Method and system for securing digital assets using process-driven security policies

• US 8,327,138 B2
• Filed: 04/16/2010
• Issued: 12/04/2012
• Est. Priority Date: 09/30/2003
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Guardian Data Storage LLC
• Inventors: Nath, Satyajit, Vainstein, Klimenty, Ouye, Michael Michio
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US12/762,028
• Publication Number:
  US 20100199088A1
• Time in Patent Office: 963 Days
• Field of Search: None
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065

Abstract

Techniques for dynamically altering security criteria used in a file security system are disclosed. The security criteria pertains to keys (or ciphers) used by the file security system to encrypt electronic files to be secured or to decrypt electronic files already secured. The security criteria can, among other things, include keys that are required to gain access to electronic files. Here, the keys can be changed automatically as electronic files transition between different states of a process-driven security policy. The dynamic alteration of security criteria enhances the flexibility and robustness of the security system. In other words, access restrictions on electronic files can be dependent on the state of the process-driven security policy.

Claims

1. A method comprising:

receiving a request to transition an electronic document from a state of a process-driven security policy to an additional state of the process-driven security policy;

decrypting the electronic document with a private state decryption key assigned to the state of the process-driven security policy, wherein the private state decryption key is accessible by a plurality of authorized users; and

re-encrypting the electronic document with a public state encryption key assigned to the additional state.

2. The method of claim 1, wherein re-encrypting the electronic document with the public state encryption key comprises re-encrypting a file key by which a portion of the electronic document is encrypted.

3. The method of claim 1, further comprising:

checking the request to transition the electronic document to the additional state for permission to perform the transition.

4. The method of claim 1, further comprising:

generating the request to transition the electronic document to the additional state of the process-driven security policy in response to an internal or external system event.

5. The method of claim 4, wherein the request to transition the electronic document to the additional state of the process-driven security policy is based on a transition rule associated with the event.

6. The method of claim 1, further comprising:

determining the state of the process-driven security policy based on security information within the electronic document.

7. The method of claim 1, further comprising:

receiving a request for access to the electronic document;

determining whether a set of access restrictions associated with the additional state of the process-driven security policy have been satisfied; and

decrypting the electronic document with a state decryption key assigned to the additional state of the process-driven security policy, wherein decrypting is permitted based on satisfaction of the set of access restrictions.

8. The method of claim 7, wherein decrypting the electronic document with the private state decryption key assigned to the additional state comprises decrypting the electronic document with the private state decryption key assigned to the additional state being a different key than the public state encryption key.

9. A non-transitory computer-readable device having computer-executable instructions stored thereon, execution of which, by a computing device, causes the computing device to perform operations comprising:

receiving a request to transition an electronic document from a state of a process-driven security policy to an additional state of the process-driven security policy;

decrypting the electronic document with a private state decryption key assigned to the state of the process-driven security policy, wherein the private state decryption key is accessible by a plurality of authorized users; and

re-encrypting the electronic document with a public state encryption key assigned to the additional state.

10. The computer-readable device of claim 9, wherein re-encrypting the electronic document with the public state encryption key comprises re-encrypting a file key by which a portion of the electronic document is encrypted.

11. The computer-readable device of claim 9, wherein the request to transition the electronic document to the additional state is checked for permission to perform the transition.

12. The computer-readable device of claim 9, wherein the request to transition the electronic document to the additional state of the process-driven security policy is generated automatically in response to an internal or external system event.

13. The computer-readable device of claim 12, wherein the request to transition the electronic document to the additional state of the process-driven security policy is based on a transition rule associated with the event.

14. The computer-readable device of claim 9, the operations further comprising:

determining the state of the process-driven security policy based on security information within the electronic document.

15. The computer-readable device of claim 9, the method further comprising:

receiving a request for access to the electronic document;

determining whether a set of access restrictions associated with the additional state of the process-driven security policy have been satisfied; and

decrypting the electronic document with a state decryption key assigned to the additional state of the process-driven security policy, wherein decrypting is permitted based on satisfaction of the set of access restrictions.

16. The computer-readable device of claim 15, wherein decrypting the electronic document with the private state decryption key assigned to the additional state comprises decrypting the electronic document with the private state decryption key assigned to the additional state being a different key than the public state encryption key.

17. A system comprising:

a tangible computer-readable medium configured to store;

a receiving module configured to receive a request to transition an electronic document from a state of a process-driven security policy to an additional state of the process-driven security policy,

a decrypting module configured to decrypt the electronic document with a private state decryption key assigned to the state of the process-driven security policy, wherein the private state decryption key is accessible by a plurality of authorized users, and

an encryption module configured to re-encrypt the electronic document with a public state encryption key assigned to the additional state; and

one or more processors configured to process the modules.