Method, secure device, system and computer program product for securely managing files

Patent metadata

Field	Value
Publication number	US-9811646-B2
Application number	US-201113822137-A
Country	US
Kind code	B2
Filing date	Aug 8, 2011
Priority date	Sep 16, 2010
Publication date	Nov 7, 2017
Grant date	Nov 7, 2017

Abstract

A method, a secure device and a computer program product for securely managing files. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server via a host, the host connected to the server through a telecommunication network, upon receiving a request for using a file stored on the secure device, processing the request at the secure device according to an updated use permission associated to the file, where the updated use permission is obtained by instructing at the secure device to establish a connection between the secure device and the server via the host and updating at the device the use permission associated to the file, according to permission data sent from the server through the established connection.

First claim

What is claimed is:

1. A method for securely managing files, comprising the steps of:
providing a secure device, wherein the secure device is protected by design against malicious software or malware and does not include client interfaces for software installation that would expose the secure device to malware, wherein the secure device is adapted to establish a connection to a server that is not the secure device, via a host connected to the server through a telecommunication network;
encrypting a file at the secure device, using an encryption key, wherein the encryption key is stored (i) on a smart card or an internal memory of the device which is not externally accessible, or (ii) entered by the user at the device;
receiving a request for accessing the file stored on the secure device, wherein the file requires an updated use permission from the server to access the file stored on the secured device;
establishing a connection between the secure device and the server, via the host;
in response to receiving, at the secure device, use permission data sent from the server, updating, at the secure device, a use permission required to access the file stored on the secured device according to the use permission data;
receiving at the secure device a decryption key for decrypting the file, the decryption key sent from the server through the connection established between the secure device and the server; and
processing the request, at the secure device, according to the updated use permission required to access the file stored on the secure device.

2. The method of claim 1 , further comprising:
storing the file at the secure device, wherein the file was sent from the server through the connection established between the secure device and the server.

3. The method of claim 1 , further comprising, after receiving the request at the device:
updating the use permission required to access the file upon granting the request received at the secure device.

4. The method of claim 3 , wherein the step of updating the use permission upon granting the request comprises:
updating, at the secure device, the use permission required to access the file.

5. The method of claim 3 , wherein the step of updating the use permission upon granting the request comprises:
sending to the server data related to the processed request, through the connection established between the secure device and the server; and
updating, at the server, the use permission required to access the file.

6. The method of claim 1 , further comprising:
before receiving the request for using the file and after updating the use permission required to access the file, instructing, at the secure device, to expose the file to a user interface or an application according to the updated use permission.

7. The method of claim 1 , wherein the connection established via the host is SSL/TLS connection.

8. The method of claim 1 , wherein the updated use permission comprises a parameter, which as interpreted by the secure device for processing a request for using the file, restricts the number of times that the associated file can be accessed or the time during which it can be accessed.

9. The method of claim 1 , wherein the updated use permission, as maintained at the secure device, decomposes into several sub-permissions, each associated to a given type of request, wherein the request comprises reading at the secure device, printing at an external printer, or reading from an external device.

10. The method of claim 1 , further comprising:
logging, at the server, the request received for using the file.

11. The method of claim 1 , wherein the updated use permission comprises a parameter, wherein the parameter is a number of times that the associated file can be accessed.

12. The method of claim 11 , further comprising:
granting the request received at the secure device;
in response to granting the request received at the secure device, updating, at the secure device, the use permission required to access the file, by decrementing the number of times that the file can accessed by one;
sending to the server data related to the decrementing of the number of times that the file can accessed, through the connection established between the secure device and the sever; and
updating, at the server, the use permission required to access to the file based on the decrementing of the number of times that the file can be accessed.

13. A secure device protected by design against malicious software or malware, wherein the secure device does not include client interfaces for software installation that would expose the secure device to malware, wherein the secure device is adapted to establish a connection to a server that is not the secure device, via a host connected to the server through a telecommunication network, the device comprising:
a processor;
a memory;
interfaces configured to couple to or interact with a user, a personal computer, and a server;
wherein the memory comprises computer readable program code having computer readable instructions which, when executed, cause the processor to carry out the steps of a method comprising:
encrypting a file at the secure device, using an encryption key, wherein the encryption key is stored (i) on a smart card or an internal memory of the device which is not externally accessible, or (ii) entered by the user at the device;
receiving a request for accessing a file stored on the secure device, wherein the file requires an updated use permission from the server to access the file stored on the secured device;
establishing a connection between the secure device and the server, via the host;
in response to receiving, at the secure device, use permission data sent from the server, updating, at the secure device, a use permission required to access the file stored on the secured device according to the use permission data;
receiving at the secure device a decryption key for decrypting the file, the decryption key sent from the server through the connection established between the secure device and the server; and
processing the request, at the secure device, according to the updated use permission required to access the file stored on the secure device.

14. A system comprising:
a personal computer;
a server; and
a secure device protected by design against malicious software or malware, wherein the secure device does not include client interfaces for software installation that would expose the secure device to malware, wherein the secure device is adapted to establish a connection to a server that is not the secure device, via a host connected to the server through a telecommunication network, the device comprising:
a processor;
a memory;
interfaces configured to couple to or interact with a user, a personal computer, and a server;
wherein the memory comprises computer readable program code having computer readable instructions which, when executed, cause the processor to carry out the steps of a method comprising:
encrypting a file at the secure device, using an encryption key, wherein the encryption key is stored (i) on a smart card or an internal memory of the device which is not externally accessible, or (ii) entered by the user at the device;
receiving a request for accessing a file stored on the secure device, wherein the file requires an updated use permission from the server to access the file stored on the secured device;
establishing a connection between the secure device and the server, via the host;
in response to receiving, at the secure device, use permission data sent from the server, updating, at the secure d

Assignees

• Baentsch Michael
• Buhler Peter
• Dykeman Harold D
• Hermann Reto J
• Hoering Frank
• Kuyper-Hammond Michael P
• Ortiz-Yepes Diego Alejandro
• Weigold Thomas D
• IBM

Inventors

• Baentsch Michael
• Buhler Peter
• Dykeman Harold D
• Hermann Reto J
• Hoering Frank
• Kuyper-Hammond Michael P
• Ortiz-Yepes Diego Alejandro
• Weigold Thomas D

Classifications

• G06F21/121 Primary

  Restricting unauthorised execution of programs · CPC title

• G06F21/10 Primary

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title