Personal key archive

A method of modifying stored data on a computer system, comprising:

• retrieving encrypted stored data from a first storage media, said encrypted stored data being an encryption of said stored data;
• maintaining a database on a second storage media for correlating said encrypted stored data to a userid and a data encryption key;
• retrieving said data encryption key corresponding to said encrypted stored data from said second storage media;
• and decrypting said encrypted stored data using said retrieved encryption key.

A computer system, comprising:

• means for retrieving encrypted stored data from a first storage media, said encrypted stored data being an encryption of said stored data;
• means for maintaining a database on a second storage media for correlating said encrypted stored data to a userid and a data encryption key;
• means for retrieving said data encryption key corresponding to said encrypted stored data from said second storage media;
• and
• means for decrypting said encrypted stored data using said retrieved encryption key.

A computing system for automatically managing keys to encrypt and decrypt stored data;

• an authentication server;
• a key client;
• a key generator;
• a key server;
• a key database;
• an encrypted data memory;
• said authentication server authenticates said user and provides said user with a ticket identifying said user;
• said key client of a creating user, when a creating user creates said stored data invokes said generator to generate a key corresponding to said stored data, said key is provided to said key server, said key client of said creating user uses said key to encrypt said stored data to form an encrypted stored data which is stored in said encrypted data memory;
• said key client of an accessing user, when an accessing user access said stored data sends said ticket and stored data identification data to said key server, said key server checks said ticket to verify that said accessing user is permitted to access said stored data said key server sends said key corresponding to said stored data to said key client of said accessing user, said key client of said accessing user uses said key to decrypt said encrypted stored data;
• a header associated with said stored data;
• said header contains said key, an identification of an owner of said stored data, a message authentication check field, a control key identifier and a list of user permitted to access said stored data;
• said key is encrypted under a control key;
• said control key is used to encrypt message authentication check fields of said header;
• said ticket contains a message key for encrypting messages sent between said key client and said key server.

A method of modifying stored data on a distributed computer system, comprising:

• authenticating an identity of a user via an authentication system that provides identification tickets, said user having a userid;
• storing encrypted data on a first storage media, said encrypted data being an encryption of said stored data;
• maintaining a database on a second storage media for correlating said encrypted stored data to a data encryption key and said userid;
• validating said userid identified in an authentication ticket against said userid contained in said database, and automatically choosing whether to grant access to said encrypted stored data;
• retrieving said data encryption key corresponding to said encrypted stored data from said second storage media;
• and
• decrypting said encrypted stored data using said retrieved encrypted key.

A distributed computer system, comprising:

• means for authenticating a user, said user having a userid;
• means for retrieving encrypted stored data from a first storage media, said encrypted stored data being an encryption of said stored data;
• means for maintaining a database on a second storage media for correlating said encrypted stored data to a data encryption key and said userid;
• means for validating an authenticated user as one of the userids listed in said database as permitted to access said encrypted stored data;
• means for retrieving said data encryption key corresponding to said encrypted stored data from said second storage media;
• and
• means for decrypting said encrypted stored data using said retrieved encryption key.