|Publication number||US6931549 B1|
|Application number||US 09/579,079|
|Publication date||16 Aug 2005|
|Filing date||25 May 2000|
|Priority date||25 May 2000|
|Publication number||09579079, 579079, US 6931549 B1, US 6931549B1, US-B1-6931549, US6931549 B1, US6931549B1|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (32), Referenced by (98), Classifications (23), Legal Events (4)|
|External Links: USPTO, USPTO Assignment, Espacenet|
1. Field of the Invention
This invention relates in general to the field of data security, and more particularly to data encoding/decoding in a network.
2. Background Art
Data security is of extreme importance to all entities utilizing data processing and computing systems. As such, various data security systems are utilized to prevent unauthorized access to stored digital information. Generally, data is stored either in a central facility in a network environment, or in local computer systems' storage in a distributed environment. In either case extreme care is required to protect the data from access by intruders. Unauthorized access to the stored data can be initiated from external sources as well as internal sources without authorization to access the data, leading to copying or loss of valuable data.
With the proliferation of easily accessible networks such as the Internet, the security threat becomes much more serious to said entities as many of their computers can be accessed by outside computers through the Internet. There are sophisticated “firewall” systems that can detect any unauthorized attempt of intrusion to a particular computing system or a network of computers, and attempt to prevent unauthorized entry into the computing system. However, in many instances unauthorized intrusion into secured computing systems takes place despite the firewall systems, and valuable information lost or stolen from the computing systems.
Therefore, there have been attempts at developing systems that virtually eliminate any loss of information even in case of unauthorized intrusion into a computing system. One such system is disclosed in U.S. Pat. No. 5,136,647 issued to Stuart Harber and Wakefield Stornetta Jr. on Aug. 4, 1992, directed to a system for time-stamping a digital document. The time stamping protects the secrecy of the document text and provides a tamper proof time scale establishing an author's claim to the temporal existence of the document. The objective is to incorporate the content of the document by utilizing a one-way hash function and a time stamp into the digital data itself so that it is not possible to change any bit of the resulting time-stamp data without such a change being apparent. The author of the document does not generate the time stamping, instead the services of an independent agent are used for time stamping. A digital signature procedure is also employed by the independent agent to deter the incorporation of a false time statement. The system is primarily directed to address the need to establish the date on which a document was created and to prove that the text of a document in question is in fact is same as that of the original dated document. The system enables the detection of any alteration of the content of the digital document by examining the hash function, the time stamp and digital signature associated with the document.
Another prior art system, disclosed in U.S. Pat. No. 5,150,407 issued to Steve Chan on Sep. 22, 1992, is directed to a secured data storage device including a secured portion and a medium portion. The secured portion is a physically secured enclosure with very limited access from outside sources. The medium portion includes a conventional storage medium such as a hard disk or a floppy disk. In this system, data encoding is accomplished by utilizing an encryption algorithm and the associated key is separated into two parts, wherein the first part is stored in the secured portion of the storage device and the second part is stored in the medium portion of the storage device. This system also uses a time stamping procedure along with the encryption of the data without using an independent agent.
A further prior art system, disclosed in U.S. Pat. No. 5,289,540 issued to Richard Jones on Feb. 22, 1994, is directed to a computer file protection system. The system includes both hardware and software elements and the protection process operates by intercepting the file system data path between a central processing unit and a file storage or memory device. The system also includes a programmable auxiliary memory and auxiliary control unit.
Another prior art system, disclosed in U.S. Pat. No. 5,619,571 issued to Brent Sandstorm, et al., on Apr. 8, 1997, is directed to a system for securely storing electronic records. In this system, a data stream image identification code and time data provided by a trusted source are combined to generate a key. The image identification code and time data are stored in a public directory and a verification code is generated from the data stream. This verification code is placed in a private area that is encrypted by the key generated by the method described earlier.
Another prior art system, disclosed in U.S. Pat. No. 5,623,546 issued to Douglas Hardy, et al., on Apr. 22, 1997, is directed to an encryption method and system for portable data, wherein portable encrypted data can be accessed through multiple hosts. A split key encryption system encrypts data and stores that data on a portable device. One split of the portable key is stored in the portable device, and another split of the key is stored in the home host.
However, the above conventional systems do not address the problem of securing the stored data from intruder access, require special hardware for the secured portion of the storage device and do not support a client-server architecture.
The present invention provides a method and system for securely storing data locally or in a central facility such that only properly authorized and authenticated persons can retrieve such stored data. For example, users may use one embodiment of the present invention to store data in encrypted form by executing a save as encrypted command. Once the date is encrypted it may be decrypted and retrieved by executing a retrieve data command. The present invention provides a way to preserve the integrity and authenticity of the stored data such that no unauthorized alteration to the content of the data or the time at which the data was originally generated takes place. The present invention generates a record of the history of the data storage and retrieval operations to facilitate auditing functions for use of such data.
In one embodiment, the present invention provides a method for authorized users to securely store and retrieve data files in a network system, whereby a user can encode data for storage and later retrieve and decrypt the data for use. The network system comprises a server computer system interconnected to a client computer system via a communication link. The method of securing access to data comprises generating identifying information that represents the data at the client computer system. The identifying information may be transmitted to the server computer system when an event occurs. The computer system receives the identifying information and utilizes it to generate a key pair corresponding to the identifying information. The key pair typically includes an encode key and a decode key for encoding and decoding of the data. In one or more embodiments of the invention the server computer system stores the key pair and the identifying information for later use. The server may then transmit the encode key to the client computer system. When the client computer system receives the encode key it utilizes it to encode the data. The invention also contemplates transmitting the decode key to the client computer system upon requests.
In one example implementation the client and server computer systems interact with one another. For example, the client computer system may generate a client message file comprising information that represents the data. The client message file is transmitted to the server computer system; and utilized to generate a key pair including an encode key for encoding the data and a decode key for decoding the encoded data. The server computer then stores the key pair and information from the client message file. In one or more embodiments of the invention the server generates a server message file that comprises the encode key and transmits the server message file to the client computer system. The client computer system may then encode data using the encode key in the server message file. Once the data is encoded it is stored for later use.
Thereafter, to provide access to encoded data, the client and server computer systems continue to interact. For example, the client computer generates a client message file. The client message file may comprise information representing the data that is to be stored. The client message file is transmitted to the server computer and utilized by the server to retrieve information including a decode key for decoding the encoded data. One embodiment of the invention contemplates generating a server message file including the decode key, and transmitting the server message file to the client computer system. When the client computer receives the server message it accesses the encoded data, and may decode the data using the decode key in the server message file.
The client and server message files can further include time stamps and authentication information for the data. As such, the integrity and authenticity of the stored data are preserved wherein no unauthorized alteration to the content of the data or the time at which the data was originally generated takes place. Further, using the time stamp information, a record of the history of the data storage and retrieval operations can be generated to facilitate auditing functions for use of such data.
These and other features, aspects and advantages of the present invention will become better understood with regard to the following description, appended claims and accompanying drawings where:
In one embodiment, the present invention provides a system for secure real time storage and retrieval of data by a first computer with the aid of a second computer via communication link between the first and second computers. In one or more embodiments of the invention, the communication link is secure. However the invention also contemplates the use of insecure communication links. The system enables a user at the remote first computer to secure a data file for storage by connecting to the second computer and by exchanging certain parameters between the two computers. The system also enables the user at the first computer to retrieve the stored secure data file by connecting to the second computer and by exchanging certain parameters between the two computers.
In one embodiment, the present invention comprises: (1) a secure data storage and retrieval module that can be downloaded to the first computer from the second computer by the first computer and executed on the first computer, and (2) an enabling module that may be executed on the second computer while the first and the second computers maintain a communication link to one another. Communication between the first computer and second computer may utilize data encryption to preserve the security and integrity of the data transferred between the two computers. The user utilizes the first computer to register with the second computer and establish a personal identity (e.g. a password). Once an identity is established, the user is then able to secure and store a data file by executing a secure save command that is made available by the secure data storage and retrieval module residing at the first computer.
Secure Save Command:
After initiating the secure save command, the first computer transmits the file name, an identification parameter of the first computer and the personal identification information to the second computer. The second computer, after processing the received information and after proper authentication of the first computer, generates a time stamp, a digital signature that is a function of the time, the file name, the identification parameter and the password, and a key pair including both encryption and decryption keys. The second computer stores such received and generated information in its database and transmits the file name, the time stamp, the digital signature and the encryption key to the first computer. The first computer encrypts the data file using the received encryption key and stores the encrypted data file along with the time stamp and the digital signature using the file name.
Retrieve Data Command:
Thereafter, the user can retrieve the data file from secure storage by using a retrieve data command made available in the secure data storage and retrieval module in the first computer. By initiating the retrieve data command, the first computer transmits the file name, the identification parameter of the first computer, and the personal identification information (e.g. password) along with the time stamp and the digital signature to the second computer. The second computer, after processing the received parameters retrieves the stored data from its database and compares the data with the received data. After proper validation, the second computer transmits the file name and the decryption key to the first computer. The first computer may then access and decrypt the encrypted data file using the decryption key.
The computer system 101 further includes a read only memory (ROM) 108 or other static storage device coupled to the bus 102 for storing static information and instructions for the processor 104. A storage device 110, such as a magnetic disk or optical disk, is provided and coupled to the bus 102 for storing information and instructions. The bus 102 may contain, for example, thirty-two address lines for addressing video memory or main memory 106. The bus 102 can also include, for example, a 32-bit data bus for transferring data between and among the components, such as the CPU 104, the main memory 106, video memory and the storage 110. Alternatively, multiplex data/address lines may be used instead of separate data and address lines.
In one embodiment, the CPU 104 comprises a microprocessor manufactured by Motorola(R), such as the 680×0 processor or a microprocessor manufactured by Intel(R), such as the 80×86, or Pentium(R) processor, or a SPARC(R) microprocessor from Sun Microsystems(R). However, any other suitable microprocessor or microcomputer may be utilized. The main memory 106 can comprise dynamic random access memory (DRAM). And video memory (not shown) can comprise a dual-ported video random access memory.
The computer system 101 may be coupled via the bus 102 to a display 112, such as a cathode ray tube (CRT), for displaying information to a computer user. An input device 114, including alphanumeric and other keys, is coupled to the bus 102 for communicating information and command selections to the processor 104. Another type or user input device comprises cursor control 116, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to the processor 104 and for controlling cursor movement on the display 112. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y) that allows the device to specify positions in a plane.
According to one embodiment of the invention, the steps of the processes of the present invention is provided by the computer system 101 in response to the processor 104 executing one or more sequences of one or more instructions contained in the main memory 106. Such instructions may be read into the main memory 106 from another computer-readable medium, such as the storage device 110. Execution of the sequences of instructions contained in the main memory 106 causes the processor 104 to perform the process steps described herein. One or more processors in a multi-processing arrangement may also execute the sequences of instructions contained in the main memory 106. In one embodiment of the invention, hard-wired circuitry may be used in place of or in combination with software instructions to implement the invention. Thus, embodiments of the invention are not limited to any specific combination of hardware circuitry and software.
The term computer-readable medium as used herein refers to any medium that participated in providing instructions to the processor 104 for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as the storage device 110. Volatile media includes dynamic memory, such as the main memory 106. Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise the bus 102. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.
Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, an EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.
Various forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to the processor 104 for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to the computer system 101 can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector coupled to the bus 102 can receive the data carried in the infrared signal and place the data on the bus 102. The bus 102 carries the data to the main memory 106, from which the processor 104 retrieves and executes the instructions. The instructions received from the main memory 106 may optionally be stored on the storage device 110 either before or after execution by the processor 104.
The computer system 101 also includes a communication interface 118 coupled to bus the 102. The communication interface 118 provides a two-way data communication coupling to a network link 120 that is connected to a local network 122. For example, the communication interface 118 may be an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line, which can comprise part of the network link 120. As another example, the communication interface 118 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, the communication interface 118 sends and receives electrical electromagnetic or optical signals that carry digital data streams representing various types of information.
The network link 120 typically provides data communication through one or more networks to other data devices. For example, the network link 120 may provide a connection through the local network 122 to a host computer 124 or to data equipment operated by an Internet Service Provider ISP) 126. The ISP 126 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the Internet 128. The local network 122 and the Internet 128 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link 120 and through the communication interface 118, which carry the digital data to and from the computer system 101, are exemplary forms or carrier waves transporting the information.
The computer system 101 can send messages and receive data, including program code, through the network(s), the network link 120 and the communication interface 118. In the Internet example, a server 130 might transmit a requested code for an application program through the Internet 128, the ISP 126, the local network 122 and the communication interface 118. Each of the servers 130 can comprise one or more computer systems such as the computer systems 101 therein.
The communication interface 118 can comprise a USB/Tuner and the network link 120 may be an antenna or cable for connecting the computer system 101 to a cable provider, satellite provider or other terrestrial transmission system for receiving messages, data and program code from another source.
The received code may be executed by the processor 104 as it is received, and/or stored in the storage device 110, or other non-volatile storage for later execution. In this manner, the computer system 101 may obtain application code in the form of a carrier wave.
The example versions of the invention described herein are implemented as logical operations in a distributed processing system such as the network system 100 including client and server computing systems 101 and 130, respectively. The logical operations of the present invention can be implemented as a sequence of steps executing on the computing network 100, and as interconnected machine modules within the computing network 100. The implementation is a matter of choice and can depend on performance of the network 100 implementing the invention. As such, the logical operations constituting said example versions of the invention are referred to for e.g. as operations, steps or modules.
In one or more embodiments of the invention the communication link between a client computer system 101 and a server 130 comprises a secure communication medium. For example, in one embodiment the present invention is directed to a secure real time data storage and retrieval system comprising the client-server architecture of the network 100 (FIG. 1), wherein a secured communication medium is maintained between the client computer 101 and the server computer 130. A user at the client computer 101 is provided with functions including secure data storage and data retrieval, wherein enabling functions are performed on the server computer 130 while the client computer 101 and the server computer 130 maintain a secure communication link to one another.
Security and authenticity of the information communicated among the computer systems 101, 130 can be maintained using different authentication protocols. In one example wherein the communication medium comprises the Internet, security for information exchanged over the Internet is accomplished utilizing a software layer such as built in features of the known secure sockets layer (SSL) Internet communication protocol. A cryptographic hardware device can also be incorporated in the server computer system 130 to ensure authenticity and security of the information exchanged between the client computer 101 and the server computer 130.
To provide secure access to data, the server computer includes a secure data storage and retrieval (“SM”) module for execution on the client computer 101, and an enabling module (“EM”) for execution on the server computer 130. In one or more embodiments of the invention the SM module and EM module comprise computer program code. However, the SM module and EM module may also be embodied into hardware devices configured to implement the logic of each module. Referring to
The public network comprises a transaction server 138 and the private network comprises a database server 140. The database server can only be accessed from the transaction server through the firewall. The database server is primarily used for storage of information and data files. Both the transaction server and the database server can comprise redundant backup servers to circumvent emergency interruptions in their operation. Referring to
Referring to the flow diagram in
Using cryptographic device 142, the EM module digitally signs the challenge using a private key associated with the EM module software (step 208). The SM module uses a corresponding public key of EM module to verify the digital signature of the server message (step 210). If the signature is valid (step 212), then the authentication process has been successfully completed (step 211), otherwise the user is prompted with an appropriate message (step 209). A user must typically register with server 130 only once and thereafter the user can use system 100 for secure storage and retrieval of data files.
Secure Data Save Process:
Referring to the flow diagrams in
After the secure communication link is established between the client computer 101 and the server computer 130, the SM module generates a one way hash function of the data that is to be stored. Then the SM module creates a client message file comprising the hash function, the data file name and an identification number of the SM module (step 228) and transmits the client message file to the server computer 130 (step 230). After processing the received client message file, the EM module at the server computer 130 generates a time stamp, a digital signature reflecting the digital time stamp and the hash function, and a key pair including an encryption key and a decryption key for encryption and decryption of the data file (step 232). The EM module then stores information comprising the user identification number, data file name, hash function, time stamp, digital signature, the encryption key and the decryption key as a data record in a server database (step 234). The data can be stored at server computer 130, or the data may be stored on another computer accessible via a computer network, or elsewhere. The EM module then generates a server message file including the data file name, time stamp, digital signature and the encryption key, and transmits the server message file to the client computer 101 (step 236).
Referring to the flow diagram in
Data Retrieve Process:
Referring to flow diagrams of
After the secure communication link is established between the client computer 101 and the server computer 100, the SM module creates a client message file comprising the data file name, the digital signature and the identification number (step 310) and transmits the client message file to server computer 140 (step 312). After processing the received client message file, the EM module retrieves the corresponding data record from the server database (step 314) for verification of the received digital signature associated with the data file name (step 316). If the verification fails, the communication terminates with an appropriate error message to the user to the user step (318).
After receiving the server message file, the SM module in the client computer 101 accesses the stored encrypted data file (step 328) and uses the decryption key in the server message file to decrypt data file (step 330). The data in the data file is then ready for further use. For each storage and retrieval operation a unique key pair is used and His key pair is not used in any subsequent storage or retrieval functions.
As such, according to the present invention, data can be stored or retrieved in a secure manner by using an authentication procedure utilizing a client-server architecture. Further, the integrity of the stored data, including the time of storage of the data, can be maintained by the use of cryptography. And, a time history of storage and retrieval of data operations can be made available for subsequent auditing purposes.
Although the present invention has been described in considerable detail, other versions are possible. Therefore, the appended claims should not be limited to the descriptions of the versions contained herein.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US4831555||6 Aug 1985||16 May 1989||Pitney Bowes Inc.||Unsecured postage applying system|
|US4900903||17 Oct 1988||13 Feb 1990||Wright Technologies, L.P.||Automated transaction system with insertable cards for transferring account data|
|US4900904||17 Oct 1988||13 Feb 1990||Wright Technologies, L.P.||Automated transaction system with insertable cards for downloading rate or program data|
|US4908770||30 Jun 1987||13 Mar 1990||Pitney Bowes, Inc.||Mail management system account validation and fallback operation|
|US5111030||12 Jun 1991||5 May 1992||Pitney Bowes Inc.||Postal charge accounting system|
|US5136647||2 Aug 1990||4 Aug 1992||Bell Communications Research, Inc.||Method for secure time-stamping of digital documents|
|US5150407||16 Dec 1991||22 Sep 1992||Chan Steve S C||Secured data storage devices|
|US5289540||26 Aug 1992||22 Feb 1994||Richard P. Jones||Computer file protection system|
|US5339361||4 Dec 1992||16 Aug 1994||Texas Instruments Incorporated||System and method for authenticating transmission and receipt of electronic information|
|US5454038||6 Dec 1993||26 Sep 1995||Pitney Bowes Inc.||Electronic data interchange postage evidencing system|
|US5455953||3 Nov 1993||3 Oct 1995||Wang Laboratories, Inc.||Authorization system for obtaining in single step both identification and access rights of client to server directly from encrypted authorization ticket|
|US5475757||7 Jun 1994||12 Dec 1995||At&T Corp.||Secure data transmission method|
|US5495533 *||29 Apr 1994||27 Feb 1996||International Business Machines Corporation||Personal key archive|
|US5615268||17 Jan 1995||25 Mar 1997||Document Authentication Systems, Inc.||System and method for electronic transmission storage and retrieval of authenticated documents|
|US5619571||1 Jun 1995||8 Apr 1997||Sandstrom; Brent B.||Method for securely storing electronic records|
|US5621795||27 Dec 1994||15 Apr 1997||Pitney Bowes Inc.||System and method for fault tolerant key management|
|US5623546||23 Jun 1995||22 Apr 1997||Motorola, Inc.||Encryption method and system for portable data|
|US5636280 *||31 Oct 1994||3 Jun 1997||Kelly; Tadhg||Dual key reflexive encryption security system|
|US5727156||10 Apr 1996||10 Mar 1998||Hotoffice Technologies, Inc.||Internet-based automatic publishing system|
|US5732137||3 Jan 1997||24 Mar 1998||Sun Microsystems, Inc.||Method and apparatus for secure remote authentication in a public network|
|US5732219||17 Mar 1995||24 Mar 1998||Vermeer Technologies, Inc.||Computer system and computer-implemented process for remote editing of computer files|
|US5748735||7 Jun 1996||5 May 1998||Bell Atlantic Network Services, Inc.||Securing E-mail communications and encrypted file storage using yaksha split private key asymmetric cryptography|
|US5748738||15 Sep 1995||5 May 1998||Document Authentication Systems, Inc.||System and method for electronic transmission, storage and retrieval of authenticated documents|
|US5751812||27 Aug 1996||12 May 1998||Bell Communications Research, Inc.||Re-initialization of an iterated hash function secure password system over an insecure network connection|
|US5757925||23 Jul 1996||26 May 1998||Faybishenko; Yaroslav||Secure platform independent cross-platform remote execution computer system and method|
|US5790977||6 Feb 1997||4 Aug 1998||Hewlett-Packard Company||Data acquisition from a remote instrument via the internet|
|US5825890||1 Jul 1997||20 Oct 1998||Netscape Communications Corporation||Secure socket layer application program apparatus and method|
|US5841871||18 Nov 1996||24 Nov 1998||Bull S.A.||Method for authenticating a user working in a distributed environment in the client/server mode|
|US6148404 *||27 May 1998||14 Nov 2000||Nihon Unisys, Ltd.||Authentication system using authentication information valid one-time|
|US6189096 *||6 Aug 1998||13 Feb 2001||Kyberpass Corporation||User authentification using a virtual private key|
|US6424718 *||11 Jun 1997||23 Jul 2002||International Business Machines Corporation||Data communications system using public key cryptography in a web environment|
|US6530023 *||4 Sep 1996||4 Mar 2003||Timesafe Trustcenter Gmbh||Method and device that validates time of an internal source using an external source|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7127434||8 Oct 2003||24 Oct 2006||Burningham Leonard W||Apparatus, system, and method for postage stamp generating|
|US7210142 *||31 Aug 2001||24 Apr 2007||Sony Corporation||Client-server bidirectional synchronization via browser plug in for an XM radio system|
|US7603547 *||8 Oct 2004||13 Oct 2009||Bea Systems, Inc.||Security control module|
|US7653930||26 Jan 2010||Bea Systems, Inc.||Method for role and resource policy management optimization|
|US7734595 *||7 Jan 2004||8 Jun 2010||Permabit Technology Corporation||Communicating information between clients of a data repository that have deposited identical data items|
|US7748027||8 Sep 2005||29 Jun 2010||Bea Systems, Inc.||System and method for dynamic data redaction|
|US7752205||4 Aug 2006||6 Jul 2010||Bea Systems, Inc.||Method and system for interacting with a virtual content repository|
|US7783670||26 Jan 2006||24 Aug 2010||Bea Systems, Inc.||Client server conversion for representing hierarchical data structures|
|US7818344||19 Oct 2010||Bea Systems, Inc.||System and method for providing nested types for content management|
|US7861289||19 Jun 2007||28 Dec 2010||Oracle International Corporation||Pagelets in adaptive tags in non-portal reverse proxy|
|US7861290||19 Jun 2007||28 Dec 2010||Oracle International Corporation||Non-invasive insertion of pagelets|
|US7865943||19 Jun 2007||4 Jan 2011||Oracle International Corporation||Credential vault encryption|
|US7886352||8 Feb 2011||Oracle International Corporation||Interstitial pages|
|US7904953||19 Jun 2007||8 Mar 2011||Bea Systems, Inc.||Pagelets|
|US7917537||22 May 2006||29 Mar 2011||Oracle International Corporation||System and method for providing link property types for content management|
|US7929702 *||19 Apr 2011||Research In Motion Limited||System and method for generating reproducible session keys|
|US7953734||31 May 2011||Oracle International Corporation||System and method for providing SPI extensions for content management system|
|US7966495 *||21 Jun 2011||Revinetix, Inc.||Conserving file system with backup and validation|
|US7992189||5 Aug 2009||2 Aug 2011||Oracle International Corporation||System and method for hierarchical role-based entitlements|
|US8086615||27 Jan 2006||27 Dec 2011||Oracle International Corporation||Security data redaction|
|US8136150||2 Nov 2010||13 Mar 2012||Oracle International Corporation||User role mapping in web applications|
|US8185752 *||27 Dec 2007||22 May 2012||Verizon Patent And Licensing Inc.||Method and system for providing data field encryption and storage|
|US8223205||17 Jul 2012||Waterfall Solutions Ltd.||Secure implementation of network-based sensors|
|US8316025||8 Apr 2011||20 Nov 2012||Oracle International Corporation||System and method for providing SPI extensions for content management system|
|US8347277 *||17 Aug 2007||1 Jan 2013||International Business Machines Corporation||Verifying that binary object file has been generated from source files|
|US8397084 *||12 Jun 2008||12 Mar 2013||Microsoft Corporation||Single instance storage of encrypted data|
|US8397283||1 Feb 2012||12 Mar 2013||Oracle International Corporation||User role mapping in web applications|
|US8401183 *||27 Dec 2007||19 Mar 2013||Verizon Patent And Licensing Inc.||Method and system for keying and securely storing data|
|US8402039 *||12 Feb 2010||19 Mar 2013||Brother Kogyo Kabushiki Kaisha||Information processing apparatus and computer readable medium having information processing program|
|US8463852||11 Jun 2013||Oracle International Corporation||Groupware portlets for integrating a portal with groupware systems|
|US8515996 *||19 May 2008||20 Aug 2013||Emulex Design & Manufacturing Corporation||Secure configuration of authentication servers|
|US8583943 *||13 Mar 2012||12 Nov 2013||Verizon Patent And Licensing Inc.||Method and system for providing data field encryption and storage|
|US8615798 *||29 Jun 2007||24 Dec 2013||International Business Machines Corporation||Optimizing a data deduplication system using client authentication information|
|US8635441||29 Aug 2007||21 Jan 2014||Waterfall Security Solutions Ltd.||Encryption-based control of network traffic|
|US8650038 *||17 Jul 2008||11 Feb 2014||William Howard Peirson, JR.||Systems and processes for obtaining and managing electronic signatures for real estate transaction documents|
|US8667284||13 Jan 2012||4 Mar 2014||Microsoft Corporation||Detection of invalid escrow keys|
|US8756436 *||16 Jan 2008||17 Jun 2014||Waterfall Security Solutions Ltd.||Secure archive|
|US8793302||4 Jun 2012||29 Jul 2014||Waterfall Security Solutions Ltd.||Secure implementation of network-based sensors|
|US8831966||14 Feb 2003||9 Sep 2014||Oracle International Corporation||Method for delegated administration|
|US8892602||19 Aug 2013||18 Nov 2014||Emulex Corporation||Secure configuration of authentication servers|
|US8996586||15 Feb 2007||31 Mar 2015||Callplex, Inc.||Virtual storage of portable media files|
|US9148412||16 Oct 2014||29 Sep 2015||Emulex Corporation||Secure configuration of authentication servers|
|US9268957||11 Dec 2007||23 Feb 2016||Waterfall Security Solutions Ltd.||Encryption-and decryption-enabled interfaces|
|US20030041245 *||29 May 2002||27 Feb 2003||Inventec Corporation||System and method of network file transmission|
|US20030043184 *||31 Aug 2001||6 Mar 2003||Sony Corporation.||Client-server bidirectional synchronization via browser plug in for an XM radio system|
|US20030091187 *||8 Oct 2002||15 May 2003||Fontijn Wilhelmus Fransiscus Johannes||Apparatus and method for reading or writing user data|
|US20040003059 *||26 Jun 2002||1 Jan 2004||Kitchin Duncan M.||Active key for wireless device configuration|
|US20040162733 *||14 Feb 2003||19 Aug 2004||Griffin Philip B.||Method for delegated administration|
|US20040162905 *||14 Feb 2003||19 Aug 2004||Griffin Philip B.||Method for role and resource policy management optimization|
|US20040167935 *||7 Jan 2004||26 Aug 2004||Permabit, Inc.||History preservation in a computer storage system|
|US20040213273 *||22 Apr 2004||28 Oct 2004||Kenneth Ma||Network attached storage device servicing audiovisual content|
|US20050081062 *||8 Oct 2004||14 Apr 2005||Bea Systems, Inc.||Distributed enterprise security system|
|US20050097350 *||8 Oct 2004||5 May 2005||Bea Systems, Inc.||Security control module|
|US20050102401 *||8 Oct 2004||12 May 2005||Bea Systems, Inc.||Distributed enterprise security system for a resource hierarchy|
|US20050102535 *||8 Oct 2004||12 May 2005||Bea Systems, Inc.||Distributed security system with security service providers|
|US20050188295 *||25 Feb 2004||25 Aug 2005||Loren Konkus||Systems and methods for an extensible administration tool|
|US20050251851 *||8 Oct 2004||10 Nov 2005||Bea Systems, Inc.||Configuration of a distributed security system|
|US20050254658 *||16 Feb 2005||17 Nov 2005||Research In Motion Limited||System and method for generating reproducible session keys|
|US20050256899 *||18 Nov 2004||17 Nov 2005||Bea Systems, Inc.||System and method for representing hierarchical data structures|
|US20050256906 *||13 May 2005||17 Nov 2005||Bea Systems, Inc.||Interface for portal and webserver administration-efficient updates|
|US20050283662 *||21 Jun 2004||22 Dec 2005||Li Yi Q||Secure data backup and recovery|
|US20060123026 *||26 Jan 2006||8 Jun 2006||Bea Systems, Inc.||Client server conversion for representing hierarchical data structures|
|US20060259587 *||21 Mar 2006||16 Nov 2006||Ackerman Steve F||Conserving file system with backup and validation|
|US20060259954 *||8 Sep 2005||16 Nov 2006||Bea Systems, Inc.||System and method for dynamic data redaction|
|US20070027781 *||12 Sep 2006||1 Feb 2007||Krishanu Seal||Delivery of digital products over a network|
|US20070055893 *||24 Aug 2005||8 Mar 2007||Mci, Inc.||Method and system for providing data field encryption and storage|
|US20070198463 *||15 Feb 2007||23 Aug 2007||Callplex, Inc.||Virtual storage of portable media files|
|US20080077809 *||19 Jun 2007||27 Mar 2008||Bea Systems, Inc.||Credential Vault Encryption|
|US20080077980 *||19 Jun 2007||27 Mar 2008||Bea Systems, Inc.||Pagelets|
|US20080077981 *||19 Jun 2007||27 Mar 2008||Bea Systems, Inc.||Pagelets in adaptive tags in non-portal reverse proxy|
|US20080077982 *||19 Jun 2007||27 Mar 2008||Bea Systems, Inc.||Credential vault encryption|
|US20080077983 *||19 Jun 2007||27 Mar 2008||Bea Systems, Inc.||Non-invasive insertion of pagelets|
|US20080250388 *||19 Jun 2007||9 Oct 2008||Bea Systems, Inc.||Pagelets in adaptive tags|
|US20080313728 *||19 Jun 2007||18 Dec 2008||Bea Systems, Inc.||Interstitial pages|
|US20080320600 *||21 Jun 2007||25 Dec 2008||Matthew Pandiscia||Secure document management system and apparatus|
|US20090007261 *||29 Jun 2007||1 Jan 2009||Smith Mark A||Receiving data in a data store in a server computer system|
|US20090025087 *||17 Jul 2008||22 Jan 2009||Peirson Jr William Howard||Systems and processes for obtaining and managing electronic signatures for real estate transaction documents|
|US20090049430 *||17 Aug 2007||19 Feb 2009||Pai Ramachandra N||Verifying that binary object file has been generated from source files|
|US20090094091 *||5 Oct 2007||9 Apr 2009||Xerox Corporation||Service call data selection and delivery method and system|
|US20090113500 *||24 Oct 2007||30 Apr 2009||Gita Technologies Ltd.||Secure implementation of network-based sensors|
|US20090169010 *||27 Dec 2007||2 Jul 2009||Verizon Business Network Services Inc.||Method and system for providing data field encryption and storage|
|US20090169016 *||27 Dec 2007||2 Jul 2009||Verizon Business Network Services Inc.||Method and system for keying and securely storing data|
|US20090287732 *||19 Nov 2009||Emulex Design & Manufacturing Corporation||Secure configuration of authentication servers|
|US20090313483 *||12 Jun 2008||17 Dec 2009||Microsoft Corporation||Single Instance Storage of Encrypted Data|
|US20090319773 *||29 Aug 2007||24 Dec 2009||Waterfall Security Solutions Ltd||Encryption-based control of network traffic|
|US20090328183 *||28 Dec 2006||31 Dec 2009||Waterfall Solutions Ltd.||One way secure link|
|US20100030827 *||4 Feb 2010||Callplex, Inc.||Distributed virtual storage of portable media files|
|US20100205188 *||12 Aug 2010||Brother Kogyo Kabushiki Kaisha||Information processing apparatus and computer readable medium having information processing program|
|US20100275039 *||16 Jan 2008||28 Oct 2010||Waterfall Security Solutions Ltd||Secure archive|
|US20100278339 *||11 Dec 2007||4 Nov 2010||Human Interface Security Ltd||Encryption- and decryption-enabled interfaces|
|US20110047611 *||24 Feb 2011||Bea Systems, Inc.||User Role Mapping in Web Applications|
|US20120173887 *||13 Mar 2012||5 Jul 2012||Verizon Business Nework Services, Inc.||Method and system for providing data field encryption and storage|
|US20140122891 *||6 Jan 2014||1 May 2014||Cleversafe, Inc.||Generating a secure signature utilizing a plurality of key shares|
|CN101136963B||1 Sep 2006||30 Nov 2011||鸿富锦精密工业（深圳）有限公司||利用手持通讯装置签章的系统及方法|
|WO2006007329A2 *||9 Jun 2005||19 Jan 2006||Motorola, Inc.||Secure data backup and recovery|
|WO2006007329A3 *||9 Jun 2005||26 May 2006||Motorola Inc||Secure data backup and recovery|
|WO2009012388A1 *||17 Jul 2008||22 Jan 2009||Peirson William Howard Jr||Systems and processes for obtaining and managing electronic signatures for real estate transaction documents|
|WO2013106492A1 *||10 Jan 2013||18 Jul 2013||Microsoft Corporation||Detection of invalid escrow keys|
|U.S. Classification||726/26, 713/171, 713/176, 713/175, 713/150, 713/155, 726/2, 713/169, 713/178, 713/161, 713/170|
|International Classification||H04L9/30, H04L9/08, G06F21/00|
|Cooperative Classification||H04L9/0838, H04L9/3247, G06F2221/2101, G06F21/6209, H04L9/3297, G06F21/62|
|European Classification||G06F21/62A, G06F21/62, H04L9/08|
|6 Sep 2000||AS||Assignment|
Owner name: STAMPS.COM, CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ANANDA, MOHAN;REEL/FRAME:011085/0575
Effective date: 20000822
|11 Feb 2009||FPAY||Fee payment|
Year of fee payment: 4
|19 Feb 2013||FPAY||Fee payment|
Year of fee payment: 8
|25 Nov 2015||AS||Assignment|
Owner name: WELLS FARGO BANK, NATIONAL ASSOCIATION, AS ADMINIS
Free format text: SECURITY INTEREST;ASSIGNOR:STAMPS.COM INC.;REEL/FRAME:037159/0492
Effective date: 20151118