Abstract: Provided is a data acquisition module. The data acquisition module includes a memory and a controller. The controller includes an encryption module configured to encrypt information written to the memory using a key included in the controller. The key is unique to the controller. Also provided is a method for processing identification information. The method includes encrypting information with a key included in a controller and storing the encrypted information. The key is unique to the controller.

Abstract: Techniques and tools for implementing protocols for secure multi-party communication after quantum key distribution (“QKD”) are described herein. In example implementations, a trusted authority facilitates secure communication between multiple user devices. The trusted authority distributes different quantum keys by QKD under trust relationships with different users. The trusted authority determines combination keys using the quantum keys and makes the combination keys available for distribution (e.g., for non-secret distribution over a public channel). The combination keys facilitate secure communication between two user devices even in the absence of QKD between the two user devices. With the protocols, benefits of QKD are extended to multi-party communication scenarios. In addition, the protocols can retain benefit of QKD even when a trusted authority is offline or a large group seeks to establish secure communication within the group.

Abstract: Digital data, such as images on a digital camera, is typically protected (e.g., encrypted and/or authenticated) based on a master key stored off the device. The original master key can be acquired in a number of different ways, including being generated by the device or by another device. A one-way, progressive series of keys are derived from the master key such that only images or data of a same session can be authenticated or decrypted for viewing, export or manipulation of the decrypted image/data. In order to decrypt images or data of a previous session on the device, the master key must be imported to the device, such as by, but not limited to, taking a picture of a representation of the key and interpreting the image to reacquire the master key.

Abstract: A security key generating method, device and system are provided, wherein, the method is used for generating a security key in the process of the handover to an EUTRAN network from other network, the method includes: an MME generates a security key based on a root key KASME of the EUTRAN network, a specific value and/or other parameters and transmits a handover request message carrying the security key to a target evolved Node B, i.e. eNB; a UE generates the security key which used by the target eNB based on the root key KASME of the EUTRAN network, the specific value and/or other parameters. The application of the present invention adopts a specific value, KASME and/or other parameters to output a security key, which can solve the problem existed in the related technology, the problem is that the middle security key used by access layer while handover between different access system can not be generated, and then it can not realize the security protection of the access layer.

Abstract: A key tree construction and key distribution method for hierarchical role-based access control, includes: constructing a key tree including relationships between a hierarchical structure of role groups and data; performing encryption and decryption of data keys and role keys; and generating a key table, in which the data keys required to decrypt encrypted data and the role keys required to decrypt encrypted data keys are stored, with reference to the key tree. Further, the key tree construction and key distribution method for hierarchical role-based access control includes performing management such that a specific role group can obtain a data key by performing decryption based on its own role key by using both the key tree and the key table.

Abstract: A method, a system and a device for maintaining user service continuity are provided in an embodiment of the present invention. The method includes prohibiting a UE from accessing a forbidden network before handover is complete when the UE needs to perform network handover if the UE adopts a SIM access technology, thus avoiding service interruption of a SIM user due to access to an incorrect network. A system and a device for maintaining user service continuity are provided in an embodiment of the present invention.

Abstract: According to one embodiment of the present invention, a method for broadcast encryption with security classes in a media key block is provided. In one embodiment the method includes receiving encrypted media of a first and a second class, where the media includes a common media key block, in a device of a first class and in a device of a second class. A first media key is calculated from the common media key block in the device of a first class. A first media key precursor is calculated from the common media key block in the device of a second class. The first media precursor may be used to decrypt media of a first class. The first media precursor may also be used to calculate a second media key in the device of a second class to decrypt content of a first class.

Abstract: A system for authenticating communication network users includes a user-associated user station communicatively coupled to an authenticating station via the communication network. The authenticating station is configured to authenticate the user and receive a first value, representing a first user credential, from the user station. A first key portion is generated based on the first value and a second value that is unknown to the user. The first key portion, along with a second key portion, is used for authenticating credentials of the user for a predefined period of time or for authenticating user credentials for a predefined number of times. The second key portion is generated based on the first key portion. A cookie that includes the second value or a value derived from the second value is generated and transmitted to the user station and then the second value is destroyed.

Abstract: The present invention relates to an authorization key generating method and an authorization key updating method in a mobile communication system. A terminal and a base station generate an authorization key by using a terminal random value and a base station random value that are exchanged in an authorization key generating procedure as input data. In addition, a lifetime of an authorization key is established to be shorter than a lifetime of a root key, and the authorization key is updated with an updating period that is shorter than that of the root period.

Abstract: An elliptic curve random number generator avoids escrow keys by choosing a point Q on the elliptic curve as verifiably random. An arbitrary string is chosen and a hash of that string computed. The hash is then converted to a field element of the desired field, the field element regarded as the x-coordinate of a point Q on the elliptic curve and the x-coordinate is tested for validity on the desired elliptic curve. If valid, the x-coordinate is decompressed to the point Q, wherein the choice of which is the two points is also derived from the hash value. Intentional use of escrow keys can provide for back up functionality. The relationship between P and Q is used as an escrow key and stored by for a security domain. The administrator logs the output of the generator to reconstruct the random number with the escrow key.

Abstract: A key distribution system for controlling access to content by rendering devices, comprising an epoch module to provide epochs, each epoch including service key periods, a service key module to provide a batch of service keys, a group module to provide group keys for each epoch such that each rendering device is assigned a group key grouping together the devices having the same group key, thereby defining groups, in different epochs the devices are grouped differently, an encryption module to encrypt, for each epoch, each service key in the batch of service keys, individually with each group key yielding a plurality of group-key-encrypted service keys from each service key, and a delivery module to distribute to the devices, for each one of the epochs, the group-key-encrypted service keys for the batch of service keys and the group keys of the one epoch. Related apparatus and methods are also described.

Abstract: A system and method efficiently deletes a file from secure storage, i.e., a cryptainer, served by a storage system. The cryptainer is configured to store a plurality of files, each of which stores an associated file key within a special metadata portion of the file. Notably, special metadata is created by a security appliance coupled to the storage system and attached to each file to thereby create two portions of the file: the special metadata portion and the main, “file data” portion. The security appliance then stores the file key within the specially-created metadata portion of the file. A cryptainer key is associated with the cryptainer. Each file key is used to encrypt the file data portion within its associated file and the cryptainer key is used to encrypt the part of the special metadata portion of each file. To delete the file from the cryptainer, the file key of the file is deleted and the special metadata portions of all other files stored in the cryptainer are re-keyed using a new cryptainer key.

Abstract: An electronic signature verification method implemented by SKI infrastructure adopts a secret key infrastructure (SKI) system for registering a secret key and issuing a signature key and a verification key. After a signer has completed a signature, a signature data, a verification data and a verification key encrypted by the secret key of a signature verification unit are sent to a recipient. After the recipient has received the data, a user needs to send the verification data and the encrypted verification key to a signature verification unit if the user wants to confirm the signature on the signature data. The signature verification unit uses a secret key authorized by the SKI for the decryption to obtain the verification key and uses the verification key to verify the verification data and confirm the existence of the signature of the signature data, so as to authenticate the signature of the signature data.

Abstract: A key generation system is disclosed that provides for the generation of privileged group keys based on the input of a privileged group. The system performing the key generation has stored component keys corresponding to every possible subset X of the unitary set, where subsets X have k or fewer members. The privileged group key is generated for the privileged set by passing ordered component keys of subsets X that do not contain members of the privileged set to a pseudo random function.

Abstract: An integrated circuit that includes a controller and multiple internal circuitries, whereas the integrated circuit is characterized by further including a security mode determination unit that includes multiple one time programmable components for defining a security mode out of multiple possible security modes, whereas a selected circuitry mode affects access to an internal circuitry. A method for testing an integrated circuit, the method includes: receiving a request to access an internal circuitry; and responding to the request in view of a defined security mode; whereas the method is characterized by a stage of defining a security mode of a debug circuit out of multiple security modes, whereas the definition is responsive to at least a state of multiple one time programmable components.

Abstract: In one embodiment, a cryptographic device is provided. The cryptographic device includes a persistent memory and a decryption control circuit coupled to the persistent memory. The decryption control circuit is configured to receive an encrypted data stream and decrypt a first portion of the encrypted data stream using a first cryptographic key stored in the persistent memory, the first portion including a second cryptographic key. The decryption circuit is configured to decrypt a second portion of the encrypted data stream using the second cryptographic key, the second portion of the encrypted data stream including payload data.

Abstract: A secure method and apparatus for data exchange that allows a client's or patient's financial data, medical records, and other information to be stored on a card-shaped compact disk, with multiple levels of encryption to preserve privacy. The trusted record disc can be read on any computer with a network or internet connection, but access to the information on the disc is restricted according to a password protected hierarchical encryption policy. In order to obtain access to the restricted information, an individual user needs to enter a unique password that is sent to a central server. The server confirms the password and returns an electronic key to the user's computer. The electronic key unlocks the encryption and allow the user to view only the information that is permitted (under federal patient, financial privacy or other laws). Thus, in the medical setting, physicians can review the patient's entire medical record and make changes to it.

Abstract: Data storage devices having one or more data security features are provided according to various embodiments of the present invention. In one embodiment, a data storage device comprises buffer and a buffer client. The buffer client comprises a scrambler configured to receive a configuration setting and a secret key on a certain event, to configure a scrambling function based on the received configuration setting, and to scramble data with the secret key using the scrambling function, wherein the buffer client is configured to write the scrambled data to the buffer.

Abstract: A wireless receiver and methods for storing content from RF signals received by the wireless receiver are provided. The wireless receiver includes a microprocessor and an RF receiver configured to operably communicate with the microprocessor. The RF receiver is configured to receive an RF signal having digital content therein. The wireless receiver further includes a detachable memory device configured to operably communicate with the microprocessor. The detachable memory device has a unique serial number stored therein. The microprocessor is configured to retrieve the unique serial number from the detachable memory device. The microprocessor is further configured to receive the digital content from the RF receiver and to encrypt the digital content utilizing the unique serial number to obtain encrypted digital content. The microprocessor is further configured to store the encrypted digital content on the detachable memory device.

Abstract: Methods and apparatus for improved scrambling and/or descrambling of packets in a communications network are described, e.g., improved scrambling/descrambling of MPEG-2 transport stream packets over an Internet Protocol network. Advance Encryption Standard (AES) under cipher block chaining is utilized in scrambling some transport stream packets. Methods and apparatus for computing an initialization vector or vectors used by the AES are also described. The initialization vector can be set to either a constant or a programmable random number. Scrambling methods and apparatus directed to scrambling solitary termination blocks with a reduced size packet payload e.g., less than 128 bits in an MPEG-2 transport stream packet, are also described. Various features are useful for and can be implemented in set-top boxes and IPTV scramblers in the headsets.

Abstract: A method of encrypting a plain text message that is m characters in length is described. A one off random key having a length of m characters is generated. The random key uses a character set and modulus that is compatible with the plain text message. A first substitution encryption of the plain text message is performed using the generated random key. A string of random fill characters that is f characters in length, f being a number between zero and infinity is generated. The generated random key and the string of random fill characters is concatenated to the encrypted plain text message to generate an encrypted message string. The encrypted message string has a length 2m+f. The encrypted message string is transmitted to a receiver.

Abstract: A method for establishing a secret key between two nodes in a communication network, in particular in a wireless local area network (WLAN), includes concealment of the fact that a key exchange occurs, one of the nodes—first node (B)—broadcasts one or more packets (Pi) that can be received by the other node—second node (A)—, wherein the packets (Pi) contain each a first key (Ki) and wherein the packets (Pi) are each encrypted with a second key (ki) before being sent, the second node (A) randomly chooses one packet (Pm) from the packets (Pi) received and breaks the encryption of the chosen packet (Pm) in order to obtain the first key (Km), and the second node (A) initiates a key exchange protocol, wherein the second node (A) encrypts the message to be sent for initiating the key exchange protocol with the revealed key (Km).

Abstract: A system and method for generating round keys used for encrypting and decrypting an input text block. A received cipher key is used to generate round keys that include round key words. Two round key words are generated at the same timebased on the word lengths of the input text block and the cipher key. The generation of round keys may be paused depending on the word lengths of the input text block and the cipher key.

Abstract: Described herein in an example embodiment, is a mechanism to distribute and implement secure credentials on a WLAN (wireless local area network) employing radio frequency identification (RFID) tags. Symmetric keys are provisioned to the tag in a manner that allows for optimized re-association and secure announcements. The provisioned keys are derived in a way that enables the controller to operate without having to maintain the key state for every tag. In an example embodiment, the controller generates keys for the RFID tags that are derived from a master key associated with the controller, an identifier assigned to the RFID tag and an address associated with the RFID tag.

Abstract: An information processing apparatus capable of effectively preventing unauthorized use of content distributed through a network when playing the content. The information processing apparatus includes a tamper-resistant secure module, a receiving block, and a playback block. The secure module includes a key storage block for storing a decryption key, a decryption block, and an encryption block. The receiving block receives distribution data distributed through the network and transfers the data to the decryption block. The decryption block decrypts the distribution data to obtain content by using the decryption key. The encryption block divides the content to a plurality of split pieces of content and encrypts them by using a temporary encryption key. Information on a temporary decryption key is output each time the temporary encryption key is changed. The playback block decrypts the encrypted pieces of content by using the temporary decryption key and combines and plays them.

Abstract: A recursive based approach to key generation produces keys for encrypted communication. Simple mathematical operations are utilized with the inherent uncertainty of an interactive process between two endpoints to establish a common secret key. The uncertainty-based key cipher starts with some public information and some private information. The public information includes a vocabulary (alphabet) and keypad, and the private information can include an authentication code. The keypad is an abstraction that represents, for example, a set of “buttons.” These buttons will be used to translate a working key into a text that could be used to evaluate coincidences in a generated working key. Each keypad button can have more than one possible value. The number of options inside the button is the so called “uncertainty level.

Abstract: A cryptographic key is virtualized to provide a virtual cryptographic key. To virtualize the key, an operation, such as an exclusive OR operation, is used with the key and a mask. The virtual key is usable by a guest of a virtual environment in cryptographic operations.

Abstract: To realize an extended-Feistel-type common-key block-cipher process configuration for realizing a diffusion-matrix switching mechanism (DSM). In a cryptographic process configuration in which an extended Feistel structure having a number of data lines: d that is set to an integer satisfying d?3 is applied, a plurality of multiple different matrices are selectively applied to linear transformation processes performed in F-function sections. A plurality of different matrices satisfying a condition in which a minimum number of branches for all of the data lines is equal to or more than a predetermined value are selected as the matrices, each of the minimum numbers of branches corresponding to the data lines being based on linear transformation matrices included in F-functions that are input to a corresponding data line in the extended Feistel structure.

Abstract: A configuration is adopted for including in key specifying information, being the configuration data of a key specifying code, subset division identifying information (partition bit) indicating whether or not cryptograms to which subset keys corresponding to divided subsets obtained by division of a dividable subset into a plurality of subsets are applied are included in a cryptogram block. With such a configuration, a cryptogram to which a subset key corresponding to a divided subset is applied can be generated and transmitted to an information processing apparatus. The information processing apparatus accepting the cryptogram and the key specifying code judges whether or not the accepted cryptogram is one to which the subset key corresponding to the divided subset is applied. Then, the information processing apparatus can select the cryptogram that is a target of decoding on the basis of the key specifying code.

Abstract: A device for determining an inverse of an initial value related to a modulus, comprising a unit configured to process an iterative algorithm in a plurality of iterations, wherein an iteration includes two modular reductions and has, as an iteration loop result, values obtained by an iteration loop of an extended Euclidean algorithm.

Abstract: In computing point multiples in elliptic curve schemes (e.g. kP and sQ) separately using, for example, Montgomery's method for the purpose of combining kP+sQ, several operations are repeated in computing kP and sQ individually, that could be executed at the same time. A simultaneous scalar multiplication method is provided that reduces the overall number of doubling and addition operations thereby providing an efficient method for multiple scalar multiplication. The elements in the pairs for P and Q method are combined into a single pair, and the bits in k and s are evaluated at each step as bit pairs. When the bits in k and s are equal, only one doubling operation and one addition operation are needed to compute the current pair, and when the bits in k and s are not equal, only one doubling operation is needed and two addition operations.

Abstract: A method, system, and computer-readable storage medium containing instructions for controlling access to data stored on a plurality of storage devices associated with a first platform. The method includes authenticating a user to access the first platform, wherein the first platform includes first and second storage devices, chipset encryption hardware, and a memory. Data stored on the storage devices are encrypted, with first data on the first storage device being encrypted by the chipset encryption hardware and second data stored on the second storage device being encrypted by another encryption mechanism. The data are decrypted and the user is allowed to access the first data and the second data.

Abstract: In a key-insulated cryptosystem according to the present invention, a plurality of external devices are associated with a number of updates of a terminal secret key which has already been updated, and a different piece of secret information is stored in each of the external devices. In addition, a key-updating method in the key-insulated cryptosystem according to the present invention includes steps of: selecting one of the external devices depending on the number of updates of the terminal secret key; and causing the selected external device to generate key-updating information used for updating the terminal secret key based on the number of updates and the stored secret information.

Abstract: A receiving unit receives information selected by a user on an operating screen. A detecting unit detects a function executing part corresponding to the information received by the receiving unit. A determining unit determines that the user authentication is required when a function is to be executed, when “the user authentication is required” is set for at least any one of a function allocated to a function executing part that is detected by the detecting unit, the function allocated to another function executing part, and the operating screen that includes the function executing part to which the function is allocated. A function executing unit executes a function allocated to the function executing part selected by the user, wherein the user is authorized to execute the function.

Abstract: The present invention concerns a method and a device for encrypting an encoded scalable enhancement frame sent by an emitter to a receiver, the enhancement frame comprising a plurality of complementary streams ordered in term of quality level, each complementary stream corresponding to a combination of more than one scalability type, where a complementary stream of a lower quality level corresponds to a lower quality on each scalability type, comprising at the level of the emitter the steps of generating a key per complementary stream for encrypting said complementary stream in such a way that all scalability types can be either simultaneously or individually used, said keys being generated in such a way that only the keys of the complementary streams of quality levels lower than the quality level of a complementary stream can be obtained from the key of said complementary stream, and sending the key of a complementary stream corresponding to a required quality level to the receiver, the key permitting a rece

Abstract: Apparatus and method for generating a traffic encryption key includes generating a traffic encryption key for encrypting data transmitted as part of a service, the traffic encryption key having a validity equal to a traffic encryption key validity time period; checking whether a period for the service is longer than the traffic encryption key validity time period; and if the period of the service is longer than the traffic encryption key validity time period, ascertaining a residual period which indicates by what period the service is longer than the traffic encryption key validity time period of the traffic encryption key; generating a residual traffic encryption key which is used for encrypting data transmitted as part of a service; ascertaining a residual traffic encryption key validity time period which indicates for how long the residual traffic encryption key is valid; and associating the residual traffic encryption key validity time period with the residual traffic encryption key.

Abstract: A method and apparatus are disclosed for managing components of a secret key according to a secret sharing scheme. The disclosed secret sharing scheme divides a secret value, R, into n secret components (R1, R2, . . . , Rn) and one super component, S, in such a way that R can be computed from (i) any k or more R1 components (k<n); or (ii) S and any one component of Rl. The secret components (R1 ,R2, . . . , Rn) are distributed to a number of authorized users. A multiple threshold secret sharing scheme assigns various users in a group into one of a number of classes. Each user class has a corresponding threshold level that indicates the number of users that must come together with their assigned components to obtain access to the shared secret. The multiple threshold scheme divides the secret into n components each having an assigned threshold level (i.e., the number of such components that are required to obtain the secret).

Abstract: Conventionally, an encryption key for encrypting data to be backed up in a tape cannot be allocated for each logical data management unit. To solve the problem, provided is a storage system including: a disk storage device; a tape storage device in which a tape storage medium is loaded; and a controller for controlling the disk storage device and the tape storage device, in which the controller is configured to: generate, upon reception of a request for setting a tape group including one or more tape storage media, a first encryption key used for encrypting data stored in the tape group set by the request; and hold information for correlating the generated first encryption key with the tape group.

Abstract: The present subject matter related to trusted computing, and more particularly, to virtual trusted platform module keys rooted in a hardware trusted platform module. Some embodiments include a trusted platform virtualization module operable to capture virtual machine trusted platform module calls and operates to generate, maintain, and utilize hardware trusted platform module keys on behalf of the one or more virtual machines. Some embodiments include virtual trusted platform module keys having a public portion on top of an private portion including an encrypted hardware trusted platform module key.

Abstract: A method to efficiently detect, store, modify, and recreate fully or partially duplicate file forks is described. During archive creation or modification, sets of fully or partially duplicate forks are detected and a reduced number of transformed forks or fork segments are stored. During archive expansion, one or more forks are recreated from each full or partial copy.

Abstract: Consistent with embodiments of the present invention, systems and methods are disclosed for deriving a secure key.

Abstract: The present invention discloses a method and device of generating asymmetrical key pair (public key and private key) based on user identity. Key Management Center (KMC) generates public/private key calculating base, and publish the public key calculating base. Based on identity provided by a user, a private key is calculated and provided to the user. Any user can calculate other user's public key based on other user's identity and the published public key calculating base. Thus, when obtaining the public key of the communicating party, no third party CA certificate is needed, and no maintenance of mass parameters associated with users are needed.

Abstract: Systems and methods are disclosed for using cryptographic techniques to configure data processing systems. A configuration manager cryptographically controls the configuration of a system by ensuring that only authorized users or applications can change the configuration. For example, requests to change configuration information may include authenticated and/or encrypted data. These cryptographic techniques are employed to enable and/or disable functions, features and capabilities of a system. For example, a system may be reconfigured to provide strong or weak encryption based on parameters in the configuration information.

Abstract: In the key management software having a key database with a tree structure, a high-speed data encryption/decryption process is achieved by changing the tree structure without reducing the security strength when deleting or adding a key from/to the tree structure. The key management software having the key database with the tree structure, when deleting or adding a key from/to the tree structure, refers to the encryption strength comparison table and the process time comparison table to change the tree structure without reducing the security strength. This reduces the number of times an encrypted key is loaded onto the encryption/decryption processing device during the data encryption/decryption process, thus achieving a high-speed data encryption/decryption.

Abstract: Method and device for generating factors of a RSA modulus N with a predetermined portion Nh, the RSA modulus comprising at least two factors. A first prime p is generated; a value Nh that forms a part of modulus N is obtained; a second prime q is generated in an interval dependent from p and Nh so that pq is a RSA modulus that shares Nh; and information enabling the calculation of the modulus/V is outputted.

Abstract: An encrypted communication system is provided, in which an encryption key for use in encrypted communication and settings information for the encrypted communication are distributed to each of a plurality of communication devices performing encrypted communication within a group, and in which traffic generated by distributing the encryption key and the like can be reduced. In the encrypted communication system according to the present invention, information including a key for use in the intra-group encrypted communication or a seed which generates the key is distributed to the communication devices belonging to the group that are participating (e.g., logged in) in the intra-group encrypted communication.

Abstract: A program tool with a data-securing function includes a flow control center and a plurality of processing units for performing respective processing steps. The flow control center receives and transfers an encrypted input data to perform a decryption step, transfers the decrypted data to one of the plurality of processing units to perform a corresponding processing step, and further transfers the processed data to perform an encryption step.

Abstract: Circuits, methods, and apparatus that prevent detection and erasure of encoding or encryption keys. These encoding keys may be used to encode a configuration bitstream or other data for an FPGA or other device. An exemplary embodiment of the present invention masks a first key to form an encoding key in order to prevent detection of the first key. In a specific embodiment, the first key is encoded using a second key. The encoded key is used to encode a configuration bitstream or other data. The encoded key is stored on an FPGA or other device. When the device is to be configured, the encoded key is retrieved and used to decode the bitstream or other data. A further embodiment stores an encryption key in a one-time programmable memory (OTP) array to prevent its erasure or modification. The encoding key may be further obfuscated before storage.

Abstract: In the field of computer enabled cryptography, such as a block cipher, the cipher is hardened against an attack by protecting the cipher key, by applying to it a predetermined linear permutation before using one key to encrypt or decrypt a message. This is especially advantageous in a “White Box” environment where an attacker has full access to the cipher algorithm, including the algorithm's internal state during its execution. This method and the associated computing apparatus are useful where the key is derived through a process and so is unknown when the software code embodying the cipher is compiled. This is typically the case where there are many users of the cipher and each has his own key, or where each user session has its own key.

Abstract: Digital assets are in a secured form that only those with granted access rights can access. Even with the proper access privilege, when a secured file is classified, at least a security clearance key is needed to ensure those who have the right security clearance can ultimately access the contents in the classified secured file. According to one embodiment, a secured file or secured document includes two parts: a header, and an encrypted data portion. The header includes security information that points to or includes access rules, a protection key and a file key. The access rules facilitate restrictive access to the encrypted data portion and essentially determine who the secured document can be accessed. The file key is used to encrypt/decrypt the encrypted data portion and protected by the protection key.