Encapsulation of public key cryptography standard number 7 into a secured document

• US 6,205,549 B1
• Filed: 08/28/1998
• Issued: 03/20/2001
• Est. Priority Date: 08/28/1998
• Status: Expired due to Term

• Current Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Pravetz, James D.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/143,022
• Time in Patent Office: 935 Days
• Field of Search: 713/152, 713/161, 713/168, 713/169, 713/171, 713/182, 380/277, 380/278, 380/259, 380/260, 380/283
• US Class Current: 713/182
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

A secured access to data in a portable document format (PDF) file is provided by encapsulating a Public Key Cryptography Standard number 7 (PKCS#7) object having a recipient list into data. ‘Enveloped data’ encapsulated in the PKCS#7 object contains access information that is used to access the remainder of the document into which the PKCS#7 object is encapsulated. The access information can be decrypted by all recipients in the PKCS#7 recipient list. If a recipient listed in the recipient list attempts to access data in the document, the access information is decrypted using the recipient'"'"'s private key. The access information is used to obtain an access key that is used to decrypt data in the document.

Claims

1. A method for providing secured access to data comprising:

embedding an access information into a Public Key Cryptography Standard number 7 (PKCS#7) object having a recipient list, said access information encrypted by a symmetric key, said access information being configured to provide access to data in a file, said symmetric key encrypted once for each recipient listed in said recipient list using a public key of each recipient;

encapsulating said PKCS#7 object into said file; and

decrypting said access information using said symmetric key, said symmetric key decrypted using a private key of a predetermined one of a plurality of recipients listed in said recipient list, said decrypting being controlled by a viewer application to access said access information to provide said predetermined one of a plurality of recipients access to said data in said file.

2. The method of claim 1 wherein said PKCS#7 object is an entry in an array of plurality of PKCS#7 objets associated with said data.

3. The method of claim 1 wherein said access information comprises a plain text seed data configured to provide access to said data.

4. The method of claim 1 wherein said data is a portable document format (PDF) document.

5. The method of claim 1 wherein said file comprises a PDF file.

6. The method of claim 1 wherein said viewer application comprises a PDF viewer application.

7. The method of claim 1 further comprising determining whether said recipient is in said recipient list associated with said data if said recipient attempts to access said data.

8. The method of claim 7 further comprising denying said recipient access to said data if said recipient is not listed in said recipient list associated with said data.

9. The method of claim 8 further comprising performing a message digest on said plain text seed data and bytes of all PKCS#7 objects in said array.

10. The method of claim 9 wherein said performing further comprising generating a digest value configured to provide said recipient access to said data.

11. The method of claim 10 wherein said digest value is a symmetric key.

12. An apparatus for providing secured access to data comprising:

a Public Key Cryptography Standard number 7 (PKCS#7) object having,

a recipient list listing a plurality of recipients designated to receive access to data,

an encrypted access information configured to provide each said plurality of recipients access to said data, said encrypted access information embedded in said recipient list; and

a file encapsulating said PKCS#7 object and said data.

13. The apparatus of claim 12 wherein said PKCS#7 object is an entry in an array of PKCS#7 object associated with said data.

14. The apparatus of claim 13 wherein said recipient list further comprises a symmetric key encrypted once for each said plurality of recipients using a public key of each said plurality of recipients, said symmetric key configured to provide decrypt said encrypted access information.

15. The apparatus of claim 14 wherein the decrypted form of said encrypted access information comprises a plain text seed data configured to provide access to said data.

16. The apparatus of claim 15 further comprises a digest value generated from performing a message digest on said plain text seed data and bytes of all PKCS#7 objects in said array, said digest value configured to decrypt said data to provide said recipient access to said data.

17. A system for providing secured access to data stored in a computer-readable medium and executable by a computer, comprising:

a Public Key Cryptography Standard number 7 (PKCS#7) object having,

a recipient list configured to list a plurality of recipients designated to receive access to data,

an encrypted access information configured to provide each said plurality of recipients access to said data, said encrypted access information embedded in said recipient list; and

a file encapsulating said PKCS#7 object and said data.

18. The system of claim 17 wherein said PKCS#7 object is an entry in an array of PKCS#7 object associated with said data.

19. The system of claim 18 wherein said recipient list further comprises a symmetric key encrypted once for each said plurality of recipients using a public key of each said plurality of recipients, said symmetric key configured to provide decrypt said encrypted access information.

20. The system of claim 19 wherein the decrypted form of said encrypted access information comprises a plain text seed data configured to provide access to said data.

21. The system of claim 20 further comprises a digest value generated from performing a message digest on said plain text seed data and bytes of all PKCS#7 objects in said array, said digest value configured to decrypt said data to provide said recipient access to said data.

22. A computer readable media containing executable computer program instructions which when executed on a digital processing system causes the system to perform a method comprising:

embedding an access information into a Public Key Cryptography Standard number 7 (PKCS#7) object having a recipient list, said access information encrypted by a symmetric key, said access information being configured to provide access to data in a file, said symmetric key encrypted once for each recipient listed in said recipient list using a public key of each recipient;

encapsulating said PKCS#7 object into said file; and

decrypting said access information using said symmetric key, said symmetric key decrypted using a private key of a predetermined one of a plurality of recipients listed in said recipient list, said decrypting being controlled by a viewer application to access said access information to provide said predetermined one of a plurality of recipients access to said data in said file.

23. The computer readable media of claim 22 wherein said PKCS#7 object is an entry in an array of plurality of PKCS#7 objets associated with said data.

24. The computer readable media of claim 22 wherein said access information comprises a plain text seed data configured to provide access to said data.

25. The computer readable media of claim 22 wherein said data is a portable document format (PDF) document.

26. The computer readable media of claim 22 wherein said file comprises a PDF file.

27. The computer readable media of claim 22 wherein said viewer application comprises a PDF viewer application.

28. The computer readable media of claim 22 further comprising determining whether said recipient is in said recipient list associated with said data if said recipient attempts to access said data.

29. The computer readable media of claim 28 further comprising denying said recipient access to said data if said recipient is not listed in said recipient list associated with said data.

30. The computer readable media of claim 29 further comprising performing a message digest on said plain text seed data and bytes of all PKCS#7 objects in said array.

31. The computer readable media of claim 30 wherein said performing further comprising generating a digest value configured to provide said recipient access to said data.

32. The computer readable media of claim 31 wherein said digest value is a symmetric key.

33. A method for providing secured access to a portable document format (PDF) data comprising:

embedding an access information into a data encapsulating and encrypting object having a recipient list, said access information encrypted by a symmetric key, said access information being configured to provide access to data in a PDF file, said symmetric key encrypted once for each recipient listed in said recipient list using a public key of each recipient;

encapsulating said data encapsulating and encrypting object into said PDF file; and

decrypting said access information using said symmetric key, said symmetric key decrypted using a private key of a predetermined one of a plurality of recipients listed in said recipient list, said decrypting being controlled by a viewer application to access said access information to provide said predetermined one of a plurality of recipients access to said data in said PDF file.

34. A computer readable media containing executable computer program instructions which when executed on a digital processing system causes the system to perform a method comprising:

embedding an access information into a data encapsulating and encrypting object having a recipient list, said access information encrypted by a symmetric key, said access information being configured to provide access to a portable document format data in a PDF file, said symmetric key encrypted once for each recipient listed in said recipient list using a public key of each recipient;

encapsulating said data encapsulating and encrypting object into said PDF file; and

decrypting said access information using said symmetric key, said symmetric key decrypted using a private key of a predetermined one of a plurality of recipients listed in said recipient list, said decrypting being controlled by a viewer application to access said access information to provide said predetermined one of a plurality of recipients access to said data in said PDF file.