Decryption and encryption of application data

Patent metadata

Field	Value
Publication number	US-9489520-B2
Application number	US-201114347550-A
Country	US
Kind code	B2
Filing date	Sep 29, 2011
Priority date	Sep 29, 2011
Publication date	Nov 8, 2016
Grant date	Nov 8, 2016

Abstract

Examples disclose providing a decryption, validation and encryption process. Specifically, disclosure includes decrypting a first encrypted application data to then validate its integrity. Disclosure also includes encrypting the decrypted application data using a technique different from that used to provide the first encrypted application data and then storing the encrypted application data.

First claim

We claim:

1. A method for preventing unauthorized access to application data comprising: receiving, from a trusted source at a trusted source location, a first encrypted application data at a computing device at a first location, wherein the trusted source uses a first encryption technique at the trusted source location; decrypting, the first encrypted application data received at the computing device from the trusted source to generate a first decrypted application data on the computing device; validating an integrity of the first decrypted application data on the computing device by computing a data value from the first encrypted application data and comparing the data value to a stored value on the trusted source; encrypting, at the first location, the first decrypted application data on the computing device with an encryption technique different from the first encryption technique used for the first encrypted application data to generate a second encrypted application data, wherein the encryption technique on the computing device is an encryption program which uses a key specific to a user of the computing device; storing the second encrypted application data on a memory of the computing device; decrypting the second encrypted application data to generate a second decrypted application data; and executing the second decrypted application data on the computing device; validating the integrity of the second decrypted application data; and receiving a status update of the second decrypted application data from the trusted source.

2. The method of claim 1 , wherein receiving the status update of the second decrypted application includes at least one of non-executable, recall, requires update, and hold.

3. The method of claim 1 , further comprising: terminating the second decrypted application data by removing one or more files associated with the second decrypted application data from the memory of the computing device.

4. A computing device at a first location, the computing device comprising: a communication platform to: receive from a trusted source a first encrypted application data wherein the trusted source uses a first encryption at a trusted source location, wherein the trusted source location is different than the first location; a processor to: decrypt the first encrypted application data to provide a first decrypted application data; validate an integrity of the first decrypted application data by computing a data value from the first encrypted application data and comparing the data value to a stored value on the trusted source; encrypt, at the first location, the first decrypted application data with a second encryption different from the first encryption to provide a second encrypted application data, wherein the second encryption is an encryption program which uses a key specific to a user of the computing device; and a memory to store the second encrypted application data, wherein the processor: decrypts the second encrypted application data to generate a second decrypted application data; and executes the second decrypted application data on the computing device; retrieves the second encrypted application data from the memory; validate the integrity of the second decrypted application data; and receive a status of the second decrypted application data from the trusted source.

5. The computing device of claim 4 , wherein to decrypt the first encrypted application data, the processor is additionally to:
receive an encryption key from the trusted source;
encrypt the encryption key; and
store the encryption key.

6. The computing device of claim 4 , wherein the application data includes at least one executable file, configuration file, media, library, metadata, source code, or other software related application file.

7. The computing device of claim 4 , wherein to retrieve the second encrypted application data from the memory includes the processor responding to a user initiated request.

8. The computing device of claim 4 , further comprising a memory for the processor to: cache the second decrypted application data into the memory; receive a request to terminate the second decrypted application data; and remove the second decrypted application data from the memory.

9. A non-transitory machine-readable storage medium comprising instructions that if executed cause a processor to: receive at a computing device at first location a first encrypted application data, encrypted with a first encryption at a location of a trusted source that is different than the first location; decrypt the first encrypted application data based on a received encryption key to generate a first decrypted application data; validate an integrity of the first decrypted application data by computing a data value from the first encrypted application data and comparing the data value to a stored value on the trusted source; generate at the computing device a second encrypted application data by encrypting, at the first location, the first decrypted application data with a second encryption different from the first encryption method, wherein the second encryption is an encryption program which uses a key specific to a user of the computing device; store the second encrypted application data in a memory of the computing device decrypt the second encrypted application data to generate a second decrypted application data; and execute the second decrypted application data on the computing device; wherein if executed cause the processor additionally to: validate the integrity of the second decrypted application data; and receive a status update from the trusted source for the second decrypted application data.

Assignees

• Martin Robert P
• Hochmuth Roland M
• Hewlett Packard Development Co Lp

Inventors

• Martin Robert P
• Hochmuth Roland M

Classifications

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F21/10

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• G06F21/12 Primary

  Protecting executable software · CPC title

• G06F2221/2107

  File encryption · CPC title

• G06Q20/1235

  with control of digital rights management [DRM] · CPC title