# US 8,543,836 B2 · Lightweight document access control using access control lists in the cloud storage or on the local file system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,836 B2 - Document ID: US8543836B2 - Status: Granted - Kind: B2 - Application number: 13/215,844 - Filed: 2011-08-23 - Published: 2013-02-28 - Granted: 2013-09-24 - Earliest claimed: 2011-08-23 - Assignees: International Business Machines Corporation - Applicants: Douglas S. Brown; John F. Kelley; Todd Seager; Robert J. Torres - Inventors: Douglas S. Brown; John F. Kelley; Todd Seager; Robert J. Torres - Web page: https://patentgrep.com/patent/US8543836B2 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/0822: {using key encryption key} - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3236: {using cryptographic hash functions} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/101: {Access control lists [ACL]} - G06F 2221/2107: File encryption - G06F 2221/2117: User registration - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F 2221/2149: Restricted operating environment - H04L 61/4523: using lightweight directory access protocol [LDAP] - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In a method for controlling access to an encrypted document, a request to access the encrypted document is received. The access request includes a user ID and a user password. A one-way hash function is performed on the user password to generate a hash value. An access control table is searched for the hash value which indicates an authorization for the user to access the encrypted document. The hash value corresponds to a document password encrypted with the user password. The document password is decrypted using the user password. The encrypted document is decrypted using the decrypted document password. ## Claims ### Claim 1 A method for controlling access to an encrypted document, the method comprising the steps of: receiving a request to access the encrypted document, wherein the access request comprises a user ID and a user password; performing a one-way hash function on the user password to generate a hash value; searching an access control table for the hash value which indicates an authorization for the user to access the encrypted document and corresponds to a document password encrypted with the user password; decrypting the document password using the user password, wherein the document password comprises a decryption key for the encrypted document; and decrypting the encrypted document using the decrypted document password. ### Claim 2 (depends on 1) The method of claim 1, wherein the hash value also corresponds to an expiration date, and wherein the step of decrypting the encrypted document further comprises the steps of: comparing, by one or more processors, the expiration date with a current date; and decrypting the encrypted document in response to determining that the current date is before the expiration date. ### Claim 3 (depends on 1) The method of claim 1, wherein the hash value corresponds to a plurality of user IDs. ### Claim 4 (depends on 1) The method of claim 1, wherein an access to the access control table is provided as a service in a cloud environment. ### Claim 5 (depends on 1) The method of claim 1, wherein the hash value corresponds to a security role and wherein the step of decrypting the encrypted document further comprises the computer decrypting the encrypted document in accordance with the security role. ### Claim 6 (depends on 1) The method of claim 1, wherein the encrypted document has been encrypted using a symmetric encryption algorithm. ### Claim 7 A computer program product for controlling access to an encrypted document, the computer program product comprising: one or more computer-readable storage devices and program instructions stored on at least one of the one or more computer-readable storage devices, the program instructions comprising: program instructions to receive a request to access the encrypted document, wherein the access request comprises a user ID and a user password; program instructions to perform a one-way hash function on the user password to generate a hash value; program instructions to search an access control table for the hash value which indicates an authorization for the user to access the encrypted document and corresponds to a document password encrypted with the user password; program instructions to decrypt the document password using the user password, wherein the document password comprises a decryption key for the encrypted document; and program instructions to decrypt the encrypted document using the decrypted document password. ### Claim 8 (depends on 7) The computer program product of claim 7, wherein the hash value also corresponds to an expiration date and wherein the program instructions to decrypt the encrypted document further comprise: program instructions to compare the expiration date with a current date; and program instructions to decrypt the encrypted document if the current date is before the expiration date. ### Claim 9 (depends on 7) The computer program product of claim 7, wherein the hash value corresponds to a plurality of user IDs. ### Claim 10 (depends on 7) The computer program product of claim 7, wherein an access to the access control table is provided as a service in a cloud environment. ### Claim 11 (depends on 7) The computer program product of claim 7, wherein the hash value corresponds to a security role and wherein the program instructions to decrypt the encrypted document further comprise program instructions to decrypt the encrypted document in accordance with the security role. ### Claim 12 (depends on 7) The computer program product of claim 7, wherein the encrypted document has been encrypted using a symmetric encryption algorithm. ### Claim 13 A method for controlling access to an encrypted web page, the method comprising the steps of: receiving an email message, wherein the email message comprises a hyperlink to the encrypted web page and wherein a markup language document for the encrypted web page includes program code to request a user ID and password from a user of the computer and to determine whether the user is authorized to access the web page, and if so, to decrypt the web page; receiving an access control table as an attachment to the email message; invoking the program code, in response to a user request to display the encrypted web page, to determine that the user is authorized to access the web page by searching the access control table; and invoking the program code to decrypt the web page and to display the web page, in response to the determination of authorization of the user to access the web page. ### Claim 14 (depends on 13) The method of claim 13, wherein the program code, when executed by the computer, further performs the steps of: receiving a request to access the encrypted web page, and in response, requesting the user ID and the password from the user; performing a one-way hash function on the user password to generate a hash value; searching the access control table for the hash value which indicates an authorization for the user to access the encrypted web page and corresponds to a document password encrypted with the user password; decrypting the document password using the user password; and decrypting the encrypted web page using the decrypted document password. ### Claim 15 (depends on 14) The method of claim 14, wherein the hash value also corresponds to an expiration date, and wherein the step of decrypting the encrypted web page further comprises the steps of: comparing, by one or more processors, the expiration date with a current date; and decrypting the encrypted web page in response to determining that the current date is before the expiration date. ### Claim 16 (depends on 14) The method of claim 14, wherein the hash value corresponds to a plurality of user IDs. ### Claim 17 (depends on 14) The method of claim 14, wherein an access to the access control table is provided as a service in a cloud environment. ### Claim 18 (depends on 14) The method of claim 14, wherein the hash value corresponds to a security role and wherein the step of decrypting the encrypted web page further comprises decrypting the encrypted web page in accordance with the security role. ### Claim 19 A computer program product for controlling access to an encrypted web page, the computer program product comprising: one or more computer-readable storage devices and program instructions stored on at least one of the one or more computer-readable storage devices, the program instructions comprising: program instructions to receive an email message, wherein the email message comprises a hyperlink to the encrypted web page and wherein a markup language document for the encrypted web page includes program code to request a user ID and password from a user of the computer and wherein the markup language document for the encrypted web page includes program code to determine whether the user is authorized to access the web page, and if so, to decrypt the web page; program instructions to receive an access control table as an attachment to the email message; program instructions to invoke the program code, in response to a user request to display the encrypted web page to determine that the user is authorized to access the web page by searching the access control table; and program instructions to invoke the program code to decrypt the web page and to display the web page at the computer, in response to the determination of authorization of the user to access the web page. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the program code further comprises: program instructions to receive a request to access the encrypted web page, and in response, to request the user ID and the password from the user; program instructions to perform a one-way hash function on the user password to generate a hash value; program instructions to search the access control table for the hash value which indicates an authorization for the user to access the encrypted web page and corresponds to a document password encrypted with the user password; program instructions to decrypt the document password using the user password; and program instructions to decrypt the encrypted web page using the decrypted document password. ### Claim 21 (depends on 20) The computer program product of claim 20, wherein the hash value also corresponds to an expiration date and wherein the program instructions to decrypt the encrypted web page further comprise: program instructions to compare the expiration date with a current date; and program instructions to decrypt the encrypted web page if the current date is before the expiration date. ### Claim 22 (depends on 20) The computer program product of claim 20, wherein the hash value corresponds to a plurality of user IDs. ### Claim 23 (depends on 20) The computer program product of claim 20, wherein an access to the access control table is provided as a service in a cloud environment. ### Claim 24 (depends on 20) The computer program product of claim 20, wherein the hash value corresponds to a security role and wherein the program instructions to decrypt the encrypted web page further comprise program instructions to decrypt the encrypted web page in accordance with the security role.