File sharing and policy control based on file link mechanism

Patent metadata

Field	Value
Publication number	US-10834060-B2
Application number	US-201816185885-A
Country	US
Kind code	B2
Filing date	Nov 9, 2018
Priority date	Apr 11, 2017
Publication date	Nov 10, 2020
Grant date	Nov 10, 2020

Abstract

A method, a computing system and a computer program product are provided. A link for use by a user to access a file is created. Content of the file is encrypted using a common key. The common key is encrypted using a public key of the user and is registered in the link. Access rights regarding the file are set for the user and registered in the link. The link includes information for use by the user to access the file when the access rights indicate that the user is authorized to access the file.

First claim

The invention claimed is:

1. A machine-implemented method for accessing a file, the method comprising:
creating, by a computing device, a plurality of links to a file, each of the plurality of links being for use by a respective user of a plurality of users to access the file;
encrypting, by the computing device, content of the file by using a common key;
encrypting, by the computing device, the common key using a respective public key of each respective user to produce a respective encrypted common key for the each respective users;
registering, by the computing device, the respective encrypted common key for the each respective user in a respective link of the plurality of links;
setting, by the computing device, respective access rights regarding the file for the each respective user;
registering, by the computing device, the respective access rights for the each respective user in the respective link of the plurality of links; and
permitting access to the content of the file for a respective user only when a request to access the file is received including a private key of the respective user, and the access rights registered in one of the plurality of created links for use by the respective user indicating that the respective user is authorized to access the file.

2. The machine-implemented method of claim 1 , further comprising:
performing key management of private keys of the plurality of users in collaboration with an external key management service.

3. The machine-implemented method of claim 1 , further comprising:
obtaining encryption information included in the one of the plurality of created links to the file;
determining whether the respective user is authorized to decrypt the content of the file based on the encryption information; and
decrypting the content of the file, when the respective user is determined to be authorized to decrypt the content of the file, to produce a decrypted content of the file, wherein
the permitting access to the content of the file includes allowing access to the decrypted content of the file when the respective user is determined to be authorized to decrypt the content of the file.

4. The machine-implemented method of claim 3 , wherein
the decrypting of the content of the file further comprises:
obtaining an encrypted common key via key information included in the one of the plurality of created links to the file,
decrypting the encrypted common key with the private key of the respective user to produce the common key, and
decrypting the content of the file using the common key.

5. A computing system comprising:
at least one processor; and
at least one memory connected to the at least one processor, wherein the at least one processor is configured to perform:
creating a plurality of links to a file, each of the plurality of links being for use by a respective user of a plurality of users to access the file;
encrypting content of the file by using a common key;
encrypting the common key using a respective public key of each respective user to produce a respective encrypted common key for the each respective user;
registering the respective encrypted common key for the each respective user in a respective link of the plurality of links;
setting respective access rights regarding the file for the each respective user;
registering the respective access rights for the each respective user in the respective link of the plurality of links; and
permitting access to the content of the file for a respective user only when a request to access the file is received including a private key of the respective user, and the access rights registered in one of the plurality of created links for use by the respective user indicating that the respective user is authorized to access the file.

6. The computing system of claim 5 , wherein the at least one processor is further configured to perform:
performing key management of private keys of the plurality of users in collaboration with an external key management service.

7. The computing system of claim 5 , wherein the at least one processor is further configured to perform:
obtaining encryption information included in the one of the plurality of created links to the file;
determining whether the respective user is authorized to decrypt the content of the file based on the encryption information; and
decrypting the content of the file, when the respective user is determined to be authorized to decrypt the content of the file, to produce a decrypted content of the file, wherein
the permitting access to the content of the file includes allowing access to the decrypted content of the file when the respective user is determined to be authorized to decrypt the content of the file.

8. The computing system of claim 7 , wherein
the decrypting of the content of the file further comprises:
obtaining an encrypted common key via key information included in the one of the plurality of created links to the file,
decrypting the encrypted common key with the private key of the respective user to produce the common key, and
decrypting the content of the file using the common key.

9. A computer program product comprising:
at least one computer readable storage medium having computer readable program code embodied therewith for execution on at least one processor, the computer readable program code being configured to be executed by the at least one processor to perform:
creating a plurality of links to a file, each of the plurality of links being for use by a respective user of a plurality of users to access the file;
encrypting content of the file by using a common key;
encrypting the common key using a respective public key of each respective user to produce a respective encrypted common key for the each respective user;
registering the respective encrypted common key for the each respective user in a respective link of the plurality of links;
setting respective access rights regarding the file for the each respective user;
registering the respective access rights for the each respective user in the respective link of the plurality of links; and
permitting access to the content of the file for a respective user only when a request to access the file is received including a private key of the respective user, and the access rights registered in one of the plurality of created links for use by the respective user indicating that the respective user is authorized to access the file.

10. The computer program product of claim 9 , wherein the computer readable program code is further configured to be executed by the at least one processor to perform:
performing key management of private keys of the plurality of users in collaboration with an external key management service.

11. The computer program product of claim 9 , wherein the computer readable program code is further configured to be executed by the at least one processor to perform:
obtaining encryption information included in the one of the plurality of created links to the file;
determining whether the respective user is authorized to decrypt the content of the file based on the encryption information; and
decrypting the content of the file, when the respective user is determined to be authorized to decrypt the content of the file, to produce a decrypted content of the file, wherein
the permitting access to the content of the file includes allowing access to the decrypted content of the file when the respective user is determined to be authorized to decrypt the content of the file.

12. The computer program product of claim 11 , wherein
the decrypting of the content of the file further comprises:

Assignees

• IBM

Inventors

• Kato Junichi
• Kushida Takayuki
• Murayama Tomoko
• Sakamoto Masaharu
• Yamafuji Kazuto

Classifications

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/045

  wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title

• G06F16/176

  Support for shared access to files; File sharing support · CPC title