Data storage incorporating cryptographically enhanced data protection

• US 8,856,530 B2
• Filed: 09/21/2011
• Issued: 10/07/2014
• Est. Priority Date: 09/21/2011
• Status: Active Grant

• Current Assignee: ONYX Privacy Incorporated
• Original Assignee: ONYX Privacy Incorporated
• Inventors: Patti, Joseph G., Lamberg, Michael
• Primary Examiner(s): Hailu, Teshome
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US13/238,581
• Publication Number:
  US 20130073854A1
• Time in Patent Office: 1,112 Days
• Field of Search: 713/171
• US Class Current: 713/171
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Various exemplary embodiments relate to a system for storing encrypted data and providing access to a group of users. The system may include: a record of user accounts including: a user identifier and a public encryption key; an access control list (ACL) defining an access control policy including: permissions defining access to data objects associated with the ACL and an ACL key list including copies of a an ACL key encrypted with the public keys of the users; a user-data storage medium including: encrypted user data, stored as a plurality of data objects, each object associated with an ACL and encrypted with the ACL key, and meta-data; and an access controller configured to: receive a request for a data object, and send a copy of the data object and the ACL key encrypted with the public key of the user if the user has permission to access the data object.

Claims

1. A system for storing a plurality of encrypted data objects and providing access to a group of users comprising:

a record of user accounts, wherein at least one record for a user account includes;

a user identifier, and

a public encryption key corresponding to a private encryption key, the private encryption key known to the user and unknown to the server;

at least one access control list (ACL) defining an access control policy for a group of users, wherein the ACL includes;

permissions for the group of users, wherein each user of the group has access to a plurality of data objects associated with the ACL as defined by the permissions, and

an ACL key list including, for each authorized user of the group, a copy of a symmetric ACL key corresponding to the ACL (ACL key) encrypted with the public encryption key of the user;

a user-data non-transitory machine readable storage medium including;

encrypted user data, stored as a plurality of data objects associated with the ACL, each object encrypted with the ACL key, and

cleartext meta-data that describes each data object including an identifier of the ACL associated with the data object; and

an access controller configured to;

receive, from a user, an access request from a user requesting access to a requested data object, and send, to the user, a copy of the requested encrypted data object to the user if the ACL associated with the data object indicates that the user has permission to access the data object; and

send, to a user, the copy of the ACL key encrypted with the public key of the user, wherein an authentication controller configured to;

receive data objects sent to the system by a user that have been digitally signed with the private encryption key of the user; and

authenticate the data object by applying the user public key, wherein the authentication controller is further configured to;

generate an accounting record including at least the identifier of the user and a time of receipt; and

store the accounting record as meta-data associated with the data object.

2. The system of claim 1, wherein the plurality of data objects are messages, and all messages for the group of users are associated with the same ACL.

3. The system of claim 1, wherein the user-data machine readable storage medium further includes encrypted meta-data including an encrypted namespace.

4. The system of claim 1, wherein the permissions are stored as cleartext.

5. The system of claim 1, wherein the record of user accounts includes at least one administrative account and the record of at least one other user account is linked to the administrative account, wherein the access control module requires an administrative account to have access to any ACL to which the linked user account has access.

6. A method performed by a computer server for securely storing a plurality of encrypted data objects:

receiving, from a client device associated with a first user, a request for an Access Control List (ACL) stored on the server, the ACL including;

permissions for a group of users, wherein each authorized user of the group has access to a plurality of data objects associated with the ACL as defined by the permissions, and

an ACL key list including, for each authorized user of the group, a copy of a symmetric ACL key corresponding to the ACL (ACL key) encrypted with a public encryption key of the authorized user;

transmitting ACL information including the encrypted ACL key for the first user to the client device;

receiving, from the client device, a write request including a data object encrypted with the decrypted ACL key and meta-data including at least an identifier of the ACL and an identifier of the data object;

verifying the permission of the first user to write according to the ACL by comparing an identifier of the first user with permissions of the first user in the ACL stored on the server; and

adding the data object and meta-data to the plurality of data objects associated with the ACL on the server only if the first user has permission to write according to the ACL, wherein the step of verifying comprises;

verifying the identity of the first user by decrypting a digital signature on the data object using the public key of the first user stored on the server;

generating an accounting record of the write request; and

storing the accounting record as meta-data describing the data object.

7. The method of claim 6, wherein the data object is not a file, and the meta-data describes raw disk partitions for locating the data object.

8. The method of claim 6, further comprising:

receiving, from a client device, a request to revoke access to data objects associated with an ACL, the request including a new ACL and an identifier of a requesting user;

verifying the permission of the requesting user to change the ACL by comparing the identifier of the requesting user with the permissions in the stored ACL;

storing the new ACL on the server if the requesting user has permission to change the ACL.

9. The method of claim 8, wherein the new ACL includes a new ACL key list including, for each user of the group, a copy of a new symmetric ACL key encrypted with the public encryption key of the user.

10. The method of claim 6, wherein the ACL includes a plurality of encrypted ACL keys for at least one user in the group and the meta-data for each data object further includes an identifier of the ACL key used to encrypt the data object.

11. The method of claim 6, further comprising:

receiving, from a client device, a request for a data object or meta-data describing a data object, the request including an identifier of a requesting user;

verifying the permission of the requesting user to read data objects within the ACL by comparing the identifier of the requesting user with the permissions in the stored ACL;

sending, to the client device, if the requesting user has permission, the requested data object or requested meta-data.

12. The method of claim 6, further comprising:

receiving, from a client device, a request for ACL information of an ACL;

verifying the permission of the requesting user to read data objects associated with the ACL by comparing the identifier of the requesting user with the permissions in the stored ACL;

searching stored meta-data for data objects associated with the ACL;

sending, to a client device, ACL information including a list of data objects associated with the ACL.