Selective data encryption using style sheet processing for decryption by a client proxy

• US 6,978,367 B1
• Filed: 10/21/1999
• Issued: 12/20/2005
• Est. Priority Date: 10/21/1999
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hind, John R., Topol, Brad B., Peters, Marcia L.
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US09/422,492
• Time in Patent Office: 2,252 Days
• Field of Search: 713/189, 713/176, 713200-201, 713/179, 713/155, 713/165, 713/170, 713/156, 713/162, 713/167, 713/169, 713/171, 713/182, 713/150, 713/161, 713/166, 713/175, 380/275, 380/28, 380/282, 380/277, 380/239, 380/286, 380/44, 380/273, 705/51, 705/72, 705/71, 705/76, 705/52, 705/75, 705/78
• US Class Current: 713/167
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method, system, and computer program product for selectively encrypting one or more elements of a document using style sheet processing. Disclosed is a policy-driven augmented style sheet processor (e.g. an Extensible Stylesheet Language, or “XSL”, processor) that creates a selectively-encrypted document (e.g. an Extensible Markup Language, or “XML”, document) carrying key-distribution material, such that by using an augmented document processor (e.g. an augmented XML processing engine), an agent can recover only the information elements for which it is authorized. The Document Type Definition (DTD) or schema associated with a document is modified, such that the DTD or schema specifies a reference to stored security policy to be applied to document elements. Each document element may specify a different security policy, such that the different elements of a single document can be encrypted differently (and, some elements may remain unencrypted). The key distribution material enables a document to be encrypted for decryption by an audience that is unknown at the time of document creation, and enables access to the distinct elements of a single encrypted document to be controlled for multiple users and/or groups of users. In this manner, group collaboration is improved by giving more people easier access to information for which they are authorized, while protecting sensitive data from unauthorized agents. A key recovery technique is also defined, whereby the entire document can be decrypted by an authorized agent regardless of how the different elements were originally encrypted and the access protections which were applied to those elements.

Claims

1. A computer program product embodied on computer readable media readable by a computing system in a computing environment, for enforcing security policy using style sheet processing, comprising:

computer-readable program code that is configured to obtain an input document;

computer-readable program code that is configured to obtain a Document Type Definition (DTD) that defines elements of said input document, wherein;

(1) an attribute of at least one element defined in said DTD references one of a plurality of stored policy enforcement objects;

(2) more than one of said references may reference a single stored policy enforcement object; and

(3) each of said stored policy enforcement objects specifies a visibility policy for said referencing element or elements, said visibility policy identifying an encryption requirement for all elements having that visibility policy and a community whose members are authorized to view those elements;

computer-readable program code that is configured to apply one or more style sheets to said input document, thereby adding markup notation to each element of said input document for which said element definition in said DTD references one of said stored policy enforcement objects specifying a visibility policy with a non-null encryption requirement, resulting in creation of an interim transient document that indicates elements of said input document which are to be encrypted; and

computer-readable program code that is configured to create an output document in which each element of said interim transient document for which markup notation has been added is encrypted in a manner that enables a client proxy associated with a group that is a community member authorized to view that element to use key distribution material associated with the output document when decrypting the encrypted element.

2. The computer program product according to claim 1, further comprising computer-readable program code that is configured to render said output document on a client device.

3. The computer program product according to claim 1, wherein said markup notation in said interim transient document comprises tags of a markup language.

4. The computer program product according to claim 1, wherein said input document is specified in an Extensible Markup Language (XML) notation.

5. The computer program product according to claim 4, wherein said output document is specified in said XML notation.

6. The computer program product according to claim 1, wherein said stored policy enforcement objects further comprise computer-readable program code that is configured to override a method for evaluating said elements of said input document, and wherein said computer-readable program code that is configured to apply said one or more style sheets further comprises computer-readable program code that is configured to invoke said computer-readable program code that is configured to override, thereby causing said markup notation to be added.

7. The computer program product according to claim 6, wherein said style sheets are specified in an Extensible Stylesheet Language (XSL) notation.

8. The computer program product according to claim 7, wherein said method is a value-of method of said XSL notation, and wherein said computer-readable program code that is configured to override said value-of method is by subclassing said value-of method.

9. The computer program product according to claim 6, wherein:

said overriding method comprises;

computer-readable program code that is configured to generate said markup notation as encryption tags; and

computer-readable program code that is configured to insert said generated encryption tags into said interim transient document to surround elements of said interim transient document for which said visibility policy of said elements in said input document have said non-null encryption requirement; and

said computer-readable program code that is configured to create said output document further comprises computer-readable program code that is configured to encrypt those elements surrounded by said inserted encryption tags.

10. The computer program product according to claim 1, wherein said encryption requirement further comprises specification of an encryption algorithm to be used when encrypting elements having that visibility policy.

11. The computer program product according to claim 1, wherein said encryption requirement further comprises specification of an encryption algorithm strength value to be used when encrypting elements having that visibility policy.

12. The computer program product according to claim 1, wherein said computer-readable program code that is configured to create said output document further comprises:

computer-readable program code that is configured to generate a distinct symmetric key for each unique one of said communities identified by said visibility policy in said stored policy objects for each of said elements of said input document; and

computer-readable program code that is configured to encrypt each of said distinct symmetric keys to create member-specific versions thereof, further comprising;

computer-readable program code that is configured to determine whether each of said members of said community for which said distinct symmetric key was generated is an individual or a group; and

computer-readable program code that is configured to encrypt a separate version of said distinct symmetric key for each determined individual and for a clerk process associated with each determined group.

13. The computer program product according to claim 12, wherein said computer-readable program code that is configured to encrypt a separate version of said distinct symmetric key creates one of said member-specific versions using, as input, a public key of one of said determined individuals or a public key of said clerk process.

14. The computer program product according to claim 1, wherein said encrypted elements in said created output document are encrypted using a cipher block chaining mode encryption process.

15. The computer program product according to claim 12, further comprising:

computer-readable program code that is configured to create a key class for each of said unique communities, wherein said key class is associated with each of said encrypted elements of said output document for which members of this unique community are authorized viewers, and wherein said key class comprises;

(1) an encryption algorithm identifier and key length used when encrypting said associated encrypted elements;

(2) an identifier of each of said members of said unique community; and

(3) one of said member-specific versions of said encrypted symmetric key for each of said identified community members.

16. The computer program product according to claim 12, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

computer-readable program code that is configured to establish a first mutually-authenticated secure session between a client device used by said individual user or process and said client proxy; and

computer-readable program code that is configured to decrypt, for said individual user or process upon determining that said individual user or process is a member of one or more of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

computer-readable program code that is configured to expand said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

computer-readable program code that is configured to identify zero or more of said expanded groups of which said individual user or process is one of said group members;

computer-readable program code that is configured to decrypt, by said clerk process for each of said identified groups upon request by said client proxy, said member-specific version of said symmetric key, thereby creating a decrypted key for each of said identified groups; and

computer-readable program code that is configured to decrypt selected ones of said encrypted elements in said output document, by said client proxy using said decrypted keys, wherein said selected ones of said encrypted elements are those which were encrypted for one of said identified groups.

17. The computer program product according to claim 16, wherein:

said computer-readable program code that is configured to encrypt a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process;

said computer-readable program code that is configured to decrypt said member-specific version of said symmetric key further comprises;

computer-readable that is configured to locate a clerk process for said identified group;

computer-readable program code that is configured to establish a second session between said client proxy and said clerk process;

computer-readable program code that is configured to digitally sign said member-specific version, a certificate of said client proxy, and an identifier of said individual user or process by said client proxy, thereby creating a first digital signature;

computer-readable program code that is configured to send said first digital signature, said member-specific version, said certificate, and said identifier from said client proxy to said clerk process on said second session;

computer-readable program code that is configured to receive said sent first digital signature, said member-specific version, said certificate of said proxy, and said identifier by said clerk process;

computer-readable program code that is configured to verify said first digital signature by said clerk process;

computer-readable program code that is configured to verify, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

computer-readable program code that is configured to decrypt said member-specific version using a private key of said clerk process, wherein said private key is associated with said public key of said clerk process;

computer-readable program code that is configured to re-encrypt said decrypted member-specific version using a public key of said client proxy, thereby creating a re-encrypted key;

computer-readable program code that is configured to digitally sign said re-encrypted key by said clerk process, thereby creating a second digital signature;

computer-readable program code that is configured to return said second digital signature and said re-encrypted key from said clerk process to said client proxy on said second session;

computer-readable program code that is configured to receive said second digital signature and said re-encrypted key by said client proxy;

computer-readable program code that is configured to verify said second digital signature by said client proxy; and

computer-readable program code that is configured to decrypt, in said client proxy, said received re-encrypted key using a private key of said client proxy, creating said decrypted key; and

said computer-readable program code that is configured to decrypt selected ones of said encrypted elements in said output document is executed by said client proxy using said decrypted key.

18. The computer program product according to claim 12, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

computer-readable program code that is configured to establish a first mutually-authenticated secure session between device used by said individual user or process and said client proxy; and

computer-readable program code that is configured to decrypt, for said individual user or process upon determining that said individual user or process is a member of one of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

computer-readable program code that is configured to expand said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

computer-readable program code that is configured to identify zero or more of said expanded groups of which said individual user or process is one of said group members; and

computer-readable program code that is configured to decrypt selected ones of said encrypted elements in said output document, by said client proxy, wherein said selected ones of said encrypted elements are those which were encrypted for one of said identified groups.

19. The computer program product according to claim 18, wherein:

said computer-readable program code that is configured to encrypt a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process; and

said computer-readable program code that is configured to decrypt selected ones of said encrypted elements in said output document further comprises;

computer-readable program code that is configured to locate a clerk process for said identified group;

computer-readable program code that is configured to establish a second mutually-authenticated secure session between said client proxy and said clerk process;

computer-readable program code that is configured to locate said member-specific version of said symmetric key which was encrypted using said public key of said clerk process, wherein said clerk process is associated with a group of which said individual user or process is a group member;

computer-readable program code that is configured to send said located member-specific version from said client proxy to said clerk process, along with a certificate of said client proxy, an identifier of said individual user or process, and an element encrypted with said member-specific version, on said second secure session;

computer-readable program code that is configured to receive said sent member-specific version, said certificate of said proxy, said identifier, and said element by said clerk process;

computer-readable program code that is configured to verify, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

computer-readable program code that is configured to decrypt said member-specific version using a private key of said clerk process;

computer-readable program code that is configured to decrypt said element using said decrypted member-specific version; and

computer-readable program code that is configured to return said decrypted element from said clerk process to said client proxy on said second secure session.

20. The computer program product according to claim 15, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

computer-readable program code that is configured to establish a first mutually-authenticated secure session between a client device used by said individual user or process and said client proxy device; and

computer-readable program code that is configured to decrypt, for said individual user or process upon determining that said individual user or process is a member of one or more of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

computer-readable program code that is configured to expand said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

computer-readable program code that is configured to identify zero or more of said key classes which identify said individual user or process as one of said group members;

computer-readable program code that is configured to decrypt, by said clerk process for each of said determined key classes, said member-specific version of said symmetric key in said key class which was encrypted using said public key of said clerk process, wherein said computer-readable program code that is configured to decrypt uses a private key of said clerk process, thereby creating a decrypted key; and

computer-readable program code that is configured to decrypt selected ones of said encrypted elements in said output document, by said client proxy using said decrypted keys, wherein said selected ones of said encrypted elements are those which were encrypted for said key class.

21. The computer program product according to claim 16, wherein:

said computer-readable program code that is configured to encrypt a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process;

said computer-readable program code that is configured to decrypt said member-specific version of said symmetric key further comprises;

computer-readable program code that is configured to locate a clerk process for said identified group; and

computer-readable program code that is configured to establish a second mutually-authenticated secure session between said client proxy and said clerk process;

computer-readable program code that is configured to send said member-specific version from said client proxy to said clerk process, along with a certificate of said client proxy and an identifier of said user or process, on said second secure session;

computer-readable program code that is configured to receive said sent member-specific version, said certificate of said proxy, and said identifier by said clerk process;

computer-readable program code that is configured to verify, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

computer-readable program code that is configured to decrypt said member-specific version using a private key of said clerk process;

computer-readable program code that is configured to return said decrypted member-specific version from said clerk process to said client proxy on said second secure session; and

computer-readable program code that is configured to receive said decrypted member-specific version by said client proxy; and

said computer-readable program code that is configured to decrypt selected ones of said encrypted elements in said output document is executed by said client proxy using said received decrypted member-specific version.

22. The computer program product according to claim 16, claim 20, or claim 21, further comprising computer-readable program code that is configured to substitute a predetermined text message for any encrypted elements in said output document which cannot be decrypted for said individual user or process.

23. The computer program product according to claim 18, wherein:

said computer-readable program code that is configured to encrypt a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process; and

said computer-readable program code that is configured to decrypt selected ones of said encrypted elements in said output document further comprises;

computer-readable program code that is configured to locate a clerk process for said identified group;

computer-readable program code that is configured to establish a second session between said client proxy and said clerk process;

computer-readable program code that is configured to locate said member-specific version of said symmetric key which was encrypted using said public key of said clerk process, wherein said clerk process is associated with a group of which said individual user or process is a group member;

computer-readable program code that is configured to digitally sign said located member-specific version, a certificate of said client proxy, an identifier of said individual user or process, and an element encrypted with said member-specific version, thereby creating a first digital signature;

computer-readable program code that is configured to send said first digital signature, said located member-specific version, said certificate, said identifier, and said element from said client proxy to said clerk process on said second session;

computer-readable program code that is configured to receive said sent first digital signature, said member-specific version, said certificate, said identifier, and said element by said clerk process;

computer-readable program code that is configured to verify said first digital signature by said clerk process;

computer-readable program code that is configured to verify, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

computer-readable program code that is configured to decrypt said member-specific version using a private key of said clerk process;

computer-readable program code that is configured to decrypt said element using said decrypted member-specific version;

computer-readable program code that is configured to re-encrypt said decrypted element using a public key of said client proxy, thereby creating a re-encrypted element;

computer-readable program code that is configured to digitally sign said re-encrypted element by said clerk process, thereby creating a second digital signature;

computer-readable program code that is configured to return said second digital signature and said re-encrypted element from said clerk process to said client proxy on said second session;

computer-readable program code that is configured to receive said second digital signature and said re-encrypted element by said client proxy; and

computer-readable program code that is configured to verify said second digital signature by said client proxy.

24. The computer program product according to claim 1, wherein said DTD is replaced by a schema.

25. The computer program product according to claim 1, wherein said encryption requirement further comprises specification of an encryption key length.

26. The computer program product according to claim 9, wherein said inserted encryption tags may surround either values of said elements or values and tags of said elements.

27. A system for enforcing security policy using style sheet processing in a computing environment, comprising:

means for obtaining an input document;

means for obtaining a Document Type Definition (DTD) that defines elements of said input document, wherein;

(1) an attribute of at least one element defined in said DTD references one of a plurality of stored policy enforcement objects;

(2) more than one of said references may reference a single stored policy enforcement object; and

(3) each of said stored policy enforcement objects specifies a visibility policy for said referencing element or elements, said visibility policy identifying an encryption requirement for all elements having that visibility policy and a community whose members are authorized to view those elements;

means for applying one or more style sheets to said input document, thereby adding markup notation to each element of said input document for which said element definition in said DTD references one of said stored policy enforcement objects specifying a visibility policy with a non-null encryption requirement, resulting in creation of an interim transient document that indicates elements of said input document which are to be encrypted; and

means for creating an output document in which each element of said interim transient document for which markup notation has been added is encrypted in a manner that enables a client proxy acting on behalf of an individual user or process to decrypt the encrypted element using key distribution material associated with the output document when the individual user or process is one of the community members authorized to view that element.

28. The system according to claim 27, further comprising means for rendering said output document on a client device.

29. The system according to claim 27, wherein said markup notation in said interim transient document comprises tags of a markup language.

30. The system according to claim 27, wherein said input document is specified in an Extensible Markup Language (XML) notation.

31. The system according to claim 30, wherein said output document is specified in said XML notation.

32. The system according to claim 27, wherein said stored policy enforcement objects further comprise means for overriding a method for evaluating said elements of said input document, and wherein said means for applying one or more style sheets further comprises means for invoking said means for overriding, thereby causing said markup notation to be added.

33. The system according to claim 32, wherein said style sheets are specified in an Extensible Stylesheet Language (XSL) notation.

34. The system according to claim 33, wherein said method is a value-of method of said XSL notation, and wherein said means for overriding said value-of method is by subclassing said value-of method.

35. The system according to claim 32, wherein:

said overriding method comprises;

means for generating said markup notation as encryption tags; and

means for inserting said generated encryption tags into said interim transient document to surround elements of said interim transient document for which said visibility policy of said elements in said input document have said non-null encryption requirement; and

said means for creating said output document further comprises means for encrypting those elements surrounded by said inserted encryption tags.

36. The system according to claim 27, wherein said encryption requirement further comprises specification of an encryption algorithm to be used when encrypting elements having that visibility policy.

37. The system according to claim 27, wherein said encryption requirement further comprises specification of an encryption algorithm strength value to be used when encrypting elements having that visibility policy.

38. The system according to claim 27, wherein said means for creating said output document further comprises:

means for generating a distinct symmetric key for each unique one of said communities identified by said visibility policy in said stored policy objects for each of said elements of said input document; and

means for encrypting each of said distinct symmetric keys to create member-specific versions thereof, further comprising;

means for determining whether each of said members of said community for which said distinct symmetric key was generated is an individual or a group; and

means for encrypting a separate version of said distinct symmetric key for each determined individual and for a clerk process associated with each determined group.

39. The system according to claim 38, wherein said means for encrypting a separate version of said distinct symmetric key creates one of said member-specific versions using, as input, a public key of one of said determined individuals or a public key of said clerk process.

40. The system according to claim 27, wherein said encrypted elements in said created output document are encrypted using a cipher block chaining mode encryption process.

41. The system according to claim 38, further comprising:

means for creating a key class for each of said unique communities, wherein said key class is associated with each of said encrypted elements of said output document for which members of this unique community are authorized viewers, and wherein said key class comprises;

(1) an encryption algorithm identifier and key length used when encrypting said associated encrypted elements;

(2) an identifier of each member of said unique community; and

(3) one of said member-specific versions of said encrypted symmetric key for each of said identified community members.

42. The system according to claim 38, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

means for establishing a first mutually-authenticated secure session between a client device used by said individual user or process and said client proxy; and

means for decrypting, for said individual user or process upon determining that said individual user or process is a member of one or more of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

means for expanding said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

means for identifying zero or more of said expanded groups of which said individual user or process is one of said group members;

means for decrypting, by said clerk process for each of said identified groups upon request by said client proxy, said member-specific version of said symmetric key, thereby creating a decrypted key for each of said identified groups; and

means for decrypting selected ones of said encrypted elements in said output document, by said client proxy using said decrypted keys, wherein said selected ones of said encrypted elements are those which were encrypted for one of said identified groups.

43. The system according to claim 42, wherein:

said means for encrypting a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process;

said means for decrypting said member-specific version of said symmetric key further comprises;

means for programmatically locating a clerk process for said identified group;

means for establishing a second session between said client proxy and said clerk process;

means for digitally signing said member-specific version, a certificate of said client proxy, and an identifier of said individual user or process by said client proxy, thereby creating a first digital signature;

means for sending said first digital signature, said member-specific version, said certificate, and said identifier from said client proxy to said clerk process on said second session;

means for receiving said sent first digital signature, said member-specific version, said certificate of said proxy, and said identifier by said clerk process;

means for verifying said first digital signature by said clerk process;

means for verifying, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

means for decrypting said member-specific version using a private key of said clerk process, wherein said private key is associated with said public key of said clerk process;

means for re-encrypting said decrypted member-specific version using a public key of said client proxy, thereby creating a re-encrypted key;

means for digitally signing said re-encrypted key by said clerk process, thereby creating a second digital signature;

means for returning said second digital signature and said re-encrypted key from said clerk process to said client proxy on said second session;

means for receiving said second digital signature and said re-encrypted key by said client proxy;

means for verifying said second digital signature by said client proxy; and

means, operable in said client proxy, for decrypting said received re-encrypted key using a private key of said client proxy, creating said decrypted key; and

said means for decrypting selected ones of said encrypted elements in said output document is executed by said client proxy using said decrypted key.

44. The system according to claim 38, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

means for establishing a first mutually-authenticated secure session between device used by said individual user or process and said client proxy; and

means for decrypting, for said individual user or process upon determining that said individual user or process is a member of one of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

means for expanding said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

means for identifying zero or more of said expanded groups of which said individual user or process is one of said group members; and

means for decrypting selected ones of said encrypted elements in said output document, by said client proxy, wherein said selected ones of said encrypted elements are those which were encrypted for one of said identified groups.

45. The system according to claim 44, wherein:

said means for encrypting a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process; and

said means for decrypting selected ones of said encrypted elements in said output document further comprises;

means for programmatically locating a clerk process for said identified group;

means for establishing a second mutually-authenticated secure session between said client proxy and said clerk process;

means for locating said member-specific version of said symmetric key which was encrypted using said public key of said clerk process, wherein said clerk process is associated with a group of which said individual user or process is a group member;

means for sending said located member-specific version from said client proxy to said clerk process, along with a certificate of said client proxy, an identifier of said individual user or process, and an element encrypted with said member-specific version, on said second secure session;

means for receiving said sent member-specific version, said certificate of said proxy, said identifier, and said element by said clerk process;

means for verifying, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

means for decrypting said member-specific version using a private key of said clerk process;

means for decrypting said element using said decrypted member-specific version; and

means for returning said decrypted element from said clerk process to said client proxy on said second secure session.

46. The system according to claim 41, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

means for establishing a first mutually-authenticated secure session between a client device used by said individual user or process and said client proxy device; and

means for decrypting, for said individual user or process upon determining that said individual user or process is a member of one or more of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

means for expanding said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

means for identifying zero or more of said key classes which identify said individual user or process as one of said group members;

means for decrypting, by said clerk process for each of said determined key classes, said member-specific version of said symmetric key in said key class which was encrypted using said public key of said clerk process, wherein said means for decrypting uses a private key of said clerk process, thereby creating a decrypted key; and

means for decrypting selected ones of said encrypted elements in said output document, by said client proxy using said decrypted keys, wherein said selected ones of said encrypted elements are those which were encrypted for said key class.

47. The system according to claim 42, wherein:

said means for encrypting a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process;

said means for decrypting said member-specific version of said symmetric key further comprises;

means for programmatically locating a clerk process for said identified group; and

means for establishing a second mutually-authenticated secure session between said client proxy and said clerk process;

means for sending said member-specific version from said client proxy to said clerk process, along with a certificate of said client proxy and an identifier of said user or process, on said second secure session;

means for receiving said sent member-specific version, said certificate of said proxy, and said identifier by said clerk process;

means for verifying, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

means for decrypting said member-specific version using a private key of said clerk process;

means for returning said decrypted member-specific version from said clerk process to said client proxy on said second secure session; and

means for receiving said decrypted member-specific version by said client proxy; and

said means for decrypting selected ones of said encrypted elements in said output document is executed by said client proxy using said received decrypted member-specific version.

48. The system according to claim 42, claim 46, or claim 47, further comprising means for substituting a predetermined text message for any encrypted elements in said output document which cannot be decrypted for said individual user or process.

49. The system according to claim 44, wherein:

said means for encrypting a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process; and

said means for decrypting selected ones of said encrypted elements in said output document further comprises;

means for programmatically locating a clerk process for said identified group;

means for establishing a second session between said client proxy and said clerk process;

means for locating said member-specific version of said r symmetric key which was encrypted using said public key of said clerk process, wherein said clerk process is associated with a group of which said individual user or process is a group member;

means for digitally signing said located member-specific version, a certificate of said client proxy, an identifier of said individual user or process, and an element encrypted with said member-specific version, thereby creating a first digital signature;

means for sending said first digital signature, said located member-specific version, said certificate, said identifier, and said element from said client proxy to said clerk process on said second session;

means for receiving said sent first digital signature, said member-specific version, said certificate, said identifier, and said element by said clerk process;

means for verifying said first digital signature by said clerk process;

means for verifying, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

means for decrypting said member-specific version using a private key of said clerk process;

means for decrypting said element using said decrypted member-specific version;

means for re-encrypting said decrypted element using a public key of said client proxy, thereby creating a re-encrypted element;

means for digitally signing said re-encrypted element by said clerk process, thereby creating a second digital signature;

means for returning said second digital signature and said re-encrypted element from said clerk process to said client proxy on said second session;

means for receiving said second digital signature and said re-encrypted element by said client proxy; and

means for verifying said second digital signature by said client proxy.

50. The system according to claim 27, wherein said DTD is replaced by a schema.

51. The system according to claim 27, wherein said encryption requirement further comprises specification of an encryption key length.

52. The system according to claim 35, wherein said inserted encryption tags may surround either values of said elements or values and tags of said elements.

53. A method for enforcing security policy using style sheet processing, comprising:

providing an input document;

providing a Document Type Definition (DTD) that defines elements of said input document, wherein;

(1) an attribute of at least one element defined in said DTD references one of a plurality of stored policy enforcement objects;

(2) more than one of said references may reference a single stored policy enforcement object; and

(3) each of said stored policy enforcement objects specifies a visibility policy for said referencing element or elements, said visibility policy identifying an encryption requirement for all elements having that visibility policy and a community whose members are authorized to view those elements;

applying one or more style sheets to said input document, thereby adding markup notation to each element of said input document for which said element definition in said DTD references one of said stored policy enforcement objects specifying a visibility policy with a non-null encryption requirement, resulting in creation of an interim transient document that indicates elements of said input document which are to be encrypted; and

creating an output document in which each element of said interim transient document for which markup notation has been added is encrypted in a manner that enables a client proxy acting on behalf of an individual user or process to decrypt the encrypted element using key distribution material associated with the output document when the individual user or process is one of the community members authorized to view that element.

54. The method according to claim 53, further comprising rendering said output document on a client device.

55. The method according to claim 53, wherein said markup notation in said interim transient document comprises tags of a markup language.

56. The method according to claim 53, wherein said input document is specified in an Extensible Markup Language (XML) notation.

57. The method according to claim 56, wherein said output document is specified in said XML notation.

58. The method according to claim 53, wherein said stored policy enforcement objects further comprise executable code for overriding a method for evaluating said elements of said input document, and wherein said of applying one or more style sheets further comprises invoking said executable code, thereby causing said markup notation to be added.

59. The method according to claim 58, wherein said style sheets are specified in an Extensible Stylesheet Language (XSL) notation.

60. The method according to claim 59, wherein said method is a value-of method of said XSL notation, and wherein said overriding said value-of method is by subclassing said value-of method.

61. The method according to claim 58, wherein:

said invoking further comprises;

generating said markup notation as encryption tags; and

inserting said generated encryption tags into said interim transient document to surround elements of said interim transient document for which said visibility policy of said elements in said input document have said non-null encryption requirement; and

said creating said output document further comprises of encrypting those elements surrounded by said inserted encryption tags.

62. The method according to claim 53, wherein said encryption requirement further comprises specification of an encryption algorithm to be used when encrypting elements having that visibility policy.

63. The method according to claim 53, wherein said encryption requirement further comprises specification of an encryption algorithm strength value to be used when encrypting elements having that visibility policy.

64. The method according to claim 53, wherein said said output document further comprises:

generating a distinct symmetric key for each unique one of said communities identified by said visibility policy in said stored policy objects for each of said elements of said input document; and

encrypting each of said distinct symmetric keys to create member-specific versions thereof, further comprising;

determining whether each of said members of said community for which said distinct symmetric key was generated is an individual or a group; and

encrypting a separate version of said distinct symmetric key for each determined individual and for a clerk process associated with each determined group.

65. The method according to claim 64, wherein said encrypting a separate version of said distinct symmetric key creates one of said member-specific versions using, as input, a public key of one of said determined individuals or a public key of said clerk process.

66. The method according to claim 53, wherein said encrypted elements in said created output document are encrypted using a cipher block chaining mode encryption process.

67. The method according to claim 64, further comprising:

creating a key class for each of said unique communities, wherein said key class is associated with each of said encrypted elements of said output document for which members of this unique community are authorized viewers, and wherein said key class comprises;

(1) an encryption algorithm identifier and key length used when encrypting said associated encrypted elements;

(2) an identifier of each member of said unique community; and

(3) one of said member-specific versions of said encrypted symmetric key for each of said identified community members.

68. The method according to claim 64, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

establishing a first mutually-authenticated secure session between a client device used by said individual user or process and said client proxy; and

decrypting, for said individual user or process upon determining that said individual user or process is a member of one or more of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

expanding said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

identifying zero or more of said expanded groups of which said individual user or process is one of said group members;

decrypting, by said clerk process for each of said identified groups upon request by said client proxy, said member-specific version of said symmetric key, thereby creating a decrypted key for each of said identified groups; and

decrypting selected ones of said encrypted elements in said output document, by said client proxy using said decrypted keys, wherein said selected ones of said encrypted elements are those which were encrypted for one of said identified groups.

69. The method according to claim 68, wherein:

said encrypting a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process;

said decrypting said member-specific version of said symmetric key further comprises;

programmatically locating a clerk process for said identified group;

establishing a second session between said client proxy and said clerk process;

digitally signing said member-specific version, a certificate of said client proxy, and an identifier of said individual user or process by said client proxy, thereby creating a first digital signature;

sending said first digital signature, said member-specific version, said certificate, and said identifier from said client proxy to said clerk process on said second session;

receiving said sent first digital signature, said member-specific version, said certificate of said proxy, and said identifier by said clerk process;

verifying said first digital signature by said clerk process;

verifying, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

decrypting said member-specific version using a private key of said clerk process, wherein said private key is associated with said public key of said clerk process;

re-encrypting said decrypted member-specific version using a public key of said client proxy, thereby creating a re-encrypted key;

digitally signing said re-encrypted key by said clerk process, thereby creating a second digital signature;

returning said second digital signature and said re-encrypted key from said clerk process to said client proxy on said second session;

receiving said second digital signature and said re-encrypted key by said client proxy;

verifying said second digital signature by said client proxy; and

decrypting, in said client proxy, said received re-encrypted key using a private key of said client proxy, creating said decrypted key; and

said decrypting selected ones of said encrypted elements in said output document is executed by said client proxy using said decrypted key.

70. The method according to claim 64, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

establishing a first mutually-authenticated secure session between device used by said individual user or process and said client proxy; and

decrypting, for said individual user or process upon determining that said individual user or process is a member of one of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

expanding said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

identifying zero or more of said expanded groups of which said individual user or process is one of said group members; and

decrypting selected ones of said encrypted elements in said output document, by said client proxy, wherein said selected ones of said encrypted elements are those which were encrypted for one of said identified groups.

71. The method according to claim 67, wherein said identification of said communities further comprises identification of at least one of:

(1) one or more individual users or processes which are community members; and

(2) one or more groups which are community members, wherein each of said groups comprises one or more individual users or processes; and

further comprising;

establishing a first mutually-authenticated secure session between a client device used by said individual user or process and said client proxy device; and

decrypting, for said individual user or process upon determining that said individual user or process is a member of one or more of said determined groups, only those encrypted elements in said output document for which any of said one or more of said determined groups is one of said authorized community members, further comprising;

expanding said determined groups to determine said individual users or processes that are group members in each of said expanded groups;

identifying zero or more of said key classes which identify said individual user or process as one of said group members;

decrypting, by said clerk process for each of said determined key classes, said member-specific version of said symmetric key in said key class which was encrypted using said public key of said clerk process, wherein said decrypting uses a private key of said clerk process, thereby creating a decrypted key; and

decrypting selected ones of said encrypted elements in said output document, by said client proxy using said decrypted keys, wherein said selected ones of said encrypted elements are those which were encrypted for said key class.

72. The method according to claim 68, wherein:

said encrypting a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process;

said decrypting said member-specific version of said symmetric key further comprises;

programmatically locating a clerk process for said identified group; and

establishing a second mutually-authenticated secure session between said client proxy and said clerk process;

sending said member-specific version from said client proxy to said clerk process, along with a certificate of said client proxy and an identifier of said user or process, on said second secure session;

receiving said sent member-specific version, said certificate of said proxy, and said identifier by said clerk process;

verifying, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

decrypting said member-specific version using a private key of said clerk process;

returning said decrypted member-specific version from said clerk process to said client proxy on said second secure session; and

receiving said decrypted member-specific version by said client proxy; and

said decrypting selected ones of said encrypted elements in said output document is executed by said client proxy using said received decrypted member-specific version.

73. The method according to claim 68, claim 71, or claim 72, further comprising substituting a predetermined text message for any encrypted elements in said output document which cannot be decrypted for said individual user or process.

74. The method according to claim 70, wherein:

said encrypting a separate version uses a public key of said clerk process as input when creating said member-specific version for said clerk process; and

said decrypting selected ones of said encrypted elements in said output document further comprises;

programmatically locating a clerk process for said identified group;

establishing a second session between said client proxy and said clerk process;

locating said member-specific version of said symmetric key which was encrypted using said public key of said clerk process, wherein said clerk process is associated with a group of which said individual user or process is a group member;

digitally signing said located member-specific version, a certificate of said client proxy, an identifier of said individual user or process, and an element encrypted with said member-specific version, thereby creating a first digital signature;

sending said first digital signature, said located member-specific version, said certificate, said identifier, and said element from said client proxy to said clerk process on said second session;

receiving said sent first digital signature, said member-specific version, said certificate, said identifier, and said element by said clerk process;

verifying said first digital signature by said clerk process;

verifying, by said clerk process, that said individual user or process and said client proxy are members of said identified group associated with said member-specific version;

decrypting said member-specific version using a private key of said clerk process;

decrypting said element using said decrypted member-specific version;

re-encrypting said decrypted element using a public key of said client proxy, thereby creating a re-encrypted element;

digitally signing said re-encrypted element by said clerk process, thereby creating a second digital signature;

returning said second digital signature and said re-encrypted element from said clerk process to said client proxy on said second session;

receiving said second digital signature and said re-encrypted element by said client proxy; and

verifying said second digital signature by said client proxy.

75. The method according to claim 53, wherein said DTD is replaced by a schema.

76. The method according to claim 53, wherein said encryption requirement further comprises specification of an encryption key length.

77. The method according to claim 61, wherein said inserted encryption tags may surround either values of said elements or values and tags of said elements.