System for automatic decryption of file data on a per-use basis and automatic re-encryption within context of multi-threaded operating system under which applications run in real-time

• US 5,699,428 A
• Filed: 01/16/1996
• Issued: 12/16/1997
• Est. Priority Date: 01/16/1996
• Status: Expired due to Term

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Grawrock, David, McDonnal, William D., Lohstroh, Shawn
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US08/586,511
• Time in Patent Office: 700 Days
• Field of Search: 380/4, 380/25, 380/49
• US Class Current: 713/165
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A machine system for automatic decryption of confidential file data on a per-use basis and automatic later elimination of the decrypted data by scorching and/or re-encrypting is disclosed. The system can operate within a multi-threaded environment. The following features are provided for secure and automatic recryption: (1) use of file-exclusion lists; (2) use of application-program exclusion lists; (3) decrypting as needed in response to intercepted file-OPEN requests; (4) encrypting as needed in response to intercepted file-CLOSE requests; (5) delaying post-CLOSE encryption in special cases; (6) delaying retry of failed encryption; (7) keeping track of the number of application programs that are using each piece of decrypted plaintext; (8) identifying non-confidential files according to the directories they are contained within; (9) including encryption and decryption rules within directories that contain confidential files; and (10) avoiding unnecessary encryption of non-modified plaintext.

Claims

1. A machine system for maintaining confidential information generally in encrypted form while allowing for decryption of such confidential information into temporary plaintext form, said machine system comprising:

(a) a memory for storing a plurality of digital data files where said plurality of files includes a first file containing first data representing a pre-encrypted form of confidential first information and where said plurality of files further includes a second file containing second data representing a plaintext form of nonconfidential second information;

(b) a decrypting mechanism for decrypting ciphertext data into plaintext data;

(c) recryption control means for selecting one of the files stored in said memory and for causing the decrypting mechanism to decrypt data contained in the selected file and for automatically later eliminating the decrypted data,

(c.1) wherein said recryption control means is responsive to a supplied exclusion list, the exclusion list identifies one or more files in said memory as excluded files that are not to be selected by the recryption control means for decryption, and the recryption control means accordingly does not select the excluded files for decryption by the decrypting mechanism.

2. A machine system according to claim 1 further comprising:

(d) an encrypting mechanism for encrypting plaintext data into ciphertext data;

(c.2) wherein recryption control means eliminates the decrypted data at least by scorching the decrypted data or by causing the encrypting mechanism to encrypt data contained in the selected file.

3. A machine system according to claim 2 wherein:

(c.3) wherein recryption control means saves a ciphertext copy of the selected file prior to causing the decrypting mechanism to decrypt data contained in the selected file;

(c.4) if at the time the recryption control means automatically eliminates the decrypted data, the decrypted data had not been modified, the recryption control means scorches the decrypted data and does not cause encryption of the decrypted data prior to said scorching; and

(c.5) if at the time the recryption control means automatically eliminates the decrypted data, the decrypted data had been modified, the recryption control means scorches the decrypted data, but prior to so scorching the decrypted data, the recryption control means causes the encrypting mechanism to make an encrypted copy of the to-be scoched modified data.

4. In an automated machine for executing one or more application programs, where the application programs access file data of a plurality of stored files by causing interceptable file-OPEN requests and file-CLOSE requests to be sent to an operating system of said machine, and where data within a subset of the plurality of stored files is encrypted;

an automatic decryption control mechanism comprising;

(a) OPEN intercept means for intercepting said interceptable file-0PEN requests;

(b) selective OPEN continuance means, responsive to the intercept means, for determining whether an intercepted file-OPEN request is requesting an open of a file containing data that is at least sometimes encrypted, and for determining whether the request-invoking application program expects to use a plaintext version of the requested file'"'"'s data, and if not, for allowing the intercepted file-OPEN request to continue on its way to the operating system;

(c) plaintext tracking means, responsive to the selective continuance means, for determining whether a plaintext version of the sometimes encrypted data of the requested file already exists, and if so, for allowing the intercepted file-OPEN request to continue on its way to the operating system such that the plaintext version will be accessed; and

(d) a decrypting mechanism, responsive to the plaintext tracking means such that on a determination that a plaintext version of the sometimes encrypted data of the requested file does not already exist, the decrypting mechanism decrypts ciphertext data within the requested file into plaintext data.

5. In an automated machine for executing one or more application programs, where the application programs access file data of a plurality of stored files by causing interceptable file-0PEN requests and interceptable file-CLOSE requests to be sent to an operating system of said machine, and where data within a subset of the plurality of stored files is encrypted;

an automatic plaintext eliminating mechanism comprising;

(a) CLOSE intercept means for intercepting said interceptable file-CLOSE requests;

(b) selective CLOSE continuance means, responsive to the intercept means, for determining whether an intercepted file-CLOSE request is requesting a close of a file containing data that is at least sometimes to be kept encrypted, and if not, for allowing the intercepted file-CLOSE request to continue on its way to the operating system;

(c) plaintext tracking means, responsive to the selective continuance means, for determining whether a plaintext version of the sometimes encrypted data of the requested file exists and is still in use, and if so, for allowing the intercepted file-CLOSE request to continue on its way to the operating system such that the still in-use plaintext version can continue to be accessed by requestors thereof; and

(d) a scorching mechanism, responsive to the plaintext tracking means such that on a determination that a plaintext version of the sometimes encrypted data of the requested file is no longer in use, the scorching mechanism effectively eliminates the corresponding plaintext data.

6. In an automated machine for executing one or more application programs, where the application programs access file data of a plurality of stored files, where a start of execution of each such application program is signalled by an interceptable program-LAUNCH request sent to an operating system of said machine, where a completion of execution of each such application program is signalled by an interceptable program-TERMINATE message sent to the operating system, and where data within a subset of the plurality of stored files is to be kept encrypted but a plaintext version of such data is used by executing application programs;

an automatic, On-termination plaintext eliminating mechanism comprising;

(a) TERMINATE intercept means for intercepting said interceptable program-TERMINATE messages;

(b) selective TERMINATE continuance means, responsive to the intercept means, for determining whether an intercepted program-TERMINATE message is being signalled for an application program that does not use plaintext data derived from one or more files containing data that is at least sometimes to be kept encrypted, and if so, for allowing the intercepted program-TERMINATE message to continue on its way to the operating system;

(c) plaintext tracking means, responsive to the selective continuance means, for determining whether a plaintext version of the sometimes encrypted data that had been in use by the terminating application program is still in use, and if so, for allowing the intercepted program-TERMINATE message to continue on its way to the operating system such that the still in-use plaintext version can continue to be accessed by other requestors thereof; and

(d) a scorching mechanism, responsive to the plaintext tracking means such that on a determination that a plaintext version of the sometimes encrypted data of the requested file is no longer in use by any other application program, the scorching mechanism effectively eliminates the corresponding plaintext data.

7. In an automated machine for executing one or more application programs, where the application programs access file data of a plurality of stored files, where a start of execution of each such application program is signalled by an interceptable program-LAUNCH request sent to an operating system of said machine, where a completion of execution of each such application program is signalled by an interceptable program-TERMINATE message sent to the operating system, and where data within a subset of the plurality of stored files is to be kept encrypted but a plaintext version of such data is used by executing application programs;

an automatic, On-launch plaintext providing mechanism comprising;

(a) LAUNCH intercept means for intercepting said interceptable program-LAUNCH requests;

(b) selective LAUNCH continuance means, responsive to the intercept means, for determining whether an intercepted program-Launch request is being signalled for an application program that does not use plaintext data derived from one or more files containing data that is at least sometimes to be kept encrypted, and if so, for allowing the intercepted program-Launch request to continue on its way to the operating system; and

(c) plaintext tracking means, responsive to the selective continuance means, for determining whether a plaintext version of the sometimes encrypted data is in use by other instances of the now launching application program, and if so, for recording the new launch and thereafter allowing the intercepted program-Launch request to continue on its way to the operating system.

8. A machine-implemented method for carrying out in an automated machine that executes one or more application programs, where the application programs access file data of a plurality of stored files by causing interceptable file-OPEN requests and file-CLOSE requests to be sent to an operating system of said machine, and where data within a subset of the plurality of stored files is to be kept encrypted most of the time;

said method comprising one or more of the following steps;

(a) using file-exclusion lists to block on-the-fly recryption of identified files that do not need to be decrypted and thereafter optionally re-encrypted;

(b) using application-program exclusion lists to block from on-the-fly recryption those files that are accessed by identified application programs that do not need use decrypted plaintext of such files;

(c) decrypting the ciphertext of unblocked files on an as needed basis in response to intercepted file-OPEN requests, said decrypting not being needed where a plaintext version thereof is already available for use;

(d) encrypting the plaintext of unblocked files on an as needed basis in response to intercepted file-CLOSE requests, said encrypting not being needed where a plaintext version thereof has not been modified and a decrypted version of the same data is already available;

(e) delaying post-CLOSE encryption in special cases where the same or other application programs will request an opening for the same plaintext data;

(f) delaying retry of a failed scorch and/or re-encryption;

(g) keeping track of the number of launched instances of each application program that is using each piece of decrypted plaintext;

(h) identifying non-confidential files according to the directories they are contained within;

(i) including encryption and decryption rules within directories that contain confidential files; and

(j) avoiding unnecessary encryption of non-modified plaintext.

9. A machine-usable memory storing a file-usage tracking data structure comprising:

(a) a plurality of User-Application records for tracking each instance of each file-using application program that uses plaintext data derived from a file whose data is to be generally kept in encrypted format, each User-Application record having a means for identifying the confidential files that have been opened by action of one or more instances of the corresponding application program;

(b) a plurality of File-Use records each for identifying a confidential file whose plaintext data is in use or to be used by a file-using application program; and

(c) a plurality of File-Tag records each for defining a logical link between one of said User-Application records and a corresponding File-Use record.

10. A machine-usable memory according to claim 9 wherein each File-Use record includes:

(b.1) a file identifying field for identifying a corresponding confidential file;

(b.2) a File-Use Count field for keeping track of the number of application programs that are still using plaintext derived from said confidential file.