Secure Peer-to-Peer Distribution of an Updatable Keyring

• US 20090060201A1
• Filed: 03/31/2008
• Published: 03/05/2009
• Est. Priority Date: 03/30/2007
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: Rhodes, Bradley J., Savitzky, Stephen R., Piersol, Kurt
• Granted Patent: US 8,885,832 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A distributed peer-to-peer document archive system provides version-control, security, access control, linking among stored documents and remote access to documents usually associated with centralized storage systems while still providing the simplicity, personalization and robustness to network outages associated with personal and peer-to-peer storage systems. A “keyring” is an encrypted repository that allows a user to recover and access a user'"'"'s entire digital archive with a single master key. After the key is created, it does not need to be updated, and can be stored in a safe, safety-deposit box or other secure location. In the event the user'"'"'s computer is stolen or destroyed, the user need only install the system on a new machine and import the master key. The system will then use that key to browse nearby servers to find and decrypt all files necessary to recreate the full digital archive in its most recent state.

Claims

1. A first computerized device for documents comprising:

a processing unit; and

data storage having stored thereon at least executable program code,

the program code configured to cause the processing unit to generate a keyring feed for storing object keys as one or more respective keyring entries by performing steps of;

generating a feed object comprising an entry key;

generating a first key based on contents of the feed object, wherein the first key comprises information to decrypt an encrypted form of the feed object;

generating a first keyring entry comprising an encrypted form of the first key, wherein the entry key is configured to decrypt the encrypted form of the first key, wherein the first keyring entry is associated with the feed object;

transmitting the encrypted form of the feed object to any computerized device that is in communication with the first computerized device; and

transmitting the first keyring entry to said any computerized device,

wherein the encrypted form of the first feed object and the first keyring entry are backed up on said any computerized device,

wherein the feed object is subsequently associated with a plurality of keyring entries, each keyring entry comprising an object key in encrypted form which can be decrypted using the entry key,

wherein each object key is used to access an object file.

2. The device of claim 1 wherein the processing unit is further configured to receive a passphrase, encrypt the first key with the passphrase to create a second encrypted form of the first key, and store the second encrypted form of the first key on the data storage.

3. The device of claim 1 wherein the passphrase is received from a user.

4. The device of claim 1 wherein the object file is an encrypted document (content blob) or an encrypted key for a second feed object.

5. The device of claim 4 wherein the second feed object is a feed object for a second keyring feed.

6. The device of claim 1 wherein the processing unit is further configured to:

receive input from a user to create a first document;

encrypt the first document to produce a first encrypted document;

generate a first object key including a first decryption key to decrypt the first encrypted document;

produce a second keyring entry comprising an encrypted form of the first object key which is decrypted by the entry key, wherein the second keyring entry is associated with the feed object; and

transmit the second keyring entry to said any computerized device.

7. The device of claim 1 wherein the processing unit is further configured to transmit the first encrypted document to said any computerized device, wherein the first encrypted document is backed up on said any computerized device.

8. The device of claim 6 wherein additional documents subsequently produced at the first computerized device are encrypted and are associated with respective additional object keys, wherein each additional object key is encrypted with the entry key to produce a respective additional keyring entry that is associated with the feed object, wherein each additional keyring entry is transmitted to said any computerized device.

9. The device of claim 1 wherein the processing unit is further configured to:

receive an object key from another user;

encrypt the received object key using the entry key to produce a second keyring entry, wherein the second keyring entry is associated with the feed object; and

transmit the second keyring entry to said any computerized device.

10. A first computerized device for documents comprising:

a processing unit; and

data storage having stored thereon at least executable program code,

the program code configured to cause the processing unit to generate a keyring feed for storing object keys as one or more respective keyring entries by performing steps of;

in response to a user initiating a user session, obtaining a first key based on information received from the user;

using information comprising the first key, decrypting a first encrypted file to produce a feed object, the first encrypted file identified based on the information comprising the first key, the feed object comprising an entry key, the feed object being associated with a plurality of keyring entries; and

for each keyring entry decrypting an encrypted form of an object key contained is said each keyring entry using the entry key to obtain the object key and transmitting a second encrypted file identified based on information contained in the object to key to any computerized device that is in communication with the first computerized device.

11. The device of claim 10 wherein the step of obtaining includes receiving a passphrase from the user and decrypting an encrypted file stored on the data storage to produce the first key.