Authenticator device facilitating file security

• US 9,813,247 B2
• Filed: 07/20/2016
• Issued: 11/07/2017
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Stuntebeck, Erich Peter, Tse, Kar Fai, Lu, Chen, Xuan, Chaoting
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US15/214,954
• Publication Number:
  US 20160330029A1
• Time in Patent Office: 475 Days
• Field of Search: 713168
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Disclosed are various embodiments for facilitating the encryption of files as well as facilitating requiring a user to employ an authenticator device in order to access a file that is encrypted or otherwise secured. The authenticator device can provide an authenticator code in which a security key used to access a secured file can be embedded. An additional layer of encryption can also be applied in the authenticator code.

Claims

1. A method for controlling access to an encrypted file, comprising:

establishing a trusted relationship between an authenticator device and a file storage application hosting the encrypted file;

receiving a request to access the encrypted file from an access device;

authenticating the request by determining that the access device has authority to access the encrypted file;

providing a decryption key to the authenticator device when the access device has authority;

providing the encrypted file to the access device;

transmitting the decryption key from the authenticator device to the access device; and

decrypting the encrypted file, by the access device, using the decryption key received from the authenticator device.

2. The method of claim 1, wherein establishing the trusted relationship comprises:

receiving authentication credentials from the authenticator device; and

verifying authenticity of the authentication credentials.

3. The method of claim 1, wherein determining that the access device has authority to access the encrypted file comprises:

obtaining a hardware identifier of the access device; and

determining that the hardware identifier corresponds to a device with authorization to access the encrypted file.

4. The method of claim 1, wherein the access device automatically deletes the decryption key after decrypting the encrypted file.

5. The method of claim 1, further comprising:

receiving, by the authenticator device, a password;

using the password to generate a time-varying password; and

double-encrypting the decryption key using the time-varying password prior to providing the decryption key to the access device.

6. The method of claim 5, further comprising:

executing a pairing process to establish a trusted relationship between the authenticator device and the access device; and

exchanging a shared secret used to create the time-varying password between the authenticator device and the access device during the pairing process.

7. The method of claim 1, wherein transmitting the decryption key from the authenticator device to the access device comprises:

displaying the decryption key on the authenticator device in the form of a QR code; and

taking a picture of the QR code using the access device.

8. One or more non-transitory computer readable media comprising instructions which, when executed by one or more processors, execute a method for controlling access to an encrypted file, the instructions being configured to:

establish a trusted relationship between an authenticator device and a file storage application hosting the encrypted file;

receive a request to access the encrypted file from an access device;

authenticate the request by determining that the access device has authority to access the encrypted file;

provide a decryption key to the authenticator device when the access device has authority;

provide the encrypted file to the access device;

transmit the decryption key from the authenticator device to the access device; and

decrypt the encrypted file, by the access device, using the decryption key received from the authenticator device.

9. The one or more non-transitory computer readable media of claim 8, further comprising instructions which, when executed:

receive authentication credentials from the authenticator device; and

verify authenticity of the authentication credentials.

10. The one or more non-transitory computer readable media of claim 8, wherein determining that the access device has authority to access the encrypted file comprises:

obtaining a hardware identifier of the access device; and

determining that the hardware identifier corresponds to a device with authorization to access the encrypted file.

11. The one or more non-transitory computer readable media of claim 8, further comprising instructions which, when execute, delete the decryption key after decrypting the encrypted file.

12. The one or more non-transitory computer readable media of claim 8, further comprising instructions which, when executed:

receive, by the authenticator device, a password;

use the password to generate a time-varying password; and

double-encrypt the decryption key using the time-varying password prior to providing the decryption key to the access device.

13. The one or more non-transitory computer readable media claim 12, further comprising instructions which, when executed:

execute a pairing process to establish a trusted relationship between the authenticator device and the access device; and

exchange a shared secret used to create the time-varying password between the authenticator device and the access device during the pairing process.

14. The one or more non-transitory computer readable media of claim 8, wherein transmitting the decryption key from the authenticator device to the access device comprises:

displaying the decryption key on the authenticator device in the form of a QR code; and

taking a picture of the QR code using the access device.

15. A system for controlling access to an encrypted file, comprising:

an authenticator device;

an access device; and

a file storage system hosting the encrypted file, wherein;

the file storage system establishes a trusted relationship with the authenticator device;

the file storage system receives a request to access the encrypted file from an access device;

the file storage system authenticates the request by determining that the access device has authority to access the encrypted file;

the file storage system provides a decryption key to the authenticator device when the access device has authority;

the file storage system provides the encrypted file to the access device;

the authenticator device transmits the decryption key to the access device; and

the access device decrypts the encrypted file using the decryption key received from the authenticator device.

16. The system of claim 15, wherein establishing the trusted relationship comprises:

receiving authentication credentials from the authenticator device; and

verifying authenticity of the authentication credentials.

17. The system of claim 15, wherein determining that the access device has authority to access the encrypted file comprises:

obtaining a hardware identifier of the access device; and

determining that the hardware identifier corresponds to a device with authorization to access the encrypted file.

18. The system of claim 15, wherein the access device automatically deletes the decryption key after decrypting the encrypted file.

19. The system of claim 15, wherein:

the authenticator device receives a password and uses the password to generate a time-varying password; and

the authenticator device double-encrypts the decryption key using the time-varying password prior to providing the decryption key to the access device.

20. The system of claim 15, wherein transmitting the decryption key from the authenticator device to the access device comprises:

displaying the decryption key on the authenticator device in the form of a QR code; and

taking a picture of the QR code using the access device.