Managing keys for encrypted shared documents
View Patent ↗A system administrator, while logged into a system-administrator account, creates and configures a key-administrator account and a member account. A key administrator, while logged into said key-administrator account, creates a group private key, a group public key, and a group symmetric key, a member private key, and a member public key. The key administrator encrypts the group private key with the group symmetric key, and encrypts said group symmetric key with the member public key. A publisher encrypts a document using the group public key. The publisher distributes the resulting encrypted group document so that it is accessible via said member account but not through said key-administrator account.
1. A method comprising:
creating and configuring accounts via a system-administrator account on a network system, said accounts including a key-administrator account and plural member accounts, said key-administrator account being separate from said system-administrator account, said creating and configuring including processing by processors of said network system;
creating keys via said key-administrator account, said keys including a group private key, a group public key, a group symmetric key, member private keys corresponding to respective accounts, and member public keys corresponding to respective member accounts;
encrypting, via said key-administrator account, said group private key with said group symmetric key and said group symmetric key with said member public keys;
encrypting a document with said group public key to yield an encrypted group document; and
distributing said encrypted group document to locations accessible via respective ones of said member accounts and via said system administrator account but not accessible through said key-administrator account.
2. A method as recited in claim 1 further comprising:
decrypting said group symmetric key with said member private keys via respective member accounts;
decrypting said group private key with said group symmetric key via respective member accounts, and
decrypting said document with said group private key via respective member accounts.
3. A method as recited in claim 1 further comprising encrypting a copy of a member private key of said member private keys with a member symmetric key, and encrypting a copy of said member symmetric key with a key-administrator public key, said creating keys including creating said member symmetric key.
4. A method as recited in claim 3 further comprising:
accessing said member symmetric via said key-administrator account;
decrypting said member symmetric key with said key-administrator private key via said key-administrator account;
accessing said member private key via said key-administrator account;
decrypting said member private key with said member symmetric key via said key-administrator account;
wrapping said member private key in a temporary passphrase via said key-administrator account; and
replacing a previous passphrase-protected member private key with said member private key wrapped in said temporary passphrase via said key-administrator account.
5. A method as recited in claim 4 further comprising resetting said temporary passphrase to a member passphrase via said member account.