System and method for providing manageability to security information for secured items
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
G06F-011/30
G06F-012/14
G06F-007/04
G06F-007/02
G06F-017/30
H04L-009/32
G06K-009/00
G11C-007/00
G06F-011/00
G06F-012/16
G06F-015/18
출원번호
UP-0206486
(2002-07-25)
등록번호
US-7562232
(2009-07-27)
발명자
/ 주소
Zuili, Patrick
Vainstein, Klimenty
대리인 / 주소
Sterne, Kessler, Goldstein & Fox P.L.L.C.
인용정보
피인용 횟수 :
28인용 특허 :
313
초록▼
Improved approaches for accessing secured digital assets (e.g., secured items) are disclosed. In general, digital assets that have been secured (secured digital assets) can only be accessed by authenticated users with appropriate access rights or privileges. Each secured digital asset is provided wi
Improved approaches for accessing secured digital assets (e.g., secured items) are disclosed. In general, digital assets that have been secured (secured digital assets) can only be accessed by authenticated users with appropriate access rights or privileges. Each secured digital asset is provided with a header portion and a data portion, where the header portion includes a pointer to separately stored security information. The separately stored security information is used to determine whether access to associated data portions of secured digital assets is permitted. These improved approaches can facilitate the sharing of security information by various secured digital assets and thus reduce the overall storage space for the secured digital assets. These improved approaches can also facilitate efficient management of security for digital assets.
대표청구항▼
What is claimed is: 1. A computer readable storage medium having stored thereon computer program code, that if executed by a processor, causes the processor to access a secured item among a plurality of secured items by a method, the method comprising: obtaining the secured item to be accessed, the
What is claimed is: 1. A computer readable storage medium having stored thereon computer program code, that if executed by a processor, causes the processor to access a secured item among a plurality of secured items by a method, the method comprising: obtaining the secured item to be accessed, the secured item having a header portion and a data portion; retrieving a security information pointer from the header portion of the secured item, wherein each of the plurality of secured items has the same security information pointer as the secured item, such that the plurality of secured items share common security information, wherein the security information includes at least an access rule and user privileges; obtaining security information for the secured item using the security information pointer; and permitting access to the secured item to the extent permitted by the security information, wherein the permitting comprises: retrieving a file key from the header portion; decrypting the data portion of the secured item using the file key; retrieving at least one access rule from the security information; and determining whether a requestor is permitted to access the secured item based on the at least one access rule and characteristics of the requestor. 2. The computer readable storage medium as recited in claim 1, wherein the requestor characteristics include at least a group association for the requestor. 3. The computer readable storage medium as recited in claim 1, wherein the at least one access rule is provided in a markup language format. 4. The computer readable storage medium as recited in claim 1, wherein a requestor desires to access the secured item, and wherein the method further comprises: decrypting the security information after being obtained and before being used to determine whether access is permitted. 5. The computer readable storage medium as recited in claim 4, wherein the decrypting of the security information uses a key associated with the requestor. 6. The computer readable storage medium as recited in claim 5, wherein the key associated with the requestor is a user key. 7. The computer readable storage medium as recited in claim 1, wherein the security information includes at least access rules, and the header portion includes at least the security information pointer and the file key. 8. The computer readable storage medium as recited in claim 7, wherein when the permitting determines that the requestor is permitted to access the secured item, the permitting further comprises: retrieving the file key from the header portion; and decrypting the data portion of the secured item using the file key. 9. The computer readable storage medium as recited in claim 8, wherein the file key is an encrypted file key. 10. The computer readable storage medium as recited in claim 9, wherein a requestor desires to access the secured item, and wherein the decrypting of the encrypted file key is performed using a key associated with the requestor. 11. The computer readable storage medium as recited in claim 1, wherein the secured item is a secured file. 12. The computer readable storage medium as recited in claim 1, wherein the secured item is a secured document. 13. The computer readable storage medium as recited in claim 1, the method further comprising: changing the security information associated with the security information pointers without having to change each of the plurality of secured items individually. 14. The computer readable storage medium as recited in claim 1, wherein the security information pointers point directly to a storage location of the security information. 15. The computer readable storage medium as recited in claim 1, wherein the security information pointers point to a security information table associated with the security information. 16. The computer readable storage medium as recited in claim 1, wherein the security information pointers point to different versions of the security information providing different levels of access control depending on a user's access privilege. 17. A system for accessing a secured item among a plurality of secured items, the secured item having a header portion and an encrypted data portion, the header portion including a security information pointer and a file key, wherein each of the plurality of secured items has the same security information pointer as the secured item, such that the plurality of secured items share common security information, the system comprising: a storage device configured to store the security information for the plurality of secured items, wherein the security information includes at least an access rule and user privileges; a first decryption module configured to: receive the security information pointer from the header portion of the secured item; receive the file key from the header portion of the secured item; and receive at least one access rule from the security information; an access analyzer operatively connected coupled to the storage device, the access analyzer configured to determine whether the encrypted data portion is permitted to be accessed by a requestor based on the security information, wherein the access analyzer determines whether the encrypted data portion is permitted to be accessed by the requestor based on the at least one access rule and characteristics of the requestor; and a second decryption module coupled to the access analyzer, the second decryption module configured to decrypt the encrypted data portion using the file key to produce an unencrypted data portion that the requestor is able to access, provided the access analyzer determines that the encrypted data portion is permitted to be accessed by the requestor. 18. The system as recited in claim 17, wherein the requestor has user privileges associated therewith, and wherein the access analyzer determines whether the encrypted data portion is permitted to be accessed by the requestor based on applying the access rule and the user privileges to the requestor and the secured item. 19. The system as recited in claim 17, further comprising: a security management system configured to change the security information associated with the pointers without having to change each of the plurality of secured items individually. 20. The system as recited in claim 17, wherein the pointers point directly to the storage device. 21. The system as recited in claim 17, wherein the pointers point to a security information table associated with the security information in the storage device. 22. The system as recited in claim 17, wherein the pointers point to different versions of the security information providing different levels of access control depending on a user's access privilege. 23. A method for accessing a secured file stored in a storage device, comprising: obtaining the secured file to be accessed, the secured file having a header portion and a data portion, wherein the storage device is configured to store security information for a plurality of secured items, wherein the security information includes at least access rules; retrieving a security information pointer from the header portion of the secured file, wherein the plurality of secured items have the same security information pointer as the secured file, such that the plurality of secured items share the security information; obtaining, from the storage device, security information for the secured file using the security information pointer; and permitting access to the secured file to the extent permitted by the security information, wherein the permitting comprises: retrieving a file key from the header portion; decrypting the data portion of the secured file using the file key; retrieving at least one access rule from the security information; and determining whether a requestor is permitted to access the secured file based on the at least one access rule and requestor characteristics. 24. The method of claim 23, wherein the requester characteristics include at least a group association for the requester. 25. The method of claim 23, wherein the at least one access rule is provided in a markup language format. 26. The method of claim 23, wherein after obtaining security information for the secured file from the storage device, but before the permitting, the method further comprises: decrypting the security information. 27. The method of claim 26, wherein decrypting the security information is performed using a key associated with the requestor. 28. The method of claim 27, wherein the key associated with the requester is a user key. 29. The method claim 23, wherein the header portion includes at least the security information pointer and the file key. 30. The method of claim 29, wherein when access to the secured file is permitted by the requestor, the permitting further comprises: retrieving the file key from the header portion; and decrypting the data portion of the secured file using the file key. 31. The method of claim 30, wherein the file key is an encrypted file key. 32. The method of claim 31, wherein decrypting the data portion of the secured file using the file key is performed using a key associated with a requester requesting access to the secured file.
연구과제 타임라인
LOADING...
LOADING...
LOADING...
LOADING...
LOADING...
이 특허에 인용된 특허 (313)
Edward M. Scheidt ; Ersin L. Domangue, Access control and authorization system.
Just, Michael K.; Van Oorschot, Paul, Apparatus and method for reducing transmission bandwidth and storage requirements in a cryptographic security system.
Bahl, Paramvir; Venkatachary, Srinivasan; Balachandran, Anand, Authentication methods and systems for accessing networks, authentication methods and systems for accessing the internet.
Strickler Gary E. ; Knapp Herbert William ; Holenstein Bruce D. ; Holenstein Paul J., Bidirectional database replication scheme for controlling ping-ponging.
Peinado,Marcus, Binding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out/checking in the digital license to/from the portable device or the like.
Brownlie,Michael; Hillier,Stephen; Van Oorschot,Paul C., Computer network security system and method having unilateral enforceable security policy provision.
Reed Drummond Shattuck ; Heymann Peter Earnshaw ; Mushero Steven Mark ; Jones Kevin Benard ; Oberlander Jeffrey Todd ; Banay Dan, Computer-based communication system and method using metadata defining a control structure.
Reed Drummond Shattuck ; Heymann Peter Earnshaw ; Mushero Steven Mark ; Jones Kevin Benard ; Oberlander Jeffrey Todd, Computer-based communication system and method using metadata defining a control-structure.
Auerbach Joshua Seth (Ridgefield CT) Chow Chee-Seng (Cupertino CA) Kaplan Marc Adam (Katonah NY) Crigler Jeffrey Charles (McLean VA), Creation and distribution of cryptographic envelope.
Ehrsam William F. (Kingston NY) Elander Robert C. (Saugerties NY) Matyas Stephen M. (Poughkeepsie NY) Meyer Carl H. W. (Kingston NY) Sahulka Richard J. (Woodstock NY) Tuchman Walter L. (Woodstock NY), Cryptographic file security for multiple domain networks.
Yoshino, Kenji; Ishibashi, Yoshihito; Akishita, Toru; Shirai, Taizo; Ito, Takeshi; Hayashi, Shigekazu, Data processing device, data storage device, data processing method, and program providing medium for storing content protected under high security management.
Hecht Matthew S. (Potomac MD) Johri Abhai (Gaithersburg MD) Wei Tsung T. (Gaithersburg MD) Steves Douglas H. (Austin TX), Distributed security auditing subsystem for an operating system.
Ohtsu Toshiyuki,JPX, Dynamic adding system for memory files shared among hosts, dynamic adding method for memory files shared among hosts, and computer-readable medium recording dynamic adding program for memory files sh.
Downs Edgar ; Gruse George Gregory ; Hurtado Marco M. ; Lehman Christopher T. ; Milsted Kenneth Louis ; Lotspiech Jeffrey B., Electronic content delivery system.
Kuroda, Yasutsugu; Kamada, Jun; Iwase, Shoko; Noda, Bintatsu; Ono, Etsuo, Electronic data storage apparatus with key management function and electronic data storage method.
Smith Jeffrey C. ; Bandini Jean-Christophe, Electronic document delivery system in which notification of said electronic document is sent to a recipient thereof.
Tozawa,Jun; Nogami,Hiroshi; Shibayama,Tetsuya; Kataoka,Tomohiro; Fujio,Hiroshi, Encryption and decryption communication semiconductor device and recording/reproducing apparatus.
Elmer Thomas I. (Sunnyvale CA) Nguyen Tuan T. (Milpitas CA) Lin Rung-Pan (San Jose CA), Encryption of streams of addressed information to be used for program code protection.
Shimbo Atsushi,JPX ; Takahashi Toshinari,JPX ; Tomoda Ichiro,JPX ; Murota Masao,JPX, File editing system and shared file editing system with file content secrecy, file version management, and asynchronous.
Eshel Marc M. (Tarrytown NY) Hunt Guerney D. H. (Ithaca NY) Jones Donald N. (Vestal NY) Meyer Christopher (Vestal NY) Schwartz Frederick A. (Binghamton NY), File manager for files shared by heterogeneous clients.
Kumar,Sanjay; Thomas,Stanton L.; Deshpande,Gaurav M.; Murty,Venkataesh V., Fulfillment management system for managing ATP data in a distributed supply chain environment.
Bonn, David Wayne; Marvais, Nick Takaski, Generalized network security policy templates for implementing similar network security policies across multiple networks.
Shimizu Hideo,JPX ; Hori Satomi,JPX ; Endoh Naoki,JPX ; Saisho Toshiaki,JPX, Information processing system having function of securely protecting confidential information.
Asano,Tomoyuki; Osawa,Yoshitomo, Information recording device, information playback device, information recording method, information playback method, and information recording medium and program providing medium used therewith.
Pensak David A. ; Cristy John J. ; Singles Steven J., Information security architecture for encrypting documents for remote access while maintaining access control.
Law,Gary K.; Deitz,David L.; Schleiss,Trevor Duncan; Naidoo,Julian, Integrated electronic signatures for approval of process control and safety system software objects.
Phillips,Robert S.; Davis,Scott H.; Dietterich,Daniel J.; Nyman,Scott E.; Porter,David, Internet-based shared file service with native PC client access and semantics.
Phillips,Robert S.; Davis,Scott H.; Dietterich,Daniel J.; Nyman,Scott E.; Porter,David, Internet-based shared file service with native PC client access and semantics and distributed access control.
Thomsen,Daniel Jay; O'Brien,Richard; Bogle,Jessica; Payne,Charles, Locally adaptable central security management in a heterogeneous network environment.
John E. Parsons, Jr. ; Bradley J. Graziadio ; Oshoma Momoh, Maintaining a first session on a first computing device and subsequently connecting to the first session via different computing devices and adapting the first session to conform to the different com.
Zavalkovsky,Arthur; Elfassy,Nitsan, Method and apparatus for communicating network quality of service policy information to a plurality of policy enforcement points.
McLaughlin Michael D. (San Jose CA) Signa John C. (Sunnyvale CA) Greicar Richard K. (Moss Beach CA) Taylor John M. (London GB2), Method and apparatus for display calibration and control.
Batten-Carew Mark,CAX ; Buchler Marek,CAX ; Hiller Stephen William,CAX ; Otway Josanne Mary,CAX, Method and apparatus for processing administration of a secured community.
Basani, Vijay R.; Mangiapudi, Krishna; Murach, Lynne M.; Karge, Leroy R.; Revsin, Vitaly S.; Bestavros, Azer; Crovella, Mark E.; LaRosa, Domenic J., Method and apparatus for reliable and scalable distribution of data files in distributed networks.
Sames, David L.; Whitmore, Brent S.; Niebuhr, Brian S.; Tally, Gregg W., Method and apparatus for securely and dynamically modifying security policy configurations in a distributed system.
DeMello, Marco A.; Keely, Leroy B.; Byrum, Frank D.; Yaacovi, Yoram; Hughes, Kathryn E., Method and system for binding enhanced software features to a persona.
Hauser Ralf,CHX ; Janson Philippe,CHX ; Molva Refik,FRX ; Tsudik Gene,CHX ; Van Herreweghen Elsie,CHX, Method and system for changing an authorization password or key in a distributed communication network.
Halter Bernard J. (Longmont CO) Bracco Alphonse M. (Reston VA) Johnson Donald B. (Manassas VA) Le An V. (Manassas VA) Matyas Stephen M. (Manassas VA) Prymak ; deceased Rostislaw (late of Dumfries VA , Method and system for multimedia access control enablement.
Krueger, Scott; Goodman, Daniel, Method and system for seamless integration of preprocessing and postprocessing functions with an existing application program.
Chan, Shannon; Jensenworth, Gregory; Goertzel, Mario C.; Shah, Bharat; Swift, Michael M.; Ward, Richard B., Method and system for secure running of untrusted content.
Komuro Teruyoshi,JPX ; Osawa Yoshitomo,JPX ; Shima Hisato ; Asano Tomoyuki,JPX, Method and system for transferring information using an encryption mode indicator.
Lambert Howard Shelton,GBX ; Orchard James Ronald Lewis,GBX, Method for controlling access to electronically provided services and system for implementing such method.
Bala,Vasanth; Smith,Michael D., Method for protecting digital content from unauthorized use by automatically and dynamically integrating a content-protection agent.
Skarbo Rune A. ; Clitheroe Cameron J. ; Lawless Christopher C. ; Kukkal Puneet ; Hochman Stephen D., Method for web based storage and retrieval of documents.
Richard Patrick,CAX ; Csinger Andrew,CAX ; Knipe Bruce,CAX ; Woodward Bruce,CAX, Method of and apparatus for providing secure distributed directory services and public key infrastructure.
Hochberg,Avishai Haim; Marek,Toby Lyn; Cannon,David Maxwell; Martin,Howard Newton; Warren, Jr.,Donald Paul; Haye,Mark Alan, Method, system, and program for retention management and protection of stored objects.
Shamoon,Talal G.; Hill,Ralph D.; Radcliffe,Chris D.; Hwa,John P.; Sibert,W. Olin; Van Wie,David M., Methods and apparatus for persistent control and protection of content.
Arlein,Robert M.; Jai,Ben; Jakobsson,Bjorn Markus; Monrose,Fabian; Reiter,Michael Kendrick, Methods and apparatus for providing privacy-preserving global customization.
Beattie,Douglas D.; Creighton, Jr.,Neal Lewis; Bailey,Christopher T. M.; Remy,David L.; Hamandi,Hani, Methods and systems for automated authentication, processing and issuance of digital certificates.
Vahalia Uresh K. ; Gupta Uday ; Porat Betti ; Tzelnic Percy, Network file server sharing local caches of file access information in data processors assigned to respective file systems.
Schmuck Frank B. ; Zlotek Anthony J. ; Shmueli Boaz,ILX ; Mandler Benjamin,ILX ; Yehudai Zvi Yosef,ILX ; Kish William A., Parallel file system with method using tokens for locking modes.
Matyas, Jr., Stephen Michael; Peyravian, Mohammad; Roginsky, Allen Leonid; Zunic, Nevenko, Secure data storage and retrieval with key management and user authentication.
Rose Anthony M. (66 Drumalbyn Road Bellevue Hill ; Sydney AUX 2023), Securing a computer against undesired write operations to or read operations from a mass storage device.
Davis, Mark C.; Hind, John R.; Peters, Marcia L.; Topol, Brad B., Selective data encryption using style sheet processing for decryption by a group clerk.
William J. Bolosky ; John R. Douceur ; Scott M. Cutshall ; Richard F. Rashid ; Nathan P. Myhrvold ; David A. Goebel, Single instance store for file systems.
Takahashi Toshinari,JPX ; Nogami Hiroyasu,JPX, Software distribution system and software utilization scheme for improving security and user convenience.
Barlow, Doug; Dillaway, Blair; Fox, Barbara; Lipscomb, Terry; Spies, Terrence, System and method for configuring and managing resources on a multi-purpose integrated circuit card using a personal computer.
Rusnak David J. ; Zientara John T., System and method for controlling access rights to and security of digital content in a distributed information system, e.g., Internet.
Carman David W. ; Balenson David M. ; Tajalli Homayoon ; Walker Stephen T., System and method for controlling access to a user secret using a key recovery field.
Richard R. Viets ; David G. Motes ; Paula Budig Greve ; Wayne W. Herberg, System and method for controlling access to documents stored on an internal network.
Viets, Richard R.; Motes, David G.; Greve, Paula Budig; Herberg, Wayne W., System and method for controlling access to documents stored on an internal network.
Lipner Steven B. (Oakton VA) Balenson David M. (Olney MD) Ellison Carl M. (Baltimore MD) Walker Stephen T. (Glenwood MD), System and method for data recovery.
Olsen, Theis; Bundesen, Rune Windfeld; Hougaard, Claes Christian; Nordly, Trygve Thor, System and method for ensuring secure transfer of a document from a client of a network to a printer.
Dennis, Michael W.; Freed, Michele L.; Plastina, Daniel; Flo, Eric R.; Kays, Jr., David E.; Corrington, Robert E., System and method for implementing group policy.
Michael W. Dennis ; Michele L. Freed ; Daniel Plastina ; Eric R. Flo ; David E. Kays, Jr. ; Robert E. Corrington, System and method for implementing group policy.
Kiessig,Rick; Yost,David A.; Mathon,John D., System and method for managing content with event driven actions to facilitate workflow and other features.
Sakurai Hiroshi (Tokyo JPX) Ikeda Nobuyuki (Tokyo JPX) Watabe Akehiro (Tokyo JPX), System and method for processing document information using password protected icons that represent document content.
Premkumar Thomas Devanbu ; Stuart Gerald Stubblebine, System and method for providing assurance to a host that a piece of software possesses a particular property.
Dixon Peggy PakFan ; Shi Danling ; Verburg Richard Lee ; Wood Donald Edwin, System and method for transferring a session from one application server to another without losing existing resources.
Bess, Dwayne Lamarr; Brischke, Harold Allan; Keller, Andrew Charles; Wagner-Krankel, Dale Alan; Tijerina, Jacob Garza; Connolly, Jr., Billy Ray; O'Connor, Karen Ann; McDaniel, James William; Lewis, R, System and method of providing electronic access to one or more documents.
McDonnal William D. (Tigard OR) Lohstroh Shawn (Beaverton OR) Grawrock David (Aloha OR), System for automatic decryption of file data on a per-use basis and automatic re-encryption within context of multi-thre.
Bacha, Hamid; Carroll, Robert Bruce; Mirlas, Lev; Tchao, Sung Wei, System for electronic repository of data enforcing access control on data search and retrieval.
Riedel,Erik; Karamanolis,Christos; Kallahalla,Mahesh; Swaminathan,Ram, System for ensuring data privacy and user differentiation in a distributed file system.
Hahn Samuel S. ; LeGault Kenn ; Wheeler Maxon ; Degenhardt Jon R., System for organizing document icons with suggestions, folders, drawers, and cabinets.
Donaghey, Robert J.; Carielli, Sandra E.; Helinek, Pamela, System for selecting and disseminating active policies to peer device and discarding policy that is not being requested.
Krishnaswamy, Sridhar; Elliott, Isaac K.; Reynolds, Tim E.; Forgy, Glen A.; Solbrig, Erin M., System, method and article of manufacture for a communication system architecture including video conferencing.
Ginter Karl L. ; Shear Victor H. ; Sibert W. Olin ; Spahn Francis J. ; Van Wie David M., Systems and methods for secure transaction management and electronic rights protection.
Ginter Karl L. ; Shear Victor H. ; Spahn Francis J. ; Van Wie David M., Systems and methods for the secure transaction management and electronic rights protection.
Davis Mark Charles ; Gray Steve D. ; Kuehr-McLaren David Gerard ; Morrison Ian A. ; Shoriak Timothy G., Systems, methods and computer program products for authenticating client requests with client certificate information.
Bly Sara A. (Mountain View CA) Hodges Jeffrey D. (Newark CA) Kupfer Michael D. (Mountain View CA) Lewis Brian T. (Palo Alto CA) Tallan Michael L. (Mountain View CA) Tom Stephen B. (San Francisco CA), Updating local copy of shared data in a collaborative system.
Okamoto Toshio,JPX ; Shimbo Atsushi,JPX ; Ishiyama Masahiro,JPX, User identification data management scheme for networking computer systems using wide area network.
Vainstein, Klimenty; Nath, Satyajit; Ouye, Michael Michio, Method and apparatus for transitioning between states of security policies used to secure electronic documents.
Vainstein, Klimenty; Nath, Satyajit; Ouye, Michael Michio, Method and apparatus for transitioning between states of security policies used to secure electronic documents.
Huang, Weiqing; Supramaniam, Senthilvasan; Vainstein, Klimenty, Method and system for implementing changes to security policies in a distributed security system.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.