Saving and retrieving data based on public key encryption

A method comprising:

• receiving a bit string from a calling program;
• checking an identifier of the calling program to determine whether the calling program is one of multiple programs allowed to access data encrypted in ciphertext of the bit string, the ciphertext including both the encrypted data and multiple encrypted identifiers each identifying a different one of the multiple programs, and the checking comprising checking whether the identifier of the calling program is included as one of the multiple encrypted identifiers of the multiple programs included in the ciphertext;
• and
• returning the data, decrypted using public key decryption, to the calling program only if the calling program is one of the multiple programs allowed to access the data.

One or more computer storage media having stored thereon a plurality of instructions that, when executed by one or more processors of a computing device, causes the one or more processors to:

• receive data from a calling program;
• generate, using public key encryption, a ciphertext that includes multiple values, the multiple values including the data and multiple target program identifiers, each of the multiple target program identifiers identifying a different one of multiple target programs;
• after the ciphertext is generated, receive a bit string from a second calling program;
• check an identifier of the second calling program to determine whether an identifier of the second calling program is included as one of the multiple target program identifiers in the ciphertext;
• and
• return the data, decrypted using public key decryption, to the second calling program only if the identifier of the second calling program is included as one of the multiple target program identifiers in the ciphertext.

A device comprising a plurality of hardware means, the plurality of hardware means including:

• means for receiving a bit string from a calling program;
• means for checking an identifier of the calling program to determine whether the calling program is one of a plurality of programs allowed to access data encrypted in ciphertext of the bit string, the ciphertext including both the encrypted data and multiple encrypted identifiers each identifying a different one of the plurality of programs, and the means for checking comprising means for checking whether the identifier of the calling program is included as one of the multiple encrypted identifiers of the multiple programs included in the ciphertext;
• and
• means for returning the data, decrypted using public key decryption, to the calling program only if the calling program is one of the plurality of programs allowed to access the data.

One or more computer storage media having stored thereon a plurality of instructions that, when executed by one or more processors of a computing device, causes the one or more processors to:

• identify data to be sealed;
• invoke a PKSeal operation, passing the data as an input to the PKSeal operation and identifying multiple target programs that are allowed to unseal the data;
• and
• receive, in response to the PKSeal operation, a ciphertext including both the data and multiple encrypted target program identifiers, wherein each of the multiple encrypted target program identifiers identifies a different one of the multiple target programs, and wherein the data and identifiers of the multiple target programs are encrypted using public key encryption.

One or more computer storage media having stored thereon a plurality of instructions that, when executed by one or more processors of a computing device, causes the one or more processors to:

• invoke a PKUnseal operation in order to obtain data from a bit string sealed in response to invocation of a PKSeal operation;
• receive, in response to invoking the PKUnseal operation, the data from the sealed bit string only if conditions that are to be satisfied in order for the data to be unsealed are satisfied, the conditions being included in the sealed bit string, and one of the conditions comprising multiple encrypted program identifiers, each of the multiple encrypted program identifiers identifying one of multiple programs that are allowed to receive the data;
• and
• otherwise not receive the data from the sealed bit string if the conditions that are to be satisfied in order for the data to be unsealed are not satisfied.

A computing device implementing a system comprising:

• a plurality of hierarchical layers including a lowest layer that guards a root resource;
• wherein the plurality of hierarchical layers further includes one or more intermediate layers that each act as principals that request access to the root resource from the next lower layer and that each act as guards to the root resource toward principals in the next higher layers, and wherein the plurality of hierarchical layers comprises four layers including the lowest layer comprising a security kernel layer, a next lowest layer comprising a basic input/output system layer, a next lowest layer comprising an operating system layer, and a highest layer comprising an application layer;
• and
• each layer of the plurality of hierarchical layers allowing access to the root resource only to programs in the next higher layer that are authorized to access the root resource, wherein the allowing comprises using a PKSeal operation to encrypt the root resource along with digests of multiple principals that are allowed to access the root resource, and using a PKUnseal operation to decrypt and return the root resource only to principals having a digest that is the same as a digest of one of the multiple principals that are allowed to access the root resource and that is encrypted with the root resource.