Back to results
US 8,914,632 B1Granted
Use of access control lists in the automated management of encryption keys
AssigneeGoogle Inc.
InventorsUmesh Shankar, Kenton Varda, Darrell Kindred
Life of this patent
Estimating the term…
Abstract
Methods and systems for managing access to stored data resources assign one or more wrapped (encrypted) encryption keys to each data resource. The resources are encrypted, and the keys may be stored in an access control list (ACL) in association with the encrypted data resources. The keys may be wrapped with metadata that indicates who or what is authorized to use the resource and what role the user or users may have with respect to the resource. The keys may be unwrapped upon receipt of access requests from authorized users, and may be used to decrypt the data resources.
Claims21
A method, comprising:
- receiving, by a management server of a hosted storage service, a data resource and a resource authentication credential;
- assigning, by the hosted storage service, an encryption key to the data resource;
- encrypting the data resource to form an encrypted data resource;
- storing the encrypted data resource in a storage facility of the hosted storage service;
- producing, based on the assigned encryption key, a wrapped encryption key;
- storing the wrapped encryption key in an access control list (ACL) in association with the encrypted data resource;
- receiving, from a first user, a request to access the data resource, wherein the request includes a presented authentication credential and a request to share the data resource with a second user;
- in response to receiving the request, automatically and without additional input from the user, verifying that the presented authentication credential demonstrates authorization to unwrap the wrapped encryption key, and unwrapping the wrapped encryption key;
- using the unwrapped encryption key to decrypt the encrypted data resource;
- providing the first user with access to the data resource;
- determining that the first user is authorized to share the data resource;
- and
- re-wrapping the unwrapped encryption key for the second user.
10 more elements
A method, comprising:
- receiving, by a management server of a hosted storage service, a data resource;
- assigning, by the hosted storage service, an encryption key to the data resource;
- creating, by the hosted storage service, a wrapped encryption key comprising the assigned encryption key and authorized user metadata;
- encrypting the data resource to form an encrypted data resource;
- storing the encrypted data resource in a storage facility of the hosted storage service;
- storing the wrapped encryption key in an access control list (ACL) in association with the encrypted data resource;
- receiving, from a first user, a request to access the data resource, wherein the request includes a presented authentication credential and a request to share the data resource with a second user;
- in response to receiving the request, automatically and without additional input from the user, verifying that the presented authentication credential demonstrates authorization to unwrap the wrapped encryption key, and unwrapping the wrapped encryption key;
- using the unwrapped encryption key to decrypt the encrypted data resource;
- providing the first user with access to the data resource;
- determining that the first user is authorized to share the data resource;
- and
- re-wrapping the unwrapped encryption key for the second user.
10 more elements
A data management system, comprising:
- a hosted storage service comprising an authentication server, one or more datastores, an access control list (ACL) memory, and a memory containing programming instructions that enable a processor to:
- receive a data resource and a resource authentication credential;
- assign an encryption key to the data resource;
- encrypt the data resource to form an encrypted data resource;
- store the encrypted data resource in the datastore;
- create an ACL entry in the ACL memory;
- generate a wrapped encryption key;
- store the wrapped encryption key in the ACL entry in association with the encrypted data resource;
- receive, from a first user, a request to access the data resource, wherein the request includes a presented authentication credential and a request to share the data resource with a second user;
- verify that the presented authentication credential demonstrates authorization to unwrap the wrapped encryption key, and unwrap the wrapped encryption key;
- use the unwrapped encryption key to decrypt the encrypted data resource;
- present the data resource to the first user;
- determine that the first user is authorized to share the data resource;
- and
- re-wrap the unwrapped encryption key for the second user.
12 more elements
Dependencies are inferred from the claim text.