SYSTEM AND METHOD FOR SECURING DATA

• US 20110040964A1
• Filed: 12/22/2008
• Published: 02/17/2011
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: Cocoon Data Holdings Limited
• Original Assignee: Cocoon Data Holdings Limited
• Inventors: Thompson, Stephen, Nussbaum, Lawrence Edward
• Granted Patent: US 8,806,207 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

The present invention provides a method for securing data distributed by a first user to at least one recipient user, comprising the steps of; responding to a request from the first user to encrypt the data with a key; and recording the location of the key in a database, wherein on the database receiving a request from the at least one recipient user for authorization, providing the key to the at least one recipient user upon authorization.

Claims

1. A method for securing data distributed by a first user to at least one recipient user, comprising the steps of:

responding to a request from the first user to encrypt the data with a key; and

,

recording the location of the key in a database, wherein the database, on receiving a request for authorization from the at least one recipient user provides the key to the at least one recipient user upon authorization.

2. A method according to claim 1 comprising the further step of the database receiving rules arranged to constrain the at least one recipient user'"'"'s interaction with the data.

3. A method according to claim 1, wherein the step of authorization further comprises the steps of:

comparing an identification profile of the at least one recipient user with a pre-determined criteria, wherein the at least one recipient user is authorized if the pre-determined criteria matches the identification profile.

4. A method according to claim 3, wherein the identification profile includes at least one criterion characterizing a characteristic of the at least one recipient user.

5. A method according to claim 1, wherein the first user interacts with a client application arranged to request the key from a central source.

6. A method according to claim 5, wherein the at least one user interacts with at least one receiver application arranged to request authorization from the central source to decrypt the data.

7. A method according to claim 1, wherein the key is generated by any one of the central source or the client application.

8. A method according to claim 1, wherein the central source comprises a gatekeeper service arranged to protect the server from unauthorized users.

9. A method according to claim 8, wherein the central source further comprises a logging service arranged to log any activity on the data by the recipient user.

10. A method according to claim 1, wherein the data is included in a file wrapper as an encrypted data string.

11. A method according to claim 10, wherein the file wrapper is a secure document arranged to be processed by the receiver application.

12. A method according to claim 10, wherein the data object is provided with a secure envelope arranged to enclose the data such that when the data is within the envelope, the at least one recipient user'"'"'s interaction with the data is constrained by the rules established by the first user.

25. A computer program comprising at least one instruction for controlling a computer system to implement a method according to claim 1.

26. A computer readable medium providing a computer program in accordance with claim 25.

13. A system for securing data distributed by a first user to at least one recipient user, comprising:

a module arranged for responding to a request from the first user to encrypt the data with a key; and

,

a routine arranged to record the location of the key in a database, wherein the database, on receiving a request for authorization from the at least one recipient user provides the key to the at least one recipient user upon authorization.

14. A system according to claim 13, wherein the database is arranged to receive rules, the rules being arranged to constrain the at least one recipient user'"'"'s interaction with the data.

15. A system according to claim 13, wherein the routine compares an identification profile of the at least one recipient user with a pre-determined criteria such that if the pre-determined criteria matches the identification profile, the at least one recipient user is authorized.

16. A system according to claim 15, wherein the identification profile includes at least one criterion characterizing a characteristic of the at least one recipient user.

17. A system according to claim 15, wherein the first user interacts with a client application, arranged to request the key from a central source.

18. A system according to claim 17, wherein the at least one user interacts with at least one receiver application arranged to request authorization from the central source to decrypt the data.

19. A system according to claim 15, wherein the key is generated by any one of the central source or the client application.

20. A system according to claim 19, wherein the central source comprises a gatekeeper service arranged to protect the server from unauthorized users.

21. A system according to claim 20, wherein the central source further comprises a logging service arranged to log any activity on the data by the recipient user.

22. A system according to claim 15, wherein the data is included in a file wrapper as an encrypted data string.

23. A system according to claim 22, wherein the file wrapper is a secure document arranged to be processed by the receiver application.

24. A system according to claim 22, wherein the data object is provided with a secure envelope arranged to enclose the data such that when the data is within the envelope, the at least one recipient user'"'"'s interaction with the data is constrained by the rules established by the first user.