SAVING AND RETRIEVING DATA BASED ON PUBLIC KEY ENCRYPTION

• US 20110119505A1
• Filed: 01/27/2011
• Published: 05/19/2011
• Est. Priority Date: 04/17/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: England, Paul, Peinado, Marcus
• Granted Patent: US 8,601,286 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

In accordance with certain aspects, data is received and a digital signature is generated and output. The digital signature can be a digital signature of the data and one or more conditions that are to be satisfied in order for the data to be revealed, or a digital signature over data generated using a private key associated with a bound key that is bound to one or more processors.

Claims

1. A method comprising:

receiving data from a calling program;

generating a digital signature, using public key encryption, over both the data and one or more conditions that are to be satisfied in order for the data to be revealed; and

returning the digital signature to the calling program.

2. A method as recited in claim 1, wherein receiving the data comprises receiving the data as part of a Quote operation.

3. A method as recited in claim 1, wherein the one or more conditions include an identifier of the calling program.

4. A method as recited in claim 3, wherein the identifier of the calling program comprises a digest value generated by applying a cryptographic hash function to the calling program.

5. A method as recited in claim 1, wherein the one or more conditions include a time constraint to be satisfied in order for the data to be revealed.

6. A method as recited in claim 1, wherein the one or more conditions include a logical formula to be evaluated, and wherein the data can be revealed only if the logical formula evaluates true.

7. A method as recited in claim 1, wherein the one or more conditions include a program to be executed, and wherein the data can be revealed only if execution of the program returns an indication of true.

8. A method comprising:

receiving data;

generating, using public key encryption, a digital signature in response to a request from a calling program, the digital signature being a digital signature of the data and one or more conditions that are to be satisfied in order for the data to be revealed; and

returning the digital signature to the calling program.

9. A method as recited in claim 8, wherein the request from the calling program comprises the calling program invoking a Quote operation.

10. A method as recited in claim 8, wherein the one or more conditions include an identifier of the calling program.

11. A method as recited in claim 10, wherein the identifier of the calling program comprises a digest value generated by applying a cryptographic hash function to the calling program.

12. A method as recited in claim 8, wherein the one or more conditions include a time constraint to be satisfied in order for the data to be revealed.

13. A method as recited in claim 8, wherein the one or more conditions include a logical formula to be evaluated, and wherein the data can be revealed only if the logical formula evaluates true.

14. A method as recited in claim 8, wherein the one or more conditions include a program to be executed, and wherein the data can be revealed only if execution of the program returns an indication of true.

15. A method of implementing a BoundQuote operation, the method comprising:

receiving, as an input, both data to be signed and a bound key, wherein the bound key is bound to one or more processors;

reconstructing, based at least in part on the bound key, a private key associated with the bound key;

generating a digital signature over the data using the private key; and

outputting the digital signature.

16. A method as recited in claim 15, wherein the bound key is bound to the one or more processors by encrypting the bound key using the public key of the one or more processors.

17. A method as recited in claim 15, wherein the bound key is restricted to being used by the BoundQuote operation.

18. A method as recited in claim 15, further comprising outputting the digital signature only if one or more bound key usage conditions of the bound key are satisfied.

19. A method as recited in claim 15, wherein generating the digital signature comprises generating, using the private key, the digital signature over both the data and an identifier of a program invoking the BoundQuote operation.