Security systems and methods for encoding and decoding digital content

• US 9,977,921 B2
• Filed: 05/12/2015
• Issued: 05/22/2018
• Est. Priority Date: 11/14/2011
• Status: Active Grant

• Current Assignee: ESW Holdings, Inc. (ESW Capital, LLC)
• Original Assignee: ESW Holdings, Inc. (ESW Capital, LLC)
• Inventors: Sprague, Steven, Sprague, Michael
• Primary Examiner(s): ZHAO, DON GORDON
• Application Number:
  US14/710,402
• Publication Number:
  US 20170200023A1
• Time in Patent Office: 1,106 Days
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods may be provided for masking data on public networks. At a publishing node, the system may monitor data input fields in a webpage, and intercept and encode content, such as text, images, and video input at the data input fields, prior to the content being posted online on a public service provider'"'"'s website. A policy may be defined to control which users are permitted access to a key to decode the encoded content. The policy may defer to a third party policy node in determining key access. An account for a controlling entity, such as a guardian or employer, may be configured to control the encoding status of posts made by another. The controlling entity may control who has key access to decode posts made by the other account. The guardian account may be configured to have preemptive rights over posting decisions made by the minor.

Claims

1. A method of controlling digital content, the method comprising:

executing code by a first user node executing code stored in a non-transitory memory to control the digital content by;

receiving a request to publish digital text content received at an input field in an electronic document, where the publishing request is associated with the first user node;

in response to the publishing request, determining whether to encrypt the input field text content in the electronic document;

receiving instructions to replace, in the electronic document, the input field text content with an encrypted version of the input field text content based on an encryption policy defined by a controlling entity and prior to uploading the input field text content to web service, wherein the controlling entity includes a policy node that is separate from the first user node;

accessing the policy node;

obtaining the encryption policy and an encryption key from the policy node;

encrypting the input field text content with the encryption key to generate encrypted input field text content;

tagging the encrypted input field text content with a tag that includes an address of the policy node and an identifier of the encryption policy to allow the web service to extract the address of the policy node and the identifier of the encryption policy and obtain a decryption key to decrypt the encrypted input field text content; and

uploading the encrypted input field text content and the tag to the web service.

2. The method of controlling digital content as in claim 1 wherein receiving a request to publish digital content received at an input field in an electronic document further includes:

detecting a change event associated with the input field; and

upon detection of the change event, requesting, from the policy node, the encryption policy to be associated with the input field text content.

3. The method of controlling digital content as in claim 1 wherein determining whether to encrypt the input field text content in the electronic document is facilitated by a privacy agent executing on the first user node, the privacy agent transmitting, to the policy node, session information concerning the first user node and a unique identifier associated with the input field text content.

4. The method of controlling digital content as in claim 3 wherein the policy node responds to the session information and the unique identifier by:

generating the decryption key for decoding the encrypted version of the input field text content; and

determining the policy for the input field text content, the policy defining conditions on which the input field text content is accessible to other viewing nodes.

5. The method of controlling digital content as in claim 1 wherein to replace, in the electronic document, the input field text content with an encrypted version of the input field text content further includes:

accessing a document object model (DOM) tree associated with the electronic document to modify and replace instances of the input field text content with the encoded version of the input field text content; and

directing a browser to draw the modified electronic document.

6. The method of controlling digital content as in claim 1 wherein the first user node is associated with a first user account.

7. The method of controlling digital content as in claim 6 wherein the controlling entity is one of the following:

an enterprise, organization, government entity, or guardian.

8. The method of controlling digital content as in claim 6 wherein the controlling entity is not the first user node, and the controlling entity is not a user operating the first user node.

9. The method of controlling digital content as in claim 6 wherein the controlling entity defines the encryption policy associated with the input field text content in the electronic document, and the controlling entity is associated with an administrative account configured to have preemptive control over encrypting and decrypting decisions associated with input field text content input at external sites by the first user node.

10. The method of controlling digital content as in claim 6 wherein the controlling entity defines the encryption policy associated with the input field text content, the encryption policy is configured to define which users or group of users have access to the decryption key that facilitates decoding of the encoded version of the input field content.

11. The method of controlling digital content as in claim 6 wherein the first user account is associated with a minor and the controlling entity'"'"'s account is associated with a guardian of the minor.

12. The method of controlling digital content as in claim 1 wherein creation of the minor'"'"'s account spawns creation of the guardian'"'"'s account.

13. The method of controlling digital content as in claim 9 wherein the encryption policy is configured to specify a least one group, having one or more users, that is permitted to access a decrypted version of the encoded input field text content.

14. The method of controlling digital content as in claim 13 wherein the existence of the controlling entity'"'"'s account and the control that it has over the first user'"'"'s account is undetectable by the one or more users in the group.

15. The method of controlling digital content as in claim 9 wherein the controlling entity'"'"'s account is configured to have the option to eject or suspend the first user'"'"'s account.

16. The method of controlling digital content as in claim 8 wherein the encryption policy is configured such that publishing requests made by the first user'"'"'s account are encrypted during a specified timeframe.

17. The method of controlling digital content as in claim 9 wherein the encryption policy is configured so that the first user'"'"'s account controls encryption and decryption decisions during a specified timeframe.

18. The method of controlling digital content as in claim 9 wherein:

the encryption policy is configured to allow the controlling entity to control the encryption status of the input field text content if the publishing request is received during working hours; and

the encryption policy is configured to allow the first user'"'"'s account to control the encryption status of the input field text content if the publishing request is received during non-working hours.

19. The method of controlling digital content as in claim 1 wherein the controlling entity is configured to control encryption permissions associated with publishing requests made by accounts of a first domain, where the first user node'"'"'s account is associated with the first domain.

20. The method of controlling digital content as in claim 1 wherein the controlling entity has the ability to access analytics information associated with content published by the first user node.