Generating and securing multiple archive keys

• US 8,694,798 B2
• Filed: 05/22/2008
• Issued: 04/08/2014
• Est. Priority Date: 05/22/2008
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Schneider, James Paul
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): TURCHEN, JAMES R
• Application Number:
  US12/125,826
• Publication Number:
  US 20090290707A1
• Time in Patent Office: 2,147 Days
• Field of Search: 380/44, 713/193
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation

Abstract

A method and apparatus for generating multiple keys for a set of archives or portions of a set of archives. The process includes receiving a passphrase from a user and an indicator of a set of archives to be modified or created. An archive key generation process can be based on a random value generation, an algorithm for generating keys with specific characteristics, an indexing scheme, a progressive enciphering scheme or a shared secret scheme. The generated keys are enciphered using an enciphering algorithm in combination with the passphrase. The archive keys are stored with the archives in their enciphered form. Other intermediate key information is also stored with the archive to enable deciphering of the set of archives using the passphrase as needed.

Claims

1. A computer-implemented method comprising:

receiving a passphrase;

generating a cipher key that is a value having a specified form;

enciphering the passphrase using the cipher key to generate an enciphered passphrase to be used as a new cipher key;

enciphering the new cipher key using a previous cipher key used to generate the new cipher key in an iterative process until a number of generated new cipher keys is equal to a number of a plurality of archive keys, wherein each new cipher key is generated in view of a unique previous cipher key;

enciphering each of the plurality of archive keys using a respective cipher key from the generated new cipher keys;

enciphering, by a computer system processing device, each of a plurality of data portions using a respective archive key of the plurality of archive keys; and

storing each of the enciphered plurality of data portions with the respective cipher key and a respective enciphered archive key.

2. The computer-implemented method of claim 1, wherein the plurality of values have a form of prime numbers or primitive polynomials.

3. The computer-implemented method of claim 1, further comprising:

generating the plurality of archive keys using a pseudo-random number generator to have a specific format.

4. The computer-implemented method of claim 1, further comprising:

storing each of the generated new cipher keys to be subsequently utilized in the enciphering the plurality of archive keys.

5. A computer-implemented method comprising:

receiving a passphrase;

generating a plurality of secret shares;

enciphering the passphrase to generate an enciphered passphrase;

enciphering an archive key using the enciphered passphrase;

generating a plurality of secrets by combining the archive key and at least one of the plurality of secret shares, wherein the combination of the archive key and at least one of the plurality of secret shares is based on a binary indexing scheme; and

enciphering, by a computer system processing device, a respective portion of data using a respective one of the plurality of secrets.

6. The computer-implemented method of claim 5, further comprising:

enciphering a plurality of portions of data each with a separate secret from the plurality of secrets.

7. A non-transitory computer readable storage medium, having a set of instructions stored therein, which when executed cause a processing device to perform a set of operations comprising:

receiving a passphrase;

generating a cipher key that is a value having a specified form;

enciphering the passphrase using the cipher key to generate an enciphered passphrase to be used as a new cipher key;

enciphering the new cipher key using a previous cipher key used to generate the new cipher key in an iterative process until a number of generated new cipher keys is equal to a number of a plurality of archive keys, wherein each new cipher key is generated in view of a unique previous cipher key;

enciphering each of the plurality of archive keys using a respective cipher key from the generated new cipher keys;

enciphering, by a computer system processing device, each of a plurality of data portions using a respective archive key of the plurality of archive keys; and

storing each of the enciphered plurality of data portions with the respective cipher key and a respective enciphered archive key.

8. The non-transitory computer readable storage medium of claim 7, wherein the plurality of values have a form of prime numbers or primitive polynomials.

9. The non-transitory computer readable storage medium of claim 7, wherein the set of operations comprises:

generating the plurality of archive keys using a pseudo-random number generator to have a specific format.

10. A non-transitory computer readable storage medium, having a set of instructions stored therein, which when executed cause a processing device to perform a set of operations comprising:

receiving a passphrase;

generating a plurality of secret shares;

enciphering the passphrase to generate an enciphered passphrase;

enciphering an archive key using the enciphered passphrase;

generating a plurality of secrets by combining the archive key and at least one of the plurality of secret shares, wherein the combination of the archive key and at least one of the plurality of secret shares is based on a binary indexing scheme; and

enciphering, by a computer system processing device, a respective portion of data using a respective one of the plurality of secrets.

11. The non-transitory computer readable storage medium of claim 10, wherein the set of operations comprises:

enciphering a plurality of portions of data each with a separate secret from the plurality of secrets.

12. A system comprising:

a memory comprising instructions; and

a processing device coupled to the memory, the processing device to execute the instructions to perform operations comprising;

receiving a passphrase;

generating a cipher key that is a value having a specified form;

enciphering the passphrase using the cipher key to generate an enciphered passphrase to be used as a new cipher key;

enciphering the new cipher key using a previous cipher key in an iterative process until a number of generated new cipher keys is equal to a number of a plurality of archive keys;

wherein each new cipher key is generated in view of a unique previous cipher key;

enciphering each of the plurality of archive keys using a respective cipher key from the generated cipher keys;

enciphering, by the processing device, each of a plurality of data portions using a respective archive key of the plurality of archive keys; and

storing each of the enciphered plurality of data portions with the respective cipher key and a respective enciphered archive key.