a content encryption key used to decrypt the encrypted data portion and a policy encryption key used to decrypt the encrypted access control policy.

13. A method as recited in claim 10, further comprising:

accessing an additional record in the metadata portion;

accessing a remote service associated with the additional record; and

receiving, from the remote service, an indication of whether an additional user of the computing device can access file data in the encrypted data portion.

14. A method as recited in claim 13, further comprising:

wherein the indication comprises both a content encryption key used to decrypt the encrypted data portion and a policy encryption key used to decrypt the encrypted access control policy.

15. A method as recited in claim 10, further comprising:

identifying whether an additional record in the metadata portion permits an additional user of the computing device to decrypt both the encrypted data portion and the encrypted access control policy; and

allowing the additional user to have read-write access to the encrypted data portion only if the additional record is present in the metadata portion and the encrypted access control policy indicates that the additional user is to have read-write access to the encrypted data portion.

16. A method as recited in claim 15, wherein the access control policy further identifies whether the additional user has permission to modify the encrypted access control policy.

17. A method as recited in claim 10, the metadata portion including a signature record, the signature record storing:

an identifier of an originator of the portable secure data file;

an identifier of file data in the encrypted data portion;

a first cryptographic hash or MAC value of the file data, digitally signed using a private key of a public/private key pair of the originator or a subsequent user of the portable secure data file;

a second cryptographic hash or MAC value of an access control policy prior to being encrypted as the encrypted access control policy, digitally signed using the private key of the public/private key pair of the originator or the subsequent user of the portable secure data file; and

one or more timestamps indicating when the digital signatures resulting from the digital signing were created.

18. A method as recited in claim 17, the metadata portion including a file modification record digitally signed using a second private key of a second public/private key pair of an additional user modifying the portable secure data file, the file modification record storing:

an identifier of the additional user;

the identifier of the file data in the encrypted data portion;

a third cryptographic hash value of the file data in the encrypted data portion as modified;

a fourth cryptographic hash value of the access control policy as modified; and

a timestamp indicating when the portable secure data file was modified.

19. A method of generating a portable secure data file, the method comprising:

receiving a request to create a portable secure data file including a metadata portion and a data portion;

storing, in the data portion, encrypted data of the portable secure data file, the encrypted data having been encrypted using a content encryption key; and

storing, in the metadata portion;

an encrypted access control policy identifying types of access one or more users are permitted to have to the portable secure data file, the access control policy having been encrypted using a policy encryption key;

a signature record affirming the integrity of the portable secure data file; and

one or more records each including both the policy encryption key and the content encryption key, each of the one or more records identifying one or more users that are permitted to decrypt both the encrypted policy encryption key and the encrypted content encryption key.

20. A method as recited in claim 19, the one or more records including:

a first recipient record associated with a first user of the one or more users having read-write access or read-only access to the file data;

a second recipient record associated with a second user of the one or more users having both read-write access to the file data and access to modify the access control policy; and

a service record associated with a remote service that is accessed to determine whether a third user of the one or more users has access to the file data.