Encryption and access method and system for peer-to-peer distributed file storage

1. A system for secure distributed data storage that uses a network, the system comprising:

a processor;

a memory operatively coupled to the processor;

computer code in the memory for implementing the following functionality:

a file stored on a plurality of storage elements that are accessible over the network; and

an access control list associated with the file;

a list of users, stored in the access control list, with read access to plaintext contents of the file;

a list of users, stored in the access control list, with write access to the file;

each user having a user public key;

each user having a user private key;

a file public key associated with the file and used for encrypting the plaintext contents of the file; and

a file private key associated with the file and used for decrypting the file into the plaintext contents,

wherein the user public key is used to encrypt the file private key, and the encrypted private file key is stored in the access control list,

wherein the user private key is used to decrypt the encrypted private file key, and

wherein data representing the ciphertext contents of the file, metadata associated with the file, data related to functioning of distributed data storage and the ciphertext access control list is available to any user of the network.

2. The system of claim 1 , wherein the access control list further comprises a list of users with access control list modification rights.

3. The system of claim 1 , wherein access control policy to the plaintext contents of the file is enforced on the client side.

4. The system of claim 1 , wherein any of: the file, file metadata, file system-related data and network metadata, is stored in an encrypted form.

5. The system of claim 1 , wherein any of: the file, file metadata, file system-related data and network metadata, is stored in a signed form.

6. The system of claim 1 , wherein the file has multiple revisions.

7. The system of claim 6 , wherein at least two of the revisions have different encryption and decryption keys.

8. The system of claim 6 , wherein every revision has the same encryption and decryption key.

9. The system of claim 1 , further comprising a directory in which at least one of the following is stored:

a path to storage elements associated with the file;

a file identifier;

the access control list;

a file's symbolic name associated with the directory and with the file identifier; file metadata; and

file history data,

wherein data representing the directory is available to users of the network.

10. The system of claim 9 , wherein the directory is stored in encrypted form.

11. The system of claim 9 , wherein the directory content in plaintext form is available only to users with read access.

12. The system of claim 9 , wherein separate entries in the directory have their own access control lists.

13. The system of claim 9 , wherein a path to the directory is provided to users of the network.

14. The system of claim 9 , wherein an owner identifier of the file is stored in the directory, and wherein the owner identifier identifies a user who can change the access control list.

15. The system of claim 14 , wherein the file has more than one owner identifier.

16. The system of claim 9 , wherein the directory is treated as if it were a file, for purposes of encryption, digital signature generation and verification.

17. The system of claim 1 , wherein the network is a peer-to-peer network.

18. The system of claim 1 , wherein all users of the network have access to ciphertext content of the file,

have access to the ciphertext access control list, and

have access to one of:

a path to storage elements associated with the file;

a file identifier;

a file's symbolic name associated with the directory and with the file identifier; and

file metadata.

19. The system of claim 1 , wherein write access includes any of write-once access, and write-many-times access.

20. The system of claim 1 , wherein the access control list includes a list of users with modification rights to a file containing the access control list.

21. The system of claim 1 , wherein the access control list is encrypted.

22. The system of claim 1 , wherein access to the plaintext contents of the access control list is restricted.

23. The system of claim 1 , further comprising a signature private key associated with the file and used to generate a digital signature for write access to the file; and

a signature public key associated with the file and used to verify the digital signature of the file.

24. The system of claim 1 , further comprising a signature private key associated with each user and used for generating a digital signature for write access to the file; and

a signature public key associated with each user and used for verifying the digital signature.

25. The system of claim 1 , wherein encrypting the plaintext contents of the file further comprises:

(a) generating a session key, which is a temporary key for symmetrical encryption;

(b) encrypting the file contents into ciphertext using the session key;

(c) encrypting the session key using the file public key; and

(d) attaching the encrypted session key to the ciphertext contents of the file.

26. The system of claim 1 , wherein all users of the network have access to file history data.

27. A computer-implemented method for secure distributed data storage that uses a network, the method comprising:

storing a file on a plurality of hardware storage elements that are accessible over the network; and

generating an access control list associated with the file;

storing, in the access control list, a list of users with read access to plaintext contents of the file;

storing, in the access control list, a list of users with write access to the file;

for each user, generating a user public key used for encrypting information for accessing the plaintext contents of the file;

for each user, generating a user private key used for decrypting the information for accessing the plaintext contents of the file;

generating a file public key associated with the file and used for encrypting the plaintext contents of the file;

generating a file private key associated with the file and used for decrypting the file into the plaintext contents;

wherein the user public key is used to encrypt the file private key, and the encrypted private file key is stored in the access control list,

wherein the user private key is used to decrypt the encrypted private file key, and

wherein data representing the ciphertext contents of the file, metadata associated with the file, data related to functioning of distributed data storage and the ciphertext access control list is available to any user of the network.

28. The method of claim 27 , wherein the method utilizes a directory in which at least one of the following is stored:

a path to storage elements associated with the file;

a file identifier;

the access control list;

a file's symbolic name associated with the directory and with the file identifier; file metadata; and

file history data,

wherein data representing the directory is available to users of the network, and

wherein the directory is treated as if it were a file, for purposes of encryption, digital signature generation and verification.

29. The method of claim 27 , wherein the method utilizes a directory in which a file identifier corresponding to the file, a public key for verifying a digital signature for the access control list, and a file identifier corresponding to a file that contains the access control list are stored.

30. The method of claim 27 , further comprising:

(a) generating a signature private key associated with the file and used to generate a digital signature for write access to the file; and

(b) generating a signature public key associated with the file and used to verify the digital signature of the file.

31. The method of claim 27 , further comprising generating a signature private key associated with each user and used for generating a digital signature for write access to the file; and

generating a signature public key associated with each user and used for verifying the digital signature.

32. The method of claim 27 , wherein encrypting the plaintext contents of the file further comprises:

(a) generating a session key, which is a temporary key for symmetrical encryption;

(b) encrypting the file contents into ciphertext using the session key;

(c) encrypting the session key using the file public key; and

(d) attaching the encrypted session key to the ciphertext contents of the file.

33. A system for secure distributed data storage that uses a network, the system comprising:

a processor;

a memory operatively coupled to the processor;

computer code in the memory for implementing the following functionality:

a file stored on a plurality of storage elements that are accessible over the network;

an access control list associated with the file;

a list of users, stored in the access control list, with write access to the file;

each user having a user public key and a user private key;

a file public key used for encrypting the file; and

a file private key used for decrypting the file,

wherein the user public key is used to encrypt the file private key, and the encrypted private file key is stored in the access control list,

wherein the user private key is used to decrypt the encrypted private file key, and

wherein the encrypted file, metadata associated with the file, and the encrypted access control list is available to users of the network.