MULTI-KEY CRYPTOGRAPHY FOR ENCRYPTING FILE SYSTEM ACCELERATION

• US 20120057696A1
• Filed: 11/09/2011
• Published: 03/08/2012
• Est. Priority Date: 09/04/2008
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Chew, Yen Hsiang
• Granted Patent: US 9,240,883 B2
• Time in Patent Office: Days
• US Class Current: 380/30
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Embodiments of methods and systems for encrypting and decrypting with encryption attributes are presented. An encryption attribute contains information to identify one or more segments of a file to be encrypted. An encryption process encrypts those one or more segments to generate a partly encrypted file instead of encrypting the entire file. That is, the file includes some data that are encrypted and some data that are not. In one embodiment, at least three encryption keys are used such that the encryption attribute is encrypted with using a third key.

Claims

3-1. The method defined in claim 1, wherein the third key is encrypted in conjunction with the second key.

10. A method for decrypting comprising:

accessing first data including partly encrypted data, an encrypted version of an encryption attribute, a version of a first key encrypted by using a second key which is a public key, and an encrypted version of a third key, wherein the partly encrypted data comprises a plurality of segments;

decrypting the encrypted encryption attribute with the third key to retrieve the encryption attribute, wherein the encryption attribute includes information to identify one or more segments of the partly encrypted data that are encrypted; and

decrypting the one or more segments of the partly encrypted data with the first key.

11. The method defined in claim 10, wherein the first key is a symmetric encryption key.

12. The method defined in claim 10, wherein the encrypted version of the third key is generated in conjunction with the second key.

13. The method defined in claim 10, wherein the encrypted version of the third key is generated in conjunction with the first key.

14. A system for encrypting comprising:

a controller to receive a request to encrypt first data associated with at least one encryption attribute, wherein the first data includes a plurality of segments, wherein the encryption attribute includes information to identify one or more segments of the first data to encrypt;

a first encryption engine to encrypt the one or more segments of the first data with a first key to produce partly encrypted data, wherein the first key is to be encrypted with a second key which is a public key;

a second encryption engine is operable to encrypt the encryption attribute with a third key to create an encrypted encryption attribute; and

a storage to store at least a part of second data, wherein the second data includes the encrypted encryption attribute, the partly encrypted data, and an encrypted version of the third key.

15. The system defined in claim 14, wherein the encrypted version of the third key is generated in conjunction with the first key.

16. The system defined in claim 14, wherein the encrypted version of the third key is generated in conjunction with the second key.

17. A system for decrypting comprising:

a controller to access first data including partly encrypted data and an encrypted version of an encryption attribute, wherein the partly encrypted data comprises a plurality of segments, wherein the partly encrypted data is encrypted using a first key, wherein an encrypted version of the first key is created in conjunction with a second key which is a public key;

a first decryption engine to decrypt the encrypted encryption attribute with a third key to retrieve the encryption attribute, wherein the encryption attribute includes information to identify one or more segments of the partly encrypted data that are encrypted; and

a second decryption engine to decrypt the one or more segments of the partly encrypted data with a first key.

18. The system defined in claim 17, wherein an encrypted version of the third key is generated in conjunction with the first key.

19. The system defined in claim 17, wherein an encrypted version of the third key is generated in conjunction with the second key.

20. An article of manufacture comprising a computer readable storage medium including data storing instructions thereon that, when accessed by a machine, cause the machine to perform a method comprising:

encrypting one or more segments of first data with a first key, the first data being associated with at least one encryption attribute and having a plurality of segments, wherein the encryption attribute includes information to identify the one or more segments of the first data to encrypt;

encrypting the first key with a second key which is a public key;

encrypting the encryption attribute with a third key to create an encrypted encryption attribute, wherein the first key, the second key, and the third key are different; and

storing at least a part of second data including partly encrypted data, an encrypted encryption attribute, an encrypted version of the first key, and an encrypted version of the third key.

21. The article of manufacture of claim 20, wherein the first key is a symmetric encryption key.

22. The article of manufacture of claim 20, wherein the third key is encrypted in conjunction with the first key.

23. The article of manufacture of claim 20, wherein the third key is encrypted in conjunction with the second key.

24. An article of manufacture comprising a computer readable storage medium including data storing instructions thereon that, when accessed by a machine, cause the machine to perform a method comprising:

accessing first data including partly encrypted data, an encrypted version of an encryption attribute, a version of a first key encrypted by using a second key which is a public key, and an encrypted version of a third key, wherein the partly encrypted data comprises a plurality of segments;

decrypting the encrypted encryption attribute with the third key to retrieve the encryption attribute, wherein the encryption attribute includes information to identify one or more segments of the partly encrypted data that are encrypted; and

decrypting the one or more segments of the partly encrypted data with the first key.

25. The article of manufacture of claim 24, wherein the encrypted version of the third key is generated in conjunction with the first key.

26. The article of manufacture of claim 24, wherein the encrypted version of the third key is generated in conjunction with the second key.