Cryptographically controlling access to documents

• US 20080184039A1
• Filed: 01/26/2007
• Published: 07/31/2008
• Est. Priority Date: 01/26/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Reid, Colin Wilson
• Granted Patent: US 8,266,706 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Aspects of the subject matter described herein relate to cryptographically controlling access to documents. In aspects, documents are encrypted to protect them from unauthorized access. A security principal seeking to access a document first obtains the document. The document includes an identifier that identifies security data associated with the document. The security data includes an encrypted portion that includes authorizations for security principals that have access to the document. A security principal having the appropriate key can decrypt its authorization in the security data to obtain one or more other keys that may be used to access the document. These other keys correspond to access rights that the security principal has with respect to the document.

Claims

1. A computer-readable medium having computer-executable instructions, which when executed perform actions, comprising:

obtaining a document that includes encrypted data, the document including an identifier that identifies security data associated with the document, at least some of the security data being encrypted;

decrypting at least a portion of the security data to obtain an indication of an action that is authorized with respect to the document;

obtaining, from the security data, a key associated with the action;

using the key to perform the action.

2. The computer-readable medium of claim 1, wherein obtaining a document that includes encrypted data comprises a first device requesting the document from a data store located external to the device.

3. The computer-readable medium of claim 2, wherein obtaining the document that includes encrypted data further comprises transmitting the document through at least an intermediary device.

4. The computer-readable medium of claim 1, further comprising sending a request for the security data and providing the identifier with the request.

5. The computer-readable medium of claim 1, wherein the action comprises decrypting the encrypted data included in the document.

6. The computer-readable medium of claim 1, wherein the action comprises changing what entities are allowed to access the document.

7. The computer-readable medium of claim 1, wherein the action comprises indicating that a document was modified at an indicated time.

8. The computer-readable medium of claim 1, wherein the action comprises creating a new version of the document.

9. The computer-readable medium of claim 1, wherein the security data is included in the document.

10. The computer-readable medium of claim 1, wherein the security data is not included in the document.

11. A method implemented at least in part by a computer, the method comprising:

receiving a request for document that includes encrypted data, the document including an identifier that identifies security data associated with the document, at least some of the security data being encrypted, the at least some of the security data that is encrypted indicating an action that is authorized with respect to accessing the document; and

in response to the request, sending the document.

12. The method of claim 11, wherein the request was sent from a first device and wherein sending the document comprises sending the document to a second device in route to the first device.

13. The method of claim 12, further comprising, forwarding the request to a device that stores the document and receiving the document from the device before sending the document.

14. the method of claim 11, wherein the request is received by a device that has access to a storage device upon which the document is stored and further comprising retrieving the document from the storage device.

15. The method of claim 11, wherein the action that is authorized with respect to accessing the document comprises decrypting the encrypted data included in the document.

16. The method of claim 11, wherein the action that is authorized with respect to accessing the document comprises creating a new version of the document.

17. In a computing environment, an apparatus, comprising:

a requesting component operable to request access to a document that includes an identifier that identifies security data associated with the document, at least some of the security data being encrypted, the security data indicating an action that is authorized with respect to the document;

a document locator operable to determine a location of the document; and

a cryptographic component operable to perform the action on the document.

18. The apparatus of claim 17, further comprising a security data component operable to obtain the security data.

19. The apparatus of claim 17, wherein the location of the document comprises a data store external to a device upon which the requesting component operates.

20. The apparatus of claim 17, wherein the action comprises decrypting an encrypted portion of the document.