Encrypted Data Processing

• US 20130177156A1
• Filed: 01/04/2013
• Published: 07/11/2013
• Est. Priority Date: 01/06/2012
• Status: Abandoned Application

• Current Assignee: Cloudtomo Limited
• Original Assignee: Cloudtomo Limited
• Inventors: Ryan, Matt
• Application Number:
  US13/734,602
• Publication Number:
  US 20130177156A1
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates

Abstract

A computer-implemented method of processing data by a first processor, the data being generated by a second processor. The method comprises receiving a data object encrypted with a first encryption key, the data object comprising the data to be processed and policy data indicating allowed processing for said data. said received data object is decrypted based upon said first encryption key and the data is processed only in accordance with the policy data.

Claims

1. A computer-implemented method of processing data by a first processor, the data being generated by a second processor, the method comprising:

receiving a data object encrypted with a first encryption key, the data object comprising;

said data to be processed; and

policy data indicating allowed processing for said data;

decrypting said received data object based upon said first encryption key; and

processing said data only in accordance with said policy data.

2. A computer-implemented method according to claim 1, wherein said data object is encrypted with a plurality of encryption keys and said first encryption key is associated with said first processor.

3. A computer-implemented method according to claim 1, wherein decrypting said received data object based upon said first encryption key comprises obtaining said first encryption key.

4. A computer-implemented method according to claim 3, wherein said first processor is associated with a second encryption key, the method further comprising:

receiving said first encryption key, said first encryption key being encrypted with said second encryption key; and

decrypting, by said processor, said first encryption key based upon said second encryption key.

5. A computer-implemented method according to claim 3 or 4, wherein said first encryption key is encrypted with a plurality of further encryption keys.

6. A computer-implemented method according to claim 5, wherein each of said plurality of further encryption keys is associated with a respective processor.

7. A computer-implemented method according to claim 1, wherein said data to be processed comprises a document, and wherein said policy data indicates operations that are allowed on said data.

8. A computer-implemented method according to claim 7, wherein said operations that are allowed on said data are selected from the group consisting of:

translation operations;

document format export operations;

document search operations;

document mining operations;

data storage requirement determination operations;

operations facilitating collaboration and access control; and

document maintenance operations.

9. A computer-implemented method according to claim 1, wherein said data to be processed comprises at least one email, and wherein said policy data provides secure email functionality.

10. A computer-implemented method according to claim 1, wherein said policy data indicates a migration policy for allowing at least one third processor to process said data.

11. A computer-implemented method according to claim 10, wherein said migration policy for allowing at least one third processor to process said data comprises data indicating processing allowed to be performed on said data object to generate data associated with said third processor.

12. A computer-implemented method according to claim 1, further comprising determining whether said first processor is allowed to process said data object, and wherein said received data object is decrypted only if it is determined that said first processor is allowed to process said data object.

13. A computer-implemented method according to claim 12, wherein said determining whether said first processor is allowed to process said data is based upon data indicating processors allowed to process said data object.

14. A computer-implemented method according to claim 12, wherein said determining whether said first processor is allowed to process said data object is based upon data indicating a time period associated with the data object.

15. A computer-implemented method according to claim 12, wherein said determining whether said first processor is allowed to process said data object is based upon data indicating a location of the first processor.

16. A computer-implemented method according to claim 13, 14 or 15, wherein said data upon which said determining is based is received from an external source.

17. A computer-implemented method according to claim 1, wherein processing said data only in accordance with said policy data comprises generating output data.

18. A computer-implemented method according to claim 17, wherein said output data is encrypted with a third key.

19. A computer-implemented method according to claim 18, wherein said data object comprises said third key.

20. A computer-implemented method according to claim 18 or 19, wherein said third key comprises data associated with a computer associated with said second processor.

21. A computer program comprising computer readable instructions configured to cause a computer to carry out a method according to claim 1.

22. A tangible computer readable medium carrying a computer program according to claim 21.

23. A computer apparatus comprising:

a memory storing processor readable instructions; and

a first processor arranged to read and execute instructions stored in said memory;

the apparatus being arranged to process data by said first processor, the data being generated by a second processor;

wherein said processor readable instructions comprise instructions arranged to control the computer to carry out a method according to claim 1.

24. A computer readable medium storing a secure data object encrypted with a first encryption key, the data object comprising:

data to be processed; and

a policy indicating allowed processing for said data.