SYSTEM, METHOD AND APPARATUS FOR ELECTRONICALLY PROTECTING DATA AND DIGITAL CONTENT

• US 20100005509A1
• Filed: 06/30/2009
• Published: 01/07/2010
• Est. Priority Date: 03/16/2005
• Status: Abandoned Application

• Current Assignee: DT Labs LLC
• Original Assignee: DT Labs LLC
• Inventors: Peckover, Douglas
• Application Number:
  US12/495,789
• Publication Number:
  US 20100005509A1
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The present invention provides a system, apparatus and method for protecting sensitive data can be provided using a pre-content manager and a post-content manager. The pre-content manager extracts sensitive or non-sensitive data from a data storage on a client, sends the extracted sensitive data to a server for storage, receives a pointer indicating where the extracted sensitive data has been stored and replaces the sensitive data on the data storage on the client with the pointer. The post content manager receives the sensitive data from the pre-content manager and transmits the sensitive data to one or more media devices. The foregoing can be implemented as a computer program embodied on a computer readable medium wherein the steps are executed by one or more code segments.

Claims

1. A system for protecting sensitive data comprising:

one or more clients, wherein each client has a data storage, a pre-content manager and a post-content manager;

wherein the pre-context manager extracts the sensitive data from the data storage, sends the extracted data to a server for storage, receives a pointer indicating where the extracted data has been stored and replaces the sensitive data on the data storage with the pointer;

wherein the post-content manager is communicably coupled with the pre-content manager or the server and one or more media devices, receives the sensitive data from the pre-content manager or the server, and transmits the sensitive data to the one or more media devices; and

a server communicably coupled to the one or more clients, wherein the server receives the extracted data from the one or more clients, stores the extracted data to a secure storage, generates the pointer and sends the pointer to the one or more clients.

2. The system as recited in claim 1, wherein the pre-content manager further receives a first request from one or more applications for data stored on the data storage, determines whether the requested data includes the sensitive data or the non-sensitive data, provides the non-sensitive data to one or more post-content manager or to the one or more applications, and performs the following steps whenever the requested data includes the sensitive data:

sends a second request containing the pointer to a server that authenticates the second request, denies the first request whenever the authentication fails, and receives and provides the sensitive data to the one or more post-content manager or the one or more applications whenever the authentication succeeds.

3. The system as recited in claim 1, wherein the post-content manager further performs the following steps whenever the post-content manager receives the sensitive data from the server or the pre-content manager:

sends one or more authentication codes to the pre-content manager or the server, accepts the sensitive data whenever the one or more authentication codes is accepted by the server or the pre-content manager, and rejects the sensitive data whenever the one or more authentication codes is rejected by the pre-content manger or the server.

4. The system as recited in claim 1, wherein the pre-content manager performs one or more corrective or destructive actions whenever the authentication fails and the client is determined to be compromised, lost or stolen.

5. The system as recited in claim 1, wherein the post-content manger is integrated into the one or more media devices.

6. The system as recited in claim 5, wherein the communications between the integrated post-content manager and the pre-context manager are encrypted.

7. The system as recited in claim 1, wherein:

the one or more clients comprise a computer, a laptop computer, a handheld computer, a desktop computer, a workstation, a data terminal, a phone, a mobile phone, a personal data assistant, a media player, a gaming console, a security device, a surveillance device or a combination thereof;

the one or more media devices comprise a printer, a plotter, a projector, an optical disc drive, a removable magnetic media drive, a copier, a removable data storage device, a scanner or a combination thereof; and

the server is communicably coupled to the one or more clients via a computer network, a telecommunications network, a wireless communications link, a physical connection, a landline, a satellite communications link, an optical communications link, a cellular network or a combination thereof.

8. The system as recited in claim 1, wherein the communications between the server and the client are encrypted.

9. The system as recited in claim 1, wherein the server further comprises:

an application program interface layer;

an authentication layer coupled to the application program layer;

a plug-in layer coupled to the authentication layer;

a data layer coupled to the plug-in layer; and

an events layer coupled to the data layer, the plug-in layer and the authentication layer.

10. The system as recited in claim 1, wherein the pointer comprises random data that is of a same data type as the sensitive data.

11. The system as recited in claim 1, wherein the pointer is subsequently used to access the sensitive data after proper authentication.

12. The system as recited in claim 1, wherein access to and storage of the sensitive data is governed by one or more rules.

13. An apparatus for protecting sensitive data comprising:

a data storage containing sensitive or non-sensitive data;

one or more applications;

a communications interface to a remote server having a secure storage;

one or more media devices;

a pre-content manager communicably coupled to the data storage, the one or more applications, and the communications interface, wherein the pre-content manager controls access to the data storage, extracts the sensitive data and non-sensitive from the data storage, sends the extracted sensitive data to the remote server for storage via the communications interface, receives a pointer indicating where the extracted sensitive data has been stored and replaces the sensitive data on the data storage with the pointer;

a post-content manager communicably coupled with the pre-content manager or the server, and one or more media devices, wherein the post-content manager receives the sensitive data or the non-sensitive data from the pre-content manager or the server, and transmits the sensitive data or the non-sensitive data to the one or more media devices.

14. The apparatus as recited in claim 13, wherein the pre-content manager performs one or more corrective or destructive actions whenever the authentication fails and the client is determined to be compromised, lost or stolen.

15. The apparatus as recited in claim 13, wherein the post-content manger is integrated into the one or more media devices.

16. The apparatus as recited in claim 13, wherein the communications between the integrated post-content manager and the pre-context manager are encrypted.

17. The apparatus as recited in claim 13, wherein the pre-content manager further receives a first request from the one or more applications for data stored on the data storage, determines whether the requested data includes the sensitive data or the non-sensitive data, provides the non-sensitive data to one or more post-content manager or to the one or more applications, and performs the following steps whenever the requested data includes the sensitive data:

sends a second request containing the pointer to a server that authenticates the second request, denies the first request whenever the authentication fails, and receives and provides the sensitive data to the one or more post-content manager or the one or more applications whenever the authentication succeeds.

18. The apparatus as recited in claim 13, wherein the post-content manager further performs the following steps whenever the post-content manager receives the sensitive data from the server or the pre-content manager:

sends one or more authentication codes to the pre-content manager or the server, accepts the sensitive data whenever the one or more authentication codes is accepted by the server or the pre-content manager, and rejects the sensitive data whenever the one or more authentication codes is rejected by the pre-content manager or the server.

19. A method for protecting sensitive data on a data storage on a client device comprising the steps of:

extracting the sensitive data or non-sensitive data from the data storage on the client device, sending the extracted sensitive data to a server for storage, receiving a pointer indicating where the extracted sensitive data has been stored and replacing the extracted sensitive data on the data storage on the client device with the pointer, wherein the foregoing steps are performed using a pre-content manager; and

receiving the extracted sensitive data from the pre-content manager and transmitting the extracted sensitive data to one or more media devices, wherein the foregoing steps are performed using a post-content manager.

20. The method as recited in claim 19, further comprising the steps of receiving the extracted sensitive data from the pre-content manager, storing the extracted sensitive data to a secure storage on the server, generating the pointer and sending the pointer to the client device, wherein the foregoing steps are performed at the server.

21. The method as recited in claim 19, further comprising the following steps performed by the pre-content manager:

receiving a first request for data stored on the data storage;

determining whether the requested data includes the sensitive data;

providing the requested data whenever the requested data includes non-sensitive data; and

performing the following steps whenever the requested data includes the sensitive data;

sending a second request containing the pointer to the server, authenticating the second request, denying the second request whenever the authentication fails, retrieving the sensitive data using the pointer and sending the sensitive data to one or more media devices whenever the authentication succeeds.

22. The method as recited in claim 19, further comprising the following steps performed by the post-content manager:

sending one or more authentication codes to the pre-content manager or server; and

transmitting the sensitive data to one or more media device whenever the one or more authentication codes is accepted by the pre-content manager or server.

23. The method as recited in claim 19, further comprising the following steps performed by the pre-content manager:

receiving one or more authentication codes from the post-content manager;

validating the one or more authentication codes; and

transmitting the sensitive data whenever the one or more authentication codes is valid.

24. The method as recited in claim 19, wherein the pre-content manager further performs one or more corrective or destructive actions whenever the authentication fails and the client device is determined to be compromised, lost or stolen.

25. The method as recited in claim 19, wherein the pointer comprises random data that is of a same data type as the sensitive data.

26. The method as recited in claim 19, wherein the pointer is subsequently used to access the sensitive data after proper authentication.

27. The method as recited in claim 19, wherein access to and storage of the sensitive data is governed by one or more rules.

28. The method as recited in claim 19, wherein the sensitive data comprises personal data, financial data, corporate data, legal data, government data, police data, immigration data, military data, intelligence data, security data, surveillance data, technical data, copyrighted content or a combination thereof.

29. A computer program embodied on a computer readable medium for protecting sensitive data on a client device comprising:

a pre-content manager code segment for extracting the sensitive data or non-sensitive data from a data storage on the client device, sending the extracted sensitive data to a server for storage, receiving a pointer indicating where the extracted sensitive data has been stored and replacing the extracted sensitive data on the data storage on the client device with the pointer; and

a post-content manager code segment for receiving the sensitive data from the pre-content manager and transmitting the sensitive data to one or more media devices.

30. The computer program as recited in claim 29, wherein the pre-content manager code segment further receives a first request for data stored on the data storage, determines whether the requested data includes the sensitive data, provides the requested data whenever the requested data includes non-sensitive data, and performs the following steps whenever the requested data includes the sensitive data:

sending a second request containing the pointer to the server, authenticating the second request, denying the second request whenever the authentication fails, retrieving the sensitive data using the pointer and sending the sensitive data to one or more media devices whenever the authentication succeeds.

31. The computer program as recited in claim 29, wherein the post-content manager code segment further sends one or more authentication codes to the pre-content manager or server and transmits the sensitive data to one or more media device whenever the one or more authentication codes is accepted by the pre-content manager or server.

32. The computer program as recited in claim 29, wherein the pre-content manager code segment further receives one or more authentication codes from the post-content manager, validates the one or more authentication codes, and transmits the sensitive data whenever the one or more authentication codes is valid.

33. The computer program as recited in claim 29, wherein the pre-content manager code segment further performs one or more corrective or destructive actions whenever the authentication fails and the client is determined to be compromised, lost or stolen.