COMPUTERIZED METHOD AND SYSTEM FOR MANAGING SECURE CONTENT SHARING IN A NETWORKED SECURE COLLABORATIVE EXCHANGE ENVIRONMENT WITH CUSTOMER MANAGED KEYS

• US 20160285838A1
• Filed: 06/10/2016
• Published: 09/29/2016
• Est. Priority Date: 04/27/2012
• Status: Active Grant

• Current Assignee: IntraLinks Incorporated (SS&C Technologies Holdings Incorporated)
• Original Assignee: IntraLinks Incorporated (SS&C Technologies Holdings Incorporated)
• Inventors: Ford, Christopher Todd, Callison, Wade, Siddiqui, Fahim, Hakhinian, Mushegh
• Granted Patent: US 9,654,450 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06

Abstract

In embodiments of the present invention, improved capabilities are described for securely sharing computer data content between business entities as managed through an intermediate business entity, where the secure sharing process utilizes encryption provided by the intermediate business entity but where the encryption keys used in the encryption are at least in part managed through one of the business entities as customer managed keys.

Claims

1. A method for managing a networked secure collaborative computer data exchange environment, the method comprising:

establishing, by a secure exchange server managed by an intermediate business entity, a user login data authentication procedure that allows a user through at least one client computing device to access the secure exchange server, wherein the user is one of a plurality of users of a plurality of other business entities and communications between the secure exchange server and the plurality of users are through a communications network;

storing, by the secure exchange server, at least one user login authentication data for at least one of the plurality of users;

receiving at the exchange server a computer data content from a first of the plurality of users, wherein the first of the plurality of users permits a sharing access to the computer data content to at least a second of the plurality of users, and wherein management for access to the computer data content is through an exchange content access facility managed by the intermediate business entity, wherein at least one of the plurality of other business entities manages its own encryption keys for use in encrypting computer data content; and

granting, by the secure exchange server, sharing access to the computer data content to the at least second of the plurality of users when the secure exchange server receives a client login authentication data from the second of the plurality of users.

2. The method of claim 1, wherein the plurality of other business entities manages their own encryption keys for use in encrypting the computer data content.

3. The method of claim 1, wherein the exchange content access facility managed by the intermediate business entity interfaces with a key management facility of at least one of the other business entities by which the other business entity manages its own encryption keys for encrypting and decrypting the computer data content to facilitate the sharing access.

4. A method for managing a networked secure collaborative computer data exchange environment, the method comprising:

establishing, by a secure exchange server managed by an intermediate business entity, a user login data authentication procedure that allows a user through at least one client computing device to access the secure exchange server, wherein the user is one of a plurality of users of a plurality of other business entities and communications between the secure exchange server and the plurality of users are through a communications network, wherein at least one of the plurality of other business entities manages its own encryption keys in association with the user login data authentication procedure;

storing, by the secure exchange server, at least one user login authentication data for at least one of the plurality of users;

receiving at the exchange server a computer data content from a first of the plurality of users, wherein the first of the plurality of users permits a sharing access to the computer data content to at least a second of the plurality of users, and wherein management for access to the computer data content is through an exchange content access facility managed by the intermediate business entity; and

granting, by the secure exchange server, sharing access to the computer data content to the at least second of the plurality of users when the secure exchange server receives from the second of the plurality of users its client login authentication data.

5. The method of claim 4, wherein the plurality of other business entities manages their own encryption keys in association with the user login data authentication procedure.

6. The method of claim 4, wherein the exchange content access facility managed by the intermediate business entity interfaces with a key management facility of at least one of the other business entities by which the other business entity manages its own encryption keys in association with the user login data authentication procedure.

7. A method for managing a networked secure collaborative computer data exchange environment, the method comprising:

providing a user login data authentication procedure that allows a user through at least one client computing device to access a secure exchange server, wherein the user is one of a plurality of users;

storing in a storage device at least one user login authentication data for at least one of the plurality of users;

receiving data content from a first user of the plurality of users, wherein the first user permits a sharing access to the data content to a subset of the plurality of users, and wherein management for access to the data content is through an exchange content access facility managed by an intermediate business entity;

granting sharing access to the data content to at least a second user of the plurality of users when the second user client login authentication data is one of the subset of data for the plurality of users to which sharing access is permitted;

receiving a copy access request from the second user to access a copy of the data content;

granting, in response to the copy access request, copy access to the second user;

receiving from the first user a request to revoke sharing and copy access to the data content to the second user; and

revoking sharing access to the data content and copy access to the copy of the data content by the second user, wherein revoking copy access to the copy of the data content is a change in the digital rights management of the data content, and wherein access to the data content is revocable at any time at the request of the first user.

8. The method of claim 7, further comprising additional sharing of the data content with others of the plurality of users, wherein the revoking of sharing access and copy access revokes access to all instances of the shared data content and all copies of the data content made by any of the others of the plurality of users.

9. The method of claim 7, wherein the copy of the data content is deleted from the client computing device.

10. The method of claim 7, wherein revoking sharing access to the copy of the data content makes the copy of the data content inaccessible to the second user.