Back to results
US 2026/0089142 A1Published application
Managing access to digital files in a computing environment
AssigneeOnData, Inc.
InventorsShaofei Chen, Daniel Cole Harrell
Life of this patent
Estimating the term…
Abstract
Managing access to digital files in a computing environment, including facilitating protection of digital files; including facilitating the user experience for authentication, file encryption, file decryption, dynamic read access of protected files, dynamic write access of protected files, file cache management, and logging of access and updates to the protected files.
Claims27
A computer-implemented method of managing access to digital files in a computing environment, including:
- receiving, by a secure file computing module at a client computing device, a user token representing credentials of a user associated with the client computing device;
- detecting, by the secure file computing module, an attempt to access a file utilizing the client computing device, wherein the file is encrypted with a first encryption method;
- in response to detecting the attempt, identifying a header of the file, including identifying a file identifier (ID) and an organization identifier (ID) of the header;
- providing, by the client computing device and to a central management computing device, the file ID, the organization ID, a public key of a random key pair, and the user token;
- determining, by the central management computing device, that the user is authorized for the file based on i) the file ID and ii) the user token;
- in response to determining that the user is authorized for the file:
- obtaining, by the central management computing device and from a database, a cryptographic key;
- decrypting, by the central management computing device, the cryptographic key utilizing an organization private key, the organization private key stored in a secure location and associated with the organization ID;
- after decrypting the cryptographic key using the organization private key, encrypting, by the central management computing device, the cryptographic key using the random public key obtained from the client computing device;
- after encrypting the cryptographic key using the random public key, providing, by the central management computing device and to the client computing device, the cryptographic key;
- decrypting, by the secure file computing module, the cryptographic key using a private key of the random key pair;
- and
- after decrypting the cryptographic key using the private key, decrypting, by the secure file computing module, the file utilizing the cryptographic key.
10 more elements
An information handling system comprising a processor having access to memory media storing instructions executable by the processor to perform operations, comprising:
- receiving, by a secure file computing module at a client computing device, a user token representing credentials of a user associated with the client computing device;
- detecting, by the secure file computing module, an attempt to access a file utilizing the client computing device, wherein the file is encrypted with a first encryption method;
- in response to detecting the attempt, identifying a header of the file, including identifying a file identifier (ID) and an organization identifier (ID) of the header;
- providing, by the client computing device and to a central management computing device, the file ID, the organization ID, a public key of a random key pair, and the user token;
- determining, by the central management computing device, that the user is authorized for the file based on i) the file ID and ii) the user token;
- in response to determining that the user is authorized for the file:
- obtaining, by the central management computing device and from a database, a cryptographic key;
- decrypting, by the central management computing device, the cryptographic key utilizing an organization private key, the organization private key stored in a secure location and associated with the organization ID;
- after decrypting the cryptographic key using the organization private key, encrypting, by the central management computing device, the cryptographic key using the random public key obtained from the client computing device;
- after encrypting the cryptographic key using the random public key, providing, by the central management computing device and to the client computing device, the cryptographic key;
- decrypting, by the secure file computing module, the cryptographic key using a private key of the random key pair;
- and
- after decrypting the cryptographic key using the private key, decrypting, by the secure file computing module, the file utilizing the cryptographic key.
10 more elements
A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:
- receiving, by a secure file computing module at a client computing device, a user token representing credentials of a user associated with the client computing device;
- detecting, by the secure file computing module, an attempt to access a file utilizing the client computing device, wherein the file is encrypted with a first encryption method;
- in response to detecting the attempt, identifying a header of the file, including identifying a file identifier (ID) and an organization identifier (ID) of the header;
- providing, by the client computing device and to a central management computing device, the file ID, the organization ID, a public key of a random key pair, and the user token;
- determining, by the central management computing device, that the user is authorized for the file based on i) the file ID and ii) the user token;
- in response to determining that the user is authorized for the file:
- obtaining, by the central management computing device and from a database, a cryptographic key;
- decrypting, by the central management computing device, the cryptographic key utilizing an organization private key, the organization private key stored in a secure location and associated with the organization ID;
- after decrypting the cryptographic key using the organization private key, encrypting, by the central management computing device, the cryptographic key using the random public key obtained from the client computing device;
- after encrypting the cryptographic key using the random public key, providing, by the central management computing device and to the client computing device, the cryptographic key;
- decrypting, by the secure file computing module, the cryptographic key using a private key of the random key pair;
- and
- after decrypting the cryptographic key using the private key, decrypting, by the secure file computing module, the file utilizing the cryptographic key.
10 more elements
Dependencies are inferred from the claim text.