Operator provisioning of a trustworthy workspace to a subscriber

• US 8,875,234 B2
• Filed: 03/12/2013
• Issued: 10/28/2014
• Est. Priority Date: 02/13/2012
• Status: Expired due to Fees

• Current Assignee: AlephCloud Systems, Inc.
• Original Assignee: Pivotcloud Incorporated
• Inventors: Zhu, Jieming, Salzmann, Frank, Kaushik, Bala, D'Souza, Roy Peter, Totah, Ronald, Chappell, James
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/795,164
• Publication Number:
  US 20140075518A1
• Time in Patent Office: 595 Days
• Field of Search: 726 1- 7, 726 26- 30, 713/150, 713/163, 713166-170, 713/189, 713/193
• US Class Current: 726/2
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Methods, systems and apparatuses for an operator provisioning a trustworthy workspace to a subscriber are disclosed. One method includes providing the subscriber with the trustworthy workspace, where in the trustworthy workspace comprises a virtualized content repository with trustworthy workflows for storing, sharing and processing a digital content across a plurality of repositories. The method further includes allowing the subscriber authority to sub-provision the trustworthy workspace to one or more authorized parties, wherein only the one or more authorized parties can view or modify at least a portion of the digital content.

Claims

1. A method of an operator provisioning a trustworthy workspace to a subscriber, comprising:

providing, by one or more operator servers, the subscriber with the trustworthy workspace, where in the trustworthy workspace comprises a virtualized content repository with trustworthy workflows for storing, sharing and processing a digital content across a plurality of repositories;

allowing, by the one or more operator servers, the subscriber authority to sub-provision the trustworthy workspace to one or more authorized parties, wherein only the one or more authorized parties can view or modify at least a portion of the digital content;

wherein providing the subscriber with the trustworthy workspace comprises the operator providing the subscriber with a primary workspace, wherein the subscriber has a delegated authority to create nested trustworthy workspaces, or groups, thereby allowing subsets of the one or more authorized parties to access digital content shared with each nested trustworthy workspace reside across the plurality of repositories.

2. The method of claim 1, wherein the one or more authorized parties include at least one of a publisher or a consumer of the digital content, or an administrator of the trustworthy workspace.

3. The method of claim 1, wherein the authority to provision the trustworthy workspace includes access controls and authorization, which enables the authorized parties to provide at least an electronic identification of another party which triggers an automated trustworthy workflow to invite and enroll the other party, and to facilitate the other party joining the trustworthy workspace.

4. The method of claim 1, wherein the authority to provision the trustworthy workspace to the one or more authorized parties includes allowing the one or more authorized parties to at least one of create, enable access, delete, change, monitor, the electronic content in the trustworthy workspace.

5. The method of claim 1, further comprising facilitating the subscriber in vetting one or more other parties before allowing the one or more other parties to access the trustworthy workspace, based on information of the one or more other parties, wherein the one or more other parties become authorized parties if vetted more than a threshold.

6. The method of claim 5, wherein the information of the one or more other parties comprises at least identities of the one or more other parties.

7. The method of claim 6, wherein the information further includes at least one of reputations, associations of the one or more other parties.

8. The method of claim 5, further comprising allowing other subscribers to leverage vetting of at least some of the one or more other parties based on prior vetting by the subscriber.

9. The method of claim 5, wherein a level of vetting influences a level of trustworthiness associated with each of the one or more other parties, and wherein the vetting further comprises accessing information from a plurality of sources including social networking and reference sources.

10. The method of claim 1, wherein the trustworthy workspace includes one or more policies, wherein the one or more policies comprises actions to be taken for publishing and consuming digital content to and from the trustworthy workspace.

11. The method of claim 10, wherein the actions include at least one of data classification, encryption, signing, rights management, routing, quarantine, log, archive, replication, disposition, or redaction of the digital content.

12. The method of claim 1, wherein the trustworthy workspace comprises management of a plurality of different repositories and the trustworthy workspace is presented to the operator as a single unified management interface while utilizing the plurality of different repositories.

13. The method of claim 1, wherein the trustworthy workspace comprises management of a plurality of different repositories and the trustworthy workspace is presented to the subscriber as a single unified workspace while utilizing the plurality of different repositories.

14. The method of claim 1, wherein trustworthy workflows comprises providing trustworthy workflow across trust boundaries between a first party A and a second party B, comprising:

one or more curators generating a first public key (PK_C1) and a second public key (PK_C2), wherein the one or more curators generating and maintaining a first secret key (SK_C1) and a second secret key (SK_C2);

the one or more curators publishing the first public key (PK_C1) and the second public key (PK_C2);

the one or more curators generating a first proxy re-encryption key (RK_C1-C2) and a second proxy re-encryption key (RK_C2-B);

the first party A encrypting data having a key k, wherein k is encrypted according to the first public key (PK_C1);

one or more custodians proxy re-encrypting k from the first public key (PK_C1) to the second public key (PK_C2) using the first proxy re-encryption key (RK_C1-C2), wherein the proxy re-encryption is one-way;

the one or more custodians proxy re-encrypting k from the second public key (PK_C2) to a public key (PK_B) of the second party B using the second proxy re-encryption key (RK_C2-B), wherein the proxy re-encryption is one-way; and

the second party B receiving the data and decrypting the data with the key k, decrypted from a secret key SK_B.

15. The method of claim 1, wherein trustworthy workflows method of monitoring and controlling access to an electronic content, comprising:

creating, by an owner server, a group comprising generating a group public key PK_G and a group secret key SK_G;

adding, by the owner server, a member to the group, comprising generating a first share SK_G1 from the group secret key SK_G and a public key of a member, and a second share SK_G2 from the group secret key SK_G and a public key of a mediator; and

providing, by the owner server, the first share SK_G1 to a member server of the member and the second shares SK_G2 to a mediator server of the mediator.

16. The method of claim 1, further comprising:

a user publishing an electronic content for the group, comprising the user encrypting the electronic content to the group public key PK_G, wherein the electronic content includes a header and a payload;

obtaining, by the member, the encrypted electronic content;

requesting, by the member, mediation by the mediator, comprising the member dispatching the header of the encrypted electronic content to the mediator;

determining, by the mediator, whether the member is eligible to decrypt the electronic content, if eligible, the mediator responding to the request for mediation with a member accessible header, wherein the member accessible header includes the header after application of SK_G2;

obtaining, by the member, a secret based on SK_G1 and the member accessible header;

decrypting, by the member, the payload of the electronic content using the secret.

17. A system for provisioning a trustworthy workspace to a subscriber, comprising:

one or more operator servers operative to;

provide the subscriber with the trustworthy workspace, where in the trustworthy workspace comprises a virtualized content repository with trustworthy workflows for storing, sharing and processing a digital content across a plurality of repositories; and

allow the subscriber authority to sub-provision the trustworthy workspace to one or more authorized parties, wherein only the one or more authorized parties can view or modify at least a portion of the digital content;

wherein providing the subscriber with the trustworthy workspace comprises the operator server operative to;

provide the subscriber with a primary workspace, wherein the subscriber has a delegated authority to create nested trustworthy workspaces, or groups, thereby allowing subsets of the one or more authorized parties to access digital content shared with each nested trustworthy workspace reside across the plurality of repositories.

18. The system of claim 17, wherein the operator server is further operative to:

facilitate the subscriber in vetting one or more other parties before allowing the one or more other parties to access the trustworthy workspace, based on information of the one or more other parties, wherein the one or more other parties become authorized parties if vetted more than a threshold.

19. The system of claim 18, wherein the operator server is further operative to allow other subscribers to leverage vetting of at least some of the one or more other parties based on prior vetting by the subscriber.

20. The system of claim 18, wherein a level of vetting influences a level of trustworthiness associated with each of the one or more other parties, and wherein the vetting further comprises accessing information from a plurality of sources including social networking and reference sources.

21. The system of claim 17, wherein the trustworthy workspace comprises management of a plurality of different repositories and the trustworthy workspace is presented to the operator as a single unified management interface while utilizing the plurality of different repositories.

22. The system of claim 17, wherein the trustworthy workspace comprises management of a plurality of different repositories and the trustworthy workspace is presented to the subscriber as a single unified workspace while utilizing the plurality of different repositories.