US9270663B2 - System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added - Google Patents
System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added Download PDFInfo
- Publication number
- US9270663B2 US9270663B2 US14/218,897 US201414218897A US9270663B2 US 9270663 B2 US9270663 B2 US 9270663B2 US 201414218897 A US201414218897 A US 201414218897A US 9270663 B2 US9270663 B2 US 9270663B2
- Authority
- US
- United States
- Prior art keywords
- client device
- client
- trusted
- key
- security
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims description 24
- 238000004891 communication Methods 0.000 claims abstract description 56
- 238000012545 processing Methods 0.000 claims description 6
- 230000002085 persistent effect Effects 0.000 claims description 4
- 230000004044 response Effects 0.000 claims description 3
- 238000012795 verification Methods 0.000 abstract description 8
- 238000013475 authorization Methods 0.000 abstract description 6
- 238000005516 engineering process Methods 0.000 abstract description 4
- 238000013474 audit trail Methods 0.000 description 8
- 239000000243 solution Substances 0.000 description 7
- 238000007726 management method Methods 0.000 description 6
- 238000012384 transportation and delivery Methods 0.000 description 6
- 230000000694 effects Effects 0.000 description 5
- 230000008859 change Effects 0.000 description 4
- 230000010354 integration Effects 0.000 description 3
- 238000010200 validation analysis Methods 0.000 description 3
- RZVAJINKPMORJF-UHFFFAOYSA-N Acetaminophen Chemical compound CC(=O)NC1=CC=C(O)C=C1 RZVAJINKPMORJF-UHFFFAOYSA-N 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 230000001010 compromised effect Effects 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 230000002250 progressing effect Effects 0.000 description 2
- 230000000717 retained effect Effects 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 238000012512 characterization method Methods 0.000 description 1
- 230000003750 conditioning effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000002349 favourable effect Effects 0.000 description 1
- 238000002347 injection Methods 0.000 description 1
- 239000007924 injection Substances 0.000 description 1
- 230000000873 masking effect Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 231100000572 poisoning Toxicity 0.000 description 1
- 230000000607 poisoning effect Effects 0.000 description 1
- 239000000955 prescription drug Substances 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 150000003839 salts Chemical class 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L67/125—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks involving control of end-device applications over a network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/53—Network services using third party service providers
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/006—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving public key infrastructure [PKI] trust models
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
Definitions
- the present descriptions generally relate to the field of enabling security based communication lines established between users when using X.509-compatible PKI and PMI and related tools (see FIG. 1 “High-Level Depiction of Component- and Functional-Relationships in Combined Service Provider Model”). Rather than a centrally managed system of identity and relationship recognition and authorization, these functions are transferred to users through an Inviter-Invitee protocol suite, through which Inviters vouch for the identity of Invitees who successfully complete the protocol establishing communication lines.
- the Security Ecosystem includes an Attribute Authority which acts as a Trusted Third Party mediating service provider for users that can: securely set up identities, uniquely associate keys to identities and their invitees, thereby securing each communication line.
- the system delegates authorizations to inviters and invitees for each communication line, and then proceeds to enable live and/or asynchronous uploads. It delegates authorization requests and real-time verifications to the users of the system, so they can create private communication lines for the sharing of digital files.
- the service is agnostic to the platform and or service that each user uses to transport or store their encrypted content.
- authentication of identities of the other parties has been a challenge. It can be a challenge for one party to be certain of the identity of another party as well as to determine if some unknown party is impersonating the intended party.
- Cryptographic systems such as PGP have attempted to mitigate such challenges by instituting “key signing parties” and creating a “web of trust”. While helpful, such tools are cumbersome and less than absolute. Cryptographic systems such as PGP tend to become tools generally of the technically proficient who are willing to take the extra steps to overcome such limitations.
- Cryptography is the desired tool to protect digital assets from access by others. While properly encrypted digital assets can be secure, managing, transmitting, protecting the keys that allow access to such assets should be done securely and properly or the keys can come into control of others thereby compromising the encrypted asset.
- Symmetric key cryptography presents challenges not only in protecting the key in its owner's possession, but more critically in transmitting the key securely to a third party to whom the owner of the asset would like to provide access to the asset. This is can be difficult to accomplish.
- Public key cryptography can be used to address this problem.
- the digital asset can be encrypted with a symmetric encryption key followed by the symmetric key being encrypted using the public key of an intended third party to whom the owner would like to give access to the asset.
- Cryptographically, and for security purposes, this procedure works well.
- a shortcoming is related to the previously described challenges associated with public key cryptography.
- Businesses typically use centrally managed systems where users, their identities, and their relationships with other users are created and controlled. Particularly, with cryptographic capabilities involved, they aren't generally used or deployed unless there is a sophisticated Information Technology department supporting them. As a result the addition of new users, the establishment of user relationships, and the efficient flow of data between users are slowed by such a centrally managed bottleneck.
- the User-Directed, Authenticated, Cryptography-Enabling, Security-Focused Ecosystem (the “Security Ecosystem”) described herein is being created to address a number of problems encountered in both by business enterprises as well as consumers.
- the “going-paperless” problem is a manifestation of a broader problem confronting enterprises: lack of a user-friendly, workable, authenticated, secure B2C and B2B communication capability. It is a challenge today for enterprises to easily and securely exchange sensitive documents with those outside their networks.
- the Security Ecosystem's integrated software product will ensure that the sensitive documents, etc., that enterprise users send to third parties who are off the enterprise can be delivered securely and privately to their correct, authenticated recipients.
- the Security Ecosystem may be able to also offer Digital Signatures as a feature.
- Digital Signatures may address a need of enterprise businesses for non-repudiable digital signing capabilities both with individuals within and outside the enterprise.
- the Security Ecosystem's software is generally oriented to reduce impact on the existing manner in which enterprise users create, store and transmit documents to others.
- the Security Ecosystem generally does not transport, store or have access to user's encrypted data.
- the Security Ecosystem generally attempts to provide security to user's digital assets by providing a system to protect those assets though encryption, both in transit and at rest.
- the Security Ecosystem may provide a tool so that consumers may communicate privately, securely and with confidence not only with their authenticated friends, family and associates, but also with their user-created groups (e.g., schools, teams, clubs, political organizations, etc.)
- groups e.g., schools, teams, clubs, political organizations, etc.
- the Security Ecosystem may offer consumers a downloadable application to install on a desktop or mobile device that will “lock” (encrypt) and “unlock” (decrypt) documents using a cryptographic standard such as Advanced Encryption Standards (AES 256) as well as possibly other optional protocols.
- AES 256 Advanced Encryption Standards
- An authenticated, authorized recipient of a digital file may open it; locked files should not be viewable by advertisers, email or cloud providers, governments or others; private encryption keys can be held generally by their owners; and identities may be authenticated through user-managed tools.
- FIG. 1 shows a High-Level Depiction of Component—and Functional—Relationships in Combined Service Provider Model.
- FIG. 2 shows An example of Steps in the Inviter-Invitee Protocol.
- FIG. 3 shows A security Appliance deployed at an enterprise
- FIG. 4 shows An enterprise grade cloud-based B-to-C security solution
- an individual could operate under multiple identities, manage them centrally, and keep them private wherever desired.
- An Individual or group or business could tune up or down security at their discretion, so as to accomplish higher security for what he/they consider to be important communication lines and/or for specific digital assets (or likewise, lower security for less important communication lines and/or digital assets).
- Individuals and/or groups and/or businesses could mutually authenticate each other at a higher standard of care than is typically done (e.g., as a bank might authenticate its website customers.
- Security Ecosystem could authenticate individuals and groups and validate their transactions without being privy to the personal information used or the data exchanged.
- An individual or group or business could accomplish a very high standard of care for security, as the functions of a Security Ecosystem's could provide Security-as-a-Service, even using non-secure platforms like web mail and cloud services.
- Individuals or groups and/or businesses from totally different managed security platforms could communicate at high-grade assurance levels for secure end-to-end communication, without disrupting or altering their existing behavior or infrastructure.
- the Security Ecosystem is that the primary enabling security is based upon communication lines, not end points. This is why each user can have multiple identities: they can be anyone at the end of the communication line; the main thing is that the entity at each end agrees to communicate.
- the Security Ecosystem then protects entry into a device, entry into the Ecosystem software, and when desired, additional security to enter into unique documents.
- the Security Ecosystem extends from there the ability to validate identities (through various proprietary and common methods) and score identities (proprietary methods) where desired, and to on top of this the Ecosystem offer products for individuals, groups, administrators, as well as work flow packages, document signing, and customized vertical solutions. It is noted that the fundamental architecture is based on the communication line between users.
- the Security Ecosystem has a proprietary Attribute Authority (“AA”), which acts as a Trusted Third Party mediating service provider.
- AA Attribute Authority
- the Ecosystem can: securely set up identities, uniquely associate encryption keys to identities and their invitees (communication lines), delegate authorizations (e.g. to inviters or to asynchronous uploads) and/or handle authorization requests and/or other real-time verifications pertaining to accessing communication lines and sharing digital files.
- RA Registration Authority
- the Security Ecosystem is designed to be agnostic to where and/or how email or other content is hosted. Furthermore, a primary Ecosystem strength that is typically not a part of other offerings is auditable brokering of trusted relationships through the Ecosystem's Inviter-Invitee protocol suite (see FIG. 2 “Inviter-Invitee Protocol Example”), where such relationships and/or digital agreements may each stand alone (for higher privacy), and/or can optionally leverage build-up of identity confidence levels across relationships to the extent that policy allows.
- the resulting individual or chained attribute certificates could potentially be used to enhance offerings of other providers that are primarily designed to try to assure continuity of unclonable identifiers across Web sessions, rather than to add value relative to third-party (such as the Ecosystem) evidence-gathering and attestation-generation with regard to actual user identities.
- Third-party support for user identities may become more important when high-value transactions are at stake.
- the fact that most other typically systems don't rely on the services of a trusted third-party entity is directly related to the fact that there are no attestations or proofs of identity. While such a trusted third party could issue identity-based cryptography credentials, public key certificate, attribute certificates, etc. without conditioning such issuance on demonstrable proof or evidence of actual identity, the real value of such third-party involvement is in a system like the Ecosystem, where Inviters essentially vouch for the identity of Invitees who successfully complete the Invitee protocol.
- the Security Ecosystem may be deployed in either a cloud-hosted environment or in an Enterprise (i.e., business) deployment on premise in the private enterprise's hosted environment.
- the Ecosystem could be provisioned in private-label basis associated with the enterprise.
- the enterprise could use it as a Business-to-Consumer security solution, for example.
- Such a deployment could reduce any concern an enterprise might have about an outside provider having access to privileged information. (See FIG. 3 “A security Appliance deployed at an enterprise”).
- Security Ecosystem can create a security appliance that deploys at such a private enterprise to create and manage private/public key pairs for customers, partners and associates who are outside the enterprise security envelope (See FIG. 3 “A security Appliance deployed at an enterprise”).
- the appliance may contain an Attribute Authority (“AA”) in a typical HSM, which may interoperate with the typical enterprise Certificate Authority (CA) (or in another embodiment with a CA integrated with the AA).
- AA Attribute Authority
- CA Certificate Authority
- the appliance may integrate with typical LDAP tools for CRM contacts, Active Directory settings, etc. and accomplishes real-time provisioning and revocation.
- the Enterprise uses the appliance to invite their customers or other contacts to download a private-branded thin client that delivers the security as a service in the name of the Enterprise to the computer or other device of the customer or other contact.
- the appliance may provide administrative tools for security settings and optionally an audit trail of activities with reporting.
- the enterprise appliance of (optionally privately-branded infrastructure of security components will enable enterprise users to share documents and communications with external individuals and/or companies using strong authentication and encryption.
- the solution can enable the enterprise's IT Security Group to control, host, and manage a security application that invites outside parties to download a client to their smart device and/or computer in order to share content with enterprise users over any content transport and/or delivery platform (i.e. email, Dropbox, FTP sites, etc.).
- Such an ecosystem appliance may provide a variety of benefits such as one or more of: end-to-end security from the enterprise users to outside parties without extending the firewall and without requiring federated identity management; facilitating the creation of agreement-based relationships within a trusted framework so that the enterprise can have higher confidence that the sensitive data and messages it shares outside of its network are being shared generally only with the enterprise-authorized Off-Net Users; manages user-directed, end-point encryption of digital assets for secure sharing with other users (where this end-point encryption can also be used for secure storage and retrieval); may provide a future capability for enterprise cross-certification resulting in public keys that map to identities on one enterprise being recognized by another enterprise in order to facilitate automated inter-enterprise, secure communication; may provide practical adoption of non-repudiable Digital Signing of documents so that Digital Signing may become a reliable, user-contact tool and trusted tool of the enterprise's corporate records; may provides the availability of trusted audit trails with detailed, cryptographically-validated records of the encryption, decryption and authentication operations applied to users' messages
- the Security Ecosystem appliance may provide optional features such as: giving enterprise-authenticated On-Network Users an ability to invite new Off-Net Users to establish a persistent, secure communications line between them; a communications line may be established between an Off-Net User and either: (a) one or more single enterprise On-Net Users; or (b) a defined internal the enterprise Group (e.g., a sales team); or (c) a combination of (b) and (c); the Security Ecosystem appliance may integrate with the enterprise's Public Key Infrastructure (PKI) and Privilege Management Infrastructure (PMI) in order to provide Inviter and Invitee protocols that serve to securely initialize or update persistent secure communications lines between the enterprise and the enterprise-authorized Off-Net Users; communications handling preferences or instructions may be incorporated into the Inviter and Invitee protocols, e.g., proffered by the Inviter and accepted by the Invitee; endpoints may be characterized by context-specific identities (e.g., an Off-Net User may have an “Attorney” identity on a communications
- PKI
- the Security Ecosystem appliance may provide for a digital asset to be encrypted at an endpoint (such as an enterprise server or desktop or mobile device or other); the appliance manages the use of cryptographic keys through easy-to-use software for provisioning and revoking the use of these keys according to the instructions of the enterprise; appliance may optionally be customized for enforceable handling (via appropriate encryption) of unique digital assets as set by the sending user endpoint, possibly as directed by terms incorporated into the Digital Agreement governing that asset type (e.g., a digital asset of that type may not be opened on a mobile device, but only on a computer) with flexibility at the discretion of the enterprise; the appliance may be optionally customized to integrate with a metadata-injection tool applied to the enterprise files, to label them confidential or not, which might be used by the enterprise to signal whether such a file would be subject to encryption or not.
- an endpoint such as an enterprise server or desktop or mobile device or other
- the appliance manages the use of cryptographic keys through easy-to-use software for provisioning and revoking the use of these keys according
- an enterprise may use the appliance in one or more of these ways: while the Security Ecosystem software creates encrypted data at endpoints, the appliance and/or servers hosted by the enterprise generally need not access, store or transport the encrypted data (but may do so in another embodiment); encrypted data can be stored in any cloud storage and/or sent over any public network, cloud platform or email system without being readable by such a service provider; Inviter and Invitee protocol processing may generate audit trails based, in part, on digital signatures, and which are controlled entirely by the enterprise (but may be shared in another embodiment); the appliance may be optionally customized such that highly sensitive data could be designated to require one or more additional security step in order to gain access to its plaintext form (e.g., password protected or multi-factor authentication required).
- the appliance may be optionally customized such that highly sensitive data could be designated to require one or more additional security step in order to gain access to its plaintext form (e.g., password protected or multi-factor authentication required).
- an enterprise may use the Security Ecosystem appliance for one or more purposes, such as: to securely share confidential documents with Off-Net Users such as attorneys, healthcare professionals, CPA's, business partners, Government Regulators of many sorts, VIP Customers/Guests or anyone or any business or other entity where security of information is desired; common enterprise departments that could be attractive candidates for making use of the appliance capabilities are: Executive, Legal, Marketing, Finance, Sales teams, and others; an example of a noteworthy use case in a hospitality enterprise could include that between VIP hosts and hotel VIPs with the VIPs possibly benefitting from the prestige of a secure, private app on their device and/or computer in order to securely communicate and/or share sensitive assets with the enterprise; another example of a possible benefit to a hospitality enterprise would be the ability to immediately change the Host-to-VIP secure link when a host leaves the employ of the enterprise with the immediate substitution to a new host identity to assume responsibility and control of that Host-to-VIP communication line; other examples of types of sensitive information for which easy-to-use data encryption might be chosen in
- the Security Ecosystem appliance will have flexibility in integrating with an enterprise's PKI functionality relative to its scalability potential to service clients outside of the enterprise and accommodate and adjust to any potential reuse of components (such as RA) across the PKI and PMI as well as to accommodate to the enterprise's Disaster Recovery Plan (DRP).
- RA Disaster Recovery Plan
- the Consumer product will be an easy-to-use application for individuals to secure documents (through encryption) and share credentials (by invitation) with contacts and associates. With the Consumer product, individuals can take control of their security. Documents secured with the Consumer product can travel through any email or cloud-based storage platform and remain secure and unreadable by any 3rd party.
- the Consumer Product leverages high-grade security standards, and is designed to give people privacy and the freedom to decide how and where they share information, and with whom.
- products offered for sophisticated consumers to accomplish higher grade security, using digital signatures and multi-factor authentication.
- One example of such could be an out-of-band authentication product (Using barcode and/or QR code technology) that raises standard of care on man in middle attacks (described in detail elsewhere).
- tools and/or widgets for cross platform consumer application interoperability such as shared SAML assertions, federated identity, etc., as well as mini apps for smart devices, integration with 3rd party multifactor authentication).
- Peer group administration module as well as Peer to peer Workflow tools.
- an enterprise grade cloud-based B-to-C security solution there could be an enterprise grade cloud-based B-to-C security solution.
- An analogy could be to look at Dropbox, which has a consumer product with heavy-user upgrades, and a commercial version, with major institution upgrades.
- the backbone is Dropbox, and these customer-centric products and features are modules catering to different demands and tolerances for sophistication, integration, privacy, complexity and convenience.
- Such a Cloud-based Enterprise Product could interoperate with a Private Label Appliance so that the Private Label Appliance could connect to the Cloud-based Enterprise to communicate with “anyone”—not just customers in their ACL or CRM database, using the system's Authentication solutions, etc, and its Cloud CA and meanwhile not put any of an enterprises Certificates or audit trail information or usage analytics outside their private network. (See FIG.
- Customized branding within the thin client for example, when a person opens the thin client to unlock a document from a specific Group (like a Bank), the application will deliver the bank brand in the graphic; Cloud storage & transport of documents in order to automate B-to-C document delivery; Storage of hashes of documents in order to prove whether a document has been altered; vertical-specific and/or modular products such as stock trade verification, prescription drug fulfillment, etc. (e.g. could include non-repudiable proof of instructions and compliance, as well as mutual authentication as well as enable workflow such as multiple approval levels, as well as upgraded security features); platform-specific deployments (e.g.
- app store product for AWS, Salesforce, EBay etc.
- a host of add-on products apps for B-to-C enablement such as: digitally signed objects (enables workflow, permission levels); Workflow tools to enable web forms and paperless transactions; TrustScore alerts and management; expanded business intelligent tools and/or analytics; audit trail/diligence product; B-to-C statement/invoice/other encryption capability for secure transport to a designated recipient; Group management tools; escrow offering; Legal compliance offering (e.g. holding documents or orders in escrow as fiduciary).
- the system has an option that may be implemented by users called “tunable security”.
- Tunable Security a user might, for example, invite 10 people. They have baseline shared secrets, mutually authenticated comm lines. A user could add another person and might require that that authenticate every time he/she accesses a protected document or a communication line (e.g., through a fingerprint app, other multi-factor authentication, a Security Ecosystem QR/bar code methodology, or other). A user may chose to insist on session authentication (e.g., ABBA) and/or also insist on authentication for one or more documents.
- session authentication e.g., ABBA
- LKSM Key Management Issues are addressed regarding the LKSM in which the SEED is generated by first instance of the client for the given user.
- a SEED can be generated by using combined randomness from both client-local source(s) and mediating service provider, where the server's contribution is transmitted encrypted over the VPN connection.
- SEED can be securely transmitted to other instances of the client for the same user: Can potentially be done by using the VPN keys of the clients, if authenticity can be determined, e.g., if such VPN public keys bear public key certificates.
- VPN configuration may include provisioning of a key pair for use in client authentication. Such key pair is specific to the instance of the client, and need not be backed up.
- Such key pair is intended primarily for secure communications between the client and the mediating service provider, it may also be used for synchronizing user-level keying material across instances of a client associated with the same user (without involving the mediating service provider directly in such exchange so as to assure inaccessibility by the service provider).
- the user's mobile phone and/or a peripheral storage device e.g., USB
- the mediating service provider may issue a digitally signed software token that must be re-presented to the client in order to trigger encrypted export of user-level keying material to another instance of the client, potentially via a mobile device associated with the user and local to the source or destination during some sort of pairing with each.
- the software token may be movable to a peripheral storage device (where a hash is retained in the client).
- a group does not identify an individual, but defines function/role, such as host entity of a customer relationship.
- An active group may include as few as one active member.
- the group administrator is considered a member of the group.
- An attribute certificate for the group indicates group characterization (e.g., department(s) and/or role(s)), and references a public key certificate that includes a signature verification public key.
- the corresponding signature generation private key is held by the group administrator.
- This key is used to assign the group public key that is used for encryption or key establishment. This mechanism enables the group administrator to (re-)assign values to the group public key as long as the attribute certificate (or its replacement) is currently valid and the signature verification public key has not been revoked.
- the group administrator can securely provide the group private key to other current members of the group: (a) use can be made of (certificate-bearing or otherwise authenticated) encryption public keys or key establishment public keys of prospective group members; (b) use can be made of ephemeral key establishment public keys that have been digitally signed using digital signature generation private keys of prospective group members that correspond to certificate-bearing or otherwise authenticated signature verification public keys. If a (non-group administrator) group member's access is to be deleted, the group administrator can assign a new value to the group public key and distribute the corresponding group private key to surviving group members (as well as to new group members if/when such are added).
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Medical Informatics (AREA)
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
Abstract
Description
-
- Register at The Consumer Product.com
- Sign up (free or fee)
- Download the application (easy & fast)
- The Consumer Product generates user identity and keys
- The local app registers your device and generates a local private key
- Use the application to invite contacts to share secure documents
- Invite contacts using an email address
- Friend receives a link to a website for enrollment
- Friend is registered in Inviter private application.
- Friend can now unlock Inviter document, and unlimited secure docs can be shared between the two parties.
- Use the application to lock and unlock documents
- The application may Auto-launch when a locked “Consumer Product doc” is double-clicked (retrieved from storage or email or other source) and if the user is already signed in, the document will open.
- Lock a document, which includes selecting who can open it (either oneself, or add names from the list user invited connections, or invite a new associate.)
- Account administration
- For each contact, view dates and times when docs have been opened
- Upgrade account to add more contacts.
- Change/reset password, account keys.
- Download application updates
B. Architecture
- 1. General Structure
- Web-based Enrollment, Account Management
- Private, cloud-based PKI/PMI with Administrator App
- Device-side App for Opening & Closing Docs
- 2. Application Software
- Web Services & UI
- Back end infrastructure (HSM) and administration UI
- Mobile/Smart Device App: support for iOS, Android, maybe Blackberry, Windows Mobile, etc.
- Desktop support for OS-X 10.5+, Windows 7/8, etc.
- Desktop/Device-side UI (possibly JavaScript or other)
- 3. Security Architecture
- X.509 with ECC
- PKI
- PMI
- Key Escrow
- Customized code for PMI—a proprietary Authentication Authority with Inviter Protocol
- Digital signature with Time/Date stamp
- Local Key Store Module at mobile/desktop device level, No Firmware, no interoperability with other apps v.1.
- Generally requires VPN technology to connect. The device-side app in most circumstances will be online connected to the Security Ecosystem server to unlock documents operate.
C. User Interfaces Descriptions
- X.509 with ECC
- 1. Register at a designated website
- Sign up (free or fee): Needs ability to enter a user name (will become the default identity) and password, with a quality check on password and a captcha (or other). Sign up with a passcode/free coupon, or pay by credit card, maybe also PayPal. Pricing model is to be determined. In one example, the people an Inviter invites get communication line at Inviter's expense (free to them) but would need to pay to add more associates of their own. A security policy and liability waiver will likely be required as part of account registration.
- The Consumer Product generates user identity and keys On the back end, the inviter protocol is activated (proprietary code on the Authentication Authority), and the system generates keys.
- Download the application: The system can generate a downloadable executable with instructions with a functional sequence similar to Dropbox, or Skype download.
- The local app registers user device and generates a local private key. This is a back end device-side function and may display animation or sound at the device so the user can see that something related to high security is occurring. On the backend, the inviter protocol is activated (proprietary code on the Authentication Authority) to register the device-side app, and the device-side app generates a private key.
- 2. Use of the application to invite contacts to share secure documents
- Invite contacts using an email address. The Inviter opens The Consumer Product device-side app, selects “add a contact”, and enters an email address and any name for contact. The name of the inviter (from original registration) is auto-completed, but the inviter can override and enter any name desired for this communication line. The inviter clicks “invite”. The request transmits over VPN to TC Cloud, and TC server generates an email invite to the recipient.
- Friend receives a link to a designated website for enrollment. Friend (Invitee) receives link to enroll at The Consumer Product. The link associates the inviter with the invitee, and the Consumer Product registration page completes the protocol to initiate app download. The Invitee, as a new user, accomplishes a downloaded consumer app already provisioned with the Inviter name in the contact list. An email or other message is generated to the Inviter and the Invitee alerting them that they can now share secure files.
- Friend is registered in Inviter private application. Upon next login, Inviter is provisioned with the contact name (and public key) of invitee.
- Friend can now unlock Inviter/Inviter document, and can send you secure docs. Inviter and Invitee can now share docs. Invitee can add contacts by going to admin tool of their The Consumer Product device-side app. A pop-up reminder to add contacts may be desired.
- 3. Use the application to lock and unlock documents
- Auto-launch application when a locked Consumer Product Created doc is double-clicked (retrieved from storage or email or other) and open the document. A document that has been locked by an app within the system would use a standardized appendix to created files, e.g. “documentname.tex”. Device-side application needs policy for how long it stays logged-in, or under what conditions it logs out. If logged-out, possibly the application is prompted to be opened when a locked document with the standardized appendix is clicked, and password is requested. The concept is to wrap the locked document in a Consumer Product executable. It would operate similar to an Adobe PDF.
- Lock a document, which includes selecting which user can open it (either the originator, or add names from the list of authenticated connections, or invite a new user.) The option to lock could be accessed from the system print menu or possibly from a new, added menu item or other. When locking, the user may select one or more documents and one or more recipients. Recipient should already have been invited and be on the authenticated list of provisioned contacts for the sender. When a document is locked with the public key associated with a designated user, generally the originator by default is also issued a key so the software may create a locked copy of any document sent that the originator himself can store and later open.
- 4. Account administration
- For each contact, view dates and times when docs have been opened. This would be an audit trail log, showing when document files were locked and subsequently unlocked. It would not keep copies of the actual documents. Basically populates the digital signature records from cloud service, and should sync when login occurs. Could be sorted by communication line (Invitee name), then recent activity or other.
- Edit contacts. Provides a capability where contacts may be revoked. If a communication line is revoked, there could be a pop-up requesting extra approval and possibly an option for the system to alert both parties via email (or other) that the communication line has been revoked. Communication line can be re-established with a new Inviter/Invitee protocol. Additional invites are also originated here—“invite a new associate”, and needs to correlate to account balance (how many out of a possible purchase package remain) and possible prompt to purchase more contacts when the remaining balance reaches a predetermined amount.
- Upgrade account. User may use credit card on file to purchase additional packs of contacts (when contacts are charged for) or can enter new payment method. There will be other types of upgrades later in product lifecycle.
- Change/reset password, account keys. System has a method for reprovisioning keys.
- Download application updates. This should prompt when a person logs in at the local app and the app does an auto-check for updates.
- 5. Other Content on website
- Basic Web-pages of about the service, security policy, etc.
- Change/reset password, upgrade account
- Download application updates
- Other features, items as appropriate
E. Additional Features for future versions
- TrustScore—this is a measure of length of time on the system, frequency of use, size of social network, and level of verification/endorsement of the identity. This is an algorithm with various rules
- AccessScore—this is a measure of predominantly multifactor authentication, and (for example) whether the user is coming in from a browser as opposed to their provisioned application. These are the functions that would result in the ability to generate a score.
- Digital Signature usage
- Supports the non-repudiable audit trail, which can exist with a certified PKI.
- (For some security conscious users, a “no records retained” option would be offered.)
- They are also the backbone of a workflow system that would literally sign a document electronically.
- Digital signatures are the backbone of expected multiple approval levels and multiple identity types. There are many use cases in Enterprise deployments.
- Cross-certification as well as probably other features related to sharing identities
- Validating 3rd party information with the Consumer Product digital signature (for example for a prescription or stock trade).
- Supports the non-repudiable audit trail, which can exist with a certified PKI.
- Register at The Consumer Product.com
- A. User goes to website for the app and clicks Download Customer facing domain at website launches the Universal Software Provisioning Sequence (USPS).
- B. Executable checks for device type, verifies no existing TC client,
- C. At customer facing domain, USPS compiles next available:
- GUID
- Nonce
- Position Vector
- Bits Vector
- Random number (R-VPN)
- D. Subscriber device receives download and opens software
- E. App opens
- Subscriber enrolls locally:
- Username (unique username not required for security/‘repeats’ allowed because TC tracks the name+unique GUID, not just the name)
- Password (complexity check)
- Verify Password
- Mobile # (if you'd like to provision your mobile device as well. Read-only)
- More data than this is not required user can be completely anonymous
- Subscriber enrolls locally:
- F. Hit Enter
- G. Client sends package back to server:
- GUID
- Nonce in sequence
- Username
- Hash of password
- LKSM seed
- Public Key of VPN (unique to the device)
- H. The Security Ecosystem server checks the Package
- GUID matches
- Nonce matches
- Accepts new Username & stores the hash of the password and the SALT value. Potentially we encrypt these at the HSM and then store.
- I. The Security Ecosystem server spawns a piece of the seed.
- J. The Security Ecosystem server server sends a challenge using position vector to see if MAC address bits and random bits correct. The local client should correctly accomplish the right answer, plus the server gets back the client confirmed MAC address and now stores it at server.
- K. The Security Ecosystem server sends the partial seed (random number) and the vector to lock/mask the seed to the client.
- L. This specific step is what creates the LKSM, Local Key Store Module: The client generates entropy and finishes the seed (hashes the pieces together). The seed is locked and masked, and the masking is unique to that client. This seed can be used later to provision other devices for the same user. (Note—you could provision the other devices by using your phone as an intermediary, or you could use the seed to “invite” another device using inviter protocol. David had several methods here.)
- M. The Security Ecosystem server server now sends random numbers: the random number for the Key Establishment Key Pair and the random number for the Digital Signature Key Pair.
- N. The client generates the key pairs (Suite B style): the Key Establishment Key Pair and the Digital Signature Key Pair.
- O. The client sends the two Public Keys back to The Security Ecosystem server Server: the Key Establishment Public Key and the Digital Signature Public Key.
- P. The Security Ecosystem server gives these two public keys certificates and associates them with that user's account. (Uses HSM. Doesn't use GUID so no association of users and keys exists at TC).
- The private keys are separated. To reconstruct them, the client software needs the server to send the random number to the private key. The client will take the random number, + add the seed from the LKSM in order to acquire the private key.
- The private key is used to compute the public key. Each communication line has cryptographically unique public key.
- The Provision Protocol is now complete. The user can now act as an inviter, or simply lock a document for themselves. The provision protocol had already provisioned the user in advance of inviting any communication lines with the cryptographically unique public key. It is reserved in waiting until the user invites someone or locks a document, and then the next key is generated and held in waiting.
- A. Subscriber opens TC local app
- B. Server sends GUID positions to client
- C. Client verifies last stored nonce matches GUID and returns:
- user name & password entered (hash function of password sent)
- private key of VPN “Device Key”
- 2-way authenticated
- D. For security purposes, each time the Security Ecosystem server and the client communicate a position vector and a bit vector get reset. The Security Ecosystem server may query the client when they talk. The Security Ecosystem server queries, the answer comes back and immediately it's scrambled again; it does no repeat the same values going forward. A feature called “ABBA” would be used at this point. “ABBA” is a made up name to describe an innovation that is in essence a continuously progressing conversation between the Security Ecosystem's customer facing domain and the customer local client. The conversation gives the last answer plus a new piece of information each and every time, essentially passing the baton (a nonce) between the two end points of the communication line. This is a continuously progressing sequence, for example the Security Ecosystem server sends AB, then the local device gives back BC (C is new nonce), and then the Security Ecosystem gives back (for example) CD and the local device gives back (for example) DE. A third party attempting to intercept the communication between the two parties should not be able to re-create the previous sequence because it was randomly created and is not longer current, will not be used again. This procedure terminates a conversation if it is not properly replicated. ABBA participates in the security of the VPN between the client and the Security Ecosystem server. With the VPN there is the VPN private/public keys and then on top of that there is the ABBA session manager. It could be possible for ABBA to be used to conduct an intermittent session check in session (not just at the beginning) ending validation and also possibly at a session upgrade. These are further variations and examples:
- Server sends a challenge
- Client Sends a response
- Server ascertains the MAC address of device (if changed, login rejected)
- Server sends release code to release the seed value
- Server sends a new lock code (random value+seed)
- Server sends a new nonce
- Server sends a new position vector (for bits & mac address)
- Server sends a new BITS vector
- Client overwrites the old nonce with new nonce.
- E. User is logged in and ready to encrypt/decrypt/manage account.
- Now: when time out or logout, new lock codes are in place
- Next login: Server sends positions, client gives back the random bits+Mac Address. There should be continuity from one session to next, or login is rejected. Prevents man in middle attack, prevents your client from being copied to another piece of hardware—not transportable.
-
- The nature of the design puts the PMI in charge of keys, not the PKI which improves the security of the system;
- The Inviter Protocol adds attribute certs that point to public keys. The system picks these keys up for each relationship and collects them at the server. Through this procedure, the secret question isn't compromised. It all allows the system to pool and score user's identities.
- The system does not allow the live server to attach the secret question onto an identity in order to reduce insider and offline attacks.
- The system may enable document-only access or “pick-up” with public key pick-up only.
-
- There are server level Digital Signature keys for signing for VPN/TLS and HSM purposes.
- A server Digital Signature delivers a signature that may validate a document, and/or a public key request with time/date stamp. This can affirm existence of a document without forgery. With such a validation process, the server can thus know which document is being opened even if the server didn't store the document.
- A server may store a hash of a document and have the local client send a log back to the server regarding the hash of the document so the server may know when document is unlocked/opened. The server may revoke document-level keys or make them expire in a certain time frame. The server is also able to see if a document has been changed by cross-checking the hashes. If hashes are kept in plain text, the server may be able to demonstrate (for example) that pornography had been encrypted and/or decrypted, and possibly prove a crime occurred in a court of law.
-
- A system administrator would not have many duties at the user level. The users themselves revoke or reset themselves. They should have a variety of abilities, such as to find a GUID and/or revoke access to one or more documents.
Claims (2)
Priority Applications (20)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/218,897 US9270663B2 (en) | 2010-04-30 | 2014-03-18 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US14/715,588 US9356916B2 (en) | 2010-04-30 | 2015-05-18 | System and method to use a cloud-based platform supported by an API to authenticate remote users and to provide PKI- and PMI-based distributed locking of content and distributed unlocking of protected content |
US15/002,225 US9455978B2 (en) | 2010-04-30 | 2016-01-20 | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US15/154,861 US9578035B2 (en) | 2010-04-30 | 2016-05-13 | System and method to use a cloud-based platform supported by an API to authenticate remote users and to provide PKI- and PMI-based distributed locking of content and distributed unlocking of protected content |
US15/269,832 US20170134350A1 (en) | 2010-04-30 | 2016-09-19 | System and Method to Enable PKI- and PMI- Based Distributed Locking of Content and Distributed Unlocking of Protected Content and/or Scoring of Users and/or Scoring of End-Entity Access Means - Added |
US15/409,427 US20170187538A1 (en) | 2010-04-30 | 2017-01-18 | System and method to use a cloud-based platform supported by an api to authenticate remote users and to provide pki- and pmi- based distributed locking of content and distributed unlocking of protected content |
US15/469,244 US9716595B1 (en) | 2010-04-30 | 2017-03-24 | System and method for internet of things (IOT) security and management |
US15/621,982 US9832026B2 (en) | 2010-04-30 | 2017-06-13 | System and method from Internet of Things (IoT) security and management |
US15/642,304 US10038678B2 (en) | 2010-04-30 | 2017-07-05 | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US15/668,598 US9843450B2 (en) | 2010-04-30 | 2017-08-03 | System and method to use a cloud-based platform supported by an API to authenticate remote users and to provide PKI- and PMI- based distributed locking of content and distributed unlocking of protected content |
US15/686,076 US10153908B2 (en) | 2010-04-30 | 2017-08-24 | Secure communication of IOT devices for vehicles |
US15/890,140 US10333720B2 (en) | 2010-04-30 | 2018-02-06 | Secure communication of IOT devices for vehicles |
US16/045,646 US10567361B2 (en) | 2010-04-30 | 2018-07-25 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US16/236,124 US10652031B2 (en) | 2010-04-30 | 2018-12-28 | Using PKI for security and authentication of control devices and their data |
US16/412,247 US10644891B2 (en) | 2010-04-30 | 2019-05-14 | Secure communication of IoT devices for vehicles |
US16/786,884 US11463423B2 (en) | 2010-04-30 | 2020-02-10 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US16/872,112 US11456882B2 (en) | 2010-04-30 | 2020-05-11 | Using PKI for security and authentication of control devices and their data |
US17/886,291 US20230132554A1 (en) | 2010-04-30 | 2022-08-11 | System and method to enable pki- and pmi-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means - added |
US17/896,992 US11743057B2 (en) | 2010-04-30 | 2022-08-26 | Using PKI for security and authentication of control devices and their data |
US18/224,022 US12028466B2 (en) | 2010-04-30 | 2023-07-19 | Using PKI for security and authentication of control devices and their data |
Applications Claiming Priority (9)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US33022610P | 2010-04-30 | 2010-04-30 | |
US36757410P | 2010-07-26 | 2010-07-26 | |
US36757610P | 2010-07-26 | 2010-07-26 | |
US41662910P | 2010-11-23 | 2010-11-23 | |
US13/096,764 US20110270763A1 (en) | 2010-04-30 | 2011-04-28 | Methods and apparatus for a financial document clearinghouse and secure delivery network |
US201261650866P | 2012-05-23 | 2012-05-23 | |
US13/481,553 US20120284506A1 (en) | 2010-04-30 | 2012-05-25 | Methods and apparatus for preventing crimeware attacks |
US201361792927P | 2013-03-15 | 2013-03-15 | |
US14/218,897 US9270663B2 (en) | 2010-04-30 | 2014-03-18 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/481,553 Continuation-In-Part US20120284506A1 (en) | 2010-04-30 | 2012-05-25 | Methods and apparatus for preventing crimeware attacks |
Related Child Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/715,588 Continuation-In-Part US9356916B2 (en) | 2010-04-30 | 2015-05-18 | System and method to use a cloud-based platform supported by an API to authenticate remote users and to provide PKI- and PMI-based distributed locking of content and distributed unlocking of protected content |
US15/002,225 Continuation US9455978B2 (en) | 2010-04-30 | 2016-01-20 | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
Publications (3)
Publication Number | Publication Date |
---|---|
US20150312233A1 US20150312233A1 (en) | 2015-10-29 |
US9270663B2 true US9270663B2 (en) | 2016-02-23 |
US20160057120A9 US20160057120A9 (en) | 2016-02-25 |
Family
ID=54335868
Family Applications (6)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/218,897 Active US9270663B2 (en) | 2010-04-30 | 2014-03-18 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US15/002,225 Active US9455978B2 (en) | 2010-04-30 | 2016-01-20 | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US15/269,832 Abandoned US20170134350A1 (en) | 2010-04-30 | 2016-09-19 | System and Method to Enable PKI- and PMI- Based Distributed Locking of Content and Distributed Unlocking of Protected Content and/or Scoring of Users and/or Scoring of End-Entity Access Means - Added |
US15/642,304 Active US10038678B2 (en) | 2010-04-30 | 2017-07-05 | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US16/045,646 Active US10567361B2 (en) | 2010-04-30 | 2018-07-25 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US16/786,884 Active US11463423B2 (en) | 2010-04-30 | 2020-02-10 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
Family Applications After (5)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/002,225 Active US9455978B2 (en) | 2010-04-30 | 2016-01-20 | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US15/269,832 Abandoned US20170134350A1 (en) | 2010-04-30 | 2016-09-19 | System and Method to Enable PKI- and PMI- Based Distributed Locking of Content and Distributed Unlocking of Protected Content and/or Scoring of Users and/or Scoring of End-Entity Access Means - Added |
US15/642,304 Active US10038678B2 (en) | 2010-04-30 | 2017-07-05 | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US16/045,646 Active US10567361B2 (en) | 2010-04-30 | 2018-07-25 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US16/786,884 Active US11463423B2 (en) | 2010-04-30 | 2020-02-10 | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
Country Status (1)
Country | Link |
---|---|
US (6) | US9270663B2 (en) |
Cited By (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150271197A1 (en) * | 2014-03-20 | 2015-09-24 | Microsoft Corporation | Providing multi-level password and phishing protection |
US20160173596A1 (en) * | 2012-12-21 | 2016-06-16 | Dropbox, Inc. | Systems and methods for adding digital content to content management service accounts |
US20170180326A1 (en) * | 2015-12-16 | 2017-06-22 | Virtual Solution Ag | Secure transmission of local private encoding data |
WO2017210563A1 (en) * | 2016-06-02 | 2017-12-07 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US20180109387A1 (en) * | 2016-10-18 | 2018-04-19 | Red Hat, Inc. | Continued verification and monitor of application code in containerized execution environment |
US9973484B2 (en) | 2011-10-31 | 2018-05-15 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US9992194B2 (en) | 2010-03-03 | 2018-06-05 | Duo Security, Inc. | System and method of notifying mobile devices to complete transactions |
US10021113B2 (en) | 2014-04-17 | 2018-07-10 | Duo Security, Inc. | System and method for an integrity focused authentication service |
US10038678B2 (en) | 2010-04-30 | 2018-07-31 | T-Central, Inc. | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US10050787B1 (en) * | 2014-03-25 | 2018-08-14 | Amazon Technologies, Inc. | Authentication objects with attestation |
US10049202B1 (en) | 2014-03-25 | 2018-08-14 | Amazon Technologies, Inc. | Strong authentication using authentication objects |
US10356069B2 (en) | 2014-06-26 | 2019-07-16 | Amazon Technologies, Inc. | Two factor authentication with authentication objects |
CN111586175A (en) * | 2020-05-07 | 2020-08-25 | 周肖林 | House resource information acquisition and release system and house resource information acquisition and sharing method |
US10789373B2 (en) | 2011-10-31 | 2020-09-29 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US20210314144A1 (en) * | 2018-09-25 | 2021-10-07 | Mcafee, Llc | Modifiable client-side encrypted data in the cloud |
US11206129B2 (en) * | 2015-04-30 | 2021-12-21 | Ubiqu B.V. | First entity, a second entity, an intermediate node, methods for setting up a secure session between a first and second entity, and computer program products |
US11290261B2 (en) | 2011-10-31 | 2022-03-29 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US11522720B1 (en) * | 2013-09-25 | 2022-12-06 | Wells Fargo Bank, N.A. | Dynamic object creation and certificate management |
US20220417038A1 (en) * | 2010-04-30 | 2022-12-29 | T-Central, Inc. | Using pki for security and authentication of control devices and their data |
US11985124B2 (en) | 2022-06-02 | 2024-05-14 | Bank Of America Corporation | System for implementing multifactor authentication based on secure tokenization |
US12028466B2 (en) | 2010-04-30 | 2024-07-02 | T-Central, Inc. | Using PKI for security and authentication of control devices and their data |
Families Citing this family (94)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10181055B2 (en) | 2007-09-27 | 2019-01-15 | Clevx, Llc | Data security system with encryption |
US9532222B2 (en) | 2010-03-03 | 2016-12-27 | Duo Security, Inc. | System and method of notifying mobile devices to complete transactions after additional agent verification |
US9467463B2 (en) | 2011-09-02 | 2016-10-11 | Duo Security, Inc. | System and method for assessing vulnerability of a mobile device |
JP5939580B2 (en) * | 2013-03-27 | 2016-06-22 | インターナショナル・ビジネス・マシーンズ・コーポレーションInternational Business Machines Corporation | Name identification system for identifying anonymized data, method and computer program therefor |
US10452567B2 (en) * | 2013-04-29 | 2019-10-22 | Hewlett Packard Enterprise Development Lp | Non-volatile memory to store resettable data |
US10915698B2 (en) * | 2013-12-31 | 2021-02-09 | Barnes & Noble College Booksellers, Llc | Multi-purpose tool for interacting with paginated digital content |
US10331777B2 (en) | 2013-12-31 | 2019-06-25 | Barnes & Noble College Booksellers, Llc | Merging annotations of paginated digital content |
US20160007201A1 (en) * | 2014-05-27 | 2016-01-07 | Telmate, Llc | Vpn-based mobile device security |
WO2016070338A1 (en) * | 2014-11-04 | 2016-05-12 | 华为技术有限公司 | Method, apparatus and device for displaying message |
US9942200B1 (en) * | 2014-12-02 | 2018-04-10 | Trend Micro Inc. | End user authentication using a virtual private network |
US10218700B2 (en) * | 2015-02-23 | 2019-02-26 | Ca, Inc. | Authorizations for computing devices to access a protected resource |
US11023968B2 (en) * | 2015-03-05 | 2021-06-01 | Goldman Sachs & Co. LLC | Systems and methods for updating a distributed ledger based on partial validations of transactions |
US9807086B2 (en) | 2015-04-15 | 2017-10-31 | Citrix Systems, Inc. | Authentication of a client device based on entropy from a server or other device |
US10122709B2 (en) | 2015-05-12 | 2018-11-06 | Citrix Systems, Inc. | Multifactor contextual authentication and entropy from device or device input or gesture authentication |
US10374904B2 (en) | 2015-05-15 | 2019-08-06 | Cisco Technology, Inc. | Diagnostic network visualization |
US9930060B2 (en) | 2015-06-01 | 2018-03-27 | Duo Security, Inc. | Method for enforcing endpoint health standards |
US10536357B2 (en) | 2015-06-05 | 2020-01-14 | Cisco Technology, Inc. | Late data detection in data center |
US9967158B2 (en) | 2015-06-05 | 2018-05-08 | Cisco Technology, Inc. | Interactive hierarchical network chord diagram for application dependency mapping |
US10142353B2 (en) | 2015-06-05 | 2018-11-27 | Cisco Technology, Inc. | System for monitoring and managing datacenters |
PT3188435T (en) * | 2015-12-28 | 2020-01-22 | Lleidanetworks Serveis Telematics Sa | Method for certifying an electronic mail comprising a trusted digital signature by a telecommunications operator |
US10817593B1 (en) * | 2015-12-29 | 2020-10-27 | Wells Fargo Bank, N.A. | User information gathering and distribution system |
KR102201093B1 (en) * | 2016-01-04 | 2021-01-08 | 클레브엑스 엘엘씨 | Data security system with encryption |
US11379771B2 (en) * | 2016-03-08 | 2022-07-05 | PeerNova, Inc. | Management of workflows |
US10601793B2 (en) * | 2016-03-11 | 2020-03-24 | Pss, Llc | Systems and methods for securing electronic data with embedded security engines |
US10211992B1 (en) * | 2016-03-18 | 2019-02-19 | EMC IP Holding Company LLC | Secure certificate pinning in user provisioned networks |
US10355858B2 (en) * | 2016-03-30 | 2019-07-16 | Intel Corporation | Authenticating a system to enable access to a diagnostic interface in a storage device |
US10091007B2 (en) * | 2016-04-04 | 2018-10-02 | Mastercard International Incorporated | Systems and methods for device to device authentication |
USD886129S1 (en) | 2016-05-10 | 2020-06-02 | Citrix Systems, Inc. | Display screen or portion thereof with graphical user interface |
US10560274B2 (en) * | 2016-06-09 | 2020-02-11 | International Business Machines Corporation | Credential-based authorization |
US10229282B2 (en) * | 2016-06-12 | 2019-03-12 | Apple Inc. | Efficient implementation for differential privacy using cryptographic functions |
US10289438B2 (en) | 2016-06-16 | 2019-05-14 | Cisco Technology, Inc. | Techniques for coordination of application components deployed on distributed virtual machines |
FR3054056B1 (en) * | 2016-07-13 | 2018-06-29 | Safran Identity & Security | METHOD FOR SECURELY CONNECTING A FIRST DEVICE WITH A SECOND DEVICE |
US10708183B2 (en) | 2016-07-21 | 2020-07-07 | Cisco Technology, Inc. | System and method of providing segment routing as a service |
CN107769915B (en) * | 2016-08-17 | 2020-09-22 | 实创时新(北京)科技有限公司 | Data encryption and decryption system and method with fine-grained user control |
CN106612174A (en) * | 2016-08-26 | 2017-05-03 | 四川用联信息技术有限公司 | Data security verification and updating method supporting third-party administrator (TPA) in mobile cloud computing |
JP6907491B2 (en) * | 2016-09-20 | 2021-07-21 | コニカミノルタ株式会社 | Information sharing servers, information sharing systems and programs |
US10972388B2 (en) | 2016-11-22 | 2021-04-06 | Cisco Technology, Inc. | Federated microburst detection |
CN106815495B (en) * | 2017-02-21 | 2020-08-04 | 苏州浪潮智能科技有限公司 | Data processing method and device in cloud environment |
JP6907619B2 (en) * | 2017-03-15 | 2021-07-21 | 株式会社リコー | Information processing system, information processing method, and information processing equipment |
US10708152B2 (en) | 2017-03-23 | 2020-07-07 | Cisco Technology, Inc. | Predicting application and network performance |
US10523512B2 (en) | 2017-03-24 | 2019-12-31 | Cisco Technology, Inc. | Network agent for generating platform specific network policies |
US10764141B2 (en) | 2017-03-27 | 2020-09-01 | Cisco Technology, Inc. | Network agent for reporting to a network policy system |
US10594560B2 (en) | 2017-03-27 | 2020-03-17 | Cisco Technology, Inc. | Intent driven network policy platform |
US10873794B2 (en) | 2017-03-28 | 2020-12-22 | Cisco Technology, Inc. | Flowlet resolution for application performance monitoring and management |
WO2018213239A1 (en) * | 2017-05-15 | 2018-11-22 | Polyport, Inc. | Stacked encryption |
WO2018233829A1 (en) * | 2017-06-22 | 2018-12-27 | Telefonaktiebolaget Lm Ericsson (Publ) | A method for generating operating entropy |
US10110600B1 (en) | 2017-07-13 | 2018-10-23 | Cyberark Software Ltd. | Dynamically learning and securing an asset-to-asset cloud communication environment |
US9971884B1 (en) * | 2017-07-13 | 2018-05-15 | Cyberark Software Ltd. | Providing credentials in an automated machine-to-machine communication system environment |
US10680887B2 (en) | 2017-07-21 | 2020-06-09 | Cisco Technology, Inc. | Remote device status audit and recovery |
US10721222B2 (en) * | 2017-08-17 | 2020-07-21 | Citrix Systems, Inc. | Extending single-sign-on to relying parties of federated logon providers |
US11368442B2 (en) | 2017-08-29 | 2022-06-21 | Amazon Technologies, Inc. | Receiving an encrypted communication from a user in a second secure communication network |
US11095662B2 (en) | 2017-08-29 | 2021-08-17 | Amazon Technologies, Inc. | Federated messaging |
US11349659B2 (en) | 2017-08-29 | 2022-05-31 | Amazon Technologies, Inc. | Transmitting an encrypted communication to a user in a second secure communication network |
US10791196B2 (en) * | 2017-08-29 | 2020-09-29 | Wickr Inc. | Directory lookup for federated messaging with a user from a different secure communication network |
US10554501B2 (en) | 2017-10-23 | 2020-02-04 | Cisco Technology, Inc. | Network migration assistant |
US10523541B2 (en) | 2017-10-25 | 2019-12-31 | Cisco Technology, Inc. | Federated network and application data analytics platform |
US10601813B2 (en) | 2017-10-26 | 2020-03-24 | Bank Of America Corporation | Cloud-based multi-factor authentication for network resource access control |
US10594542B2 (en) | 2017-10-27 | 2020-03-17 | Cisco Technology, Inc. | System and method for network root cause analysis |
WO2019095200A1 (en) * | 2017-11-16 | 2019-05-23 | Prisec Innovation Limited | A system and method for authenticating a user |
US10412113B2 (en) | 2017-12-08 | 2019-09-10 | Duo Security, Inc. | Systems and methods for intelligently configuring computer security |
US11233821B2 (en) | 2018-01-04 | 2022-01-25 | Cisco Technology, Inc. | Network intrusion counter-intelligence |
CN108170825B (en) * | 2018-01-05 | 2022-08-12 | 上海电气分布式能源科技有限公司 | Distributed energy data monitoring and cleaning method based on cloud platform |
US10798015B2 (en) | 2018-01-25 | 2020-10-06 | Cisco Technology, Inc. | Discovery of middleboxes using traffic flow stitching |
US10999149B2 (en) | 2018-01-25 | 2021-05-04 | Cisco Technology, Inc. | Automatic configuration discovery based on traffic flow data |
US10826803B2 (en) | 2018-01-25 | 2020-11-03 | Cisco Technology, Inc. | Mechanism for facilitating efficient policy updates |
US10574575B2 (en) | 2018-01-25 | 2020-02-25 | Cisco Technology, Inc. | Network flow stitching using middle box flow stitching |
US11128700B2 (en) | 2018-01-26 | 2021-09-21 | Cisco Technology, Inc. | Load balancing configuration based on traffic flow telemetry |
US10250383B1 (en) | 2018-03-20 | 2019-04-02 | Mocana Corporation | Dynamic domain key exchange for authenticated device to device communications |
JP7063666B2 (en) * | 2018-03-22 | 2022-05-09 | 株式会社東海理化電機製作所 | Authentication system |
CN108769020B (en) * | 2018-05-29 | 2021-07-13 | 东北大学 | Privacy-protecting identity attribute certification system and method |
CN108964986B (en) * | 2018-06-15 | 2022-01-25 | 国网上海市电力公司 | Application-level double-active disaster recovery system of cooperative office system |
CN109087078B (en) * | 2018-08-27 | 2023-03-24 | 深圳市智税链科技有限公司 | Data processing method, device, storage medium and equipment for electronic bill |
TWI725352B (en) * | 2018-11-05 | 2021-04-21 | 緯創資通股份有限公司 | Method for authentication and authorization and authentication server using the same |
US20220019652A1 (en) * | 2018-11-16 | 2022-01-20 | Snyk Canada Inc. | Flexible credential supported software service provisioning |
US10771435B2 (en) * | 2018-11-20 | 2020-09-08 | Netskope, Inc. | Zero trust and zero knowledge application access system |
US10938574B2 (en) * | 2018-11-26 | 2021-03-02 | T-Mobile Usa, Inc. | Cryptographic font script with integrated signature for verification |
US11595217B2 (en) | 2018-12-06 | 2023-02-28 | Digicert, Inc. | System and method for zero touch provisioning of IoT devices |
US11658962B2 (en) | 2018-12-07 | 2023-05-23 | Cisco Technology, Inc. | Systems and methods of push-based verification of a transaction |
CN109728903B (en) * | 2018-12-22 | 2021-09-17 | 复旦大学 | Block chain weak center password authorization method using attribute password |
US11461498B2 (en) * | 2019-02-06 | 2022-10-04 | mSignia, Inc. | Systems and methods for secured, managed, multi-party interchanges with a software application operating on a client device |
CN110061978A (en) * | 2019-03-20 | 2019-07-26 | 深圳金澜汉源科技有限公司 | Binary Cooperative Security client framework |
US11290439B1 (en) * | 2019-04-03 | 2022-03-29 | Snap Inc. | Multiple application list prioritization |
US11677554B2 (en) * | 2019-06-01 | 2023-06-13 | Apple Inc. | Key registration transparency for secure messaging |
WO2021112603A1 (en) * | 2019-12-06 | 2021-06-10 | Samsung Electronics Co., Ltd. | Method and electronic device for managing digital keys |
US11662888B2 (en) * | 2020-03-05 | 2023-05-30 | Brain Technologies, Inc. | Collaboration user interface for computing device |
US11425131B2 (en) | 2020-06-23 | 2022-08-23 | Slack Technologies, Llc | Verified entities associated with a communication platform |
US10897351B1 (en) * | 2020-07-02 | 2021-01-19 | Slack Technologies, Inc. | Encryption key management for an automated workflow |
CN114531467B (en) * | 2020-11-04 | 2023-04-14 | 中移(苏州)软件技术有限公司 | Information processing method, equipment and system |
US11783073B2 (en) * | 2021-06-21 | 2023-10-10 | Microsoft Technology Licensing, Llc | Configuration of default sensitivity labels for network file storage locations |
CN113708939B (en) * | 2021-10-29 | 2022-02-08 | 深圳百纳维科技有限公司 | Container lock control method and device, container lock and storage medium |
US11755423B2 (en) * | 2022-02-10 | 2023-09-12 | Vinpower Inc. | Mobile device for protecting data stored in data backup device and data protection method thereof |
US20230291548A1 (en) * | 2022-03-08 | 2023-09-14 | Western Digital Technologies, Inc. | Authorization requests from a data storage device to multiple manager devices |
US11811752B1 (en) * | 2022-08-03 | 2023-11-07 | 1080 Network, Inc. | Systems, methods, and computing platforms for executing credential-less network-based communication exchanges |
US11843619B1 (en) * | 2022-10-07 | 2023-12-12 | Uab 360 It | Stateless system to enable data breach notification |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050044197A1 (en) * | 2003-08-18 | 2005-02-24 | Sun Microsystems.Inc. | Structured methodology and design patterns for web services |
US7093121B2 (en) * | 2002-01-10 | 2006-08-15 | Mcafee, Inc. | Transferring data via a secure network connection |
US7571325B1 (en) * | 2005-03-14 | 2009-08-04 | Symantec Corporation | Remote identification of blocked websites while maintaining user privacy |
US7966646B2 (en) * | 2006-07-31 | 2011-06-21 | Aruba Networks, Inc. | Stateless cryptographic protocol-based hardware acceleration |
US20130262857A1 (en) * | 2012-04-01 | 2013-10-03 | Authentify, Inc. | Secure authentication in a multi-party system |
Family Cites Families (48)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH10511471A (en) | 1994-08-12 | 1998-11-04 | リートン,フランク、タムスン | Fail-safe key marking system |
US5812671A (en) | 1996-07-17 | 1998-09-22 | Xante Corporation | Cryptographic communication system |
EP2028614A3 (en) | 1996-10-09 | 2010-01-06 | Visa International Service Association | Electronic statement presentation system |
US5920630A (en) | 1997-02-25 | 1999-07-06 | United States Of America | Method of public key cryptography that includes key escrow |
US6105131A (en) | 1997-06-13 | 2000-08-15 | International Business Machines Corporation | Secure server and method of operation for a distributed information system |
US6229894B1 (en) | 1997-07-14 | 2001-05-08 | Entrust Technologies, Ltd. | Method and apparatus for access to user-specific encryption information |
US7051003B1 (en) | 1998-02-26 | 2006-05-23 | Atabok Japan, Inc. | Method and apparatus for delivering electronic data through a proxy server |
US6941454B1 (en) | 1998-10-14 | 2005-09-06 | Lynn Spraggs | System and method of sending and receiving secure data with a shared key |
US7236950B2 (en) | 1998-10-29 | 2007-06-26 | Universal Card Services Corp. | Method and system of combined billing of multiple accounts on a single statement |
US6988199B2 (en) | 2000-07-07 | 2006-01-17 | Message Secure | Secure and reliable document delivery |
US6760752B1 (en) | 1999-06-28 | 2004-07-06 | Zix Corporation | Secure transmission system |
US6795920B1 (en) | 1999-06-30 | 2004-09-21 | International Business Machines Corporation | Vault controller secure depositor for managing secure communication |
US6584567B1 (en) | 1999-06-30 | 2003-06-24 | International Business Machines Corporation | Dynamic connection to multiple origin servers in a transcoding proxy |
US7340439B2 (en) | 1999-09-28 | 2008-03-04 | Chameleon Network Inc. | Portable electronic authorization system and method |
US7509281B1 (en) | 1999-11-12 | 2009-03-24 | Convergys Cmg Utah, Inc. | System and method for statement presentation |
US6721783B1 (en) | 1999-11-24 | 2004-04-13 | Parish National Bank | E-mailer controller for privately and securely delivering bank notices, advices and monthly statements |
US7020688B2 (en) | 2000-09-05 | 2006-03-28 | Financial Network, Inc. | Methods and systems for archiving and verification of electronic communications |
US6996841B2 (en) | 2001-04-19 | 2006-02-07 | Microsoft Corporation | Negotiating secure connections through a proxy server |
US20030028494A1 (en) | 2001-08-06 | 2003-02-06 | King Shawn L. | Electronic document management system and method |
US7100054B2 (en) | 2001-08-09 | 2006-08-29 | American Power Conversion | Computer network security system |
WO2003105400A1 (en) * | 2002-06-07 | 2003-12-18 | ソニー株式会社 | Data processing system, data processing device, data processing method, and computer program |
US20050240758A1 (en) | 2004-03-31 | 2005-10-27 | Lord Christopher J | Controlling devices on an internal network from an external network |
US7653587B2 (en) | 2004-04-07 | 2010-01-26 | Ameriprise Financial, Inc. | Automated account statement generation process |
US7552322B2 (en) * | 2004-06-24 | 2009-06-23 | Palo Alto Research Center Incorporated | Using a portable security token to facilitate public key certification for devices in a network |
US8224725B2 (en) | 2004-10-14 | 2012-07-17 | Google Inc. | Escrowing digital property in a secure information vault |
US7600011B1 (en) | 2004-11-04 | 2009-10-06 | Sprint Spectrum L.P. | Use of a domain name server to direct web communications to an intermediation platform |
US7975140B2 (en) | 2005-04-08 | 2011-07-05 | Nortel Networks Limited | Key negotiation and management for third party access to a secure communication session |
US7288478B2 (en) | 2005-07-05 | 2007-10-30 | International Business Machines Corporation | Method for performing chemical shrink process over BARC (bottom anti-reflective coating) |
US8478986B2 (en) | 2005-08-10 | 2013-07-02 | Riverbed Technology, Inc. | Reducing latency of split-terminated secure communication protocol sessions |
CN101647006A (en) | 2005-10-12 | 2010-02-10 | 数据城堡公司 | Be used for method of data backup and system |
US20070174429A1 (en) | 2006-01-24 | 2007-07-26 | Citrix Systems, Inc. | Methods and servers for establishing a connection between a client system and a virtual machine hosting a requested computing environment |
US7797211B1 (en) | 2006-07-31 | 2010-09-14 | Intuit Inc. | Method and system for an enhanced payroll report |
US20160344745A1 (en) * | 2006-09-25 | 2016-11-24 | Weaved, Inc. | Method and protocol for secure device deployment using a partially-encrypted provisioning file |
FR2907942A1 (en) | 2006-10-25 | 2008-05-02 | Ingenico Sa | METHOD FOR PROVIDING TRANSACTION DATA, TERMINAL, TRANSACTION METHOD, METHOD FOR ENRICHING BANKING STORIES, SERVER, SIGNALS, AND CORRESPONDING COMPUTER PROGRAM PRODUCTS. |
JP5870442B2 (en) | 2006-11-23 | 2016-03-01 | ジャグウッド プロプライエタリー リミテッド | Process and apparatus for notifying financial documents and the like |
US7600077B2 (en) | 2007-01-10 | 2009-10-06 | Arm Limited | Cache circuitry, data processing apparatus and method for handling write access requests |
US20080222736A1 (en) | 2007-03-07 | 2008-09-11 | Trusteer Ltd. | Scrambling HTML to prevent CSRF attacks and transactional crimeware attacks |
US8275984B2 (en) | 2008-12-15 | 2012-09-25 | Microsoft Corporation | TLS key and CGI session ID pairing |
US8341710B2 (en) * | 2009-12-14 | 2012-12-25 | Verizon Patent And Licensing, Inc. | Ubiquitous webtoken |
US20110276493A1 (en) | 2010-04-30 | 2011-11-10 | Tobsc Inc. | Methods and apparatus for a financial document clearinghouse and secure delivery network |
US20120284506A1 (en) | 2010-04-30 | 2012-11-08 | T-Central, Inc. | Methods and apparatus for preventing crimeware attacks |
US9270663B2 (en) | 2010-04-30 | 2016-02-23 | T-Central, Inc. | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US9356916B2 (en) | 2010-04-30 | 2016-05-31 | T-Central, Inc. | System and method to use a cloud-based platform supported by an API to authenticate remote users and to provide PKI- and PMI-based distributed locking of content and distributed unlocking of protected content |
US20120023593A1 (en) | 2010-07-26 | 2012-01-26 | Puder George | System and method for filtering internet content & blocking undesired websites by secure network appliance |
WO2012166115A1 (en) * | 2011-05-31 | 2012-12-06 | Research In Motion Limited | System and method for authentication and key exchange for a mobile device via spectrally confined wireless communications |
US8863299B2 (en) * | 2012-01-06 | 2014-10-14 | Mobile Iron, Inc. | Secure virtual file management system |
US20130226813A1 (en) * | 2012-02-23 | 2013-08-29 | Robert Matthew Voltz | Cyberspace Identification Trust Authority (CITA) System and Method |
CN105791272A (en) * | 2016-02-23 | 2016-07-20 | 青岛海尔智能家电科技有限公司 | Method and device for secure communication in Internet of Things |
-
2014
- 2014-03-18 US US14/218,897 patent/US9270663B2/en active Active
-
2016
- 2016-01-20 US US15/002,225 patent/US9455978B2/en active Active
- 2016-09-19 US US15/269,832 patent/US20170134350A1/en not_active Abandoned
-
2017
- 2017-07-05 US US15/642,304 patent/US10038678B2/en active Active
-
2018
- 2018-07-25 US US16/045,646 patent/US10567361B2/en active Active
-
2020
- 2020-02-10 US US16/786,884 patent/US11463423B2/en active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7093121B2 (en) * | 2002-01-10 | 2006-08-15 | Mcafee, Inc. | Transferring data via a secure network connection |
US20050044197A1 (en) * | 2003-08-18 | 2005-02-24 | Sun Microsystems.Inc. | Structured methodology and design patterns for web services |
US7571325B1 (en) * | 2005-03-14 | 2009-08-04 | Symantec Corporation | Remote identification of blocked websites while maintaining user privacy |
US7966646B2 (en) * | 2006-07-31 | 2011-06-21 | Aruba Networks, Inc. | Stateless cryptographic protocol-based hardware acceleration |
US20130262857A1 (en) * | 2012-04-01 | 2013-10-03 | Authentify, Inc. | Secure authentication in a multi-party system |
Non-Patent Citations (23)
Title |
---|
2D barcode that is scanned and decrypted via a user's mobile device http://blog.nyaruka.com/2d-barcode-error-correction. |
2D barcode that is scanned and decrypted via a user's mobile device http://uvsar.blogspot.com/2009/05/secure-qr-and-qm-codes.html. |
2D barcode that is scanned and decrypted via a user's mobile device http://www.quickmark.cn/En/basic/index.asp. |
2D barcode that is scanned and decrypted via a user's mobile device http://www.quickmark.com.tw/en/basic/downloadPC.asp. |
2D barcode that is scanned and decrypted via a user's mobile device http://www.woodwing.com/en/blog/article/2d-barcodes-publishing. |
2D barcode that is scanned and decrypted via a user's mobile device YouTube demo http://www.youtube.com/watch?v=9GbFVcQ7aBc. |
Generation of 2D barcodes on a mobile device-https://itunes.apple.com/us/app/qm-classic-qr-code-reader/id384883554?mt=8. |
HMAC computations may be truncated http://csrc.nist.gov/publications/nistpubs/800-107-rev1/sp800-107-rev1.pdf. |
http://code.google.com/a/eclipselabs.org/p/sauth-shibboleth-qca/downloads/detail?name=andrade-master-thesis-final-08052011.pdf. |
HTTPS capability of mobile devices: authentication accomplished using SSL/TLS w/ digital certificate(s) http://www.springerlink.com/content/4078h25746236445/. |
Key Derivation Function (KDF) to generate new HMAC/MAC keys http://csrc.nist.gov/publications/nistpubs/800-108/sp800-108.pdf. |
Keyed-hash Message Authentication Code (HMAC) specification http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1-final.pdf. |
Keyed-hash Message Authentication Code (HMAC) specification http://tools.ietf.org/pdf/rfc2104.pdf. |
Methods for multi-factor authentication: SecurID hardware/software products http://www.rsa.com/products/securid/sb/AS51-SB-0607-lowres.pdf. |
Methods for multi-factor authentication: SiteKey https://www.bankofamerica.com/privacy/online-mobile-banking-privacy/sitekey.go. |
Mizuno, M., Yamada, K. and Takahashi, K., Authentication Using Multiple Communication Channels, pp. 54-62, http://dl.acm.org/citation.cfm?id=1102496, Nov. 11, 2005. |
Prior Art shown in Figures 1, 2 & 3 in Prior U.S. Appl. No. 61/792,927, Appendix G. |
Privilege management addressed via attribute certificates http://courses.cs.vt.edu/~cs5204/fall02/Papers/Security/AttributeCertificates.pdf. |
Privilege management addressed via attribute certificates http://courses.cs.vt.edu/˜cs5204/fall02/Papers/Security/AttributeCertificates.pdf. |
Renaud, K., Cooper, R. and Al Fairuz, M., A Support Architecture for Multi-Channel Multi-Factor Authentication, http://www.dcs.gla.ac.uk/~karen/Papers/mca.pdf, Oct. 13, 2008. |
Renaud, K., Cooper, R. and Al Fairuz, M., A Support Architecture for Multi-Channel Multi-Factor Authentication, http://www.dcs.gla.ac.uk/˜karen/Papers/mca.pdf, Oct. 13, 2008. |
RSA SecurID [http://www.emc.com/security/rsa-securid.htm] SafeNet OTP authenticators [http://www.safenet-inc.com/data-protection/authentication/otp-authentication/]. |
SafeNet eTokens and SafeNet eToken 3500 specifically [http://www.safenet-inc.com/products/data-protection/two-factor-authentication/etoken3500/]. |
Cited By (33)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11832099B2 (en) | 2010-03-03 | 2023-11-28 | Cisco Technology, Inc. | System and method of notifying mobile devices to complete transactions |
US10129250B2 (en) | 2010-03-03 | 2018-11-13 | Duo Security, Inc. | System and method of notifying mobile devices to complete transactions |
US9992194B2 (en) | 2010-03-03 | 2018-06-05 | Duo Security, Inc. | System and method of notifying mobile devices to complete transactions |
US20220417038A1 (en) * | 2010-04-30 | 2022-12-29 | T-Central, Inc. | Using pki for security and authentication of control devices and their data |
US10567361B2 (en) | 2010-04-30 | 2020-02-18 | T-Central, Inc. | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US11463423B2 (en) | 2010-04-30 | 2022-10-04 | T-Central, Inc. | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added |
US12028466B2 (en) | 2010-04-30 | 2024-07-02 | T-Central, Inc. | Using PKI for security and authentication of control devices and their data |
US10038678B2 (en) | 2010-04-30 | 2018-07-31 | T-Central, Inc. | System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added |
US11743057B2 (en) * | 2010-04-30 | 2023-08-29 | T-Central, Inc. | Using PKI for security and authentication of control devices and their data |
US11818251B2 (en) | 2011-10-31 | 2023-11-14 | Crowdstrike, Inc. | System and method for securely storing and sharing information |
US11290261B2 (en) | 2011-10-31 | 2022-03-29 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US9973484B2 (en) | 2011-10-31 | 2018-05-15 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US10789373B2 (en) | 2011-10-31 | 2020-09-29 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US20160173596A1 (en) * | 2012-12-21 | 2016-06-16 | Dropbox, Inc. | Systems and methods for adding digital content to content management service accounts |
US10348823B2 (en) * | 2012-12-21 | 2019-07-09 | Dropbox, Inc. | Systems and methods for adding digital content to content management service accounts |
US10848556B2 (en) | 2012-12-21 | 2020-11-24 | Dropbox, Inc. | Systems and methods for adding digital content to content management service accounts |
US11522720B1 (en) * | 2013-09-25 | 2022-12-06 | Wells Fargo Bank, N.A. | Dynamic object creation and certificate management |
US9407654B2 (en) * | 2014-03-20 | 2016-08-02 | Microsoft Technology Licensing, Llc | Providing multi-level password and phishing protection |
US20150271197A1 (en) * | 2014-03-20 | 2015-09-24 | Microsoft Corporation | Providing multi-level password and phishing protection |
US10050787B1 (en) * | 2014-03-25 | 2018-08-14 | Amazon Technologies, Inc. | Authentication objects with attestation |
US10049202B1 (en) | 2014-03-25 | 2018-08-14 | Amazon Technologies, Inc. | Strong authentication using authentication objects |
US10021113B2 (en) | 2014-04-17 | 2018-07-10 | Duo Security, Inc. | System and method for an integrity focused authentication service |
US11451528B2 (en) | 2014-06-26 | 2022-09-20 | Amazon Technologies, Inc. | Two factor authentication with authentication objects |
US10356069B2 (en) | 2014-06-26 | 2019-07-16 | Amazon Technologies, Inc. | Two factor authentication with authentication objects |
US11206129B2 (en) * | 2015-04-30 | 2021-12-21 | Ubiqu B.V. | First entity, a second entity, an intermediate node, methods for setting up a secure session between a first and second entity, and computer program products |
US10003577B2 (en) * | 2015-12-16 | 2018-06-19 | Virtual Solution Ag | Secure transmission of local private encoding data |
US20170180326A1 (en) * | 2015-12-16 | 2017-06-22 | Virtual Solution Ag | Secure transmission of local private encoding data |
WO2017210563A1 (en) * | 2016-06-02 | 2017-12-07 | Reid Consulting Group, Inc. | System and method for securely storing and sharing information |
US10666443B2 (en) * | 2016-10-18 | 2020-05-26 | Red Hat, Inc. | Continued verification and monitoring of application code in containerized execution environment |
US20180109387A1 (en) * | 2016-10-18 | 2018-04-19 | Red Hat, Inc. | Continued verification and monitor of application code in containerized execution environment |
US20210314144A1 (en) * | 2018-09-25 | 2021-10-07 | Mcafee, Llc | Modifiable client-side encrypted data in the cloud |
CN111586175A (en) * | 2020-05-07 | 2020-08-25 | 周肖林 | House resource information acquisition and release system and house resource information acquisition and sharing method |
US11985124B2 (en) | 2022-06-02 | 2024-05-14 | Bank Of America Corporation | System for implementing multifactor authentication based on secure tokenization |
Also Published As
Publication number | Publication date |
---|---|
US20150312233A1 (en) | 2015-10-29 |
US20160057120A9 (en) | 2016-02-25 |
US9455978B2 (en) | 2016-09-27 |
US20200236095A1 (en) | 2020-07-23 |
US20170324717A1 (en) | 2017-11-09 |
US20160248760A1 (en) | 2016-08-25 |
US10038678B2 (en) | 2018-07-31 |
US10567361B2 (en) | 2020-02-18 |
US20180332014A1 (en) | 2018-11-15 |
US20170134350A1 (en) | 2017-05-11 |
US11463423B2 (en) | 2022-10-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11463423B2 (en) | System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added | |
US11526879B2 (en) | Method and system for zero-knowledge and identity based key management for decentralized applications | |
EP3424176B1 (en) | Systems and methods for distributed data sharing with asynchronous third-party attestation | |
US20230020193A1 (en) | Quantum-safe networking | |
US10263779B2 (en) | Secure communications using loop-based authentication flow | |
US20170187538A1 (en) | System and method to use a cloud-based platform supported by an api to authenticate remote users and to provide pki- and pmi- based distributed locking of content and distributed unlocking of protected content | |
US7568098B2 (en) | Systems and methods for enhancing security of communication over a public network | |
US11412385B2 (en) | Methods for a secure mobile text message and object sharing application and system | |
US9100171B1 (en) | Computer-implemented forum for enabling secure exchange of information | |
US10298561B2 (en) | Providing a single session experience across multiple applications | |
US20230132554A1 (en) | System and method to enable pki- and pmi-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means - added | |
US9148419B2 (en) | User administering a trustworthy workspace | |
US8117438B1 (en) | Method and apparatus for providing secure messaging service certificate registration | |
US20070150299A1 (en) | Method, system, and apparatus for the management of the electronic files | |
US7627532B2 (en) | Method for creating and managing secure service communities | |
US20170279807A1 (en) | Safe method to share data and control the access to these in the cloud | |
JP5602165B2 (en) | Method and apparatus for protecting network communications | |
US20230188345A1 (en) | System and methods for interactive document sharing and authentication with privacy guarantee | |
US7747850B1 (en) | Automated, internet-based secure digital certificate distribution and maintenance | |
TWM583082U (en) | User identity verification system for safety transaction environment | |
Sharp | Information Security in the Enterprise | |
Huda | Academic document verification using SSI and blockchain technology | |
Kattwinkel et al. | Exchange of Preparatory Information for Secure and Usable Cryptocurrency Transactions | |
EP3346659B1 (en) | Communication method for electronic communication system in open environment | |
NL2010808C2 (en) | System and method for remote access. |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: T-CENTRAL, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:GRAHAM, DONALD;REEL/FRAME:034381/0309 Effective date: 20140715 Owner name: T-CENTRAL, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BOUDETT, JOSSELYN;REEL/FRAME:034381/0349 Effective date: 20140715 Owner name: T-CENTRAL, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:KRAVITZ, DAVID W;REEL/FRAME:034381/0357 Effective date: 20111028 Owner name: T-CENTRAL, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:DIETZ, RUSSELL;REEL/FRAME:034381/0567 Effective date: 20130210 |
|
FEPP | Fee payment procedure |
Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YR, SMALL ENTITY (ORIGINAL EVENT CODE: M2551); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY Year of fee payment: 4 |
|
FEPP | Fee payment procedure |
Free format text: MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY |
|
FEPP | Fee payment procedure |
Free format text: 7.5 YR SURCHARGE - LATE PMT W/IN 6 MO, SMALL ENTITY (ORIGINAL EVENT CODE: M2555); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YR, SMALL ENTITY (ORIGINAL EVENT CODE: M2552); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY Year of fee payment: 8 |