Identity-based encryption system for secure data distribution

• US 8,024,769 B2
• Filed: 12/09/2005
• Issued: 09/20/2011
• Est. Priority Date: 02/05/2003
• Status: Expired due to Fees

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Voltage Security Incorporated (HP Inc.)
• Inventors: Kacker, Rishi R., Appenzeller, Guido, Pauker, Matthew J., Spies, Terence
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US11/298,954
• Publication Number:
  US 20060123238A1
• Time in Patent Office: 2,111 Days
• Field of Search: 713/185, 726/1, 726/27, 726/28, 380/30, 380/44, 380/277, 380/280, 380/286
• US Class Current: 726/1
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/68 Special signature format, e.g. XML format
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

A system is provided that allows encrypted content to be distributed to users over a communications network. A policy enforcement service may use an identity-based encryption algorithm to generate public parameter information and private keys. Data content may be encrypted prior to distribution using an identity-based encryption engine. The encryption engine may use the public parameter information from the policy service and public key information to encrypt the data. The public key information may be based on policy information that specifies which types of users are allowed to access the data that is encrypted using that public key. A user may obtain a private key for unlocking particular encrypted data by providing a key request to the policy enforcement service that contains the public key. The policy enforcement service may enforce the policies given by the policy information and may provide private keys only to authorized users.

Claims

1. A method for distributing data structures to users over a communications network, the method comprising:

at a data packaging service, receiving a plurality of data structures having different associated data types and associated attributes;

at the data packaging service, using information on which data type is associated with each data structure to select some of the attributes associated with that data structure;

at the data packaging service, using the selected attributes for each data structure in forming a policy-based public key for that data structure;

at the data packaging service, using an identity-based encryption engine to encrypt each data structure based on identity-based-encryption public parameter information and the public key for that data structure; and

at the data packaging service, distributing each encrypted data structure to a plurality of users over the communications network, wherein each data structure has associated data type encryption policy information and wherein using information on which data type is associated with each data structure to select the attributes comprises using the data type encryption policy information to select the attributes.

2. The method defined in claim 1, further comprising:

transmitting an access request from a given one of the users to a policy enforcement service to access a desired one of the data structures, wherein the access request directs the policy enforcement service to provide a private key corresponding to the public key that was used to encrypt that data structure.

3. The method defined in claim 1, further comprising:

using video playback software to transmit an access request from a given one of the users to a policy enforcement service to access a desired one of the data structures, wherein the access request directs the policy enforcement service to provide a private key corresponding to the public key that was used to encrypt that data structure.

4. The method defined in claim 1 further comprising storing the data structures at the data packaging service using an XML format.

5. The method defined in claim 1 wherein the data structure comprises a movie having a rating, the method further comprising using the rating in generating the public key.

6. The method defined in claim 1 wherein the data structure comprises a song having an artist, the method further comprising using the artist in generating the public key.

7. The method defined in claim 1 wherein the data structure comprises a song having a genre and a rating, the method further comprising using the genre and rating in generating the public key.

8. A method for distributing data structures to users over a communications network, the method comprising:

at a data packaging service, receiving a plurality of data structures having different associated data types and associated attributes;

at the data packaging service, using information on which data type is associated with each data structure to select some of the attributes associated with that data structure;

at the data packaging service, using the selected attributes for each data structure in forming a policy-based public key for that data structure;

at the data packaging service, using an identity-based encryption engine to encrypt each data structure based on identity-based-encryption public parameter information and the public key for that data structure; and

at the data packaging service, distributing each encrypted data structure to a plurality of users over the communications network, wherein each data structure contains associated data type encryption policy information and wherein using information on which data type is associated with each data structure to select the attributes comprises using the data type encryption policy information to select the attributes.

9. The method defined in claim 8, further comprising:

transmitting an access request from a given one of the users to a policy enforcement service to access a desired one of the data structures, wherein the access request directs the policy enforcement service to provide a private key corresponding to the public key that was used to encrypt that data structure.

10. The method defined in claim 8, further comprising:

using video playback software to transmit an access request from a given one of the users to a policy enforcement service to access a desired one of the data structures, wherein the access request directs the policy enforcement service to provide a private key corresponding to the public key that was used to encrypt that data structure.

11. The method defined in claim 8 further comprising storing the data structures at the data packaging service using an XML format.

12. The method defined in claim 8 wherein the data structure comprises a movie having a rating, the method further comprising using the rating in generating the public key.

13. The method defined in claim 8 wherein the data structure comprises a song having an artist, the method further comprising using the artist in generating the public key.

14. The method defined in claim 8 wherein the data structure comprises a song having a genre and a rating, the method further comprising using the genre and rating in generating the public key.