SHARED SCALABLE SERVER TO CONTROL CONFIDENTAL EVENT TRAFFIC AMONG RECORDATION TERMINALS, ANALYSIS ENGINES, AND A STORAGE FARM COUPLED VIA A PUBLIC NETWORK

• US 20100223466A1
• Filed: 08/31/2009
• Published: 09/02/2010
• Est. Priority Date: 02/27/2009
• Status: Abandoned Application

• Current Assignee: Third Iron LLC
• Original Assignee: Third Iron LLC
• Inventors: Forrester, Paul H., Roskowski, Steven Goddard
• Application Number:
  US12/551,239
• Publication Number:
  US 20100223466A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 1/1685 the supervisory signal being transmitted in response to a specific request, e.g. to a polling signal
• CPC Class Codes: H04L 2001/125 Arrangements for preventing errors in the return channel
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04N 21/2187 Live feed
• CPC Class Codes: H04N 21/23473 by pre-encrypting
• CPC Class Codes: H04N 21/25808 Management of client data terminal profiles in network data switching protocols H04L67/303
• CPC Class Codes: H04N 21/25866 Management of end-user data customer care in data networks H04L41/5077
• CPC Class Codes: H04N 21/632 using a connection between clients on a wide area network, e.g. setting up a peer-to-peer communication via Internet for retrieving video segments from the hard-disk of other client devices broadcast-related systems characterised by transmission among terminal devices H04H60/80; distributed application using peer-to-peer [P2P] networks H04L67/104
• CPC Class Codes: H04N 21/6581 Reference data, e.g. a movie identifier for ordering a movie or a product identifier in a home shopping application

Abstract

A highly secure event server receiving and storing encrypted assets and references to those assets over a public wide area network. A system for selectively decrypting and transmitting references to analysis clients such as authenticated mutually unconscious users, and retrieving, decrypting and transmitting certain assets from high-volume storage, distributed storage, or in transit. A method for controlling a plurality of event recordation clients and a plurality of analysis clients transmitting policies and commands requesting upload of assets and obtaining status solely by receiving client initiated sessions.

Claims

1. A method for operating an event recordation system provisioning a quantifiably provable provenance process comprising the steps of:

on an event recordation server apparatus;

receiving a digitally signed asset,

authenticating an analysis client,

validating an asset upon request by an authorized authenticated analysis client,

and delivering the validated asset to the authorized authenticated analysis client;

wherein digitally signing mathematically combines the identification of the event recordation client apparatus, the time and date, and the content of the asset in a way that any modification is quantifiably detectable.

2. A method for operating an event recordation system with secure transmission and storage of assets comprising

on an event recordation server apparatus:

receiving and storing an encrypted asset,

authenticating an authorized analysis client,

decrypting the asset only at the request of an authenticated authorized analysis client, and

delivering the decrypted asset to the authenticated authorized analysis client;

whereby the asset is protected in storage and during transmission by an encryption at the event recordation client apparatus and not merely by a transport layer protocol.

3. The method of claim 2 further comprising

on an event recordation server apparatus:

receiving a digitally signed and encrypted asset,

authenticating an authorized analysis client,

retrieving the asset from storage or the event recordation client,

validating the encrypted asset only upon request of an authorized analysis client,

and delivering the asset to the authorized analysis client;

wherein digitally signing mathematically combines the identification of the event recordation client apparatus, the time and date, and the content of the asset in a way that any modification is quantifiably detectable,

wherein delivering comprises at least one of;

assuring that the client has appropriate credentials and capabilities to validate or decrypt the asset, validating the asset, and decrypting the asset.

4. A method for operating a event server apparatus, the apparatus comprising a command server, a network interface, a storage manager, an event recordation server;

the method comprising the steps;

receiving and maintaining a client session from a event recordation client apparatus,

receiving and storing a reference,

presenting a reference to an analysis server, and

in processing an analysis server request for an asset, responding to a client request with a command to priority upload an asset.

5. A method for operating an event server apparatus, the apparatus comprising a command server, a network interface, a location server, a storage manager, an event recordation server;

the method comprising the steps;

receiving and maintaining a client session from a event recordation client apparatus,

receiving and storing a reference and receiving a bandwidth shaped upload of an asset related to the reference;

receiving a request from a PORT, which includes identification information of the PORT authenticating the PORT, comprising one or more of the steps;

responding to the PORT request with a challenge response and receiving a subsequent request from the PORT with the appropriate response,

and validating the PORT identification information against known good PORTs;

responding to the PORT request with a nonce to use for authenticated access and an IP address to use for camera server transactions;

receiving a request from a valid server for the active server to use to rendezvous with a specific PORT,

responding to the request with identification information for the specific camera server the PORT is associated with, and

responding with an error response if the PORT is not valid.

6. The method of claim 5 further comprising the step of

in processing an analysis server request for an asset, responding to a client request with a command to priority upload an asset whereby an asset already in transit by bandwidth shaped upload is completed by priority upload.

7. The method of claim 6 wherein the asset is digitally signed within the event recordation client apparatus for quantifiably provable provenance further comprising the steps:

receiving and storing a digitally signed asset,

authenticating an analysis client and

validating an asset upon request by an authorized authenticated analysis client.

8. The method of claim 6 whereby the asset is received in encrypted format within the event recordation client apparatus for privacy and not decrypted unless accessed by authenticated analysis client the method further comprising the steps:

receiving an encrypted asset,

authenticating an authorized analysis client, and

decrypting the asset only at the request of an authenticated authorized analysis client whereby the asset is protected during transmission by an encryption at the event recordation client apparatus and not merely by a transport layer protocol.

9. The method of claim 8 whereby the asset is both encrypted for privacy and digitally signed for provenance further comprising the steps:

receiving and storing a digitally signed and encrypted asset,

authenticating an authorized analysis client, and

validating as asset upon request by an authorized authenticated analysis client.

10. The method of claim 9 wherein an event further comprises a server recognized event which is initiated by a process within the server further comprising the steps:

receiving an asynchronous request from a server or analysis client to initiate a demand for event creation, asset transfer, and reference for a certain camera,

receiving and maintaining a client session from an event recordation client apparatus,

responding to a client request with a command to create an event, and at least one reference and asset and priority upload the asset to the server.

11. An event recordation system with quantifiably provable provenance apparatus comprising

a network attached event recordation server comprising:

a decryption circuit,

means for receiving and storing a reference,

means for receiving and storing an asset,

means for validating an asset traceably to a certain network attached event recordation client comprising

an encryption circuit,

a event determination policy,

an event recognition circuit, the recordation client having

means for digitally signing an asset documenting the time and locus of an event recognition, and

means for summarizing an asset into a compact reference.

12. A public network attached event recordation asset server apparatus comprising

an event recordation server,

analysis server,

storage manager circuit,

a storage server,

a network interface coupled to at least one event recordation client apparatus

wherein said event recordation server responds to a client initiated session to provide status, transmit references and assets, and obtain commands and

wherein said storage manager circuit maintains location information for every asset among three classes:

in transit between the recordation client and the server, stored at the storage server, or stored at the event recordation client.

13. The server apparatus of claim 12 further comprising the following:

means for transmitting to an event recordation client a demand for immediate transmission of an asset, and

means for transmitting to an event recordation client a policy for delayed transmission of a stored asset according to an allocation of bandwidth.

14. The apparatus of claim 12 further comprising means for policy distribution to public network attached event recordation apparatus.

15. The apparatus of claim 14 comprising a software update circuit providing code to define meta-data to be uploaded.

16. The apparatus of claim 14 comprising a software update circuit providing code to define an event to be recorded.

17. The apparatus of claim 14 comprising a software update circuit providing code to define an asset to be stored and transmitted.

18. The apparatus of claim 12 further comprising means for quantifiably provable provenance and a decryption circuit,

a record of the criteria for each event recordation apparatus,

a circuit to receive a digitally signed asset for an event, and

a circuit to store a digitally signed asset.

19. A method for operating a public network attached event recordation asset server comprising the processes:

receiving a client initiated protocol to establish connectivity,

receiving a client initiated protocol to transmit a reference to an event,

receiving a client initiated protocol to transmit an asset,

storing a reference,

receiving an authenticated authorized analysis client request for an asset,

resolving an asset from storage if possible,

locating an asset by identifying a certain event recordation server,

operating an event recordation server, and delivering the asset to the authorized authenticated analysis client.

20. The method of claim 19 further comprising

redirecting a asset currently in transit,

reading an asset from storage,

transmitting a command to client to priority upload an asset, and

storing an asset.

21. The method of claim 19 wherein operating an event recordation server comprises the steps:

receiving a request for an asset,

on the condition, the asset does not yet exist, opening a receptacle for the asset, responding to a request from an event recordation client with a command to priority upload the asset, and delivering blocks of the data as they are received;

on the condition, the asset is partially uploaded from an event recordation client, responding to a request from an event recordation client with a command to priority upload the remainder of the asset, and delivering blocks of the data as they are received; and

on the condition the asset is already received, delivering the asset to the analysis server.

22. The method of claim 19 wherein delivering the asset to the authorized authenticated analysis client comprises one or more of:

assuring the client has the credentials and capability for validating or decrypting the asset, validating the asset before sending to the client, and decrypting the asset before sending to the client.

23. The method of claim 19 wherein delivering the asset to the authenticated authorized client comprises checking an opened file for available data, transferring data whenever the file has data and waiting for new data to be placed into the file.

24. The method of claim 19 for operating a public network attached event recordation asset server further comprising

distributing a policy to a public network attached event recordation apparatus wherein a policy is a computer executable instruction to adapt a processor to transform data tangibly encoded on computer readable media.

25. The method of claim 24 wherein a policy determines an event based on object recognition rules.

26. The method of claim 24 wherein a policy determines an event based on facial recognition rules.

27. The method of claim 24 wherein a policy determines an event based on object placement or movement.

28. The method of claim 24 wherein a policy determines an event based on duration of occupancy within a part of an image field.

29. The method of claim 24 wherein a policy determines an event based on a repetition of motions.

30. The method of claim 24 wherein a policy determines an event based on motion detection and time of day &

day of week.

31. The method of claim 24 wherein a policy determines which meta data is transmitted by type of event.

32. The method of claim 24 wherein a policy determines if a low resolution video frame is included in a reference.

33. The method of claim 24 wherein a policy determines if a high resolution image is included in an asset.

34. The method of claim 24 wherein a policy determines the immediacy of transmitting an asset to a server.

35. The method of claim 24 wherein a policy determines the immediacy of transmitting a reference to a server.

36. An event server apparatus comprising:

a event recordation server circuit

to receive a reference from a event recordation client,

to receive status from and transmit commands to each event recordation client,

to receive and store assets from a event recordation client according to an bandwidth shaping policy for incremental fulfillment or according to a demand for elaboration, a command server, to retrieve assets from an event recordation client,

a storage manager circuit,

to maintain storage location of assets for every event, and

to retrieve assets from storage server, and

an analysis server to determine which references are of interest.

37. The apparatus of claim 36 further comprising means for transmitting an update to a event recordation client apparatus comprising configuration for determining an event, performing analysis, uploading meta-data, and transmitting a reference.

38. The apparatus of claim 36 further comprising means for forcing an immediate event determination to a selected event recordation client apparatus.

39. The apparatus of claim 36

further comprising an authentication and decryption circuit,

and means for receiving and storing an asset in a digitally signed format

which prevents modification of the time of day, the asset, or the identification of the event recordation apparatus without detection,

whereby provenance of the asset is quantifiably measurable and proven.

40. The apparatus of claim 36

further comprising an authentication and decryption circuit and

means for receiving and storing an asset in an encrypted format without decrypting it whereby an asset may be transmitted through a public network and stored in a shared use server without revealing the contents to unauthenticated or unauthorized parties sharing the network or server apparatus.

41. The apparatus of claim 36, further comprising a location server comprising:

a client interface which receives connections from PORTS, interface being available at a fixed IP address to avoid client DNS,

a load balancing service which allocates PORTS to a pool of camera servers,

authentication service which validates the PORT identification information against know PORTS and provide credentials to allow access to camera servers,

a location data base which record the specific camera server a specific port is allocated to, and

a location query server which provides the location data to other servers on request;

wherein the command server comprises a circuit to

receive a request for immediate elaboration of a reference,

determine location of a asset stored on a certain event recordation client,

determine a command sequence to retrieve and deliver the asset, and

respond to an open session established by the event recordation client with a command sequence to immediately upload the asset with priority over any other event recordation client traffic.

42. A method for operating a system,

the system comprising,

a plurality of analysis client apparatus coupled to an analysis server apparatus by a network,

the analysis server apparatus coupled to a storage server apparatus, and

the storage server apparatus,

the method comprising the following processes:

providing access to assets which may be in any one of a plurality of states,

determining a location for an asset currently stored,

directing a request to retrieve an asset from a storage location, and

fetching assets and storing them in high volume reliable storage.

43. The method of claim 42 further comprising the steps following:

receiving a hyper text transfer protocol POST method request initiated by point of recordation terminal,

receiving a status report from a PORT and transferring it to any server,

receiving a command from any server and transferring it to a PORT,

receiving references and assets from a PORT, and

publishing the existence of assets and references as they are being uploaded.