Security system for generating keys from access rules in a decentralized manner and methods therefor

• US 8,006,280 B1
• Filed: 09/17/2002
• Issued: 08/23/2011
• Est. Priority Date: 12/12/2001
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Guardian Data Storage LLC
• Inventors: Garcia, Denis Jacques Paul, Hildebrand, Hal S.
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): SHAW, YIN CHEN
• Application Number:
  US10/246,079
• Time in Patent Office: 3,262 Days
• Field of Search: 380277-282, 380/28, 380/30, 713/189, 713/193, 713/168, 713/182, 705/51, 705/59, 726 6- 7, 726 1- 2, 726/4, 726 26- 28
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Improved system and approaches for decentralized key generation are disclosed. The keys that can be generated include both public keys and private keys. The public keys are arbitrary strings that embed or encode access restrictions. The access restrictions are used to enforce access control policies. The public keys are used to encrypt some or all portions of files. The private keys can be generated to decrypt the portions of the files that have been encrypted with the public keys. By generating keys in a decentralized manner, not only are key distribution burdens substantially eliminated but also off-line access to encrypted files is facilitated.

Claims

1. A method for encrypting a file, comprising:

producing, using a processing device, an access rules string having embedded therein access rules to be imposed for restricting access to the file;

generating, using the processing device, a public key derived from the access rules string; and

encrypting, using the processing device, at least a portion of the file using the public key, such that the public key, in a form used to encrypt the portion of the file, contains the access rules string embedded therein and extractable therefrom when decrypting the portion of the file.

2. The method as recited in claim 1, wherein the access rules limit user access to the file once it has been encrypted.

3. The method as recited in claim 1, wherein the access rules are defined using a markup language.

4. The method as recited in claim 1, wherein the access rules comprise a textual indication of who is permitted to access the file and when they are permitted to access the file.

5. The method as recited in claim 4, wherein the access rules further comprise a textual indication of how access to the file is permitted.

6. The method as recited in claim 4, wherein the access rules further comprise a textual indication of locations from where access to the file is permitted.

7. The method as recited in claim 4, wherein the textual indication is provided using a markup language.

8. The method as recited in claim 1, wherein at least one of the access rules expires on predetermined conditions.

9. The method as recited in claim 1, wherein the access rules specify one or more of data types, group users or individual users, applicable rights, and duration of access rules.

10. The method as recited in claim 1, wherein the access rules specify a policy.

11. The method as recited in claim 1, wherein the at least a portion of the file being encrypted is a data portion of the secured file.

31. The method of claim 1, wherein the public key is not supplied by a key generator.

32. The method of claim 1, wherein the access rules are embedded within the public key.

33. The method of claim 1, wherein the access rules string is used as the public key.

12. A method for encrypting a file including a key block portion and a data block portion, comprising:

producing, using a processing device, an access rules string having embedded therein access rules to be imposed for restricting access to the file;

generating, using the processing device, a public key for the key block portion derived from the access rules string; and

encrypting, using the processing device, the key block portion of the file using the public key, such that the public key, in a form used to encrypt the key block portion of the file, contains the access rules string embedded therein and extractable therefrom when decrypting the key block portion of the file.

13. The method as recited in claim 12, wherein prior to said encrypting of the key block portion, the data block is encrypted using a key within the key block.

14. A method of decrypting a secured file that has been previously encrypted, comprising:

identifying, using a processing device, access rules, for restricting access of a user to the secured file, that are embedded in a public key associated with the secured file to be decrypted by reading the access rules from the public key, wherein the public key was previously used to encrypt the secured file;

denying, using the processing device, access to the secured file if the access rules do not permit the user to access the secured file;

generating, using the processing device, a private key if the access rules permit the user to access the secured file, wherein the private key is generated based on the access rules and a master key; and

decrypting, using the processing device and following said generating, at least a portion of the secured file for access thereto by the user with the private key.

15. The method as recited in claim 14, wherein the private key is a file key.

16. The method as recited in claim 15, wherein the at least a portion of the secured file being decrypted is a data portion of the secured file.

29. The method of claim 14, wherein the master key is generated based on information distributed among a plurality of servers.

30. The method of claim 14, further comprising:

after the identifying and before the denying, determining, using the processing device, if the access rules are satisfied by the user,

wherein the determining comprises comparing the access rules with access privileges associated with the user.

17. A method of decrypting a secured file that has been previously encrypted, comprising:

identifying, using a processing device, access rules for restricting access of a user to the secured file that are embedded in a public key associated with the secured file to be decrypted by reading the access rules from the public key, wherein the public key was previously used to encrypt the secured file;

denying, using the processing device, access to the secured file if the access rules do not permit the user to access the secured file;

generating, using the processing device, a private key if the access rules permit the user to access the secured file, wherein the private key is generated based on the access rules and a master key;

decrypting, using the processing device and following said generating, an encrypted key block of the secured file to obtain a file key; and

decrypting, using the processing device, at least a portion of the secured file for access thereto by the user through use of the file key.

18. The method as recited in claim 17, wherein the private key is a file key.

19. The method as recited in claim 18, wherein the at least a portion of the secured file being decrypted is a data portion of the secured file.

20. A system for restricting access to a file, said system comprising:

a memory comprising;

a key store configured to store at least one segment of gathered information about a master key,

a rules engine configured to read an access rules string from a public key associated with a secured file, said access rules string having embedded therein access rules for restricting access to the file and embedded in said public key, and

a key generator configured to generate the master key based on said gathered information, if the access rules identified by the access rules string are satisfied, and to generate a private key derived from the access rules and the master key, wherein said private key is used to decrypt at least a portion of said secured file; and

one or more processing devices configured to process the key store, the rules engine, and the key generator.

21. The system as recited in claim 20, wherein said key store, rules engine, and key generator are located on a hardware card from which said private key is not transmitted.

22. The system as recited in claim 21, wherein the portion of the secured file being decrypted using the private key is a key block portion of the secured file.

23. The system as recited in claim 22, wherein the key block portion of the secured file is transmitted to the hardware card, and wherein the key block portion is decrypted within the hardware card using the private key.

24. The system as recited in claim 20, wherein another segment of the gathered information being used to generate the private key is stored in a server.

25. An article of manufacture including a data storage device having computer-executable instructions stored thereon, execution of which, by a computing device, causes the computing device to perform operations for encrypting a file, the operations comprising:

producing an access rules string having embedded therein access rules for restricting access to the file to be imposed;

generating a public key derived from the access rules string; and

encrypting at least a portion of the file using the public key, such that the public key, in a form used to encrypt the portion of the file, contains the access rules string embedded therein and extractable therefrom when decrypting the portion of the file.

26. The article of manufacture as recited in claim 25, wherein:

the access rules limit user access to the file once it has been encrypted,

the access rules are defined using a markup language, and

the access rules comprise a textual indication of who can access the file and when they can access the file.

27. An article of manufacture including a data storage device having computer-executable instructions stored thereon, execution of which, by a computing device, causes the computing device to perform operations for decrypting a secured file that has been previously encrypted, the operations comprising:

computer program code that enables a processor to identify access rules for restricting access of a user to the secured file that are embedded in a public key associated with the secured file to be decrypted by reading the access rules from the public key, wherein the public key was previously used to encrypt the secured file;

computer program code that enables the processor to deny access to the secured file if the access rules do not permit the user to access the secured file;

computer program code that enables the processor to generate a private key if the access rules permit the user to access the secured file, wherein the private key is generated based on the access rules and a master key; and

computer program code that enables the processor to decrypt at least a portion of the secured file for access thereto by the user with the private key.

28. A method for encrypting a file, comprising:

accessing, using a processing device, access rules to be imposed for restricting access to the file;

producing, using the processing device, an access rules string having embedded therein the access rules, wherein the access rules are embedded in the rules string according to a predetermined format;

generating, using the processing device, a public key derived from the access rules string; and

encrypting, using the processing device, at least a portion of the file using the public key, such that the public key, in a form used to encrypt the portion of the file, contains the access rules string embedded therein and extractable therefrom when the decrypting the portion of the file.