Cryptographic protection of core data secrets

A method of protecting data from unauthorized access, comprising the following steps:

• accepting clear data from an application program;
• accepting an optional user-readable description of the clear data from the application program;
• accepting optional cryptographic entropy from the application program;
• accepting an optional high-security indicator from the application program along with the clear data;
• encrypting the clear data along with the user-readable description of the clear data, wherein the encrypting is based at least in part on any cryptographic entropy accepted from the application program;
• returning the encrypted data and the encrypted user-readable description to the application program;
• accepting the encrypted data back from the application for decryption;
• prompting a user to enter a secure attention sequence to initiate a secure operating system mode if the high-security indicator was specified with the clear data, wherein the secure operating system mode cannot be initiated programmatically;
• confirming that the user initiates the secure operating system mode;
• decrypting the encrypted data and returning the clear data to the application program only after confirming that the user initiated the secure mode.

A method of protecting data from unauthorized access, comprising the following steps:

• accepting clear data from an application program;
• accepting an optional user-readable description of the clear data from the application program;
• accepting optional cryptographic entropy from the application program;
• encrypting the clear data along with the user-readable description of the clear data, wherein the encrypting is based at least in part on any cryptographic entropy accepted from the application program;
• returning the encrypted data and the encrypted user-readable description to the application program;
• wherein the encrypting step uses a key that is derived at least in part from a user logon secret;
• sending the key from a client computer to a network supervisory computer that authenticates network users during user logon procedures;
• encrypting a data combination at the network supervisory computer, the data combination including the key and a user identification corresponding to a currently authenticated current user of the client computer;
• returning the encrypted data combination to the client computer;
• storing the encrypted data combination at the client computer.

A system for protecting data items and for protecting them from unauthorized access, comprising:

• a data protection server that (a) receives data items from application programs, (b) encrypts said data items, and (c) returns the encrypted data items to the application programs;
• one or more encryption providers that are called by the data protection server to encrypt the data item;
• a data protection interface associated with the data protection server, wherein the data protection interface accepts at least the following parameters from the application programs:
• clear data;
• an optional user-readable description of the clear data;
• optional cryptographic entropy for use in encrypting the clear data;
• wherein the data protection interface returns an encrypted representation of the clear data and user-readable description, wherein the encrypted representation is based at least in part on the optional cryptographic entropy supplied by the application program and is based also at least in part on additional entropy supplied by one or more of the encryption providers.

A system for protecting data items and for protecting them from unauthorized access, comprising:

• a data protection server that (a) receives data items from application programs, (b) encrypts said data items, and (c) returns the encrypted data items to the application programs;
• one or more encryption providers that are called by the data protection server to encrypt the data item;
• a data protection interface associated with the data protection server, wherein the data protection interface accepts at least the following parameters from the application programs:
• clear data;
• an optional user-readable description of the clear data;
• optional cryptographic entropy for use in encrypting the clear data;
• wherein the data protection interface returns an encrypted representation of the clear data and user-readable description, wherein the encrypted representation is based at least in part on the optional cryptographic entropy supplied by the application program;
• wherein said one or more encryption providers include an encryption provider that prompts a user to enter a secure attention sequence to initiate a secure operating system mode;
• wherein the secure operating system mode cannot be initiated programmatically;
• and
• wherein said encryption provider decrypts encrypted data only after confirming that the user initiates the secure operating system mode.

A system for protecting data items and for protecting them from unauthorized access, comprising:

• a data protection server that (a) receives data items from application programs, (b) encrypts said data items, and (c) returns the encrypted data items to the application programs;
• one or more encryption providers that are called by the data protection server to encrypt the data item;
• a data protection interface associated with the data protection server, wherein the data protection interface accepts at least the following parameters from the application programs:
• clear data;
• an optional user-readable description of the clear data;
• optional cryptographic entropy for use in encrypting the clear data;
• wherein the data protection interface returns an encrypted representation of the clear data and user-readable description, wherein the encrypted representation is based at least in part on the optional cryptographic entropy supplied by the application program;
• wherein said one or more encryption providers include an encryption provider that presents a user-customizable prompt for a user to enter a secure attention sequence to initiate a secure operating system mode;
• wherein the secure operating system mode cannot be initiated programmatically;
• and
• wherein said encryption provider decrypts encrypted data only after confirming that the user initiates the secure operating system mode.

A system for protecting data items and for protecting them from unauthorized access, comprising:

• a data protection server that (a) receives data items from application programs, (b) encrypts said data items, and (c) returns the encrypted data items to the application programs;
• one or more encryption providers that are called by the data protection server to encrypt the data item;
• a data protection interface associated with the data protection server, wherein the data protection interface accepts at least the following parameters from the application programs:
• clear data;
• an optional user-readable description of the clear data;
• optional cryptographic entropy for use in encrypting the clear data;
• wherein the data protection interface returns an encrypted representation of the clear data and user-readable description, wherein the encrypted representation is based at least in part on the optional cryptographic entropy supplied by the application program;
• wherein said one or more encryption providers include an encryption provider that encrypts data using a key that is derived at least in part from a user logon secret, wherein said encryption provider is configured to perform steps comprising:
• sending the key from a client computer to a network supervisory computer that authenticates network users during user logon procedures;
• encrypting a data combination at the network supervisory computer, the data combination including the key and a user identification corresponding to a currently authenticated current user of the client computer;
• returning the encrypted data combination to the client computer;
• storing the encrypted data combination at the client computer.

A method of protecting data from unauthorized access, comprising the following steps:

• accepting clear data from an application program;
• accepting first cryptographic entropy from the application program;
• providing the clear data and first cryptographic entropy to an encryption provider for encryption of the clear data;
• encrypting the clear data with the encryption provider, wherein the encrypting is based on both the first cryptographic entropy accepted from the application and on second cryptographic entropy supplied by the encryption provider;
• and
• returning the encrypted data to the application program.

A computer-readable storage medium containing instructions that are executable to implement an application programming interface, the application programming interface having a data protect method that performs actions comprising:

• accepting clear data from an application program;
• accepting first cryptographic entropy from the application program;
• encrypting the clear data based on both the accepted first cryptographic entropy and additionally supplied second cryptographic entropy;
• and
• returning the encrypted data to the application program.

A system for protecting data items from unauthorized access, comprising:

• a data protection server that (a) receives data items from application programs, (b) encrypts said data items, and (c) returns the encrypted data items to the application programs;
• at least one encryption provider that is called by the data protection server to encrypt the data items;
• a data protection interface associated with the data protection server, wherein the data protection interface accepts clear data and first cryptographic entropy from the application programs;
• wherein the data protection interface returns an encrypted representation of the clear data, wherein the encrypted representation is based on both the first cryptographic entropy supplied by the application program and second cryptographic entropy supplied by said at least one encryption provider.

A method of protecting data from unauthorized access, comprising the following steps:

• accepting clear data from an application program;
• accepting optional cryptographic entropy from the application program;
• encrypting the clear data based at least in part on any cryptographic entropy accepted from the application program and additionally on a key that is derived at least in part from a network-related secret associated with a currently authenticated current user of the client computer;
• returning the encrypted data to the application program;
• sending the key from a client computer to a network supervisory computer that authenticates network users during user logon procedures;
• encrypting a data combination at the network supervisory computer, the data combination including the key and a user identification corresponding to the currently authenticated current user of the client computer;
• returning the encrypted data combination to the client computer;
• storing the encrypted data combination at the client computer.

A system for protecting data items from unauthorized access, comprising:

• a data protection server that (a) receives data items from application programs, (b) encrypts said data items, and (c) returns the encrypted data items to the application programs;
• one or more encryption providers that are called by the data protection server to encrypt the data item;
• a data protection interface associated with the data protection server, wherein the data protection interface accepts clear data and optional cryptographic entropy from the application programs;
• wherein the data protection interface returns an encrypted representation of the clear data and user-readable description, wherein the encrypted representation is based at least in part on the optional cryptographic entropy supplied by the application program;
• wherein said one or more encryption providers include an encryption provider that encrypts data using a key that is derived at least in part from a network related secret associated with a currently authenticated computer user, wherein said encryption provider is configured to perform steps comprising:
• sending the key from a client computer to a network supervisory computer that authenticates network users during user logon procedures;
• encrypting a data combination at the network supervisory computer, the data combination including the key and a user identification corresponding to the currently authenticated current user;
• returning the encrypted data combination to the client computer;
• storing the encrypted data combination at the client computer.