Granted Patent B2

US 10,083,307 · App. 15/147,277 · Granted Sep 25, 2018

Abstract

Claims (70)

1. A method for selectively assisting a decryption process of an encrypted file entity, the method comprises:

receiving, from a computerized system, a first encrypted file entity key and signed access metadata,

wherein the first encrypted file entity key is created by encrypting a file entity key using a first encryption key;

wherein the signed access metadata is signed by the file entity key;

wherein the encrypted file entity is created by encrypting a file entity using the file entity key;

determining whether to facilitate the decryption of the encrypted file entity by the computerized system;

sending a second encrypted file entity key to the computerized system if it is determined to facilitate the decryption, wherein the second encrypted file entity key is created by (a) decrypting the first encrypted file entity key to provide the file entity key, and (b) encrypting the file entity key with an encryption key of the computerized system; and

preventing the computerized system to decrypt the encrypted file entity if it is determined not to facilitate the decryption of the encrypted file entity by the computerized system.

2. The method according to claim 1 wherein the file entity is a file.

3. The method according to claim 1 wherein the file entity is a first portion of a file.

4. The method according to claim 3 , wherein the file further comprises a second file portion that is not encrypted by the file entity key.

5. The method according to claim 1 wherein the first encrypted file entity key and the signed access metadata are received from the computerized system via another computerized system.

6. The method according to claim 1 wherein the first encrypted file entity key, the signed access metadata, and the encrypted file entity are created, signed, and encrypted by one or more computerized systems other than the computerized system.

7. The method according to claim 1 comprising determining not to facilitate the decryption of the encrypted file entity by the computerized system if the signed access data is invalid.

8. The method according to claim 1 comprising determining whether to facilitate the decryption of the encrypted file entity by the computerized system based a content of the signed access data if the signed access data is valid.

9. The method according to claim 1 wherein the signed access metadata comprises information about one or more computerized systems that are entitled to decrypt the encrypted file entity.

10. A method for selectively assisting a decryption process of an encrypted file entity, the method comprises:

receiving, from a computerized system, a double encrypted file entity key and signed access metadata;

wherein the first encrypted file entity key is created by encrypting a file entity key using a first encryption key;

wherein the double encrypted file entity key is created by encrypting a first encrypted file entity key using a second encryption key;

wherein the signed access metadata is signed by the file entity key;

wherein the encrypted file entity is created by encrypting a file entity using the file entity key;

determining whether the computerized system is entitled to decrypt the file entity;

preventing from assisting the computerized system to decrypt the encrypted file entity if it is determined that the computerized system is not entitled to decrypt the file entity;

decrypting the double encrypted file entity key to provide the first encrypted file entity key if it is determined that the computerized system is entitled to decrypt the file entity;

sending a second encrypted file entity key to the computerized system, wherein the second encrypted file entity key is created by (a) decrypting the first encrypted file entity key to provide the file entity key, and (b) encrypting the file entity key with an encryption key of the computerized system.

11. The method according to claim 10 wherein the file entity is a file.

12. The method according to claim 10 wherein the file entity is a first portion of a file.

13. The method according to claim 12 , wherein the file further comprises a second file portion that is not encrypted by the file entity key.

14. The method according to claim 10 wherein one or more of the first encrypted file entity key, the double encrypted file entity key, the second encrypted file entity key, the signed access metadata, and the encrypted file entity are created, signed, and encrypted by one or more computerized systems other than the computerized system.

15. The method according to claim 10 wherein the signed access metadata comprises information about one or more computerized systems that are entitled to decrypt the encrypted file entity.

16. The method according to claim 10 comprising determining not to facilitate the decryption of the encrypted file entity by the computerized system if the signed access data is invalid.

17. At least one computer-readable storage medium having computer-executable instructions embodied thereon, wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to:

receive, from a computerized system, a first encrypted file entity key and signed access metadata,

wherein the first encrypted file entity key is created by encrypting a file entity key using a first encryption key;

wherein the signed access metadata is signed by the file entity key;

wherein the encrypted file entity is created by encrypting a file entity using the file entity key;

determine whether to facilitate the decryption of the encrypted file entity by the computerized system;

send a second encrypted file entity key to the computerized system if it is determined to facilitate the decryption, wherein the second encrypted file entity key is created by (a) decrypting the first encrypted file entity key to provide the file entity key, and (b) encrypting the file entity key with an encryption key of the computerized system; and

prevent the computerized system to decrypt the encrypted file entity if it is determined not to facilitate the decryption of the encrypted file entity by the computerized system.

18. At least one computer-readable storage medium having computer-executable instructions embodied thereon, wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to:

receive a double encrypted file entity key and signed access metadata;

wherein the double encrypted file entity key is created by encrypting a first encrypted file entity key using a second encryption key;

wherein the first encrypted file entity key is created by encrypting a file entity key using a first encryption key;

wherein the signed access metadata is signed by the file entity key;

wherein the encrypted file entity is created by encrypting a file entity using the file entity key;

determine whether the computerized system is entitled to decrypt the file entity;

prevent from assisting the computerized system to decrypt the encrypted file entity if it is determined that the computerized system is not entitled to decrypt the file entity;

decrypt the double encrypted file entity key to provide the first encrypted file entity key if it is determined that the computerized system is entitled to decrypt the file entity;

send a second encrypted file entity key to the computerized system, wherein the second encrypted file entity key is created by (a) decrypting the first encrypted file entity key to provide the file entity key, and (b) encrypting the file entity key with an encryption key of the computerized system.

19. A computer, comprising:

a processor configured to

receive, from a computerized system, a first encrypted file entity key and signed access metadata;

wherein the first encrypted file entity key is created by encrypting a file entity key using a first encryption key;

wherein the signed access metadata is signed by the file entity key;

wherein the encrypted file entity is created by encrypting a file entity using the file entity key;

determine whether to facilitate the decryption of the encrypted file entity by the computerized system;

send a second encrypted file entity key to the computerized system if it is determined to facilitate the decryption, wherein the second encrypted file entity key is created by (a) decrypting the first encrypted file entity key to provide the file entity key, and (b) encrypting the file entity key with an encryption key of the computerized system; and

prevent the computerized system to decrypt the encrypted file entity if it is determined not to facilitate the decryption of the encrypted file entity by the computerized system.

20. A computer, comprising:

a processor configured to

receive, from a computerized system, a double encrypted file entity key and signed access metadata;

wherein the double encrypted file entity key is created by encrypting a first encrypted file entity key using a second encryption key;

wherein the first encrypted file entity key is created by encrypting a file entity key using a first encryption key;

wherein the signed access metadata is signed by the file entity key;

wherein the encrypted file entity is created by encrypting a file entity using the file entity key;

determine whether the computerized system is entitled to decrypt the file entity;

prevent from assisting the computerized system to decrypt the encrypted file entity if it is determined that the computerized system is not entitled to decrypt the file entity;

decrypt the double encrypted file entity key to provide the first encrypted file entity key if it is determined that the computerized system is entitled to decrypt the file entity;

send a second encrypted file entity key to the computerized system, wherein the second encrypted file entity key is created by (a) decrypting the first encrypted file entity key to provide the file entity key, and (b) encrypting the file entity key with an encryption key of the computerized system.

Assignments (10)