Generic file protection format
View Patent ↗A file may contain an unencrypted and an encrypted portion. The unencrypted portion may contain a layout section that may point to a published license, metadata, and a contents section, where the contents section is in the encrypted portion. The encrypted portion may contain the contents section which may act as a directory for one or more included files that may be compressed and stored in the encrypted portion. When the file is opened by a receiver, the receiver may read the published license and communicate with a security server to establish access rights and receive at least one key for decrypting at least a portion of the encrypted portion of the file. The receiver may then gain access to the included files.
1. A storage medium, the storage medium being hardware, storing computer-readable instructions that, when executed, perform actions comprising:
generating a container file comprising:
an unencrypted portion comprising:
a publication license comprising a license identifier, the publication license indicating one or more authorized devices, the publication license indicating a first user is allowed read only access and a second user is allowed read write access;
a layout section comprising a first pointer to said publication license, said layout section being located at a predefined location within said computer file;
an encrypted portion encrypted using a first encryption mechanism, the encrypted portion comprising:
a first encrypted data item encrypted using a second encryption mechanism, the second encryption mechanism being different from the first encryption mechanism; and
a contents directory comprising a second pointer to said first encrypted data item.
2. The storage medium of claim 1 , said first encrypted data item being a first encrypted file.
3. The storage medium of claim 2 , said encrypted portion comprising a plurality of encrypted files, said contents directory further comprising at least one pointer to each of said plurality of encrypted files.
4. The storage medium of claim 2 , said publication license further comprising an access policy.
5. The storage medium of claim 4 , said access policy comprising a condition for accessing said encrypted portion.
6. The storage medium of claim 5 , said condition comprising a first user identifier for the first user who is allowed a first type of access.
7. The storage medium of claim 6 , said condition comprising a second user identifier for the second user who is allowed a second type of access.
8. The storage medium of claim 1 , said encrypted portion being encrypted using a first encryption key, said first encryption key being related to said license identifier.
9. A method comprising:
reading a container file by a processor comprising:
an unencrypted portion comprising:
a publication license comprising a license identifier, the publication license indicating one or more authorized devices, the publication license indicating a first user is allowed read only access and a second user is allowed read write access;
a layout section comprising a first pointer to said publication license, said layout section being located at a predefined location within said computer file;
an encrypted portion encrypted using a first encryption mechanism, the encrypted portion comprising:
a first encrypted data item encrypted using a second encryption mechanism, the second encryption mechanism being different from the first encryption mechanism; and
a contents directory comprising a second pointer to said first encrypted data item;
examining said container file at said predefined location within said container file to read said layout section;
determining a first location within said container file for said publication license;
reading said publication license to retrieve said license identifier;
presenting said license identifier to a security server;
receiving a first encryption key from said security server; and
unencrypting said contents directory using said first encryption key.
10. The storage medium of claim 1 , the license identifier being a unique license identifier.
11. The storage medium of claim 1 , the publication license indicating a number of copies of the first encrypted data item that can be made.
12. The method of claim 9 further comprising:
presenting user credentials to said security server prior to retrieving said first encryption key.
13. The method of claim 12 further comprising:
presenting an application identification for a receiving application for said container file, said receiving application being capable of applying an access policy defined in said publication license.
14. The method of claim 13 , said access policy defining a read only access for any user having said user credentials.
15. The method of claim 13 , said access policy defining read and write access for any user having said user credentials.
16. The method of claim 13 , said access policy defining at least one restriction on said user access.
17. The method of claim 16 , said restriction being a time restriction.
18. An apparatus comprising:
a processor configured to provide:
a container generator configured to generate a container including:
an unencrypted portion comprising:
a publication license comprising an access policy and a license identifier, the publication license indicating one or more authorized devices, the publication license indicating a first user is allowed read only access and a second user is allowed read write access;
a metadata section;
a layout section comprising a first pointer to said publication license and a second pointer to said metadata section, said layout section being located at a predefined location within said computer file;
an encrypted portion encrypted using a first encryption mechanism, the encrypted portion comprising:
a first encrypted file encrypted using a second encryption mechanism, the second encryption mechanism being different from the first encryption mechanism; and
a contents directory comprising a second pointer to said first encrypted data item, said layout section further comprising a third pointer to said contents directory.
19. The apparatus of claim 18 , said access policy comprising a user identifier and a set of access permissions associated with said user identifier.
20. The apparatus of claim 19 , said publication license further comprising a Uniform Resource Identifier for a security server capable of receiving user credentials and said license identifier and returning a second encryption key capable of decrypting said contents directory.