Document Security System that Permits External Users to Gain Access to Secured Files

• US 20120198230A1
• Filed: 04/04/2012
• Published: 08/02/2012
• Est. Priority Date: 02/12/2002
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Guardian Data Storage LLC
• Inventors: VAINSTEIN, Klimenty
• Granted Patent: US 8,943,316 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A system includes a server with an access manager configured to restrict access to files of an organization and maintain at least encryption keys for internal and external users and an external access server connected to the server and coupled between the server and a data network. The data network is configured to allow the external users use of the external access server. The external access server is also configured to permit file exchange between the internal users and the external users via the server.

Claims

1. A system comprising:

a server including an access manager configured to restrict access to files of an organization and maintain at least encryption keys for internal and external users; and

an external access server operatively connected to the server and coupled between the server and a data network,

wherein the data network is configured to allow the external users use of the external access server,

wherein the external access server is configured to permit file exchange between the internal users and the external users via the server.

2. The system of claim 1, wherein exchanging of a file by the internal and external users is permitted in response to the internal and external users being members of a common group.

3. The system of claim 1, wherein the encryption keys are public-private keys.

4. The system of claim 3, wherein the server further comprises:

a central server;

a local server operatively connected to the central server; and

a database operatively connected to the central server, the database configured to serve as a key store for the public-private keys.

5. The system of claim 1, wherein the data network includes at least a part of the Internet.

6. The system of claim 1, wherein the external users are unaffiliated with the internal users.

7. The system of claim 1, wherein the external users are unable to change group membership or query group membership to determine members of a user group including at least one of the internal users and at least one of the external users.

8. A method comprising:

restricting access to files in a server including an access manager that restricts access to files of an organization and maintains at least encryption keys for internal and external users;

permitting file exchange between the internal users and the external users through an external access server operatively connected to the server and coupled between the server and a data network; and

using the data network to allow the external users to interact with the external access server.

9. The method of claim 8, wherein the permitting is in response to the internal and external users being members of a common group.

10. The method of claim 8, further comprising using public-private keys as the encryption keys.

11. The method of claim 10, further comprising:

operatively connecting at least one local server to a central server; and

operatively connecting a database to the central server, the database serving at least as a key store for the public-private keys.

12. The method of claim 8, further comprising:

configuring the data network to include at least a part of the Internet.

13. The method of claim 8, wherein the external users are unaffiliated with an organization of the internal users.

14. The method of claim 13, further comprising:

blocking the external users from changing group membership or querying group membership to determine members of a user group including at least one of the internal users and at least one of the external users.

15. A computer-readable storage device having instructions stored thereon, execution of which, by a computing device, causes the computing device to perform operations comprising:

restricting access to files in a server including an access manager that restricts access to files of an organization and maintains at least encryption keys for internal and external users;

permitting file exchange between the internal users and the external users through an external access server operatively connected to the server and coupled between the server and a data network; and

using the data network to allow the external users to interact with the external access server.

16. The computer-readable storage device of claim 15, wherein the permitting is in response to the internal and external members being members of a common group.

17. The computer-readable storage device of claim 15, further comprising using public-private keys as the encryption keys.

18. The computer-readable storage device of claim 17, the operations further comprising:

operatively connecting at least one local server to a central server; and

operatively connecting a database to the central server, the database serving at least as a key store for the public-private keys.

19. The computer-readable storage device of claim 15, the operations further comprising:

configuring the data network to include at least a part of the Internet.

20. The computer-readable storage device of claim 15, wherein the external users are unaffiliated with an organization of the internal users.