Extending encrypting web service

• US 8,825,999 B2
• Filed: 09/26/2008
• Issued: 09/02/2014
• Est. Priority Date: 10/20/2007
• Status: Active Grant

• Current Assignee: Blackout, Inc.
• Original Assignee: Blackout, Inc.
• Inventors: Mohamed, Ahmed
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US12/239,214
• Publication Number:
  US 20090106550A1
• Time in Patent Office: 2,167 Days
• Field of Search: 713150-159, 713168-174, 709/203, 709/229, 709217-219, 709/225, 726 22- 23
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A data encryption service is provided over the Internet. Users specifying only authorized users'"'"' identity information can share encrypted information without sharing passwords or accessing public key certificates. A user sends data to be encrypted to a trusted EWS, along with authorization information. An encrypted data envelope including signed encrypted data blocks, authorization information, and a digital signature is returned to the user. When a second user attempts to access the data inside the encrypted data envelope, it is transmitted to the EWS. If the EWS authenticates the second user, determines that tampering has not occurred, and verifies the second user'"'"'s identity against the authorization information in the data envelope, then the data are returned. The encrypted data envelope can be expressed as a raw byte stream or encoded within an HTML file to enable browser-based data envelope submission and retrieval.

Claims

1. A computer-implemented method for protecting information exchanged between entities, comprising:

as implemented by one or more computing devices configured with specific executable instructions,

receiving, by a trusted service via a secure transmission from a first entity over a communication link;

information that is to be protected; and

authorization information that can be used to determine who is authorized to access the information;

encrypting, by the trusted service, both the information that is to be protected and the authorization information, within an encrypted data envelope;

securely transmitting, by the trusted service, the encrypted data envelope to the first entity over a communication link, so that the first entity can subsequently convey the encrypted data envelope to one or more other entities authorized to access the information being protected;

receiving, by the trusted service, the encrypted data envelope securely transmitted by a second entity over a communication link;

decrypting, by the trusted service, the encrypted data envelope in order to access the authorization information;

using the authorization information, by the trusted service, for determining if the second entity is authorized to access the information in the encrypted data envelope;

if the second entity is authorized to access the information in the encrypted data envelope, then;

decrypting, by the trusted service, the encrypted data envelope to access the information; and

securely transmitting, by the trusted service, the information to the second entity over a communication link; and

if the second entity is not authorized to access the information in the encrypted data envelope, then returning, by the trusted service, an access denied status to the second entity.

2. The computer-implemented method of claim 1, wherein the authorization information comprises at least one item selected from the group of items consisting of:

an access control list that indicates one or more entities authorized to access the information; and

a network address indicating a location of an access control list that indicates one or more entities authorized to access the information.

3. The computer-implemented method of claim 2, further comprising receiving, by the trusted service, the access control list from an authorization service at the location indicated by the network address, the access control list indicating the one or more entities authorized to access the information.

4. The computer-implemented of claim 1, wherein the trusted service comprises an encrypting web service (EWS), and wherein the information to be protected and the authorization is received from the first entity over a public network, using a secure communication link.

5. The computer-implemented method of claim 1, wherein the information to be protected comprises a file encryption key (FEK).

6. The computer-implemented method of claim 5, wherein the information returned from the trusted service to the second entity comprises the FEK, so that the second entity can use the FEK to decrypt the encrypted file to access the data included therein.

7. The computer-implemented method of claim 1, wherein at least one of the first entity and the second entity comprises a software program executing on a computing device.

8. The computer-implemented method of claim 1, further comprising digitally signing, by the trusted service, the information that is to be protected and the authorization information to produce a digital signature, before producing the encrypted data envelope that is returned to the first entity, the digital signature being included in the encrypted data envelope.

9. The computer-implemented method of claim 8, further comprising, in response to receiving the encrypted data envelope from the second entity:

extracting, by the trusted service, the digital signature included in the encrypted data envelope after decrypting the encrypted data envelope;

digitally signing, by the trusted service, the authorization information and information to be protected that were in the encrypted data envelope that has been decrypted to produce a test signature;

comparing, by the trusted service, the test signature with the signature that was extracted; and

returning, by the trusted service, an access denied status to the second entity if the test signature does not match the signature extracted, to indicate that the second entity is not authorized to access the information in the encrypted data envelope, and continue with processing the request for decrypting the encrypted data envelope, if the test signature matches the signature extracted.

10. The computer-implemented method of claim 1, Further comprising establishing, by the trusted service, communications with an authentication service to confirm an identity of the second entity before enabling the second entity to access the information in the encrypted data envelope.

11. The computer-implemented method of claim 10, further comprising:

receiving, by the trusted service, a current user token from the second entity;

attempting, by the trusted service, to map the current user token to a user identity maintained by the authentication service; and

returning, by the trusted service, an access denied status if the current user token cannot be mapped to a user identity maintained by the authentication service, to indicate that the second entity is not authorized to access the information in the encrypted data envelope, and otherwise, returning the information to the second entity.

12. The computer-implemented method of claim 1, wherein a first computing device of the one or more computing devices generates the encrypted data envelope, and wherein a second computing device of the one or more computing devices decrypts the encrypted data envelope.

13. A system for protecting information exchanged between entities, comprising:

a first computing device associated with a first entity, the first computing device comprising a network interface for communicating over a network, a memory in which machine executable instructions are stored, and a processor connected to the network interface and the memory, the processor executing the machine executable instructions stored in the memory to carry out a plurality of functions, including;

enabling the first entity that is using the first computing device to securely transmit an encrypt request to a trusted service over the network, the encrypt request comprising information that is to be protected, as well as authorization information that can be used to determine who is authorized to access the information; and

receiving an encrypted data envelope from the trusted service via a secure transmission over the network, the encrypted data envelope including the information that is to be protected and the authorization information; and

a second computing device associated with the trusted service, the second computing device comprising a second network interface for communicating over the network, a second memory in which machine executable instructions are stored, and a second processor connected to the second network interface and the second memory, the second processor executing the machine executable instructions stored in the second memory to carry out a plurality of functions, including;

receiving the encrypt request from the first entity

encrypting the information that is to be protected and the authorization information, to produce the encrypted data envelope;

securely transmitting the encrypted data envelope to the first entity over the network, so that the first entity can subsequently convey the encrypted data envelope to one or more other entities authorized to access the information being protected; and

in response to a decrypt request securely transmitted over the network from a second entity, the decrypt request including the encrypted data envelope;

decrypting the encrypted data envelope in order to access the authorization information;

using the authorization information to determine if the second entity is authorized to access the information in the encrypted data envelope;

if the second entity is authorized to access the information in the encrypted data envelope, then;

decrypting the encrypted data envelope to access the information; and

securely transmitting the information to the second entity over the network; and

if the second entity is not authorized to access the information in the encrypted data envelope, then returning an access denied status to the second entity.

14. The system of claim 13, further comprising a third computing device associated with the second entity, the third computing device comprising a third network interface for communicating over the network, a third memory in which machine executable instructions are stored, and a third processor connected to the third network interface and the third memory, the third processor executing the machine executable instructions stored in the third memory to carry out a plurality of functions, including:

enabling the second entity who has the encrypted data envelope to securely transmit the decrypt request to the trusted service over the network; and

receiving the information that was protected in the encrypted data envelope from the trusted service by a secure transmission over the network, if the trusted service has determined that the second entity is authorized to receive the information.

15. The system of claim 14, wherein the machine executable instructions executed by the third processor cause it to transmit a current user token for the second entity to the trusted service with the decrypt request, and wherein the machine instructions executed by the second processor cause it to attempt to map the current user token to a user identity maintained by an authentication service to:

return an access denied status to the second entity if the current user token cannot be mapped to a user identity maintained by the authentication service, to indicate that the second entity is not authorized to access the information in the encrypted data envelope; and

otherwise,

return the information requested to the second entity.

16. The system of claim 13, wherein the authorization information comprises at least one item selected from the group of items consisting of:

an access control list that indicates one or more entities authorized to access the information; and

a network address indicating a location on the network of an access control list that indicates one or more entities authorized to access the information.

17. The system of claim 16, wherein the machine instructions stored in the second memory that are executed by the second processor further cause it to employ an authorization service at the location indicated by the network address, to provide the access control list that indicates the one or more entities authorized to access the information.

18. The system of claim 13, wherein the machine instructions stored in the memory of the first computing device used by the first entity further enable the first entity to employ a file encryption key (FEK) to encrypt data, producing encrypted data that will be conveyed to the one or more other entities, the information to be protected comprising the FEK.

19. The system of claim 18, wherein the encrypted data envelope is included in a logical file structure of an encrypted file that includes the encrypted data, for conveyance to the one or more other entities.

20. The system of claim 19, wherein the information returned by the trusted service to the second entity comprises the FEK, and wherein the FEK can be used to decrypt the encrypted file, to access the data included therein.

21. The system of claim 13, wherein at least one of the first entity and the second entity comprises a software program executing on a corresponding at least one of the first computing device and the third computing device.

22. The system of claim 13, wherein the machine instructions stored in the second memory of the second computing device further cause the second processor to digitally sign the information that is to be protected and the authorization information to produce a digital signature, before producing the encrypted data envelope that is returned to the first entity, the digital signature being included in the encrypted data envelope.

23. The system of claim 22, wherein after receiving the decrypt request from the second entity, the machine instructions stored in the second memory of the second computing device further cause the second processor to:

extract the digital signature included in the encrypted data envelope after decrypting the encrypted data envelope;

digitally sign the authorization information and information to be protected that were in the encrypted data envelope that has been decrypted to produce a test signature;

compare the test signature with the signature that was extracted; and

return an access denied status to the second entity if the test signature does not match the signature extracted, to indicate that the second entity is not authorized to access the information in the encrypted data envelope, and continue with processing the decrypt request, if the test signature matches the signature extracted.

24. The system of claim 13, wherein the machine executable instructions executing on the second processor of the second computing device cause the second processor to communicate with an authentication service to confirm an identity of the second entity before enabling the second entity to access the information in the encrypted data envelope.

25. The system of claim 13, wherein the machine instructions stored in the second memory that are executed by the second processor further cause it to decrypt an encrypted data envelope generated by a third computing device.