USRE41186E1 - Method of encrypting information for remote access while maintaining access control - Google Patents

Abstract

The invention provides for encrypting electronic information such as a document so that only users with permission may access the document in decrypted form. The process of encrypting the information includes selecting a set of policies as to who may access the information and under what conditions. A remote server stores a unique identifier for the information and associates an encryption/decryption key pair and access policies with the information. Software components residing on the author's computer retrieve the encryption key from the remote server, encrypt the information, and store the encrypted information at a location chosen by the author. A user wishing to access the information acquires the encrypted information electronically. Software components residing on the viewing user's computer retrieve the associated decryption key and policies, decrypt the information to the extent authorized by the policies, and immediately delete the decryption key from the viewing user's computer upon decrypting the information and rendering the clear text to the viewing user's computer screen. The software components are also capable of prohibiting functional operations by the viewing user's computer while the clear text is being viewed.

Description

This application is a division of U.S. patent application Ser. No. 09/906,811, filed Jul. 18, 2001, which is a division of U.S. patent application Ser. No. 09/321,839, filed May 28, 1999, now U.S. Pat. No. 6,289,450.

This application is a reissue of application Ser. No.09/985,096, filed on Nov.1,2001, now U.S. Pat. No.6,449,721, which application is a division of application Ser. No.09/906,811, filed on Jul.18,2001, now U.S. Pat. No.6,339,825, which is a division of application Ser. No.09/321,839, filed on May28,1999, now U.S. Pat. No.6,289,450.

BACKGROUND

This invention relates to an electronic security system for electronic objects such as documents, video and audio clips and other objects that can be transmitted via a network.

Electronic security systems have been proposed for managing access to electronic information and electronic documents so that only authorized users may open protected information and documents. Several software tools have been developed to work with particular document readers such as Adobe Acrobat Exchange and Adobe Acrobat Reader.

A need still exists for improved systems for providing access to encrypted information by authorized users and which prevent unauthorized users from gaining access to the encrypted information. The present invention allows the authoring user or other controlling party to maintain access control over the electronic information.

SUMMARY

The preferred embodiment(s) of the invention are summarized here to highlight and introduce some aspects of the present invention. Simplifications and omissions may be made in this summary. Such simplifications and omissions are not intended to limit the scope of the invention.

The object of the present invention is to provide a system and method for encrypting electronic information so that access to the information can be controlled by the author or other controlling party.

A further object of the present invention is to provide an electronic encryption/decryption system and method in which a central server maintains control over the electronic encryption and decryption keys.

A further object of the present invention is to provide an electronic encryption/decryption system and method in which electronic encryption and decryption keys are not retained by an encrypting or decrypting party.

A further object of the present invention is to provide a system and method for encrypting electronic information so that access to the information can be dynamically changed from a single location without the necessity of collecting or redistributing the encrypted information.

A further object of the present invention is to provide an electronic encryption/decryption system and method in which access to electronic information can be permanently revoked by destroying the association of a decryption key to the electronic information.

These and other objects will become apparent from the figures and written description contained herein.

BRIEF DESCRIPTION OF THE DRAWINGS

Preferred embodiment(s) of the invention will be discussed below with reference to attached drawings in which:

FIG. 1 is a block diagram illustrating a system configuration of an authoring tool, a viewing tool, and a remote server of the electronic encryption system.

FIG. 2 is a block diagram illustrating a detailed system configuration and functions associated with each component of the electronic encryption system.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT(S)

Referring now to the Figures wherein like reference numerals indicate like elements, inFIG. 1, the system of the preferred embodiment can be broken down conceptually into three functional components: anauthoring tool102, aviewing tool104, and aremote server106. For convenience, the embodiments described herein are described with respect to a document in Adobe Acrobat Exchange, but other embodiments using other base software packages are possible. Other types of electronic information, as determined by the base software package chosen, can be encrypted using the present invention.

Theauthoring tool102 allows anauthoring user108 to convert atext document110 tounreadable form112 using a strong encryption algorithm and an encryption key, or set of encryption keys, provided by theremote server106. Theauthoring tool102 also registers the electronic document or information with theremote server106 and associates a set of access policies with the encryption key so that only selected viewingusers116 under selected circumstances may view the document in clear text. The document or information may also be broken down into segments using theauthoring tool102, so that certain segments within a document may have different access policies. For example, a set of users may be allowed to view pages 1-5 of a 10 page document in clear text, while a subset of those users may be allowed to view all 10 pages of the document. Theauthoring tool102 also allows the authoringuser108 to block certain functions normally accessible by theviewing user116. For example, the authoringuser108 may deny a viewinguser116 privileges such as printing and copying of the clear text.

Theviewing tool104 allows aviewing user116 to decrypt thedocument112 anauthoring user108 has encrypted, provided theauthoring user108 has associated an access policy with the decryption key which grants access to the clear text to theviewing user116. Theviewing tool104 retrieves the decryption key118 associated with thedocument segment112 from theremote server106, decrypts the document into clear text, renders the document segment, and destroys the decryption key and the clear text version of the document segment. Theviewing tool104 prevents the saving of the decryption key or the clear text version of the document. Theviewing tool104 also blocks the viewing user's machine from performing certain functions, such as printing or copying, as directed by the authoringuser108 during registration of thedocument110.

The secureremote server106 performs several functions. Theremote server106 generates encryption keys114 for each document segment, maintains decryption keys118 for registered encrypteddocuments112, authenticates requests for viewing a document segment, grants access to registereddocuments112 by providing decryption keys118 and associated access policies to authorized viewingusers116, and maintains an encrypted secure central database which provides association between registered authoring users, registered documents, associated decryption keys, associated policies for each document, options for each user and document, and associated registered viewing users. Theremote server106 does not store or receive the actual document, either encrypted or unencrypted.

Theauthoring tool102 and theviewing tool104 each use essentially the same suite of software tools. As shown inFIG. 2, the software tools reside on the authoring and viewing users'computers222,224, on a computer readable medium such as on the hard drive of a particular user's computer. Registration with the centralremote server206 determines which functions within the suite of software tools are available to a particular user. The software tools include aConfiguration Utility226, anAdministrator Utility228, and anApplication Interface230. In the embodiment using Adobe Acrobat Exchange, the Application Interface is a “Plug-In,” which uses SDK and Plug-In Standard Interface. The three software tools run in conjunction with base viewing orplayback software232, such as Adobe Acrobat Exchange, a web browser, a word processor, an audio or video playing application, a custom data processing, or a specialized low-level device driver, such as a hard disk driver, video driver, or audio driver. Thebase software package232 will depend on the type of data stream to be encrypted/decrypted.

THE SECURE REMOTE SERVER

The secureremote server206 is a server which is remote from an authoring or viewinguser208,216. Theserver206 maintains adatabase236 of encryption keys and associated decryption keys for distribution to registered or authorized users. Theremote server206 also maintains a database which associates registered document segments, which are identified by unique segment IDs, with authoring users, user access profiles, document access policies and options, and associated encryption/decryption keys. Theremote server206 does not actually store registered documents or segments, but instead relates identifying information about a document to the associated information.

Theremote server206 also tracks and maintains records of requests to view documents and to obtaindocument decryption keys238. The records may be used to monitor the system for suspicious activity. For example, a single user requesting the decryption key for a document several times during a specific time period might be an indication of suspicious activity. The server can then provide an alert message to a pager, e-mail or fax, thus allowing timely investigation of the activity. The request information may also be used for the purposes of non-repudiation or as a basis for billing in situations where access to the system or access to protected information is being sold.

All communication between theremote server206 and a user'scomputer222,224 is encrypted using Secure Socket Layer (SSL) protocols. Once an SSL tunnel has been negotiated between a user'smachine222,224 and thesecure server206, a session key is negotiated. Thus, communications to and from thesecure server206 and a user'scomputer222,224 are doubly encrypted.

Registration with theremote server206 of a user or automated system wishing to use the system is done separately from any communication for registering a document or viewing a document. A user wishing to register documents for viewing by other users, or viewing registered document registered by other users, must contact the server independently, possibly through a separatehuman Coordinator240 or separate network link which can collect payment for the authoring, viewing, and other services, can verify the identity of the user and provide the server with user identification information and user authorization profiles.

The server may be a single server, a set of synchronized servers, or dual servers with a shared database.

THE CONFIGURATION UTILITY

TheConfiguration Utility226 defines a local user (authoring or viewing) on the user'scomputer222,224. TheConfiguration Utility226 establishes the communication parameters for a local user and theremote server206. For example, theConfiguration Utility226 will query the user to define a local user profile, to include name, password and other identifying information. This local user profile must match the information provided by a user to theCoordinator240 at theremote server206.

TheConfiguration Utility226 is also responsible for maintaining information regarding the authentication and secure communication method used by the local user, for example, certificate, secret passphrase, smart card, etc. TheConfiguration Utility226 maintains information about the local user's secure communication method, for example, the certificate and certification authority for a certificate based secure communication system.

THE ADMINISTRATOR UTILITY

TheAdministrator Utility226 is a network client application used by thehuman Coordinator240 and other users to control access to documents selected for encryption by defining policies associated with a document. TheAdministrator Utility228 is a software program residing on the user'scomputer222,224. TheCoordinator240 orauthoring user208 uses theAdministrator Utility228 to define policies related to a particular user. For example, theCoordinator240 can use theAdministrator Utility228 to control the functions available to aparticular authoring user208, which might depend on the fees paid by theauthoring user208, or theCoordinator240 can control the amount of access anauthoring user208 can allow toviewing users216. Other policies that an individual can define using theAdministrator Utility228 are site policies, group policies, and default policies.

TheAdministrator Utility228 allows theCoordinator240 or authoring orviewing user208,216 to determine what documents have been registered by a particular user by accessing the registereduser database236. TheAdministrator Utility228 also allows an authoring user to permanently disable the viewing of documents by deleting the associated decryption key from the server. TheAdministrator Utility228 also allows anauthoring user208 to initially define the policies related to his documents and to change the policies after the documents have initially been registered.

TheAdministrator Utility228 allows anormal authoring user208 to create, edit, and delete time windows, network specifications and policy templates; view the list of registered documents; and view and edit the policies of documents that are registered. TheAdministrator Utility228 allows theCoordinator240 to create, edit, and delete users and user policies; create, edit, and delete groups of users and group polices; create, edit, and delete document groups and document group policies; define and modify the Site and Default polices; create, edit, and delete document override policies; and view the activity log and set up notification policies

THE APPLICATION INTERFACE

TheApplication Interface230 of the preferred embodiment is a standard “Plug-In” to Adobe Acrobat Exchange using SDK and Plug-In Standard Interface. The Plug-In230 provides a user screen interface to allow the user to access the particular functions associated with registering and viewing documents and communicating with the server. The Plug-In Screen may be integral to the Adobe User Interface Window or may be a separate window. In the preferred embodiment, the Plug-In230 modifies the Adobe User Interface Window by adding functional “buttons” such as register, create policies, tag, encrypt, view and decrypt.

The Plug-In230 allows encryption and decryption of PDF files using encryption keys from theremote server206. The Plug-In230 connects to theserver206, authenticates the user to the server, registers documents with the server, selects policies at the server as they have been defined -by theauthoring user208 using theAdministrator Utility228.

In addition, the Plug-In230 blocks certain functions at the viewing user'scomputer224 that are otherwise available in Adobe Acrobat Exchange. For example, if theauthoring user208 has limited access to a document so that aviewing user216 is prohibited from printing a viewed document, the Plug-In230 temporarily disables the print function of Adobe Acrobat Exchange. Among the functions that the Plug-In230 can disable are print, copy, cut, paste, save, and other functions. Other functions may be disabled or limited as appropriate for the type of file viewed and the access level. TheApplication Interface230 is designed in such a way that it does not disclose either the decryption key or the clear text or unencrypted representation of the protected information content in electronic form.

THE GRAPHICAL USER INTERFACE

The Graphical User Interface (“GUI”)supports standard user interface objects such as push buttons, text input fields, lists, menus, and message boxes. The GUI is controlled by the mouse and keypad. The GUI has multiple windows that allow real time setup of server configuration such as who may register a document, who may view a document, when a document may be viewed and on which host the document key and viewing information resides.

INITIAL USER SETUP

A user who wishes to register or to access information must first register and be recognized by theserver206, as represented by reference numeral1042,1044 in FIG.2. Theuser208,216 contacts theserver206 independently, possibly through a separatehuman Coordinator240 or separate network link which can collect payment for the authoring, viewing and other services; verify the identity of the user; and provide the server with user identification information and user authorization profiles. Once theuser208,216 is registered with theserver206, the suite of software tools is provided to the user.

The user must have installed thebase software230, such as Adobe Acrobat Exchange, on his computer. The user then installs theApplication Interface230 provided by theCoordinator240, as well as the Administrator andConfiguration Utilities228,226. In one embodiment, upon running theApplication Interface230, theApplication Interface230 will install the Administrator andConfiguration Utilities228,226 on the user's machine. There is no network activity involved in the installation of theApplication Interface230, Administrator, orConfiguration Utilities228,226.

CREATING POLICIES USING THE ADMINISTRATOR

Once auser208,216 is registered and theConfiguration Utility226 has set up identification and encryption information for theuser208,216, the user authorized to do so can use theAdministrator Utility228 to create policies associated with a specific document. Anauthoring user208 wishing to register a document creates policies to define who, when and how a document may be viewed or otherwise accessed.

Theauthoring user208 runs theAdministrator Utility228 which has been installed on hismachine222 and instructs theAdministrator Utility228 to create policies for a document. TheAdministrator Utility228 will request the information provided during set up to theConfiguration Utility226 such as username, passphrase, and method of authentication to verify the user's identity. TheAdministrator Utility228 will also ask on which server theauthoring user208 wishes to register his document. TheAdministrator Utility228 will then establish a connection to the remote server through theApplication Interface230.

Theremote server206 and the authoring or viewing user'scomputer222,224 communicating with theserver206 will negotiate a standard Secure Socket Layet (SSL) encryption tunnel, as represented inFIG. 2 byreference numerals1046,1056.

Once the SSL tunnel is established, the user'scomputer222,224 and theserver206 negotiate a secondary session key, as represented inFIG. 2 byreference numerals1048,1058. All subsequent communications is additionally encrypted using 128-bit RC4 and this secondary session key. All communication between the users'computers222,224 and theserver206 is thus doubly encrypted.

Once the doubly encrypted communication link is established between the authoring user'scomputer222 and theserver206, the authoring user'scomputer222 provides login and authentication information to theserver206,1050. Theserver206 authenticates the authoring user's208 identity and verifies that theauthoring user208 has authority to use the system by checking a database of registeredusers236 maintained on the server. The information provided by theauthoring user208 to theConfiguration Utility226 is compared to the information provided by the user to theCoordinator240 during the independent user registration process1042,1044. Thedatabase234 contains all of the access controls related to a particular user, so that if a user is only authorized to view documents, he will not be allowed to use the system to register or encrypt documents.

After theserver206 authenticates theauthoring user208 and verifies that theauthoring user208 is authorized to register documents, theAdministrator Utility228 allows theauthoring use208 to create policies applicable to aparticular viewing user216, a group of viewing users, or a default policy for all other users. The policies are then communicated to theserver206,1051. Policies define who may view a document, when, and under what conditions. Policies are created by combining a set of constraints including allowable or denied users and groups, time ranges, and Internet Protocol (IP) addresses. Access to a document by aviewing user216 is determined by combining the user policy, document policy, as well as possibly the group policy and document group policy. If theCoordinator240 has created a document override policy for a document, then the override takes precedence over the regular document policy defined by the authoring user. Policies include limiting who may view a document or portion of a document and the time frame during which a user may view the document.

TheAdministrator Utility228 also allows theauthoring user208 to create options. Options specify what functions of thebase software232 are temporarily disabled so that theviewing user216 is prohibited from accessing them while viewing the document. An option can also enforce a watermark on printing. For example, theauthoring user208 can prohibit aparticular viewing user216 from printing, saving, or copying a particular document or portion of a document. These Options are defined by theauthoring user208 using theAdministrator Utility228, but the options are enforced by theApplication Interface230.

ENCRYPTING DOCUMENTS AND DATA STREAMS

Anauthoring user208 wishing to encrypt a document will open the document on hiscomputer222. TheApplication Interface230 must also be loaded before the document or information can be encrypted. In the preferred embodiment, the Plug-In230 adds menu items to the menu bar in Adobe Acrobat Exchange such as “tag” and “encrypt” “Tag” allows theauthoring user208 to select segments of the document to be encrypted. Theauthoring user208 can assign different policies to different tagged segments of a single document, i.e., policies are associated with segments. A segment may consist of any subset of the entire document or the entire document. Once the document has been segmented or “tagged,” the authoring user selects “encrypt” from the menu bar. If theauthoring user208 has not already logged into theremote server206, the Plug-In230 will force a log in to theremote server206 through theAdministrator Utility228. A log-in screen is provided and theauthoring user208 must log-in to theserver206. Theserver206 authenticates theauthoring user208 and verifies that theauthoring user208 is authorized to register documents.

Once the authoring user has been authenticated, the authoring user is asked to associate the overall document with a policy, and this information is communicated to theremote server1052. This policy becomes the default policy for any portions of the document which are not tagged and associated with a specific policy. The Plug-In230 assigns a unique segment ID for each tagged segment after the authoring user has tagged all segments and has instructed the Plug-In230 to go ahead with the encryption. ThePlugIn230 transmits the segment IDs to theserver206. Theserver206 generates a random encryption key for each segment ID and communicates the encryption key to the authoring user'scomputer222,1054. Theserver206 stores the segment ID, the key associated with the particular segment ID, and the policy associated with a particular segment ID in thecentral database234, and then transmits the key to the Plug-In230 at the authoring user'scomputer222. The Plug-In230 at the authoring user'scomputer222 encrypts the segment, immediately destroys or removes the key from the authoring user'smachine222, and then deletes the clear text for the segment from the Plug-In230. Thus, key lifetime is very short on the authoring user's machine. The encryption key is never stored on the authoring user's machine where it is accessible, such as the hard disk. The key can even be obfuscated while in the memory of the authoring user's machine. The duration of the key's existence depends on the speed of the computer which actually performs the encryption, since the key is destroyed immediately after the encryption. In the preferred embodiment, 128-bit RC4 is used for document and segment encryption.

Once all segments have been encrypted, the Plug-In230 produces a hash of the entire document and sends the hash to the server as document identification,1055. Theserver206 stores the hash with the keys associated with the document. Thus, the document is never transmitted to theserver206, only the segment IDs and hash.

A pop-up window asks theauthoring user208 where he wishes to store the encrypted document. By default, the encrypted document overwrites the clear text document on the authoring user'smachine222.

VIEWING REPLAYING AND DECRYPTING

A user wishing to view a document must have installed theConfiguration Utility226,Administrator Utility228, and theApplication Interface230 on hiscomputer224. Theviewing user216 must be independently registered with theCoordinator240 as a user. Theviewing user216 must also have installed thebase software application232 for viewing the document, such as Adobe Acrobat Exchange. Theviewing user216 must enter theConfiguration Utility226 and provide user set up information.

If theviewing user216 has not opened theConfiguration Utility226, theAdministrator Utility228 and theApplication Interface230, these programs will automatically be opened once the information to be accessed has been selected, and the system has recognized that the information is encrypted.

Once theConfiguration Utility226 has opened, it will request the user to provide information defining both theviewing user216 and the viewing user'scomputer224. If theviewing user216 is a new user, theviewing user216 will select a button on the Configuration Utility's interface window indicating that a new user profile needs to be provided. TheConfiguration Utility226 will provide a query screen to the user and the user will input identification information, such as a user name. The identification information will be checked against the information provided to theserver206 orCoordinator240 during the independent user registration process.

TheApplication Interface230 will check to see if the user is logged onto theremote server206. If theviewing user216 has not logged onto the remote server, theApplication Interface230 provides a pop-up window so that the user can log in to the server. An SSL tunnel and session key are negotiated,1056,1058. The viewing user'scomputer224 provides login and authentication information to theserver206,1060. Once logged into theserver206, theApplication Interface230 requests access to the document orinformation1062 by asking theserver206 for the decryption key for the first segment of the document or information to be accessed. Theserver206 uses the segment ID to check the database to find the policies associated with the segment and thus to determine whether theviewing user216 is authorized to access this segment or the document as a whole.

If theviewing user216 is not authorized to access the segment, theviewing user216 is so informed. If theuser216 is authorized to access the segment, theserver206 sends the decryption key and options for that segment to theApplication Interface230 at the viewing user'scomputer224 and theApplication Interface230 decrypts the segment using the decryption key. After decrypting the segment, theApplication Interface230 immediately discards/destroys the key, renders the decrypted segment to the screen, and then destroys the decrypted version of the segment. When the viewing user moves to a different segment, the process is repeated.

TheApplication Interface230 enforces the options which were assigned by theauthoring user230 to the segment viewed by theviewing user216. For example, if theauthoring user208 assigned that theviewing user216 cannot print the clear text document or segment, then the Plug-In230 disables the print function of Adobe Acrobat Exchange while the clear text document or segment is available to theviewing user216. Other functions which can be controlled or disabled by the Plug-In230 are save, copy, paste, and print with watermark. For other base software packages such asaudio230, the functions controlled by theApplication Interface230 could be play, copy, and save unencrypted. Thus, using the options, theviewing user216 has no ability to permanently acquire the clear text document or data.

THE DATABASE

The securecentral database234 resides on theremote server206. It may be a distributed or shared database residing on multipleremote servers206. In the preferred embodiment thedatabase234 is maintained in Berkley DB software. All records maintained in thecentral database234 are encrypted and the database is password protected. TheCoordinator240 controls thedatabase234 and has access to thedatabase234 using the password.

All keys for encryption and decryption are maintained in thedatabase234. Thedatabase234 provides a structure for associating segment IDs with an associated decryption key, policies for accessing that segment, and options for accessing that segment. Theauthoring user208 may change a policy associated with a segment ID through theAdministrator Utility228 on his computer. The change in policy is communicated to theremote server206 and thedatabase234 is updated accordingly. The update policy function allows anauthoring user208 to revoke access to a segment or document by a user or group of users.

Theauthoring user208 can destroy the decryption key or the association of a decryption key to a segment or document on thedatabase234 using theAdministrator Utility228. By destroying the decryption key or the association of the decryption key with a Segment or Document, theauthoring user208 destroys the ability to decrypt the information, effectively shredding all copies of the information.

Regular backups of thedatabase234 are made without shutting down thewhole database234.

One or more preferred embodiments have been described to illustrate the invention(s). Additions, modifications, and/or omissions may be made to the preferred embodiment(s) without departing from the scope or spirit of the invention(s). It is the intent that the following claims encompass all such additions, modifications, and/or variations to the fullest extent permitted by law.

Claims (11)

1. A method of controlling distribution of a segment of encrypted electronic information, comprising:

receiving, at a user location, a user code and an identification of the segment;

transmitting the user code and the identification from the user location to a key server;

receiving, at a user location from a key server in response to the user code representing a user authorized to view the segment, a decryption key for the segment and at least one access policy associated with the segment;

decrypting the segment with the decryption key into clear text in response to said receiving;

destroying the decryption key in response to said decrypting;

rendering the clear text;

limiting access to the clear text consistent with the at least one access policy; and

defending the decryption key at the user location when the decryption key is resident at the user location;

wherein a processing between and including said receiving the decryption key and said destroying the decryption key occurs with sufficient speed such that the decryption key is only resident at the user location for a moment, and said defending resists capturing of the decryption key during the moment.

2. A method of controlling distribution of a segment of encrypted electronic information, comprising:

receiving, at a user location from a key server, a decryption key for the segment;

immediately decrypting the segment with the decryption key after said receiving;

immediately destroying the decryption key after to said decrypting; and

defending the decryption key at the user location when the decryption key is resident at the user location; wherein said receiving, said immediately decrypting and said immediately destroying only permit the decryption key to be resident at the user location for a brief moment in time, and said defending resists capture of the decryption key during the brief moment in time, such that it is difficult to improperly capture the decryption key at the user location.

3. A method of controlling distribution of a segment of encrypted electronic information, comprising:

attempting to access the segment at a user location;

requesting from the user location to the key server a decryption key for the segment;

receiving, at a user location from a key server, a the decryption key for the segment;

decrypting the segment with the decryption key in response to said receiving;

destroying the decryption key in response to said decrypting; and defending the decryption key at the user location when the decryption key is resident at the user location; wherein processing between and including said receiving and said destroying occurs with sufficient speed such that the decryption key is only resident at the user location for a moment, and said defending resists capture of the decryption key during the moment.

4. A method of controlling distribution of a segment of encrypted electronic information, comprising:

receiving, at a user location from a key server, a decryption key for the segment;

immediately decrypting the segment into clear text with the decryption key after said receiving;

immediately rendering said clear text on a display;

immediately destroying the decryption key after one of said decrypting and said rendering; and

defending the decryption key at the user location when the decryption key is resident at the user location;

wherein said receiving, said immediately decrypting and said immediately destroying only permit the decryption key to be resident at the user location for a brief moment in time, and said defending resists capture of the decryption key during the brief moment in time, such that it is difficult to improperly capture the decryption key at the user location.

5. A method of controlling distribution of a segment of encrypted electronic information, comprising:

attempting to access the segment at a user location, including receiving, at athe user location, a user code and an identification of the segment;

transmitting, in response to the attempting to access, the user code and the identification to a server;

receiving, at a user location from a key server, a decryption key for the segment in response to the user code representing a user authorized to view the segment;

decrypting the segment with the decryption key in response to said receiving;

destroying the decryption key in response to said decrypting; and

defending the decryption key at the user location when the decryption key is resident at the user location; wherein a processing between and including said receiving the decryption key and said destroying the decryption key occurs with sufficient speed such that the decryption key is only resident at the user location for a moment, and said defending resists capturing of the decryption key during the moment.

6. A system for controlling access to a segment of encrypted electronic content, comprising:

a computer readable medium containing instructions designed to operate in conjunction with computer hardware and other computer software to:

receive, at a user location, a user code and an identification of the segment;

transmit the user code and the identification from the user location to a key server;

receive, at a user location from a key server in response to the user code representing a user authorized to view the segment, a decryption key for the segment and at least one access policy associated with the segment;

decrypt the segment with the decryption key into clear text in response to said receiving;

destroy the decryption key in response to said decrypting;

render the clear text;

limit access to the clear text consistent with the at least one access policy; and

defend the decryption key at the user location when the decryption key is resident at the user location;

wherein said instructions require that computer processing between and including said receive the decryption key and said destroy the decryption key occurs with sufficient speed such that the decryption key is only resident at the user location for a moment, and said defend the decryption key resists capture of the decryption key during the moment.

7. A system for controlling access to a segment of encrypted electronic content, comprising:

a computer readable medium containing instructions designed to operate in conjunction with computer hardware and other computer software to:

receive, at a user location from a key server, a decryption key for the segment;

immediately decrypt the segment with the decryption key after said receiving;

immediately destroy the decryption key after said decrypting; and

defend the decryption key at the user location when the decryption key is resident at the user location;

wherein the decryption key will only be resident at the user location for a brief moment in time, and said defend the key resists capture of the decryption key during the brief moment in time, such that it is difficult to improperly capture the decryption key at the user location.

8. A system for controlling access to a segment of encrypted electronic content, comprising:

a computer readable medium containing instructions designed to operate in conjunction with computer hardware and other computer software to:

attempt to access the segment at a user location;

request from the user location to the key server a decryption key for the segment;

receive, at a user location from a key server, a the decryption key for the segment;

decrypt the segment with the decryption key in response to said receiving;

destroy the decryption key in response to said decrypting; and

defend the decryption key at the user location when the decryption key is resident at the user location; wherein said instructions require computer processing between and including said receive and said destroy to occur with sufficient speed such that the decryption key is only resident at the user location for a moment, and said defend resists capture of the decryption key during the moment.

9. A system for controlling access to a segment of encrypted electronic content, comprising:

a computer readable medium containing instructions designed to operate in conjunction with computer hardware and other computer software to:

receive, at a user location from a key server, a decryption key for the segment;

immediately decrypt the segment into clear text with the decryption key after said receiving;

immediately render said clear text on a display;

immediately destroy the decryption key in response to one of said decrypting and said rendering; and

defend the decryption key at the user location when the decryption key is resident at the user location;

wherein the decryption key will only be resident at the user location for a brief moment in time, and said defend resists capture of the decryption key during the brief moment in time, such that it is difficult to improperly capture the decryption key at the user location.

10. A system for controlling access to a segment of encrypted electronic content, comprising:

a computer readable medium containing instructions designed to operate in conjunction with computer hardware and other computer software to:

receiveattempt to access the segment at a user location, including receiving, at a user location, a user code and an identification of the segment;

transmit, in response to the attempt to access, the user code and the identification to a server; receive, at a user location from a key server, a decryption key for the segment in response to the user code representing a user authorized to view the segment;

decrypt the segment with the decryption key in response to said receiving;

destroy the decryption key in response to said decrypting; and

defend the decryption key at the user location when the decryption key is resident at the user location; wherein said instructions require that computer processing between and including said receiving the decryption key and said destroying the decryption key occurs with sufficient speed such that the decryption key is only resident at the user location for a moment, and said defend resists capturing of the decryption key during the moment.

11. A system for controlling distribution of a segment of encrypted electronic information, comprising:

means for receiving, at a user location, a user code and an identification of the segment;

means for transmitting the user code and the identification of the segment from the user location to a key server;

means for receiving, at a user location from a key server in response to the user code representing a user authorized to view the segment, a decryption key for the segment and at least one access policy associated with the segment;

means for decrypting the segment with the decryption key into clear text in response to said receiving;

means for destroying the decryption key in response to said decrypting;

means for rendering the clear text;

means for limiting access to the clear text consistent with the at least one access policy; and

means for defending the decryption key at the user location when the decryption key is resident at the user location;

wherein a time between operations performed by and including said means for receiving the decryption key and said means for destroying the decryption key occurs with sufficient speed such that the decryption key is only resident at the user location for a moment, and said means for defending resists capturing of the decryption key during the moment.

Images