Method and apparatus for protecting widely distributed digital information

• US 5,999,622 A
• Filed: 11/22/1995
• Issued: 12/07/1999
• Est. Priority Date: 11/22/1995
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kurosawa, Takashi, Yasukawa, Hiroshi
• Primary Examiner(s): Hayes, Gail O.
• Assistant Examiner(s): LATHAM, BRYAN S
• Application Number:
  US08/562,260
• Time in Patent Office: 1,476 Days
• Field of Search: 380/4, 380/25, 380/23, 380/3
• US Class Current: 705/51
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress

Abstract

To facilitate protected distribution of digital data files, the files are segmented, and each segment (e.g. disk sector) is encrypted separately. Some segments can be left unencrypted, speeding access since less decryption is required. Different segments can utilize different encryption techniques, increasing protection against unauthorized decryption. A table stored in association with the encrypted data provides authorized users with data identifying the encrypted segments, and the form of encryption used. Decryption is accomplished with a layered set of operating system software that operates in conjunction with said table. Specialized APIs aren'"'"'t used; applications programs are provided with unencrypted data using conventional APIs. Internal interfaces, invisible to the APIS, intercept normal processing calls (e.g READs) and direct them to internal decryption software that returns decrypted data back to the APIs.

Claims

1. A method of file system operation in a computer comprising:

receiving a request through a computer operating system to read a unitary file of data, said unitary file comprising a plurality of non-encrypted segments interspersed with at least two encrypted segments, all stored on a single storage medium;

determining which of said file segments is encrypted;

reading the encrypted segment and decrypting same;

reading the non-encrypted segments;

assembling the non-encrypted segments with the decrypted segment to produce an original unitary file of data; and

providing the assembled unitary file of data in response to said request;

wherein at least one encrypted segment is encrypted using a first encryption procedure and a second encrypted segment is encrypted using a second encryption procedure, different than the first encryption procedure.

2. The method of claim 1 in which the determining step comprises consulting a set of map data to determine which segments are encrypted.

3. The method of claim 2 which includes reading the set of map data from a storage medium, said storage medium also including the encrypted and non-encrypted segments of the unitary file.

4. The method of claim 2 in which the set of map data comprises a bit table in which a single bit in said table indicates whether a corresponding segment of the unitary file is encrypted.

5. The method of claim 1 in which the segments of the unitary file are read from a storage medium located at the computer.

6. The method of claim 1 in which the segments of the unitary file are read from a remote storage medium linked to the computer through a telecommunications circuit.

7. A method of encrypting and storing an original, unitary file of data comprising:

dividing the unitary file into a plurality of segments;

allocating to each of said segments a corresponding portion of a single physical storage medium;

storing a first of said segments in a corresponding portion of the single physical storage medium without encryption;

encrypting a second of said segments; and

storing the encrypted segment in a corresponding portion of the single physical storage medium;

wherein at least one of the encrypted segments is encrypted with a different encryption procedure than another of the encrypted segments.

8. The method of claim 7 which further includes:

identifying a key useful in decrypting said second segment;

providing said identified key to a file system associated with an authorized computer with which said physical storage medium is associated; and

in response to a file system service request issued by a central processing unit (CPU) of the authorized computer, restoring the original unitary file of data, said restoration including automatically applying said key to said second segment, said restoration being transparent to a user of the authorized computer;

wherein the original file is protected from unauthorized use, yet is transparently available to the CPU of the authorized computer through its file system, said transparent availability being provided without the delay associated with decrypting the entirety of the file.

9. The method of claim 8 in which the unitary file is divided into a plurality of first segments and a plurality of second segments, and the first and encrypted second segments are interspersed together for storage on the physical storage medium.

10. The method of claim 9 which further includes providing the file system with map data identifying which of said interspersed segments are first segments.

11. The method of claim 10 which includes storing the map data in the physical storage medium, and providing the map data therefrom to the file system.

12. The method of claim 11 which includes storing exactly one set of map data in the physical storage medium, said stored set of map data having data therein relating to a plurality of processed files stored in the physical storage medium.

13. The method of claim 11 which includes storing a plurality of sets of map data in the physical storage medium, each of said stored sets of map data corresponding to one of the processed files stored in said physical storage medium.

14. The method of claim 8 in which the physical storage medium is a CD ROM.

15. The method of claim 8 in which the physical storage medium is a remote data repository linked to the authorized computer through a telecommunications circuit.

16. The method of claim 8 in which the physical storage medium is a remote data repository linked to the authorized computer through a network connection.

17. The method of claim 8 which includes limiting a period of time the authorized computer can use the restored original unitary file of data.

18. The method of claim 8 which includes limiting a number of times the authorized computer can use the restored original unitary file of data.

19. The method of claim 8 which includes associating the first and second segments with an object, the object further having data associated therewith that defines a plurality of attributes.

20. The method of claim 19 in which the object includes data indicating a proprietor of the original data file.

21. A physical storage medium having data processed according to the method of claim 8 stored thereon, said storage medium further having map data indicating which of said segments are encrypted and which are non-encrypted also stored thereon.

22. The physical storage medium of claim 21 comprising a CD ROM having a plurality of surface features thereon, said features encoding the first and second segments and said map data.

23. The physical storage medium of claim 22 in which the map data is stored in a table that also includes data indicating a type of encryption used for a second segment.

24. The method of claim 7 which includes:

encrypting the second of said segments according to a first encryption procedure;

encrypting a third of said segments according to a second encryption procedure different than the first, and storing the third segment in a corresponding portion of the physical storage medium.

25. The method of claim 7 which includes storing map data in said physical storage medium, said map data permitting determination of the encryption procedure used, if any, for each of the portions of the storage medium comprising the unitary file.

26. The method of claim 7 which includes storing map data in said physical storage medium, said map data permitting determination of whether a portion of the physical storage medium includes an encrypted segment of said unitary file.

27. The method of claim 7 which includes storing a plurality of non-encrypted segments of said unitary file interspersed with a plurality of encrypted segments.

28. A storage medium having data produced by the process of claim 7 stored therein.

29. A computer-readable storage medium having stored therein instructions capable of causing a computer to perform the method of claim 26.

30. A computer-readable storage medium having stored therein instructions capable of causing a computer to perform the following method:

receiving a request through a computer operating system to read a unitary file of data, said file comprising a plurality of non-encrypted segments interspersed with at least two encrypted segments on a single storage medium;

determining which of said file segments is encrypted;

reading the encrypted segment and decrypting same;

reading the non-encrypted segments;

assembling the non-encrypted segments with the decrypted segment to produce an original unitary file of data; and

providing the assembled file of data in response to said request;

wherein some of the encrypted segments are encrypted with different encryption procedures than others of the encrypted segments.

31. A computer-readable storage medium having stored therein instructions capable of causing a computer to perform the following method:

dividing a unitary file into a plurality of segments;

allocating to each of said segments a corresponding portion of a single physical storage medium;

storing a first of said segments in a corresponding portion of the single physical storage medium without encryption;

encrypting a second of said segments using a first encryption technique;

encrypting a third of said segments using a second encryption technique; and

storing the encrypted segment in a corresponding portion of the single physical storage medium.

32. A computer system including a microprocessor and a software program, the software program utilizing an application program interface to request services from a windowed operating system, the requested services relating to transparent sector-based encryption and decryption of information stored on a single storage medium in a file system of a computer operating system, wherein file data is protected from unauthorized use, yet is transparently available to a user without delay associated with decrypting, the application program interface including a separate command to request each of the following services:

identifying one or more keys useful for decrypting a unitary file written as a plurality of non-encrypted segments interspersed with at least two encrypted segments that are encrypted using different encryption techniques; and

reading a unitary file of data, said file comprising a plurality of non-encrypted segments interspersed with at least two encrypted segments using one or more decryption procedures.

33. The method of claim 32 in which the operating system performs the following operations in response to a request to read a unitary file of data, said file comprising a plurality of non-encrypted segments interspersed with at least one encrypted segment:

determining which of said file segments is encrypted;

reading the encrypted segments;

determining the encryption procedure used to encrypted the encrypted file segments;

retrieving a key useful in decrypting each of the encryption procedures;

decrypting the encrypted segments using the determined encryption procedure and the retrieved key;

reading the non-encrypted segments;

assembling the non-encrypted segments with the decrypted segments to produce an original file of data; and

providing an assembled file of non-encrypted original data in response to said read request.

34. A computer system including a microprocessor and a software program, the software program utilizing an application program interface to request services from a windowed operating system, the requested services relating to transparent sector-based encryption and decryption of information stored on a single storage medium in a file system of a computer operating system, wherein file data is protected from unauthorized use, yet is transparently available to a user without delay associated with decrypting, the application program interface including a separate command to request each of the following services:

identifying one or more encryption procedures used to encrypt a unitary file of original information; and

writing a unitary file of data, said file written as a plurality of non-encrypted segments interspersed with at least two encrypted segments using at least two encryption procedures.

35. The method of claim 34 in which the operating system performs the following operations in response to a service request to write a unitary file of data

dividing the data into a plurality of file segments;

allocating to each of said segments a corresponding portion of a physical storage medium;

storing a first of said segments in a corresponding portion of the physical storage medium without encryption;

identifying one or more encryption procedures to be used to encrypt said segments;

encrypting a second of said segments according to a first encryption procedure;

storing the second encrypted segment in a corresponding portion of the physical storage medium;

encrypting a third of said segments according to a second encryption procedure, if any, different from the first encryption procedure;

storing the third encrypted segment, if any, in a corresponding portion of the physical storage medium;

storing encryption map data in said physical storage medium permitting determination of the encryption procedure used;

storing encryption map data in said physical storage medium permitting determination of which segments are encrypted; and

storing a plurality of non-encrypted segments interspersed with a plurality of encrypted segments in a corresponding portion of the physical storage medium as a unitary file.

36. A method of file system operation in a computer comprising:

receiving a request through a computer operating system to read a unitary file of data, said unitary file comprising a plurality of non-encrypted segments interspersed with at least one encrypted segments;

determining which of said file segments is encrypted;

reading the encrypted segment and decrypting same;

reading the non-encrypted segments;

assembling the non-encrypted segments with the decrypted segment to produce an original unitary file of data; and

providing the assembled unitary file of data in response to said request;

wherein the unitary file of data cannot be used without a decryption key.

37. The method of claim 36 wherein at least one of the encrypted segments uses a different encryption procedure than at least one other encrypted segment.

38. A computer system including a microprocessor and a software program, the software program utilizing an application program interface to request services from a windowed operating system, the requested services relating to transparent sector-based encryption and decryption of information stored on a single storage medium in a file system of a computer operating system, wherein file data is protected from unauthorized use, yet is transparently available to a user without delay associated with decrypting, the application program interface including a separate command to request each of the following services:

identifying one or more keys useful for decrypting a unitary file written as a plurality of non-encrypted segments interspersed with at least one encrypted segments; and

reading a unitary file of data, said file comprising a plurality of non-encrypted segments interspersed with the at least one encrypted segments using one or more decryption procedures;

wherein the unitary file is not usable when it contains the at least one encrypted segments, without a decryption key.