Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Security kernel or utility
Reexamination Certificate
1999-08-09
2003-07-22
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Security kernel or utility
C713S168000
Reexamination Certificate
active
06598161
ABSTRACT:
FIELD OF THE INVENTION
The present invention relates to cryptography and more particularly to the encryption where multiple access rights are provided.
BACKGROUND OF THE INVENTION
With electronic documents, security is often a concern. One conventional way to protect a document is by associating a password or a key with the document and then encrypting the document content with the password or key. Thus, only users with the password or key may decrypt the document contents to view the contents.
However, the conventional encryption of a document typically only provides for a single level of protection. Thus, for example, if portions of a document are only to be viewed by certain authorized users and other portions are to be accessible by a different user or group of users, then it may be necessary, with conventional encryption techniques, to create multiple versions of the document. Each version would then be encrypted with different keys or passwords. Such an approach may be inefficient, time consuming and may, in some cases, compromise security as multiple versions of a secure document may make location and access of the document by an unauthorized party more likely.
One approach to providing different levels of security for a document is described in commonly assigned U.S. patent application Ser. No. 09/240,387 to Fletcher et al., entitled “METHOD, SYSTEM AND APPARATUS FOR SELECTING ENCRYPTION LEVELS BASED ON POLICY PROFILING,” the disclosure of which is incorporated herein as if set forth in its entirety. In Fletcher et al. documents are stored in an unencrypted database and different parts of a document are annotated with different security levels. When a request for the document is received a server looks up the requestor and determines which level(s) of information the requester is permitted to access. The server then inspects the document and filters out the content that the requestor is not allowed to access. The content which is not filtered out is then encrypted and provided to the user.
While the approach of Fletcher et al. provides differentiated levels of security for a document without requiring the storage of multiple versions of the document, this approach may be processor intensive as it utilizes a centralized resource to control the dissemination of information in documents. Furthermore, such an approach may be limiting in the event that a document is to be widely distributed, as distribution would involve subsequent interaction with the server to obtain the appropriate version of the document for each recipient in the distribution list.
In light of the above discussion, a need exists for improvements in the encryption of documents which allows for different levels of access to the documents.
SUMMARY OF THE INVENTION
In view of the above discussion, it is an object of the present invention to provide different levels of access to a document.
A further object of the present invention is to provide different levels of access to a document utilizing information contained in the document itself.
Still another object of the present invention is to provide multiple levels of access to a document which may be provided at the time of document generation or upon document access.
These and other objects of the present invention may be provided by methods, systems, and computer program products which encrypt a document by dividing the document into at least a first portion having a first security level and a second portion having a second security level. The document is then encrypted utilizing at least two encryption keys so as to encrypt the first portion of the document with a first of the at least two encryption keys and so as to encrypt the second portion of the document with a second of the at least two encryption keys. Although each portion of the document may be separately encrypted, preferably, the document is sequentially encrypted utilizing at least two encryption keys so as to encrypt the first portion of the document with a first of the at least two encryption keys and so as to encrypt the first and the second portion of the document with a second of the at least two encryption keys.
By separately encrypting portions of a document, the document may be later selectively decrypted to provide different levels of access to the document. Furthermore, by sequentially encrypting a document with separate encryption keys, the document may be decrypted to provide differing levels of access to the document without separately providing information about which portions of the document are encrypted with which encryption keys. Also, because the encryption process is independent of when the document is created, the encryption may be performed at the time of generation of the document or at a later time.
In a further embodiment of the present invention, a set of encryption keys corresponding to the portions of the document to be decrypted by an intended recipient of the document is incorporated into the document. The incorporated set of encryption keys may be encrypted utilizing an encryption key associated with the intended recipient to provide further security. Also, a plurality of sets of encryption keys may be incorporated for different intended recipients. By incorporating the encryption keys into the document, the document may be selectively decrypted without requiring further information about the document. Furthermore, the intended recipients and their respective levels of access may be controlled by controlling the sets of encryption keys that are incorporated into the document. Thus, the document may provide a self-contained mechanism for providing controlled access to the contents of the document.
In a still further embodiment of the present invention, the first portion of the document is decrypted utilizing the first encryption key and the second portion of the document is decrypted utilizing the second encryption key. Preferably, the first and the second portions of the document are decrypted utilizing the second encryption key and the first portion of the document is decrypted utilizing the first encryption key. If the encryption keys are incorporated into the document as a set of encryption keys, then the document may be decrypted utilizing the set of encryption keys incorporated into the document. Furthermore, the set of encryption keys may be decrypted utilizing the encryption key associated with the intended recipient after which the document may be decrypted utilizing the decrypted encryption keys contained within the set of encryption keys.
If a document is sequentially encrypted utilizing encryption keys contained within the set of encryption keys, then the document may be decrypted by sequentially decrypting the document utilizing the decrypted encryption keys in the set of encryption keys. The sequential decryption may be provided in a sequential order in reverse to the sequential order in which the document was encrypted.
In a still further embodiment of the present invention, an encrypted document is provided having a first portion of the document encrypted with a first encryption key and a second portion of the document, different from the first portion, encrypted with both the first encryption key and a second encryption key. The document may also include a third portion of the document which is unencrypted. The document may further include a key area containing at least one of the first encryption key and the second encryption key. If such is the case, then, preferably, the key area is encrypted with a third encryption key. The encrypted document may be a video clip, a word processing document, an audio clip, a spreadsheet, a database and/or a multimedia presentation.
As will further be appreciated by those of skill in the art, the present invention may be embodied as methods, apparatus/systems and/or computer program products.
REFERENCES:
patent: 5689565 (1997-11-01), Spies et al.
patent: 5742685 (1998-04-01), Berson et al.
patent: 5787175 (1998-07-01), Carter
patent: 5903646 (1999-05-01), Rackman
Kluttz Karen Ruth
Singhal Sandeep Kishan
Clay, Esq. A. Bruce
International Business Machines - Corporation
Myers Bigel Sibley & Sajovec P.A.
Peeso Thomas R.
LandOfFree
Methods, systems and computer program products for... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Methods, systems and computer program products for..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Methods, systems and computer program products for... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3093344