×

Storing encrypted objects

  • US 8,601,263 B1
  • Filed: 05/18/2011
  • Issued: 12/03/2013
  • Est. Priority Date: 05/18/2010
  • Status: Active Grant
First Claim
Patent Images

1. A method comprising:

  • storing an encrypted resource at a hosted storage service and in association with an access control list, the access control list specifying a group identifier that identifies a group of users that can access the resource and a wrapped key associated with the group identifier, the wrapped key including an encrypted resource encryption key, wherein the resource encryption key is able to decrypt the encrypted resource, wherein the wrapped key also includes the group identifier in encrypted form;

    receiving, at an application server system of the hosted storage service and from a client application executing on a client system, a request to retrieve the resource, the request including authentication credentials;

    sending, from the application server system, the wrapped key and the authentication credentials to a key server system;

    decrypting, at the key server system, the received wrapped key to generate an unwrapped key that includes the resource encryption key and the group identifier in unencrypted form;

    accessing, at the key server system, the group identifier from the unwrapped key;

    determining, at the key server system, that the received authentication credentials correspond to a user in the group of users identified by the accessed group identifier; and

    in response to determining that the received authentication credentials correspond to a user in the group of users identified by the accessed group identifier, sending, from the key server system, an unencrypted version of the resource encryption key to the application server system;

    receiving, at the application server system, the unencrypted version of the resource encryption key from the key server system;

    decrypting, at the application server system, the stored encrypted resource using the received unencrypted version of the resource encryption key to generate an unencrypted version of the resource; and

    sending, from the application server system, the unencrypted version of the resource to the client application.

View all claims
  • 2 Assignments
Timeline View
Assignment View
    ×
    ×