CRYPTOGRAPHIC METHOD AND SYSTEM

• US 20140351586A1
• Filed: 08/08/2014
• Published: 11/27/2014
• Est. Priority Date: 02/20/2012
• Status: Abandoned Application

• Current Assignee: KL Data Security Pty Limited
• Original Assignee: Lock Box Pty Limited
• Inventors: HOOK, David Geoffrey, HARVEY, Richard Hans, DETTMAN, Peter Kai
• Application Number:
  US14/455,300
• Publication Number:
  US 20140351586A1
• Time in Patent Office: Days
• US Class Current: 713/164
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

In the field of security for electronic data and/or communications, a method of providing data security and/or privacy in a distributed and/or decentralised network environment. Private collaboration and/or information sharing between users, agents and/or applications is enabled, as well as the sharing of key(s) and/or content between a first user and/or agent and a second user and/or agent. The sharing may be of encrypted information via information sharing services.

Claims

1. A method of accessing encrypted content via one or more data stores accessible by a first user having a first computer, the method comprising the steps of:

providing a first blob to a first data store, the first blob comprising encrypted content, encrypted with a first content key;

providing a second blob to a second data store, the second blob comprising an encrypted first content key;

providing the first and second blobs and rights management criteria for use by the first computer;

decrypting the second blob by the first computer to obtain the first content key and enabling the decryption of the first blob to obtain unencrypted content; and

providing the unencrypted content by the first computer to the first user via a client-side application,

wherein the client-side application controls operations available that the first user can perform on the content in accordance with the rights management criteria.

2. The method as claimed in claim 1, wherein a second user has a second computer, further comprising:

providing the first blob and the second blob and the rights management criteria for use by the second computer;

decrypting the second blob by the second computer to obtain the first content key and enabling the decryption the first blob to obtain the unencrypted content; and

providing the unencrypted content by the second computer to the second user via a second client-side application,

wherein the second client-side application controls operations available that the second user can perform on the content in accordance with the rights management criteria.

3. The method as claimed in claim 1, wherein the first blob remains on the first computer.

4. The method as claimed in claim 1, wherein the first computer pulls the first blob from the first data store.

5. The method as claimed in claim 1, wherein the first data store pushes the first blob to the first computer.

6. The method as claimed in claim 2, wherein the first blob is replicated to the second computer.

7. The method as claimed in claim 1, wherein the first blob on the first computer is synchronised with the first blob stored in the first data store.

8. The method as claimed in claim 1, wherein the first computer stores the first blob and by replication or synchronisation the first blob is provided to the first data store.

9. The method as claimed in claim 1, wherein the first data store and the second data store are the same data store

10. The method as claimed in claim 1, wherein a plurality of first blobs, corresponding to a plurality of corresponding content, are provided to a plurality of data stores.

11. The method as claimed in claim 10, wherein the second blob or a plurality of second blobs corresponding to the plurality of first blobs is provided to the plurality of data stores.

12. The method as claimed in claim 1, wherein a plurality of computers provide to a plurality of data stores, a plurality of first blobs corresponding to a plurality of corresponding content.

13. The method as claimed in claim 12, further wherein the second blob or a plurality of second blobs corresponding to the plurality of first blobs is provided to the plurality of data stores.

14. The method as claimed in claim 1, wherein the second blob further comprises a permit.

15. The method as claimed in claim 1, wherein the rights management criteria comprises any one or any combination of restricting and/or controlling decryption, copying, saving, printing, copying to clipboard, watermarking and/or access times.

16. The method as claimed in claim 1, wherein the client-side application is an agent adapted to make use of at-rest encrypted content and control what the second user can or can'"'"'t do with content.

17. The method as claimed in claim 1, wherein the client-side application is:

a viewer

an enforcing application

a reader, or

an application

which enables specific rights either directly granted to the respective user or obtained in real-time from a rights management server.