Secure application access system

• US 9,047,480 B2
• Filed: 12/09/2013
• Issued: 06/02/2015
• Est. Priority Date: 08/01/2013
• Status: Active Grant

• Current Assignee: Bitglass, Inc. (Forcepoint LLC)
• Original Assignee: Bitglass, Inc. (Forcepoint LLC)
• Inventors: Kahol, Anurag, Bhattacharjya, Anoop Kumar, Kausik, Balas Natarajan
• Primary Examiner(s): Su, Sarah
• Application Number:
  US14/101,326
• Publication Number:
  US 20150039886A1
• Time in Patent Office: 540 Days
• Field of Search: 726/2, 726/26, 726/27, 726/28, 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A proxy server creates an index of keywords, receives at least a portion of a file, and, when a keyword in the index is encountered in the at least a portion of the file as the at least a portion of the file is being encrypted, associates in the index an encrypted record location identifier with the encountered keyword. The proxy server receives a search query and uses the keyword index to retrieve encrypted records from the server. The encrypted records are decrypted and sent as search results in response to the search query.

Claims

1. A method, comprising:

receiving, over a network, by a proxy server, a file to be encrypted;

creating, by the proxy server, an index of keywords;

encrypting, by the proxy server, the file, when a keyword in the index is encountered in the file as the file is being encrypted, associating in the index a substring of encrypted data extracted from the encrypted file in which the keyword was encountered with the encountered keyword.

2. The method as recited in claim 1, wherein the encryption step encrypts the file as encrypted data records, and wherein the substring of encrypted data is associated with an encrypted data record.

3. The method as recited in claim 1, further comprising:

inserting a unique identifier string in the encrypted file corresponding to a location where the keyword was encountered.

4. The method as recited in claim 1, further comprising:

sending the encrypted file to a second device for storage.

5. The method as recited in claim 4, wherein the second device is a server.

6. The method as recited in claim 1, wherein the index is created for a particular cloud application program.

7. The method as recited in claim 1, wherein the index is created for a particular user.

8. The method as recited in claim 1, further comprising:

receiving, by the proxy server, a search query, the search query comprising one or more keywords;

matching the one or more keywords with one or more keywords in the index;

in response to a match of a keyword in the index, issuing a search query to a second device, the search query including a substring of encrypted data associated with the matched keyword.

9. The method as recited in claim 8, further comprising:

receiving, by the proxy server, a search result set from the second device, the search result set including at least one encrypted record;

decrypting the at least one encrypted record;

including the decrypted at least one encrypted record in a second search result set;

sending the second search result set to a third device.

10. An apparatus, comprising:

a subsystem at a proxy server, implemented at least partially in hardware, that receives, over a network, a file to be encrypted;

a subsystem at the proxy server, implemented at least partially in hardware, that creates an index of keywords;

an encryption subsystem at the proxy server, implemented at least partially in hardware, that encrypts the file, when a keyword in the index is encountered in the file as the file is being encrypted, associates in the index a substring of encrypted data extracted from the encrypted file in which the keyword was encountered with the encountered keyword.

11. The apparatus as recited in claim 10, wherein the encryption subsystem encrypts the file as encrypted data records, and wherein the substring of encrypted data is associated with an encrypted data record.

12. The apparatus as recited in claim 10, further comprising:

a subsystem at the proxy server, implemented at least partially in hardware, that inserts a unique identifier string in the encrypted file corresponding to a location where the keyword was encountered.

13. The apparatus as recited in claim 10, further comprising:

a subsystem at the proxy server, implemented at least partially in hardware, that sends the encrypted file to a second device for storage.

14. The apparatus as recited in claim 13, wherein the second device is a server.

15. The apparatus as recited in claim 10, wherein the index is created for a particular cloud application program.

16. The apparatus as recited in claim 10, wherein the index is created for a particular user.

17. The apparatus as recited in claim 10, further comprising:

a subsystem at the proxy server, implemented at least partially in hardware, that receives a search query, the search query comprising one or more keywords;

a subsystem at the proxy server, implemented at least partially in hardware, that matches the one or more keywords with one or more keywords in the index;

a subsystem at the proxy server, implemented at least partially in hardware, that in response to a match of a keyword in the index, issues a search query to a second device, the search query including a substring of encrypted data associated with the matched keyword.

18. The apparatus as recited in claim 17, further comprising:

a subsystem at the proxy server, implemented at least partially in hardware, that receives a search result set from the second device, the search result set including at least one encrypted record;

a subsystem at the proxy server, implemented at least partially in hardware, that decrypts the at least one encrypted record;

a subsystem at the proxy server, implemented at least partially in hardware, that includes the decrypted at least one encrypted record in a second search result set;

a subsystem at the proxy server, implemented at least partially in hardware, that sends the second search result set to a third device.

19. A non-transitory computer readable medium, storing software instructions, which when executed by one or more processors cause performance of:

receiving, over a network, by a proxy server, a file to be encrypted;

creating, by the proxy server, an index of keywords;

encrypting, by the proxy server, the file, when a keyword in the index is encountered in the file as the file is being encrypted, associating in the index a substring of encrypted data extracted from the encrypted file in which the keyword was encountered with the encountered keyword.

20. The non-transitory computer readable medium as recited in claim 19, wherein the encryption step encrypts the file as encrypted data records, and wherein the substring of encrypted data is associated with an encrypted data record.

21. The non-transitory computer readable medium as recited in claim 19, further comprising:

inserting a unique identifier string in the encrypted file corresponding to a location where the keyword was encountered.

22. The non-transitory computer readable medium as recited in claim 19, further comprising:

sending the encrypted file to a second device for storage.

23. The non-transitory computer readable medium as recited in claim 22, wherein the second device is a server.

24. The non-transitory computer readable medium as recited in claim 19, wherein the index is created for a particular cloud application program.

25. The non-transitory computer readable medium as recited in claim 19, wherein the index is created for a particular user.

26. The non-transitory computer readable medium as recited in claim 19, further comprising:

receiving, by the proxy server, a search query, the search query comprising one or more keywords;

matching the one or more keywords with one or more keywords in the index;

in response to a match of a keyword in the index, issuing a search query to a second device, the search query including a substring of encrypted data associated with the matched keyword.

27. The non-transitory computer readable medium as recited in claim 26, further comprising:

receiving, by the proxy server, a search result set from the second device, the search result set including at least one encrypted record;

decrypting the at least one encrypted record;

including the decrypted at least one encrypted record in a second search result set;

sending the second search result set to a third device.