Source: https://patents.google.com/patent/AU2010256810B2/en
Timestamp: 2020-01-18 23:50:51
Document Index: 549688905

Matched Legal Cases: ['Application No. 12', 'Application No. 12', 'Application No. 12', 'Application No. 12', 'Application No. 12', 'Application No. 12']

AU2010256810B2 - Workgroup key wrapping for community of interest membership authentication - Google Patents
AU2010256810B2
AU2010256810B2 AU2010256810A AU2010256810A AU2010256810B2 AU 2010256810 B2 AU2010256810 B2 AU 2010256810B2 AU 2010256810 A AU2010256810 A AU 2010256810A AU 2010256810 A AU2010256810 A AU 2010256810A AU 2010256810 B2 AU2010256810 B2 AU 2010256810B2
AU2010256810A1 (en
2009-06-02 Priority to US12/476,437 priority Critical patent/US20100306530A1/en
2009-06-02 Priority to US12/476,437 priority
2 Summary In a first aspect, a method of managing a community of interest having access to a resource comprises creating a workgroup key associated with a community of interest, and protecting one or more resources associated with the 5 community of interest using the workgroup key. The method also includes encrypting the workgroup key using a public key associated with an administrator of the community of interest, the public key included with a private key in a public/private key pair associated with the administrator. The method further includes storing the encrypted workgroup key, and associating the workgroup key 10 with a user, thereby adding the user to the community of interest, wherein associating the workgroup key with a user comprises retrieving the encrypted workgroup key; decrypting the workgroup key encrypted with the private key associated with the administrator using the private key associated with the administrator; and encrypting the decrypted workgroup key using a public key 15 associated with a user to be added to the community of interest, the public key included with a private key in a public/private key pair associated with the user. In a second aspect, a method of rekeying a community of interest including a plurality of users, each of the users having access to a workgroup key used to protect a resource, is disclosed. The method includes disassociating a workgroup key from 20 each of the plurality of users having access to the workgroup key, and creating a replacement workgroup key associated with the community of interest, the replacement workgroup key protecting the resource protected by the workgroup key. The method also includes encrypting the replacement workgroup key using a key associated with an administrator of the community of interest, and storing the 25 encrypted replacement workgroup key. The method further includes associating the replacement workgroup key with each of the plurality of users, thereby including each of the plurality of users in the community of interest, wherein the key is a public key of a public/private key pair associated with the administrator; and wherein associating the replacement workgroup key with each of the plurality of 30 users comprises retrieving the encrypted replacement workgroup key; decrypting the replacement workgroup key encrypted with the public key associated with the administrator using the private key associated with the administrator; and for each of the plurality of users, encrypting the decrypted workgroup key using a public key 3 associated with that user, the public key included with a private key in a public/private key pair associated with the user.. In a third aspect, a system for managing membership in a community of interest includes a key server including a memory and a programmable circuit. The 5 key server is accessible to a plurality of users and manages access to a plurality of resources. The memory is configured to store a directory including a plurality of user profiles, each user profile associated with a user. The programmable circuit is communicatively connected to the memory and configured to execute program instructions to create a workgroup key associated with a community of interest and 10 protect one or more of the plurality of resources associated with the community of interest using the workgroup key. The programmable circuit is further configured to encrypt the workgroup key using a public key associated with an administrator of the community of interest, the public key included with a private key in a public/private key pair associated with the administrator. The programmable circuit 15 is also configured to store the encrypted workgroup key in a user profile of the administrator, the user profile of the administrator included in the directory, and associate the workgroup key with one or more users from among the plurality of users, thereby adding each of the one or more users to the community of interest, wherein the programmable circuit is configured to associate the workgroup key with 20 one or more uses by executing program instructions to: retrieve the encrypted workgroup key; decrypt the workgroup key encrypted with the private key associated with the administrator using the private key associated with the administrator; and encrypt the decrypted workgroup key using a public key associated with a user to be added to the community of interest, the public key 25 included with a private key in a public/private key pair associated with the user. Brief Description of the Drawings Figure 1 is a schematic view of a network in which aspects of the present disclosure can be implemented; Figure 2 is a schematic view of a secured network implementing 30 communities of interest; Figure 3 is a schematic illustration of a system in which secure access of a requested resource is accomplished using wrapped workgroup keys; 3a Figure 4 is a schematic block diagram of aspects of a key server used to manage wrapped workgroup keys; Figure 5 is an example flowchart of methods and systems for managing a community of interest having access to a resource; 5 Figure 6 is an example flowchart of methods and systems for associating a user with a workgroup key associated with a community of interest; Figure 7 is an example flowchart of methods and systems for accessing a resource as a member of a community of interest; Figure 8 is an example flowchart of methods and systems for rekeying a 10 community of interest with a replacement workgroup key; and Figure 9 is a block diagram illustrating example physical components of an electronic computing device. Detailed Description Various embodiments of the present invention will be described in detail 15 with reference to the drawings, wherein like reference numerals represent like parts and assemblies throughout the several views. Reference to various embodiments does not limit the scope of the invention, which is limited only by the scope of the claims attached hereto. Additionally, any examples set forth in this specification are WO 2010/141445 PCT/US2010/036869 4 not intended to be limiting and merely set forth some of the many possible embodiments for the claimed invention. The logical operations of the various embodiments of the disclosure described herein are implemented as: (1) a sequence of computer implemented steps, 5 operations, or procedures running on a programmable circuit within a computer, and/or (2) a sequence of computer implemented steps, operations, or procedures running on a programmable circuit within a directory system, database, or compiler. In general the present disclosure relates to use of workgroup keys to define communities of interest and protect computing resources, and a methodology for 10 wrapping of workgroup keys using secondary encryption keys to manage access to the workgroup keys. The methods and systems of this disclosure use key management techniques to control membership in communities of interest and thereby allow user access to data, network ports, or other computing resources. Figure 1 is a schematic view of a network 100 in which aspects of the 15 present disclosure can be implemented. The network 100 represents a number of different example scenarios in which secured access to a computing resource is desired, and in which communities of interest can be implemented. In the embodiment shown, the network 100 includes a number of example subnetworks in which secured communication using communities of interest can take place. The 20 network 100 includes a secured local area network 102, a storage network 104, and a secure communication connection 106. The local area network 102 corresponds to a secured local area network in which data, applications, computing resources, or other computing capabilities can be shared among a number of computers and a number of users. For example, the 25 local area network 102 can be a network within a corporation or otherwise controlled by a single entity, such that access to the network is limited but data access within the network is widely distributed. In such situations, one or more users may require access to certain data, and other users are restricted from access to that data. Or, certain users can have access to computing resources or portions of 30 the network (or a level of access) that other users within the local area network do WO 2010/141445 PCT/US2010/036869 5 not have. Other distributions of users in communities of interest within the local area network 102 are possible as well. In certain embodiments, each of the users in the local area network 102 can communicate using a secure communications arrangement such as those using 5 cryptographic splitting of data across messages transmitted between computers within the network. Example secure communications systems are described in U.S. Patent Applications Nos. 11/714,590, entitled "Securing and Partitioning Data-in Motion Uising a Community-of-Interest Key," to Johnson, filed March 6, 2007 (Attorney Docket No. TN400.USCIP 1), 11/714,666, entitled "Communicating Split 10 Portions Of A Data Set Across Multiple Data Paths," to Johnson et al., filed March 6, 2007 (Attorney Docket No. TN400.USCIP2), and 11/714,590, entitled "Gateway For Securing Data To/From A Private Network," to Johnson, filed March 6, 2007 (Attorney Docket No. TN400.USCIP3), all of which are Continuation-in-Parts of U.S. Patent Application Serial No. 11/339,974, entitled "Integrated Multi-Level 15 Security System', to Johnson, filed January 26, 2006 (Attorney Docket No. TN400), the disclosures of which are hereby incorporated by reference in their entireties. The storage network 104 includes a number of data storage devices (e.g. databases or data storage devices) configured to store data accessible to a number of users. In the context of the storage network, different users can be allowed access to 20 different sets of data, or different views of a given set of data. Alternately, different users can be allowed different access levels to the data. In certain embodiments, the storage network 104 can be secured using communities of interest to control access to virtual volumes that are further secured using cryptographic splitting to store data across volumes, improving security and data availability. Example cryptographic 25 splitting architectures are described in U.S. Patent Application No. 12/342,636 (Unisys Control No. TN498); U.S. Patent Application No. 12/342,575 (Unisys Control No. TN498A); and U.S. Patent Application No. 12/343,6 10 (Unisys Control No. TN498B), each filed on December 23, 2008 and entitled "Storage Communities Of Interest Using Cryptographic Splitting", the disclosures of which are hereby 30 incorporated by reference in their entireties. Further example cryptographic splitting architectures are described in U.S. Patent Application No. 12/336,559 (Unisys WO 2010/141445 PCT/US2010/036869 6 Control No. TN496); U.S. Patent Application No. 12/336,562 (Unisys Control No. TN496A); and U.S. Patent Application No. 12/336,564 (Unisys Control No. TN496B), each filed on December 17, 2008 and entitled "Storage Security Using Cryptographic Splitting", the disclosures of which are hereby incorporated by 5 reference in their entireties. The secure communication connection 106 includes a direct secure communication connection between two or more computing systems. In such an arrangement, a user of one of the computing systems may be provided dedicated and/or secure access to a port or some other portion of the complementary 10 computing system. That access right can be provided to that user (and other users having access to that computer) based on the user's identity and access to a workgroup key used to protect communicative access to the remote computer, in an analogous manner to that described in the local area network 102, above. In the embodiment shown, the secured local area network 102, storage 15 network 104, and secure communication connection 106 are interconnected via an unsecured connection, illustrated as the Internet 108. Although any of a variety of networks can be used, it is intended that the Internet 108 represent unsecured communication channels between computing systems, such that data or other resources must be individually secured prior to transmission on such a network. 20 Such security over an open network such as Internet 108 can be accomplished using a community of interest access control of resources between trusted computers as well. Figure 2 is a schematic view of a secured network 200 implementing communities of interest. The secured network 200 can represent any of a number of 25 networks having accessible computing resources, such as the network 100 of Figure 1 or any of the subnetworks described therein. The secured network 200 illustrates an example network in which access to computing resources is controlled using communities of interest, as implemented using protected workgroup keys. The secured network 200 includes a plurality of communities of interest 30 202a-n, each of which corresponds to one or more users having common interests in WO 2010/141445 PCT/US2010/036869 7 and access to computing resources within the network. Each of the communities of interest 202a-n can include one or more users and/or computing systems accessible to users having a common interest in a computing resource, such as data storage, communication ports, or other computing resources. 5 A number of computing resources are available to the communities of interest 202a-n in the example secured network 200, including computing systems 204a-b, and data storage 206a-d. A key server 208 manages access to the computing resources by managing users in one or more communities of interest. In general, the key server 208 maintains a directory of users, and can provide to each user one or 10 more workgroup keys (designated "WK[number]" in the examples below, or generally as "WK" for convenience). Each workgroup key WK1 through WKN is associated with a particular community of interest, with access to the workgroup key defining whether or not a user is a member of the community of interest. For example, a first community of interest can be associated with a number of resources 15 protected by workgroup key WK1, while a second community of interest (which may include the same or different users as members) can be associated with a different set of resources protected by a different workgroup key, e.g., WK2. The key server 208 securely stores copies of workgroup keys specific to different communities of interest by "wrapping" each workgroup key, or encrypting the key 20 with a key specific to that user. Example configurations providing additional details of a user accessing a protected resource as a member of a community of interest are shown in further detail in Figures 3-4. Figure 3 is a schematic illustration of a system 300 in which secure access of a requested resource is accomplished using wrapped workgroup keys. In the 25 embodiment shown, a requesting computing device 302 is connected to a requested resource host 304 and a key server 306. The requesting computing device 302 is a computing device operated or accessed by a user who is a member of a community of interest. The requesting computing device 302 includes a secure communication module 308, which manages secure communication with hosts of protected 30 resources, and which can temporarily store a workgroup key required to access the resource.
WO 2010/141445 PCT/US2010/036869 12 Operational flow proceeds to a workgroup key creation module 504, which generates a workgroup key (e.g. key WK) to be used to protect one or more resources. The workgroup key creation module 504 can be executed by the key server (e.g., by key generator 406 of Figure 4). The workgroup key can be any of a 5 number of types/sizes of encryption keys, and is typically held, while in a clear text format, within a "black box" module such as the key generator and/or wrapping module of Figure 4, to obscure the key from external software or the administrator. An encryption module 506 encrypts at the key server the preserved workgroup key with a second encryption key that is specific to an administrator 10 capable of granting access to the resource. In certain embodiments, the second encryption key can be a public key of a public/private key pair. Such an encrypted key, noted herein as WKA, can be stored in a directory within the key server without concern for access to the directory, since only that administrator can retrieve the original workgroup key WK by applying the private key of the administrator's 15 public/private key pair to decrypt the encrypted key. Other encryption key pairs (symmetric or asymmetric keys) could be used as well. Optionally, the encryption module 506 can encrypt multiple copies of the workgroup key with different public keys of different administrative users (e.g., WKAl-WKMA) and store those keys in the administrators' profiles within a directory, 20 thereby allowing each administrative user to access the workgroup key and grant others access to the workgroup key and associated resource(s). A storage module 508 stores the workgroup key, encrypted with a second, administrator-specific key (i.e. WKA), in a profile of the administrator(s) within the directory managed on the key server. At this point in operation of the methods and 25 systems 500, the administrator(s) have access to the workgroup key, and can make that key available to other users, thereby enabling access to the protected computing resource. A protection module 510 transmits the encrypted workgroup key WKA securely to the location of a resource (e.g. to a requested resource host 304 as in 30 Figure 3) to apply to the resource. For example, in embodiments in which the WO 2010/141445 PCT/US2010/036869 13 resource is a data storage location, the data stored at that location (or separate information providing access to that data, e.g., another encryption key, a data header address, etc.) can be encrypted using the workgroup key. The workgroup key WKA, when received at the resource, is decrypted and used by the administrator to protect 5 the resource, and then discarded by the resource, such that the key server provides the exclusive mechanism for access to the key. Each workgroup key provides a common protection mechanism for one or more computing resources, and therefore defines the community of interested users (i.e. the community of interest) that can access the resource. 10 An association module 512 optionally can be performed using the key server to associate the workgroup key WK with one or more users, as directed by an administrator having access to the workgroup key. The association module 512 generally makes the workgroup key available to a user such that the user can access the workgroup key and the corresponding resource protected by the workgroup key. 15 For example, the association module 512 can include reencryption of the workgroup key using a user-specific second encryption key, and storing the user-encrypted version of the workgroup key (e.g., WKu) in a location accessible to the user (e.g. in a user profile within a directory, such as directory 400 of Figure 4). Additional details regarding an example of operation of the association module 512 are 20 described in conjunction with Figure 6, below. End operation 514 corresponds to completed establishment of community of interest-based access to computing resources using a wrapped workgroup key. Through use of the methods and systems 500, additional workgroup keys can be created, and different sets of computing resources can be protected using those 25 keys. Each workgroup key can be associated with a unique number and collection of users and resources, and defines the community of interest of users that can access that particular set of resources. Now referring to Figure 6, an example flowchart of methods and systems 600 are shown for associating a user with a workgroup key associated with a 30 community of interest. The methods and systems 600 provide one example process by which an administrator can make available a workgroup key to a user, thereby WO 2010/141445 PCT/US2010/036869 14 adding that user to a community of interest. In general, the methods and systems 600 provide re-wrapping of the workgroup key created using the methods and systems 500 of Figure 5, so that the workgroup key is accessible to and able to be decrypted by a user who is added as part of the community of interest. 5 Operational flow is instantiated at a start operation 602, which corresponds to an administrator accessing a key server to add the user to the community of interest. Operational flow proceeds to a retrieve module 604, which retrieves the workgroup key accessible to the administrator from a directory, such as the directory 400 of Figure 4. The workgroup key stored in the directory is preferably encrypted 10 such that only the administrator can access the key, such as by encrypting the key using a public key of a public/private key pair associated with the administrator. In the present disclosure, the workgroup key encrypted for access by the administrator (and not accessible to a user) is denoted as a workgroup key WKA. Operational flow proceeds to a decryption module 606, which decrypts the 15 encrypted workgroup key WKA using a decryption key complementary to the key used to encrypt the workgroup key, resulting in a clear text workgroup key WK. In certain embodiments, the decryption module 606 uses a private key managed by the administrator to decrypt the encrypted workgroup key WKA that is the complement of the public key used to encrypt the key. Following decryption, the workgroup key 20 WK is preferably stored within a "black box" such that the clear text workgroup key is not maintained in memory Following operation of the decryption module 606, a clear text workgroup key (WK) resides on the key server, preferably stored within a black box or other protective logical construct such that the workgroup key is not exposed to a user or administrator of a resource or network. 25 Operational flow proceeds to a reencryption module 608 which reencrypts the clear text workgroup key (WK) using an encryption key associated with a user to form a reencrypted workgroup key accessible to that user, WKu. In certain embodiments, the encryption key used that is accessible to the user is a public key of a public/private key pair associated with the user.
1. A method of managing a community of interest having access to a resource, the method comprising: creating a workgroup key associated with a community of interest; protecting one or more resources associated with the community of interest using the workgroup key; encrypting the workgroup key using a public key associated with an administrator of the community of interest, the public key included with a private key in a public/private key pair associated with the administrator; storing the encrypted workgroup key; and associating the workgroup key with a user, thereby adding the user to the community of interest, wherein associating the workgroup key with a user comprises: retrieving the encrypted workgroup key; decrypting the workgroup key encrypted with the private key associated with the administrator using the private key associated with the administrator; and encrypting the decrypted workgroup key using a public key associated with a user to be added to the community of interest, the public key included with a private key in a public/private key pair associated with the user.
2. The method of claim 1, wherein associating the workgroup key with a user further comprises storing the workgroup key encrypted with the public key associated with the user in a location accessible to the user.
3. The method of claim 2, further comprising removing the user from the community of interest.
4. The method of claim 3, wherein removing the user from the community of interest comprises deleting the workgroup key encrypted with the public key associated with the user from the location in which it is stored. 24
5. The method of claim 2, wherein the location comprises a profile associated with the user on a key server.
6. The method of claim 1, further comprising rekeying the community of interest, wherein rekeying the community of interest comprises: disassociating the workgroup key from the user; creating a second workgroup key associated with the community of interest; protecting the one or more resources associated with the community of interest using the second workgroup key; encrypting the second workgroup key using a public key associated with an administrator of the community of interest, the public key included with a private key in a public/private key pair associated with the administrator; storing the encrypted second workgroup key; and associating the second workgroup key with a user, thereby including the user in the community of interest.
7. The method of claim 1, wherein the one or more resources includes at least one resource selected from the group consisting of: a communication port; a server; and data storage.
8. The method of claim 1, further comprising receiving a request for access to a resource at a key server from a user; retrieving the workgroup key encrypted using a public key of a public/private key pair associated with the user from a directory; providing the encrypted workgroup key to the user.
9. A method of rekeying a community of interest including a plurality of users, each of the users having access to a workgroup key used to protect a resource, the method comprising: 25 disassociating a workgroup key from each of the plurality of users having access to the workgroup key; creating a replacement workgroup key associated with the community of interest, the replacement workgroup key protecting the resource protected by the workgroup key; encrypting the replacement workgroup key using a key associated with an administrator of the community of interest; storing the encrypted replacement workgroup key; and associating the replacement workgroup key with each of the plurality of users, thereby including each of the plurality of users in the community of interest; wherein the key is a public key of a public/private key pair associated with the administrator; and wherein associating the replacement workgroup key with each of the plurality of users comprises: retrieving the encrypted replacement workgroup key; decrypting the replacement workgroup key encrypted with the public key associated with the administrator using the private key associated with the administrator; and for each of the plurality of users, encrypting the decrypted workgroup key using a public key associated with that user, the public key included with a private key in a public/private key pair associated with the user.
10. The method of claim 9, further comprising receiving a request for access to a resource at a key server from a user; retrieving the replacement workgroup key encrypted using a public key of a public/private key pair associated with the user from a directory; and providing the encrypted replacement workgroup key to the user.
11. The method of claim 9, wherein the resource is selected from the group consisting of: a communication port; 26 a server; and data storage.
12. A system for managing membership in a community of interest, the system including: a key server accessible to a plurality of users and managing access to a plurality of resources, the key server including: a memory configured to store a directory including a plurality of user profiles, each user profile associated with a user; a programmable circuit communicatively connected to the memory, the programmable circuit configured to execute program instructions to: create a workgroup key associated with a community of interest; protect one or more of the plurality of resources associated with the community of interest using the workgroup key; encrypt the workgroup key using a public key associated with an administrator of the community of interest, the public key included with a private key in a public/private key pair associated with the administrator; store the encrypted workgroup key in a user profile of the administrator, the user profile of the administrator included in the directory; and associate the workgroup key with one or more users from among the plurality of users, thereby adding each of the one or more users to the community of interest; wherein the programmable circuit is configured to associate the workgroup key with one or more uses by executing program instructions to: retrieve the encrypted workgroup key; 27 decrypt the workgroup key encrypted with the private key associated with the administrator using the private key associated with the administrator; and encrypt the decrypted workgroup key using a public key associated with a user to be added to the community of interest, the public key included with a private key in a public/private key pair associated with the user.
13. The system of claim 12, wherein the programmable circuit is further configured to: receive a request for access to a resource at a key server from a user; retrieve the workgroup key encrypted using a public key of a public/private key pair associated with the user from a directory; and provide the encrypted workgroup key to the user.
14. The system of claim 12, wherein the resource is selected from the group consisting of: a communication port; a server; and data storage.
15. The system of claim 12, wherein the programmable circuit is further programmed to: disassociate the workgroup key from each of the one or more users; create a second workgroup key associated with the community of interest; protect the one or more resources associated with the community of interest using the second workgroup key; encrypt the second workgroup key using a public key associated with an administrator of the community of interest, the public key included with a private key in a public/private key pair associated with the administrator; store the encrypted second workgroup key in a user profile of the administrator; and associate the second workgroup key with each of the one or more users, thereby including the one or more users in the community of interest. 28
16. The system of claim 12, wherein the programmable circuit is further programmed to remove the user from the community of interest.
AU2010256810A1 AU2010256810A1 (en) 2012-01-19
AU2010256810B2 true AU2010256810B2 (en) 2015-07-09
EP2974210A1 (en) 2013-03-13 2016-01-20 nCrypted Cloud LLC Multi-identity for secure file sharing
EP1326156A2 (en) * 2001-12-12 2003-07-09 Pervasive Security Systems Inc. Managing file access via a designated storage area
CA2946778A1 (en) * 2008-02-22 2009-08-27 Security First Corp. Systems and methods for secure workgroup management and communication
AU2010256810A1 (en) 2012-01-19
CA2623141C (en) 2014-07-22 Content cryptographic firewall system
JP5592565B2 (en) 2014-09-17 Control of platform resources using domain authentication