# US 10,503,880 B2 · Method and apparatus for limiting access to data by process or computer function with stateless encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,503,880 B2
- Document ID: US10503880B2
- Status: Granted
- Kind: B2
- Application number: 15/671,339
- Filed: 2017-08-08
- Published: 2017-12-14
- Granted: 2019-12-10
- Earliest claimed: 2012-02-21
- Applicants: Pulselocker, Inc.
- Inventors: Ryan D. Walsh; Michael P. Snyder
- Web page: https://patentgrep.com/patent/US10503880B2

## CPC

- G06F 21/12: Protecting executable software
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 2463/101: applying security measures for digital rights management
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods related to DRM content usage mechanisms for both online and offline usage of content are disclosed, including systems providing secure access to data regardless of network state or connectivity state to the networked access control mechanism. An access control mechanism having a secondary offline access control mechanism is presented, further including multiple implementations for data encapsulation, as well as providing a method for writes to files and to the filesystem itself by externally created applications with no API or modification to their operation.

## Claims

### Claim 1

A method for stateless encryption or decryption of files associated with a content management system, comprising:
determining, for a string of data, a base block number based on a read/write address and a block size;
setting a start value of a counter based on the base block number and the block size translated from the read/write address;
determining a number of blocks to encrypt or decrypt based on a size of read/write data;
determining a count value of the counter based on the base block number and the number of blocks to encrypt or decrypt;
writing a block number of a first block to an initialization vector (IV) string;
encrypting or decrypting the IV string with an encryption key to generate ciphertext;
logically combining the ciphertext with the first block; and
decrementing the count value of the counter by the block size and repeatedly performing the logically combining steps until a loop count is exhausted to provide the stateless encryption or decryption of files associated with the content management system.

### Claim 2 (depends on 1)

The method of claim 1, wherein the base block number is determined by dividing the block address by the block size.

### Claim 3 (depends on 1)

The method of claim 1, wherein the number of blocks is determined by dividing a read/write size by the block size.

### Claim 4 (depends on 1)

The method of claim 1, wherein the block size is 16 bytes.

### Claim 5 (depends on 1)

The method of claim 1, further comprising, for each block in the number of blocks, writing the block number for a respective block to the IV string, encrypting or decrypting the IV string with the encryption key to generate the ciphertext; logically combining the ciphertext with the respective block, and decrementing the counter by the block size until the counter is zero.

### Claim 6 (depends on 5)

The method of claim 5, further comprising writing the logically combined ciphertext with each block to a file.

### Claim 7 (depends on 1)

The method of claim 1, wherein the ciphertext is logically combined with the first block by an exclusive OR logical combination.

### Claim 8

A computer-readable storage device for stateless encryption or decryption of files associated with a content management system having instructions stored thereon that, when executed by a processor, cause the processor to:
translate a read/write address to a start value of a counter based on a block size and a base block number;
determine a number of blocks to encrypt or decrypt based on a size of read/write data;
determine a count value of the counter based on the base block number and the number of blocks to encrypt or decrypt;
write a block number of a first block to an initialization vector (IV) string;
encrypt or decrypt the IV string with an encryption key to generate ciphertext;
logically combine the ciphertext with the first block; and
decrement the count value of the counter by the block size and repeatedly performing the logically combining steps until a loop count is exhausted to provide the stateless encryption or decryption of files associated with the content management system.

### Claim 9 (depends on 8)

The computer-readable storage device of claim 8, wherein the read/write address is algebraically translated to the counter value by dividing the read/write address by a block size.

### Claim 10 (depends on 8)

The computer-readable storage device of claim 8, wherein the number of blocks is determined by dividing a read/write size by a block size.

### Claim 11 (depends on 10)

The computer-readable storage device of claim 10, wherein the block size is 16 bytes.

### Claim 12 (depends on 8)

The computer-readable storage device of claim 8, further comprising instructions stored thereon that, when executed by the processor, cause the processor to, for each block in the number of blocks, write the block number for a respective block to the IV string, encrypt or decrypt the IV string with the encryption key to generate the ciphertext; logically combine the ciphertext with the respective block, and decrement the counter until the counter is zero.

### Claim 13 (depends on 12)

The computer-readable storage device of claim 12, further comprising instructions stored thereon that, when executed by the processor, cause the processor to write the logically combined ciphertext with each block to a file.

### Claim 14 (depends on 8)

The computer-readable storage device of claim 8, wherein the ciphertext is logically combined with the first block by an exclusive OR logical combination.