Document security system that permits external users to gain access to secured files

• US 8,943,316 B2
• Filed: 04/04/2012
• Issued: 01/27/2015
• Est. Priority Date: 02/12/2002
• Status: Expired

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: Vainstein, Klimenty
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US13/439,485
• Publication Number:
  US 20120198230A1
• Time in Patent Office: 1,028 Days
• Field of Search: 713/165, 713/168, 713/171, 713/189, 726 22- 29, 380277-282
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A system includes a server with an access manager configured to restrict access to files of an organization and maintain at least encryption keys for internal and external users and an external access server connected to the server and coupled between the server and a data network. The data network is configured to allow the external users use of the external access server. The external access server is also configured to permit file exchange between the internal users and the external users via the server.

Claims

1. A system comprising:

a server an access manager configured to restrict access to a file of an organization having an internal user responsive to a request for the file, the file comprising a header portion including an access rule that restricts access to the file, and a content portion encrypted by a file key;

a database coupled to the server and configured to store an encryption key for use between the internal user and an external partner comprising an external user, wherein the access manager is further configured to encrypt the file key, located within security information of the header portion of the file, with the encryption key in response to a partner relationship existing between the organization and the external partner and deny the request in response to a partner relationship not existing; and

an external access server operatively connected to the server and coupled between the server and a data network, the data network configured to allow the external user use of the external access server, wherein the external access server is configured to permit file exchange between the internal user and the external user via the server.

2. The system of claim 1, wherein file exchange by the internal and external users is permitted in response to the internal and external users being members of a common group.

3. The system of claim 1, wherein the encryption key comprises a public-private key pair, and wherein the access manager is configured to encrypt the security information with the public key.

4. The system of claim 1, wherein the server further comprises:

a central server; and

a local server operatively connected to the central server.

5. The system of claim 1, wherein the data network includes at least a part of an Internet.

6. The system of claim 1, wherein the external user is unaffiliated with the internal user.

7. The system of claim 1, wherein:

the external user and the internal user are members of a common group; and

the external user is unable to change group membership and is unable to query group membership to determine members of the common group.

8. A method comprising:

maintaining, in a database, an encryption key for use between an organization comprising an internal user and an external partner comprising an external user;

receiving, by a server coupled to the database, a request to access a file, the file comprising a header portion including an access rule that restricts access to the filer and a content portion encrypted by a file key;

encrypting the file key, located within security information of the header portion, with the encryption key in response to a partner relationship existing between the organization and the external partner; and

denying the request in response to the partner relationship not existing.

9. The method of claim 8, further comprising permitting file exchange between the internal user and the external user through an external access server in response to the internal user and the external user being members of a common group.

10. The method of claim 8, further comprising using a public-private key pair as the encryption key.

11. The method of claim 10, further comprising:

encrypting the security information with the public key.

12. The method of claim 8, further comprising:

communicating, in response to the security information being encrypted, the requested file via a data network.

13. The method of claim 8, wherein the external user is unaffiliated with the organization comprising the internal user.

14. The method of claim 13, further comprising:

blocking the external user from changing group membership and querying group membership to determine members of a common group, the common group comprising the internal user and the external user.

15. A computer-readable storage device having instructions stored thereon, execution of which, by a computing device associated with an organization, causes the computing device to perform operations comprising:

maintaining an encryption key for use between the organization comprising an internal user and an external partner comprising an external user;

receiving a request to access a file at the computing device, the file comprising a header portion including an access rule that restricts access to the file and a content portion encrypted by a file key;

encrypting the file key, located within security information of the header portion, with the encryption key in response to a partner relationship existing between the organization and the external partner; and

denying the request in response to the partner relationship not existing.

16. The computer-readable storage device of claim 15, the operations further comprising permitting file exchange between the internal user and the external user through an external access server in response to the internal user and the external user being members of a common group.

17. The computer-readable storage device of claim 15, further comprising using a public-private key pair as the encryption key.

18. The computer-readable storage device of claim 17, the operations further comprising:

encrypting the security information with the public key.

19. The computer-readable storage device of claim 15, the operations further comprising:

communicating, in response to the security information being encrypted, the requested file via a data network.

20. The computer-readable storage device of claim 15, wherein the external user is unaffiliated with the organization comprising the internal user.