NETWORK ENCRYPTED DATA OBJECT STORED ON AN ENCRYPTED FILE SYSTEM

• US 20150169894A1
• Filed: 12/13/2013
• Published: 06/18/2015
• Est. Priority Date: 12/13/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Keohane, Susann M., Mullen, Shawn P., Murillo, Jessica C., Shieh, Johnny M.
• Granted Patent: US 9,697,378 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method of storing a data object received from a network is described. An encrypted data object encrypted with a first encryption key is received. It is determined whether the encrypted data object is to be stored in an encrypted file system that requires encryption of a data object with a second encryption key. The first encryption key is encrypted with a third encryption key when it is determined the encrypted data object is to be stored in the encrypted file system. The first encryption key is attached to the encrypted data object. The data object encrypted by the first encryption key is stored in the encrypted file system.

Claims

1. A method of storing a data object received from a network in an encrypted file system that requires encryption of the data object with an encryption key, comprising:

receiving an first data object from the network, the first data object being encrypted with a first encryption key;

determining whether the first data object is to be stored in the encrypted file system;

encrypting the first encryption key with a second encryption key when it is determined the first data object is to be stored in the encrypted file system;

attaching the first encryption key to the first data object; and

storing the first data object in the encrypted file system.

2. The method of claim 1, further comprising:

receiving a command to use the first data object;

decrypting the first encryption key with the second encryption key; and

decrypting the first data object with the first encryption key.

3. The method of claim 1, further comprising;

receiving a second data object that is unencrypted;

determining whether the second data object is to be stored in the encrypted file system;

encrypting the second data object with a third encryption key, when it is determined the second data object is to be stored in the encrypted file system;

encrypting the third encryption key with the second encryption key;

attaching the third encryption key to the second data object; and

storing the second data object in the encrypted file system.

4. The method of claim 1, wherein the first encryption key is a symmetric session key and the third encryption key is a symmetric file key.

5. The method of claim 1, wherein the second encryption key is a public key of a public/private key pair.

6. The method of claim 1, wherein the second encryption key is stored in a user keystore.

7. The method of claim 1, further comprising:

if the first encryption key is encrypted, decrypting the first encryption key with a fourth encryption key when the first encryption key is received.

8. A computer system for storing a data object received from a network in an encrypted file system that requires encryption of the data object with an encryption key, comprising:

a processor;

an encrypted file system communicatively coupled to the processor; and

memory communicatively coupled to the processor and encrypted file system, wherein the memory is encoded with instructions, and wherein the instructions when executed by the processor include;

receiving an first data object from the network, the first data object being encrypted with a first encryption key;

determining whether the first data object is to be stored in the encrypted file system;

encrypting the first encryption key with a second encryption key when it is determined the first data object is to be stored in the encrypted file system;

attaching the first encryption key to the first data object; and

storing the first data object in the encrypted file system.

9. The system of claim 8, wherein the instructions further include:

receiving a command to use the first data object;

decrypting the first encryption key with the second encryption key; and

decrypting the first data object with the first encryption key.

10. The system of claim 8, wherein the instructions further include:

receiving a second data object that is unencrypted;

determining whether the second data object is to be stored in the encrypted file system;

encrypting the second data object with a third encryption key, when it is determined the second data object is to be stored in the encrypted file system;

encrypting the third encryption key with the second encryption key;

attaching the third encryption key to the second data object; and

storing the second data object in the encrypted file system.

11. The system of claim 8, wherein the first encryption key is a symmetric session key and the third encryption key is a symmetric file key.

12. The system of claim 8, wherein the second encryption key is a public key of a public/private key pair.

13. The system of claim 8, wherein the second encryption key is stored in a user keystore.

14. The system of claim 8, wherein the instructions further include:

if the first encryption key is encrypted, decrypting the first encryption key with a fourth encryption key when the first encryption key is received.

15. A computer program product storing a data object received from a network in an encrypted file system that requires encryption of the data object with an encryption key, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code executable by a computer system to:

receive an first data object from the network, the first data object being encrypted with a first encryption key;

determine whether the first data object is to be stored in the encrypted file system;

encrypt the first encryption key with a second encryption key when it is determined the first data object is to be stored in the encrypted file system;

attach the first encryption key to the first data object; and

store the first data object in the encrypted file system.

16. The computer program product of claim 15, wherein the program code executable by a processor is further configured to:

receive a command to use the first data object;

decrypt the first encryption key with the second encryption key; and

decrypt the first data object with the first encryption key.

17. The computer program product of claim 15, wherein the program code executable by a processor is further configured to:

receive a second data object that is unencrypted;

determine whether the second data object is to be stored in the encrypted file system;

encrypt the second data object with a third encryption key, when it is determined the second data object is to be stored in the encrypted file system;

encrypt the third encryption key with the second encryption key;

attach the third encryption key to the second data object; and

store the second data object in the encrypted file system.

18. The computer program product of claim 15, wherein the program code executable by a processor is further configured to:

if the first encryption key is encrypted, decrypt the first encryption key with a fourth encryption key when the first encryption key is received.

19. The computer program product of claim 15, wherein the second encryption key is a public key of a public/private key pair belonging to an authorized user of the encrypted data object.

20. The computer program product of claim 15, wherein the first encryption key is a symmetric session key and the third encryption key is a symmetric file key.