Apparatus and method for securing data in computer storage
AssigneeHewlett-Packard Development Company, L.P.
InventorJohn A. Thywissen
Life of this patent
Estimating the term…
Abstract
Apparatus, and an associated method, for maintaining data, such as a data file, in secure form. Security keys are stored and maintained at a central location. The security key is downloaded to a device that is to operate upon the data. When the security key is authorized to be downloaded to a computer device, a time boundary is associated with the security key. The time boundary defines the period of usability of the security key. The security key is used at the computer device to encrypt the data each time the data is written to storage and to decrypt the data each time the data is read from storage. Thereby, at all times, when the data is stored at storage, the data is maintained in secure form.
Claims20
Apparatus for a computer station to facilitate maintenance of at least a first data file in secure form, said apparatus comprising:
- a cache configured to store a first assigned time-bounded key associated with the first data file, wherein the first assigned time-bounded key expires after a first time period;
- a key manager configured to manage storage and retrieval of the first assigned time-bound key stored at the cache, the first assigned time-bound key operable during the first time period;
- and
- an access controller configured to control access to an access manager and the cache, and to control to which remotely-stored and operated upon data files that time-bound keys shall be provided, wherein the first assigned time-bound key is associated with and can be used to operate on the first data file before the first time period ends and cannot be used to decrypt the first data file after the first time period ends;
- and
- an operator configured to use the first assigned time-bounded key to operate upon the first data file during the first time period, wherein the first assigned time-bounded key cannot be used to decrypt the first data file after the first time period.
A method for facilitating maintenance of at least a first data file in secure form at a computer station, said method comprising:
- storing a first assigned time-bounded key associated with the first data file at a cache of the computer station, wherein the first assigned time-bounded key expires after a first time period;
- managing, performed a key manager, storage and retrieval of the first assigned time-bound key stored at the cache, the first assigned time-bound key operable during the first time period;
- and
- controlling, performed by an access controller, access to an access manager and the cache;
- controlling, performed by the access controller, which remotely-stored and operated upon data files that time-bound keys shall be provided, wherein the first assigned time-bound key is associated with and can be used to operate on the first data file before the first time period ends and cannot be used to decrypt the first data file after the first time period ends;
- and
- using the first assigned time-bounded key to operate upon the first data file during the first time period, wherein the first assigned time-bounded key cannot be used to decrypt the first data file after the first time period.
An apparatus for facilitating maintenance of remotely-stored and operated-upon data files, said apparatus comprising:
- a storage element configured to store security keys;
- a key manager configured to manage storage and retrieval of the security keys stored at said storage element, the retrieved security keys operable during time-bounded periods, wherein a first security key expires after a first time period ends;
- and
- an access controller configured to control access to an access manager and said storage element, and to control to which remotely-stored and operated upon data files that the security keys shall be provided, wherein the first security key is associated with and can be used to operate on a first data file before the first time period ends and cannot be used to decrypt the first data file after the first time period ends.
Dependencies are inferred from the claim text.