Methods and systems for providing access control to secured data

• US 9,542,560 B2
• Filed: 09/23/2013
• Issued: 01/10/2017
• Est. Priority Date: 12/12/2001
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: Garcia, Denis Jacques Paul, Ouye, Michael Michio, Rossmann, Alain, Crocker, Steven Toye, Gilbertson, Eric, Huang, Weiqing, Humpich, Serge, Vainstein, Klimenty, Ryan, Nicholas Michael
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/034,147
• Publication Number:
  US 20140075206A1
• Time in Patent Office: 1,205 Days
• Field of Search: 713/165
• US Class Current: 1/1
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

In a system for providing access control management to electronic data, techniques to secure the electronic data and keep the electronic data secured at all times are disclosed. According to one embodiment, a secured file or secured document includes two parts: an attachment, referred to as a header, and an encrypted document or data portion. The header includes security information that points to or includes the access rules and a file key. The access rules facilitate restrictive access to the secured document and essentially determine who/when/how/where the secured document can be accessed. The file key is used to encrypt/decrypt the encrypted data portion. Only those who have the proper access privileges are permitted to retrieve the file key to encrypt/decrypt the encrypted data portion.

Claims

1. A method for securing an electronic document, the method comprising:

obtaining an electronic document to be secured;

determining a particular electronic document data type corresponding to the electronic document, wherein the electronic document and the electronic document data type are associated with an application;

obtaining a data type key associated with the electronic document data type that has been determined;

encrypting at least a data portion of the electronic document using the data type key according to a public key encryption algorithm;

producing an encrypted document corresponding to the electronic document and storing the encrypted document in an existing database, wherein the encrypted document is associated with the application and is in a format accessible by the application;

wherein the data portion of the electronic document can be decrypted using the data type key upon determining that a requester has permission to access the particular electronic document data type of the electronic document.

2. The method as recited in claim 1, wherein the electronic document data type provides a categorization of different types of electronic document content.

3. The method as recited in claim 1, wherein the method further comprises:

saving the secured electronic document to a storage device.

4. The method as recited in claim 1, wherein the determining comprises:

receiving a selection of at least one of a plurality of available data types.

5. The method as recited in claim 1, wherein the determining comprises:

displaying a plurality of available data types; and

selecting at least one of the available data types being displayed.

6. The method as recited in claim 5, wherein the displaying and the selecting are performed with the assistance of a graphical user interface.

7. The method as recited in claim 1, further comprising attaching security information to the encrypted data portion, wherein the security information includes the data type key.

8. The method as recited in claim 7, wherein the data type key within the security information is encrypted.

9. The method as recited in claim 1, wherein the encrypting uses an encryption hierarchy, and wherein the data type key is used in at least one level of the encryption hierarchy.

10. The method as recited in claim 1, further comprising imposing at least one data type policy restriction to the encrypted document based on the electronic document data type corresponding to the electronic document.

11. The method as recited in claim 1, wherein the encrypted document maintains the same length as the electronic document.

12. The method as recited in claim 1, wherein the existing database is a financial application database.

13. The method as recited in claim 1, wherein the encrypting further comprises:

accessing the electronic document via the application; and

automatically requesting, by the application, that the electronic document be encrypted using the data type key.

14. A method for decrypting a secure electronic document, the method comprising:

identifying an electronic document to be unsecured for access by a requestor;

determining a particular electronic document data type of the electronic document, wherein the electronic document and the electronic document data type are associated with an application;

determining whether the requestor has permission to access the particular electronic document data type of the electronic document;

obtaining a data type key associated with the electronic document data type when the determining determines that the requestor has permission to access electronic documents having the particular electronic document data type, wherein at least a data portion of the electronic document has been encrypted using the data type key according to a public key encryption algorithm, and wherein the encrypted electronic document is in a format accessible by the application;

decrypting at least the data portion of the electronic document using at least the data type key upon determining that the requester has permission to access the particular electronic document data type of the electronic document; and

providing at least the unencrypted data portion to the requestor.

15. The method as recited in claim 14, wherein the electronic document data type provides a categorization of different types of electronic document content.

16. The method as recited in claim 14, wherein the secured electronic document includes the data portion and security information, the security information including a reference to the data type key in an encrypted or unencrypted manner.

17. The method as recited in claim 16, wherein the reference to the data type key within the security information is encrypted.

18. The method as recited in claim 14, wherein the decrypting is used to reverse an encryption hierarchy, and wherein the data type key is used in at least one level of the encryption hierarchy.

19. The method as recited in claim 14, wherein the obtaining further comprises obtaining at least one data type policy restriction.

20. The method as recited in claim 19, wherein the at least one data type policy restriction prevents usage of the data type key in specified circumstances.

21. The method as recited in claim 19, wherein the decrypting is prohibited when the at least one data type policy restriction is not satisfied.

22. The method as recited in claim 19, wherein the at least one data type policy restriction is specified by an administrative user.

23. The method as recited in claim 14, wherein the method further comprises:

determining, prior to the providing, whether the secured electronic document has at least one data type policy restriction; and

requiring that the at least one data type policy restriction is satisfied before at least one of the obtaining, the decrypting, or the providing are performed.

24. The method as recited in claim 23, wherein the at least one data type policy restriction is a rule affiliated with the electronic document data type for the secured electronic document.

25. The method as recited in claim 14, wherein the unencrypted electronic document maintains the same length as the encrypted electronic document.

26. The method as recited in claim 14, wherein the electronic document is stored in an existing financial application database.

27. The method as recited in claim 14, wherein the decrypting further comprises:

accessing the encrypted electronic document via the application; and

automatically requesting, by the application via a file system driver, that the electronic document be decrypted for use by the application.

28. A computer program product embodied in a non-transitory computer-readable storage medium having computer program logic recorded thereon enabling a hardware processor to secure an electronic document, said computer program code comprising:

computer program code enabling a processor to obtain an electronic document to be secured;

computer program code enabling the processor to determine a particular electronic document data type corresponding to the electronic document, wherein the electronic document and the electronic document data type are associated with an application;

computer program code enabling the processor to obtain a data type key associated with the electronic document data type that has been determined;

computer program code enabling the processor to encrypt at least a data portion of the electronic document using the data type key according to a public key encryption algorithm;

computer program code enabling the processor to produce an encrypted document corresponding to the electronic document and store the encrypted document in an existing database, wherein the encrypted document is associated with the application and is in a format accessible by the application;

wherein the data portion of the electronic document can be decrypted using the data type key upon determining that a requester has permission to access the particular electronic document data type of the electronic document.