System, method and apparatus for electronically protecting data and digital content

• US 20060212698A1
• Filed: 03/16/2006
• Published: 09/21/2006
• Est. Priority Date: 03/16/2005
• Status: Active Grant

• Current Assignee: Kloke LLC
• Original Assignee: DT Labs LLC
• Inventors: Peckover, Douglas
• Granted Patent: US 7,937,579 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The present invention provides a system, method and apparatus for protecting sensitive data by extracting the sensitive data from a data storage on a client, sending the extracted data to a server for storage, receiving a pointer indicating where the extracted data has been stored and replacing the sensitive data on the data storage on the client with the pointer. The pointer may include random data that is of a same data type as the sensitive data. Furthermore, the pointer is subsequently used to access the sensitive data after proper authentication.

Claims

1. A system for protecting sensitive data comprising:

one or more clients, each client having a data storage and a content manager that extracts the sensitive data from the data storage, sends the extracted data to a server for storage, receives a pointer indicating where the extracted data has been stored and replaces the sensitive data on the data storage with the pointer; and

a server communicably coupled to the one or more clients, wherein the server receives the extracted data from the client, stores the extracted data to a secure storage, generates the pointer and sends the pointer to the client.

2. The system as recited in claim 1, wherein:

the client comprises a computer, a laptop computer, a handheld computer, a desktop computer, a workstation, a data terminal, a phone, a mobile phone, a personal data assistant, a media player, a gaming console, a security device, a surveillance device or a combination thereof; and

the server is communicably coupled to the one or more clients via a computer network, a telecommunications network, a wireless communications link, a physical connection, a landline, a satellite communications link, an optical communications link, a cellular network or a combination thereof.

3. The system as recited in claim 1, wherein the communications between the server and the client are encrypted.

4. The system as recited in claim 1, wherein the server further comprises:

an application program interface layer;

an authentication layer coupled to the application program layer;

a plug-in layer coupled to the authentication layer;

a data layer coupled to the plug-in layer; and

an events layer coupled to the data layer, the plug-in layer and the authentication layer.

5. The system as recited in claim 1, wherein the pointer comprises random data that is of a same data type as the sensitive data.

6. The system as recited in claim 1, wherein the pointer is subsequently used to access the sensitive data after proper authentication.

7. The system as recited in claim 1, wherein access to and storage of the sensitive data is governed by one or more rules.

8. An apparatus for protecting sensitive data comprising:

a data storage;

one or more applications;

a communications interface to a remote server having a secure storage; and

a content manager communicably coupled to the data storage, the one or more applications and the communications interface, wherein the content manager controls access to the data storage, extracts the sensitive data from the data storage, sends the extracted data to the remote server for storage via the communications interface, receives a pointer indicating where the extracted data has been stored and replaces the sensitive data on the data storage with the pointer

9. The apparatus as recited in claim 8, wherein the content manager further receives a first request from the one or more applications for data stored on the data storage, determines whether the requested data includes the sensitive data, provides the requested data to the one or more applications whenever the requested data does not include the sensitive data, and performs the following steps whenever the requested data includes the sensitive data:

sends a second request containing the pointer to a server that authenticates the second request, denies the first request whenever the authentication fails, and receives and provides the sensitive data to the one or more applications whenever the authentication succeeds.

10. A method for protecting sensitive data comprising the steps of:

extracting the sensitive data from a data storage on a client;

sending the extracted data to a server for storage;

receiving a pointer indicating where the extracted data has been stored; and

replacing the sensitive data on the data storage on the client with the pointer.

11. The method as recited in claim 10, further comprising the steps of:

receiving the extracted data from the client;

storing the extracted data to a secure storage on the server;

generating the pointer; and

sending the pointer to the client.

12. The method as recited in claim 10, further comprising the steps of:

receiving a first request for data stored on the data storage;

determining whether the requested data includes the sensitive data;

providing the requested data whenever the requested data does not include the sensitive data; and

performing the following steps whenever the requested data includes the sensitive data;

sending a second request containing the pointer to the server, authenticating the second request, denying the second request whenever the authentication fails, retrieving the sensitive data using the pointer and sending the sensitive data whenever the authentication succeeds.

13. The method as recited in claim 10, wherein the received sensitive information can only be viewed or used in an application.

14. The method as recited in claim 10, wherein the received sensitive information cannot be further transferred or stored.

15. The method as recited in claim 10, wherein the pointer comprises random data that is of a same data type as the sensitive data.

16. The method as recited in claim 10, wherein the pointer is subsequently used to access the sensitive data after proper authentication.

17. The method as recited in claim 10, wherein access to and storage of the sensitive data is governed by one or more rules.

18. The method as recited in claim 10, wherein the sensitive data comprises personal data, financial data, corporate data, legal data, government data, police data, immigration data, military data, intelligence data, security data, surveillance data, technical data, copyrighted content or a combination thereof.

19. A computer program embodied on a computer readable medium for protecting sensitive data comprising:

a code segment for extracting the sensitive data from a data storage on a client;

a code segment for sending the extracted data to a server for storage;

a code segment for receiving a pointer indicating where the extracted data has been stored; and

a code segment for replacing the sensitive data on the data storage on the client with the pointer.

20. The computer program as recited in claim 19, further comprising the steps of:

a code segment for receiving the extracted data from the client;

a code segment for storing the extracted data to a secure storage on the server;

a code segment for generating the pointer; and

a code segment for sending the pointer to the client.