Saving and Retrieving Data Based on Symmetric Key Encryption

• US 20070088946A1
• Filed: 11/08/2006
• Published: 04/19/2007
• Est. Priority Date: 04/17/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: England, Paul, Peinado, Marcus
• Granted Patent: US 7,424,612 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

In accordance with certain aspects, data is received from a calling program. Ciphertext that includes the data is generated, using a symmetric cipher, in a manner that allows only one or more target programs to be able to obtain the data from the ciphertext. In accordance with other aspects, a bit string is received from a calling program. An identifier of the calling program is checked to determine whether the calling program is allowed to access data encrypted in ciphertext of the bit string. The integrity of the data is also verified, and the data is decrypted using a symmetric key. The data is returned to the calling program only if the calling program is allowed to access the data and if the integrity of the data is successfully verified.

Claims

1. One or more computer readable media having stored thereon a plurality of instructions that, when executed by one or more processors of a computing device, causes the one or more processors to:

invoke an unseal operation in order to have a bit string decrypted, passing the bit string as an input to the unseal operation; and

receive, in response to invoking the unseal operation, at least a portion of the decrypted bit string only if the plurality of instructions are allowed to unseal the bit string, wherein the data is decrypted using a symmetric cipher.

2. One or more computer readable media as recited in claim 1, wherein the plurality of instructions are allowed to unseal the bit string if a digest generated by applying a cryptographic hash function to the plurality of instructions is the same as one or more digests identified by a calling program when data encrypted in the bit string was previously sealed.

3. One or more computer readable media as recited in claim 1, wherein the input to the unseal operation is a pointer to the bit string.

4. One or more computer readable media having stored thereon a plurality of instructions that, when executed by one or more processors of a computing device, causes the one or more processors to:

invoke an unseal operation in order to obtain data from a sealed bit string; and

receive, in response to invoking the unseal operation, the data from the sealed bit string only if one or more conditions that are to be satisfied in order for the data to be unsealed are satisfied.

5. One or more computer readable media as recited in claim 4, wherein the one or more conditions comprise one or more identifiers of programs that are allowed to unseal the data.

6. One or more computer readable media as recited in claim 4, wherein one of the one or more conditions comprises a time constraint for when the data can be unsealed.

7. One or more computer readable media as recited in claim 4, wherein one of the one or more conditions comprises a logical formula to be evaluated, and wherein the data can be unsealed only if the logical formula evaluates true.

8. One or more computer readable media as recited in claim 4, wherein one of the one or more conditions comprises a program to be executed, and wherein the data can be unsealed only if execution of the program returns an indication of true.