System and method to enable PKI- and PMI-based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means—added

Abstract

A central server configured with an Attribute Authority (“AA”) acting as a Trusted Third Party mediating service provider and using X.509-compatible PKI and PMI, VPN technology, device-side thin client applications, security hardware (HSM, Network), cloud hosting, authentication, Active Directory and other solutions. This ecosystem results in real time management of credentials, identity profiles, communication lines, and keys. It is not centrally managed, rather distributes rights to users. Using its Inviter-Invitee protocol suite, Inviters vouch for the identity of Invitees who successfully complete the protocol establishing communication lines. Users establish and respond to authorization requests and other real-time verifications pertaining to accessing each communication line (not end point) and sharing encrypted digital files. These are auditable, brokered, trusted-relationships where such relationships / digital agreements can each stand-alone (for privacy) or can leverage build-up of identity confidence levels across relationships. The service is agnostic to how encrypted user content is transported or stored.

Description

CROSS REFERENCE TO RELATED APPLICATIONS[0001]This application claims priority under 35 U.S.C. §119(e) from U.S. Provisional Patent Application No. 61 / 792,927, filed Mar. 15, 2013, titled “SYSTEM AND METHOD TO ENABLE PM- AND PMI-BASED DISTRIBUTED LOCKING OF CONTENT AND DISTRIBUTED UNLOCKING OF PROTECTED CONTENT AND / OR SCORING OF USERS AND / OR SCORING OF END-ENTITY ACCESS MEANS,” which is incorporated herein by reference and for all purposes.[0002]This application is a continuation-in-part and claims priority under 35 U.S.C. §120 from U.S. patent application Ser. No. 13 / 481,553, tilted “METHODS AND APPARATUS FOR PREVENTING CRIMEWARE ATTACKS,” filed May 25, 2012, by Kravitz, et al, which claimed priority under 35 U.S.C. §119(e) from U.S. Provisional Patent Application No. 61 / 650,866, filed May 23, 2012, entitled “METHOD AND APPARATUS FOR A CYBERSECURITY ECOSYSTEM,” by Kravitz et al., which is incorporated herein by reference and for all purposes and which also claimed priority under 35 ...

AI Technical Summary

Benefits of technology

[0020]To make the Security Ecosystem cryptographically sound, cryptographically based digital signing was built in. Therefore the Security Ecosystem may be able to also offer Digital Signatures as a feature. Such an integrated Digital Signature capability may address a need of enterprise businesses for non-repudiable digital signing capabilities both with individuals within and outside the enterprise.

[0022]For Consumers the Security Ecosystem may provide a tool so that consumers may communicate privately, securely and with confidence not only with their authenticated friends, family and associates, but also with their user-created groups (e.g., schools, teams, clubs, political organizations, etc.)

Problems solved by technology

In establishing and achieving secure communications between individuals and other individuals and / or businesses and / or with other businesses, authentication of identities of the other parties has been a challenge.

In the field of secure communications using public key cryptography, authenticating the pubic key of a remote party has been a challenge.

A third party has been know to impersonate the intended party and provide a public key purported to be from the desired remote party, but it is not, thus security can be compromised.

While helpful, such tools are cumbersome and less than absolute.

Symmetric key cryptography presents challenges not only in protecting the key in its owner's possession, but more critically in transmitting the key securely to a third party to whom the owner of the asset would like to provide access to the asset.

This is can be difficult to accomplish.

As a result the addition of new users, the establishment of user relationships, and the efficient flow of data between users are slowed by such a centrally managed bottleneck.

Additionally, it is difficult for businesses to efficiently manage (with good security of data and keys) the encryption of digital assets so that they are protected both in transit and at rest.

Such limitations result in a business' difficulty or inability to securely transmit a digital asset to such a third party.

For example, email is widely considered insecure for such uses.

Such mail / shipping options are both expensive and inconvenient for a business to provide.

The result of these limitations is that many businesses require their off-network third parties to login to a secure website and from there, then can access and download desired digital assets that are stored behind the business' firewall.

Such practices are not favorable for the third party users (e.g., customers).

Customers should maintain multiple unique, secure logins for each such business visited and they generally take the time and trouble to manually retrieve, download and save such digital assets.

It is noteworthy that once downloaded from such a business' secure website and saved to the third party user's computer, the digital assets are no longer secure.

They are typically save in plain text and thus are not secure at rest.

Images