US 7,412,603 B2Granted

Methods and systems for enabling secure storage of sensitive data

AssigneeMicrosoft Corporation

InventorsAnthony Yeates, Pavel Dournov, Kirk Blackwood

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are disclosed for storing sensitive data in a database, such as an application database or a dedicated application security database or store. In accordance with one aspect of the invention, user passwords are not directly stored in a database; but instead, when a password is entered, a one-way hash of the password phrase is produced for storage and/or comparison purposes. In accordance with another aspect, individual authorized application users are each aligned with their own version of an application-wide security key such that it becomes unnecessary to directly store the key in its original form. The security key is used to process sensitive data. In accordance with another aspect, a user's version of the application-wide security reflects an encryption-based relationship to the user's password. Various embodiments also support flexible access to particular collections of sensitive data based on user account and/or user role information.

A computer-implemented method for providing data security, the method comprising:

receiving a password from a user, the password being the user's password;
utilizing the password to encrypt an encryption component, wherein utilizing the password comprises applying the password to the encryption component so as to produce a user-specifically encrypted version of the encryption component, the user-specifically encrypted version being user-specific in that the encryption process applied to the encryption component factors in the user's password, and wherein the encryption component is a collection of data that specifies an encryption or decryption process;
storing the user-specifically encrypted version of the encryption component, wherein storing comprises storing the user-specifically encrypted version of the encryption component within a record that is associated with the user;
selectively allowing the user to process the user-specifically encrypted version of the encryption component so as to derive the encryption component, wherein selectively allowing further comprises selectively allowing the user to decrypt the user-specifically encrypted version of the encryption component so as to regain access to the encryption component itself;
utilizing the decrypted encryption component to process sensitive data;
receiving a second password from a different user, the second password being the different user's password;
and
utilizing the second password to encrypt the encryption component, wherein utilizing the second password comprises applying the second password to the encryption component so as to produce a second user-specifically encrypted version of the encryption component, the second user-specifically encrypted version being user-specific in that the encryption process applied to the encryption component factors in the different user's password;
and
storing the second user-specifically encrypted version of the encryption component, wherein storing comprises storing the second user-specifically encrypted version of the encryption component within a record that is associated with the different user.

7 more elements

Facts

Application

10/728,396Filed 5 Dec 2003

Published

US 2005/0125698 A19 Jun 2005

Granted

12 Aug 2008

Term ends

Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes
H04L 9/0863
Generation of secret information including derivation or calculation of cryptographic keys or passwords: involving passwords or one-time passwords
H04L 9/0894
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: escrow, recovery or storing of secret…
H04L 2209/56
Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication…

Abstract

Claims9