# US 8,543,827 B2 · Methods and systems for providing access control to secured data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,827 B2 - Document ID: US8543827B2 - Status: Granted - Kind: B2 - Application number: 12/057,015 - Filed: 2008-03-27 - Published: 2009-04-16 - Granted: 2013-09-24 - Earliest claimed: 2001-12-12 - Assignees: Intellectual Ventures I LLC - Applicants: Denis Jacques Paul Garcia; Michael Michio Ouye; Alain Rossmann; Steven Toye Crocker; Eric Gilbertson; Weiqing Huang; Serge Humpich; Klimenty Vainstein; Nicholas Michael Ryan - Inventors: Denis Jacques Paul Garcia; Michael Michio Ouye; Alain Rossmann; Steven Toye Crocker; Eric Gilbertson; Weiqing Huang; Serge Humpich; Klimenty Vainstein; Nicholas Michael Ryan - Web page: https://patentgrep.com/patent/US8543827B2 ## CPC - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/60: Protecting data - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/105: {Multiple levels of security} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/2107: File encryption - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F 2221/2137: Time limited access, e.g. to a computer or data - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In a system for providing access control management to electronic data, techniques to secure the electronic data and keep the electronic data secured at all times are disclosed. According to one embodiment, a secured file or secured document includes two parts: an attachment, referred to as a header, and an encrypted document or data portion. The header includes security information that points to or includes the access rules and a file key. The access rules facilitate restrictive access to the secured document and essentially determine who/when/how/where the secured document can be accessed. The file key is used to encrypt/decrypt the encrypted data portion. Only those who have the proper access privileges are permitted to retrieve the file key to encrypt/decrypt the encrypted data portion. ## Claims ### Claim 1 A method comprising: configuring at least one computing device to perform the functions of: associating an access level with a store, the access level comprising access rules; retrieving the access rules based on a file being deposited in the store; encrypting the file in accordance with the access rules to produce an encrypted data portion; generating a header portion of the encrypted file to include encryption related security information from the access rules, wherein the access rules control at least a physical or network location from which a request for access to the file originates so as to permit access from a single access location at a time; and integrating the header with the encrypted data portion to produce a secured file. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the electronic data is one or more of: streaming audio, streaming video, streaming multimedia, electronic files, electronic documents, images, executable code, audio files, databases, database tables, database table records, collections of electronic files; collections of electronic documents, stored passwords, stored ciphers, public encryption keys, private encryption keys, and multimedia files. ### Claim 3 (depends on 2) The method as recited in claim 2, wherein the streaming audio is one or more of audio streams created from applications, audio and real time audio streams. ### Claim 4 (depends on 2) The method as recited in claim 2, wherein the images are one or more of bitmapped graphics format files and image files created from applications. ### Claim 5 (depends on 2) The method as recited in claim 2, wherein the multimedia files are one or more of video files, multimedia files created from applications, video files created from applications, multimedia objects created from applications, and executable code. ### Claim 6 (depends on 2) The method as recited in claim 2, wherein the audio files are one or more of playlists, audio and files created from applications. ### Claim 7 A computer readable storage device having computer program code stored thereon, execution of which, by a processing device, causes the processing device to perform operations comprising: associating an access level with a store, the access level comprising access rules; retrieving the access rules based on a file being deposited in the store; encrypting the file in accordance with the access rules to produce an encrypted data portion; generating a header portion of the encrypted file to include encryption related security information from the access rules, wherein the access rules control at least a physical or network location from which a request for access to the file originates so as to permit access from a single access location at a time; and integrating the header with the encrypted data portion to produce a secured file. ### Claim 8 (depends on 7) The computer readable storage device as recited in claim 7, wherein the electronic data is one or more of: streaming audio, streaming video, streaming multimedia, electronic files, electronic documents, images, executable code, audio files, databases, database tables, database table records, collections of electronic files; collections of electronic documents, stored passwords, stored ciphers, public encryption keys, private encryption keys, and multimedia files. ### Claim 9 (depends on 8) The computer readable storage device as recited in claim 8, wherein the streaming audio is one or more of audio streams created from applications and real time audio streams. ### Claim 10 (depends on 8) The computer readable storage device as recited in claim 8, wherein the images are one or more of bitmapped graphics format files and image files created from applications. ### Claim 11 (depends on 7) The computer readable storage device as recited in claim 7, wherein the multimedia files are one or more of video files, multimedia files created from applications, video files created from applications, multimedia objects created from applications, and executable code. ### Claim 12 (depends on 7) The computer readable storage device as recited in claim 7, wherein the audio files are one or more of playlists audio and files created from applications. ### Claim 13 A system comprising: a processor; and a memory storing a plurality of modules comprising: a first module configured to associate an access level with a store, the access level comprising access rules, a second module configured to retrieve the access rules based on a file being deposited in the store, a third module configured to encrypt the file in accordance with the access rules to produce an encrypted data portion, a fourth module configured to generate a header portion of the encrypted file to include encryption related security information from the access rules, wherein the access rules control at least a physical or network location from which a request for access to the file originates so as to permit access from a single access location at a time, and a fifth module configured to integrate the header with the encrypted data portion to produce a secured file. ### Claim 14 (depends on 13) The system as recited in claim 13, wherein the electronic data is one or more of: streaming audio, streaming video, streaming multimedia, electronic files, electronic documents, images, executable code, audio files, databases, database tables, database table records, collections of electronic files; collections of electronic documents, stored passwords, stored ciphers, public encryption keys, private encryption keys, and multimedia files. ### Claim 15 (depends on 14) The system as recited in claim 14, wherein the streaming audio is one or more of audio streams created from applications and real time audio streams. ### Claim 16 (depends on 14) The system as recited in claim 14, wherein the images are one or more of bitmapped graphics format files and image files created from applications. ### Claim 17 (depends on 14) The system as recited in claim 14, wherein the multimedia files are one or more of video files, multimedia files created from applications, video files created from applications, multimedia objects created from applications, and executable code. ### Claim 18 (depends on 14) The system as recited in claim 14, wherein the audio files are one or more of playlists and files created from applications.