Method of distributing computer data files

• US 5,058,162 A
• Filed: 08/09/1990
• Issued: 10/15/1991
• Est. Priority Date: 08/09/1990
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Company (HP Inc.)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Shah, Pankaj B., Armbrust, Christen M., Hand, Steven J., Santon, John C., Nielsen, Kenneth R.
• Primary Examiner(s): Buczinski, Stephen C.
• Application Number:
  US07/564,911
• Time in Patent Office: 432 Days
• Field of Search: 364/200, 364/900, 380/23, 380/25, 380/45, 380/4
• US Class Current: 705/51
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G07F 17/16 for devices exhibiting advertisements, announcements, pictures or the like
• CPC Class Codes: Y10S 707/99953 Recoverability
• CPC Class Codes: Y10S 707/99956 File allocation

Abstract

A method of distributing a plurality of data files to a plurality of recipients including the steps of: placing encrypted copies of the data files to be distributed on a plurality of identical media and providing the recipients with media reading devices having data file decryption capability; logically arranging the data files into data file groups; in response to a recipient'"'"'s request for access to selected file groups providing the recipient with a group access map indicative of the file groups to which access is requested; in further response to a recipient'"'"'s request for access to selected file groups providing the recipient with a password to be used for access verification; completing an access verification operation using the group access map and the password and data indicative of the media being read and data indicative of the reading device being used; providing access to the data files in the file groups to which access is requested by use of the group access map; and decrypting the accessed data files.

Claims

1. A method of distributing a plurality of data files to a plurality of recipients comprising the steps of:

a) placing encrypted copies of the data files to be distributed on a plurality of identical media and providing the recipients with media reading devices having data file decryption capability;

b) logically arranging the data files into data file groups;

c) in response to a recipient'"'"'s request for access to selected file groups providing the recipient with a group access map indicative of the file groups to which access is requested;

d) in further response to a recipient'"'"'s request for access to selected file groups providing the recipient with a password to be used for access verification;

e) completing an access verification operation using the group access map and the password and data indicative of the media being read and data indicative of the reading device being used;

f) providing access to the data files in the file groups to which access is requested by use of the group access map; and

g) decrypting the accessed data files.

2. The method of claim 1 wherein step (a) comprises:

creating a plurality of identical media which each contain copies of the plurality of data files encrypted with a first encryption key and which each contain a copy of the first encryption key encrypted with a second encryption key;

and further comprising the steps of;

providing each of the recipients with a media reading device having a machine readable copy of the second encryption key stored therein;

initiating reading one of the media on one of the media reading devices;

reading the stored copy of the second encryption key;

and wherein step (e) comprises the steps of;

using the read copy of the second encryption key to decrypt the encrypted copy of the first encryption key which is provided on the media; and

using the decrypted first encryption key to decrypt the encrypted data files on the media.

3. The method of claim 1 comprising the further steps of:

providing a media identifier and a security program initiator on each of the media;

providing a common security program and a unique reading device identifier on each reading device;

initiating reading of one of the media on one of the media reading devices;

initiating the security program in response to reading the security program initiator;

utilizing the security program to access the unique reading device identifier of the reading devices and the media identifier of the media being read;

inputting to the reading device the group access map indicative of particular files which are to be accessed;

inputting to the reading device the password;

and wherein step (g) comprises;

performing a verification operation to establish that a predetermined correlation exists among the password, reading device identifier, media identifier, and group access map.

4. The method of claim 1 comprising the steps of:

logically assigning each data file to a file group based upon predetermined criteria and assigning a unique file group number to each file group;

logically dividing the area on the disk on which data files are stored into a plurality contiguous physical regions wherein each data file is contained within a single region and wherein no region contains data files of more than one file group;

creating a region access map indicating the group number of the files in each region and indicating the disk location of each region and providing the region access map on the media;

and wherein step (f) comprises;

comparing the group access map to the region access map to determine the region locations of the data files in each of the file groups to which access is desired; and

providing access to these determined regions.

9. The method of claim 2 wherein each media reading device is provided with a recipient inaccessible decryption unit and wherein each decryption step comprises the steps of:

providing a key to the decryption unit; and

using the decryption unit to decrypt data.

12. The method of claim 3 wherein the step of performing a verification operation comprises the steps of:

decrypting the group access map using the unique reading device identifier as a key;

performing a mathematical operation involving the decrypted group access map and the media identifier and obtaining a mathematical operation result;

comparing the mathematical operation result to the password; and

providing the recipient access to the file groups indicated by the group access map when the mathematical operation result matches the password.

13. The method of claim 12 wherein the decrypted group access map comprises a string of binary digits of predetermined length and wherein the mathematical operation comprises the steps of:

dividing the decrypted group access map string of binary digits into a predetermined number of equal length segments; and

adding the equal length segments and the media identifier together to obtain a sum.

5. A method of distributing a plurality of data files to a plurality of recipients comprising the steps of:

creating a plurality of identical media which each contain copies of the plurality of data files encrypted with a first encryption key and which each contain a copy of the first encryption key encrypted with a second encryption key;

providing each of the recipients with a media reading device having a machine readable copy of the second encryption key stored therein;

initiating reading of one of the media on one of the media reading devices;

reading the stored copy of the second encryption key;

using the read copy of the second encryption key to decrypt the encrypted copy of the first encryption key which is provided on the media; and

using the decrypted first encryption key to decrypt the encrypted data files on the media.

10. The method of claim 5 wherein each media reading device is provided with a recipient inaccessible decryption unit and wherein each decryption step comprises the steps of:

providing a key to the decryption unit; and

using the decryption unit to decrypt data.

6. A method of distributing a plurality of data files to a plurality of recipients comprising the steps of:

creating a set of identical media which contain copies of the plurality of data files, a media identifier, and a security program initiator;

providing the recipients with secured media reading devices which each contain a common security program and which each contain a unique reading device identifier;

initiating reading of one of the media on one of the media reading devices;

initiating the security program in response to reading the security program initiator;

inputting to the reading device a group access map indicative of particular files which are to be accessed;

inputting to the reading device a password which is correlated to the unique reading device identifier of the reading device being used and to the media identifier of the media being read and to the input group access map;

utilizing the security program to access the unique reading device identifier of the reading device and the media identifier of the media being read;

performing a verification operation to establish that a predetermined correlation exists among the password, reading device identifier, media identifier, and group access map; and

providing access to the selected data files indicated by the group access map in response to establishing the correlation.

14. The method of claim 6 wherein the step of performing a verification operation comprises the steps of:

decrypting the group access map using the unique reading device identifier as a key;

performing a mathematical operation involving the decrypted group access map and the media identifier and obtaining a mathematical operation result;

comparing the mathematical operation result to the password; and

providing the recipient access to the file groups indicated by the group access map when the mathematical operation result matches the password.

15. The method of claim 14 wherein the decrypted group access map comprises a string of binary digits of predetermined length and wherein the mathematical operation comprises the steps of:

dividing the decrypted group access map string of binary digits into a predetermined number of equal length segments; and

adding the equal length segments and the media identifier together to obtain a sum.

7. A method of providing access to selected sets of data files which are provided on a digital data storage media comprising the steps of:

logically assigning each data file to a file group based upon predetermined criteria and assigning a unique file group number to each file group;

logically dividing the area on the disk on which data files are stored into a plurality of contiguous physical regions wherein each data file is contained within a single region and wherein no region contains data files of more than one file group;

providing a region access map indicating the group number of the files in each region and indicating the disk location of each region and providing the region access map list on the media;

creating a group access map indicating the file group numbers of the file groups to which access is desired;

comparing the group access map to the region access map to determine the region locations of the data files in each of the file groups to which access is desired; and

providing access to each of these determined regions.

8. A method of distributing a plurality of data files to a plurality of recipients comprising the steps of:

creating a plurality of identical media which each contain copies of the plurality of data files encrypted with a first encryption key, a copy of the first encryption key encrypted with a second encryption key, a media identifier, and a security program initiator;

logically assigning each data file to a file group based upon predetermined criteria and assigning a unique file group number to each file group;

logically dividing the area on the disk on which data files are stored into a plurality of contiguous physical regions wherein each data file is contained within a single region and wherein no region contains data files of more than one file group;

providing a region access map indicating the group number of the files in each region and indicating the disk location of each region and providing the region access map on the media;

creating a group access map indicating the file group numbers of the file groups to which access is desired;

providing each of the recipients with a media reading device having firmware including a copy of the second encryption key, a unique reading device identifier, and a security program;

initiating reading of one of the media on one of the media reading devices;

initiating the security program in response to reading the security program initiator;

inputting to the reading device the group access map indicative of particular file groups which are to be accessed;

inputting to the reading device a password which is correlated to the unique reading device identifier of the reading device being used and to the media identifier of the media being read and to the input group access map;

utilizing the security program to access the unique reading device identifier of the reading device and the media identifier of the media being read;

utilizing the security program to perform a verification operation to establish that a predetermined correlation exists among the password, reading device identifier, media identifier, and group access map;

utilizing the security program to compare the group access map to the region access map to determine the region locations of the data files in each of the file groups to which access is desired and providing a recipient access to each of these determined regions;

utilizing the security program to read the stored copy of the second encryption key;

utilizing the security program to use the read copy of the second encryption key to decrypt the encrypted copy of the first encryption key which is provided on the media; and

utilizing the security program to use the decrypted first encryption key to decrypt the encrypted data files on the media regions accessed by the recipient.

11. The method of claim 8 wherein each media reading device is provided with a recipient inaccessible decryption unit and wherein each decryption step comprises the steps of:

providing a key to the decryption unit; and

using the decryption unit to decrypt data.

16. The method of claim 8 wherein the step of performing a verification operation comprises the steps of:

decrypting the group access map using the unique reading device identifier as a key;

performing a mathematical operation involving the decrypted group access map and the media identifier and obtaining a mathematical operation result;

comparing the mathematical operation result to the password; and

providing the recipient access to the file groups indicated by the group access map when the mathematical operation result matches the password.

17. The method of claim 16 wherein the decrypted group access map comprises a string of binary digits of predetermined length and wherein the mathematical operation comprises the steps of:

dividing the decrypted group access map string of binary digits into a predetermined number of equal length segments; and

adding the equal length segments and the media identifier together to obtain a sum.