US20070180240A1 - Data security system for a database - Google Patents
Data security system for a database Download PDFInfo
- Publication number
- US20070180240A1 US20070180240A1 US11/603,967 US60396706A US2007180240A1 US 20070180240 A1 US20070180240 A1 US 20070180240A1 US 60396706 A US60396706 A US 60396706A US 2007180240 A1 US2007180240 A1 US 2007180240A1
- Authority
- US
- United States
- Prior art keywords
- data
- information
- tamper
- data element
- cryptographic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04K—SECRET COMMUNICATION; JAMMING OF COMMUNICATION
- H04K1/00—Secret communication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2211/00—Indexing scheme relating to details of data-processing equipment not covered by groups G06F3/00 - G06F13/00
- G06F2211/007—Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2149—Restricted operating environment
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
- Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10S707/00—Data processing: database and file management or data structures
- Y10S707/99931—Database or file accessing
- Y10S707/99939—Privileged access
Definitions
- the present invention relates to the technical field of computer-aided information management, and concerns more specifically a method and an apparatus for data processing for accomplishing increased protection against unauthorized processing of data
- WO95/15628 which has the same owner as the present application, discloses a method for storing data, which results in increased possibilities of linking and matching with no risk of reduced integrity.
- the method which is illustrated schematically in FIGS. 1 and 2 on the enclosed drawing sheets, concerns storing of information comprising on the one hand an identifying piece of information or original identity OID, for instance personal code numbers Pcn and, on the other hand, descriptive information DI.
- OID+DI is stored as records P in a database O-DB according to the following principle:
- Step 1 OID (Pcn) is encrypted by means of a first, preferably non-reversible algorithm ALG 1 to an update identity UID;
- Step 2 UID is encrypted by means of a second, reversible algorithm ALG 2 to a storage identity SID;
- Step 3 SID and DI are stored as a record P in the database O-DB, SID serving as a record identifier;
- Step 4 At predetermined times, an alteration of SID in all or selected records P is accomplished by SID of these records being decrypted by means of a decrypting algorithm ALG 3 to UID, whereupon UID is encrypted by means of a modified second, reversible algorithm or ALG 2 ′ to a new storage identity SID′, which is introduced as a new record identifier in the associated record P as replacement for previous SID.
- ALG 3 decrypting algorithm
- ALG 2 ′ a modified second, reversible algorithm
- PTY is an abbreviation of the principal of PROTEGRITY which stands for “Protection and Integrity”.
- Shell protections are today the predominant method of protection.
- Shell protection comprises on the one hand the external security (premises) and, on the other hand, an authorization check system ACS with user's passwords for controlling the access.
- ACS is used as shell protection for main frames, client/server systems and PC, but it does not give full protection and the information at issue can often relatively easily be subjected to unauthorized access.
- This protection has been found more “sensitive” information is be stored, which must permit managing via distribution, storing and processing in dynamically changing environments, especially local distribution to personal computers. Concurrently with this development, the limits of the system will be more and more indistinct and the effect afforded by a shell protection deteriorates.
- the object of the present invention is to provide an improved method for processing information, by means of which it is possible to increase the protection against unauthorized access to sensitive information.
- a special object of the invention is to provide a technique for data processing or managing, which makes it possible for the person responsible for the system, the management of the organization etc. to easily establish and continuously adapt the user's possibility of processing stored information that is to be protected.
- a further object of the invention is to provide a technique for data processing which offers protection against attempts at unauthorized data processing by means of non-accepted software.
- One more object of the invention is to provide a technique for data processing according to the above-mentioned objects, which can be used in combination with the above-described PTY principle, for providing a safety system with an extremely high level of protection.
- the invention provides a method for processing of data that is to be protected, comprising the measure of storing the data as encrypted data element values of records in a first database (O-DB), each data element value being linked to a corresponding data element type.
- O-DB first database
- IAM-DB a data element protection catalogue, which for each individual data element type contains one or more protection attributes stating processing rules for data element values, which in the first database are linked to the individual data element type,
- each user-initiated measure aiming at processing of a given data element value in the first database, initially producing a compelling calling to the data element protection catalogue for collecting the protection attribute/attributes associated with the corresponding data element type, and compellingly controlling the processing of the given data element value in conformity with the collected protection attribute/attributes.
- “Record” concerns a number of data element values which belong together and which are linked to the respective data element types, optionally also including a record identifier, by means of which the record can be identified.
- the inventive method offers a new type of protection, which differs essentially from the prior-art shell protection and which works on the cell or data element level.
- Each data element type used in the records in the first database is thus associated with one or more protection attributes, which are stored in a separate data element protection catalogue and which protection attributes state rules of how to process the corresponding data element values.
- the calling to the data element protection catalogue is required, or in other words compelling.
- a user who for instance wants to read a certain data element value in a given record in the first database, by his attempt to access to the element value automatically produces a system calling to the data element protection catalogue in the second database for collecting the protection attributes associated with the corresponding data element types.
- the continued processing procedure (reading of data element value) of the system is also controlled compellingly in accordance with the collected protection attribute/attributes applying to the corresponding data element types.
- data element protection catalogue and the use thereof according to the invention must not be confused with the known term “active dictionary”, which means that, in addition to an operative database, there is a special table indicating different definitions or choices for data element values in the operative database, for instance that a data element value “yellow” in terms of definition means a color code which is within a numeric interval stated in such a reference table.
- the processing rules stated by the protection attributes are inaccessible to the user, and the read or collected protection attributes are preferably used merely internally by the system for controlling the processing.
- a given user who, for instance, wants to read information stored in the database regarding a certain individual, thus need not at all be aware of the fact that certain protection attributes have been activated and resulted in certain, sensitive information for this individual being excluded from the information that is made available on e.g. a display.
- Each user-initiated measure aiming at processing of data element values thus involves on the one hand a compelling calling to the data element protection catalogue and, on the other hand, a continued processing which is compellingly subjected to those processing rules that are stated by the protection attributes, and this may thus be accomplished without the user obtaining information on what rules control the processing at issue, and especially without the user having any possibility of having access to the rules.
- the person responsible for the system or an equivalent person may easily determine, for each individual data element type, the processing rules applying to data element values associated with the individual data element type and thus easily maintain a high and clear safety quality in the system.
- the individual data element (date element type) and not the entire register that becomes the controlling unit for the way in which the organization, operator etc. responsible for the system has determined the level of quality, responsibility and safety regarding the management of information.
- the data element protection catalogue is preferably encrypted so as to prevent unauthorized access thereto.
- the present invention provides the following possibilities, which, however, are to be considered an incomplete, exemplifying list:
- the above-described PTY storing method is used for encryption of all data that is to be encrypted in both the database (i.e. the data element values) and the data element protection catalogue (i.e. the protection attributes).
- the data element protection catalogue i.e. the protection attributes
- each record has a record identifier (corresponding to SID) above)
- the record identifier is protected by means of PTY.
- a floating alteration of the record identifiers in both the operative database and the data element protection catalogue can be made at desired intervals and at randomly selected times, in accordance with the above-described PTY principle.
- especially the encapsulated processor which is used for the PTY encryption can also be used for implementation of the callings to the data element protection catalogue and the procedure for processing according to the collected protection attributes.
- FIG. 1 (prior art) schematically shows the principle of storing of data information according to the PTY principle in WO95/15628.
- FIG. 2 (prior art) schematically shows the principle of producing floating storing identities according to the PTY principle in WO95/15628.
- FIG. 3 schematically shows a computer system for implementing the method according to the invention.
- FIG. 4 schematically shows the principle of data processing according to the invention with compelling callings to a data element protection catalogue.
- FIG. 5 shows an example of a display image for determining of protection attributes in the data element protection catalogue.
- IAM Information Assets Manager
- FIG. 3 schematically illustrates a data managing system, in which the present invention is implemented and in which the following databases are included for storing information, in this example person-related information:
- the data system in FIG. 3 further comprises a hardware component 10 , a control module 20 (IAM-API), and a program module 30 (PTY-API).
- IAM-API control module 20
- PTY-API program module 30
- the hardware component 10 acts as a distributed processor of its own in a computer. It has an encapsulation that makes it completely tamper-proof, which means that monitoring by so-called trace tools will not be possible.
- the hardware component 10 can as an independent unit perform at least the following functions:
- the control module 20 controls the handling of the types of data protection that the system can supply.
- the control module carries out the processing requested via API (Application Program Interface) programming interface.
- API Application Program Interface
- the program module (PTY-API) 30 handles the dialogue between the application 40 involved (including ACS) and the hardware component 10 . This module may further log events and control sorting out/removal of data from the operative database O-DB.
- FIG. 4 illustrates the same four databases (P-DB, O-DB, A-DB, IAM-DB) as in FIG. 3 and which schematically illustrates how the processing of individual data elements are, according to the invention, controlled according to the rules that are stated by protection attributes in the data element protection catalogue, which is stored in the database IAM-DB.
- the data that is to be stored concerns in this example a certain individual and contains: (1) generally accessible data such as name and address, (2) identifying information, such as personal code number (Pcn), and (3) descriptive information (DI).
- the generally accessible data name and address is stored together with personal code number (Pcn) in the open database P-DB, said storage being performable as plain text since this information is of the type that is generally accessible.
- Type indicates the type of function as follows:
- Results indicate a unique function value for a given function
- Step 3 Production of encrypted data element values DV:
- the descriptive information DI associated with the original identity OID is converted into one or more encrypted data element values DV linked to a data element type DT each.
- the encryption takes place as described below with a reversible encryption function F KR , which like the algorithms ALG 1 and ALG 2 above is also produced at random by the hardware component 10 .
- the invention is distinguished by a compelling calling here being sent to the data element protection catalogue in the database IAM-DB for automatic collection of the protection attribute which is linked to the data element type at issue and which indicates “strength” or degree with which the encryption of the descriptive data is to be performed so as to generate the data element value DV.
- the table which in FIG. 4 is shown below the database IAMDB, symbolizes an exemplifying content of the data element protection catalogue, here designated DPC.
- Step 4 Storing of records in the operative database O-DB:
- the encrypted storage identity SID according to step 2 in combination with the corresponding encrypted data element value or data element values DV according step 3 are stored as a record in the operative database O-DB.
- a stored information record P has the following general appearance: Descript. information in the form of encrypted data element values Storage identity (SID) DV1 DV2 DV3 DV4
- the original identity OID is encrypted according to the PTY principle in two steps, of which the first is non-reversible and the second is reversible.
- the descriptive information DI along with a storage identity SID that never can be linked to the original identity OID, as well as to create “floating”, i.e. which change over time, storage identities SID while retaining the possibility of locating, for a specific original identity OID, the associated descriptive information DI stored.
- the descriptive data DI is stored in accordance with protection attributes linked to each individual data element. This results in a still higher level of protection and a high degree of flexibility as to the setting up of rules, and continuous adaptation thereof, of how sensitive data is allowed to be used and can be used, down to the data element level.
- the data element protection catalogue DPC is preferably stored in IAM-DB in encrypted form in accordance with the PTY principle, in which case for instance the data element types correspond to the above storage identity and the protection attributes correspond to the descriptive information or data element values above, as schematically illustrated in FIG. 4 . This efficiently prevents every attempt at circumventing the data element protection by unauthorized access and interpretation of the content of the data element protection catalogue.
- PTY can thus have the following functions:
- a particularly interesting protection attribute is “protected programs”.
- the use of this data element protection attribute means that the data system may offer a new type of protection, which is here called “functionality protection and which means that only accepted or certified programs are allowed to be used and can be used in the system in the processing of data. It should be noted that this type of protection is still, according to the invention, on the data element level.
- Func 2 in the data element protection catalogue DPC in FIG. 4 corresponds to this protection attribute and that data elements of the data element type DTI and DT 2 , respectively, are only allowed to be processed with the accepted applications or programs P 1 and P 2 , respectively. Unauthorized handling of the corresponding data elements by means of, for instance, a different program P 3 , or a modified version P 1 ′ of P 1 , should be prevented.
- protection attribute in the data element protection catalogue data identifying PI and P 2 is therefore stored.
- an encryptographic check sum P 1 * and P 2 *, respectively, is created, in a manner known per se, based on every accepted program P 1 and P 2 , respectively.
- check sums may be considered to constitute a unique fingerprint of the respective accepted programs, and these fingerprints can be stored as protection catalogue as illustrated schematically in FIG. 4 . It should however be noted that such check sums for accepted programs can optionally be stored in a data element protection attributes in the data element protection catalogue of their own for registering of accepted programs, separately from the data element protection catalogue with protection attributes for encryption strength.
- the system in connection with a user-initiated measure aiming at processing of a given data element, for instance in-putting a new data element value in a certain record, need not, carry out a complete examination of all programs accepted in the system. If, for instance, the user tries to use a program P 3 for inputting in the operative database O-DB a new data element value, a compelling calling is sent to the data element protection catalogue in connection with the corresponding data element type, for instance DTI. The associated protection attribute P 1 * is then collected from the data element protection catalogue, which means that such a data element value is only allowed to be stored by means of the program P 1 . The attempt at registering the data element value by means of the program P 3 would therefore fail.
- “Logging” or “traceability” is another type of protection which according to the invention can be linked to a data element type in the data element protection catalogue. If this protection is activated for a certain data element type, each processing of the corresponding data element values in the operative database O-DB will automatically and compellingly result in relevant information on the processing (“user”, “date”, “record”, “user pro-gram” etc.) being logged in a suitable manner, so that based on the log, it is possible to investigate after-wards who has processed the data element values at issue, when, by means of which program etc.
- the following steps are carried out, which specifically also comprise a compelling calling to the data element protection catalogue and “unpacking” of the data which is controlled automatically and compellingly by collected protection attributes.
- the carrying out of this decryption of the data element value requires that the encryption-controlling protection attribute of the data element is first collected by the system from the data element protection catalogue DC, i.e. the attribute indicating with which strength or at which level the data element value DV stored in O-DB has been encrypted.
- the data element protection catalogue DC i.e. the attribute indicating with which strength or at which level the data element value DV stored in O-DB has been encrypted.
- a compelling calling thus is sent to the data element protection catalogue DC for collecting information which is necessary for carrying out the processing, in this case the unpacking.
- the decoding key can be stored in a storage position separate from the first and the second database.
- FIG. 5 shows an example of a user interface in the form of a dialogue box, by means of which a person responsible for IAM, i.e. a person responsible for security, may read and/or alter the protection attributes stated in the data element protection catalogue.
- the data element types “Housing allowance” and “Social allowance” have both been provided with protection attributes concerning encryption, sorting out, logging and owner.
- registration of authorized users and protected programs linked to the data element type “Social allowance” has taken place in submenus.
Abstract
A method and an apparatus for processing data provides protection for the data. The data is stored as encrypted data element values (DV) in records (P) in a first database (O-DB), each data element value being linked to a corresponding data element type (DT). In a second database (IAM-DB), a data element protection catalogue (DC) is stored, which for each individual data element type (DT) contains one or more protection attributes stating processing rules for data element values (DV), which in the first database (O-DB) are linked to the individual data element type (DT). In each user-initiated measure which aims at processing a given data element value (DV) in the first database (O-DB), a calling is initially sent to the data element protection catalogue for collecting the protection attribute/attributes associated with the corresponding data element types. The user's processing of the given data element value is controlled in conformity with the collected protection attribute/attributes.
Description
- This is a continuation of U.S. patent application Ser. No. 09/840,188, filed on Apr. 24, 2001, which is a continuation of U.S. patent application Ser. No. 09/027,585, filed on Feb. 23, 1998, now U.S. Pat. No. 6,321,201, which is a national phase filing of International Application No. PCT/SE97/01089, filed on Jun. 18, 1997. The entire contents of each of these is incorporated by reference herein.
- The present invention relates to the technical field of computer-aided information management, and concerns more specifically a method and an apparatus for data processing for accomplishing increased protection against unauthorized processing of data
- In the field of computer-aided information management, it is strongly required that the protection against unauthorized access of data registers be increased, especially against violation of the individual's personal registers, i.e. registers containing information on individuals. In particular, there are regulations restricting and prohibiting the linking and matching of personal registers. Also in other fields, such as industry, defense, banking, insurance, etc, improved protection is desired against unauthorized access to the tools, databases, applications etc. that are used for administration and storing of sensitive information.
- WO95/15628, which has the same owner as the present application, discloses a method for storing data, which results in increased possibilities of linking and matching with no risk of reduced integrity. The method, which is illustrated schematically in
FIGS. 1 and 2 on the enclosed drawing sheets, concerns storing of information comprising on the one hand an identifying piece of information or original identity OID, for instance personal code numbers Pcn and, on the other hand, descriptive information DI. The information OID+DI is stored as records P in a database O-DB according to the following principle: -
Step 1 OID (Pcn) is encrypted by means of a first, preferably non-reversible algorithm ALG1 to an update identity UID; - Step 2 UID is encrypted by means of a second, reversible algorithm ALG2 to a storage identity SID;
-
Step 3 SID and DI are stored as a record P in the database O-DB, SID serving as a record identifier; -
Step 4 At predetermined times, an alteration of SID in all or selected records P is accomplished by SID of these records being decrypted by means of a decrypting algorithm ALG3 to UID, whereupon UID is encrypted by means of a modified second, reversible algorithm or ALG2′ to a new storage identity SID′, which is introduced as a new record identifier in the associated record P as replacement for previous SID. This results in a security-enhancing “floating” alteration of SID of the records. - For a closer description of the details and advantages of this encrypting and storing method, reference is made to WO95/15628, which is to be considered to constitute part of the present description. The storing principle according to steps 1-4 above is herein referred to as PTY, which is an abbreviation of the principal of PROTEGRITY which stands for “Protection and Integrity”.
- A detailed technical description of PTY is also supplied in the document “PROTEGRITY (ASIS) Study 2”, Ver. 1.2, 1 Mar. 1996, by Leif Jonson. Also this document is to be considered to constitute part of the present description.
- In the technical field at issue, so-called shell protections are today the predominant method of protection. Shell protection comprises on the one hand the external security (premises) and, on the other hand, an authorization check system ACS with user's passwords for controlling the access. ACS is used as shell protection for main frames, client/server systems and PC, but it does not give full protection and the information at issue can often relatively easily be subjected to unauthorized access. This protection has been found more “sensitive” information is be stored, which must permit managing via distribution, storing and processing in dynamically changing environments, especially local distribution to personal computers. Concurrently with this development, the limits of the system will be more and more indistinct and the effect afforded by a shell protection deteriorates.
- In view of that stated above, the object of the present invention is to provide an improved method for processing information, by means of which it is possible to increase the protection against unauthorized access to sensitive information.
- A special object of the invention is to provide a technique for data processing or managing, which makes it possible for the person responsible for the system, the management of the organization etc. to easily establish and continuously adapt the user's possibility of processing stored information that is to be protected.
- A further object of the invention is to provide a technique for data processing which offers protection against attempts at unauthorized data processing by means of non-accepted software.
- One more object of the invention is to provide a technique for data processing according to the above-mentioned objects, which can be used in combination with the above-described PTY principle, for providing a safety system with an extremely high level of protection.
- Thus, the invention provides a method for processing of data that is to be protected, comprising the measure of storing the data as encrypted data element values of records in a first database (O-DB), each data element value being linked to a corresponding data element type.
- The inventive method is characterised by the following further measures:
- storing in a second database (IAM-DB) a data element protection catalogue, which for each individual data element type contains one or more protection attributes stating processing rules for data element values, which in the first database are linked to the individual data element type,
- in each user-initiated measure aiming at processing of a given data element value in the first database, initially producing a compelling calling to the data element protection catalogue for collecting the protection attribute/attributes associated with the corresponding data element type, and compellingly controlling the processing of the given data element value in conformity with the collected protection attribute/attributes.
- In the present application the following definitions are used:
-
- “Processing” may include all kinds of measures which mean any form of reading, printing, altering, coding, moving, copying etc. of data that is to be protected by the inventive method.
- “Data element type” identifies a specific category of data. For example, identification information (name and address) could be particular data element type. Whereas, some descriptive information (social allowance) could be a different data element type, and other descriptive information could be yet another different data element type”.
- “Data element value” concerns a value which in a given record specifies a data element type.
- “Record” concerns a number of data element values which belong together and which are linked to the respective data element types, optionally also including a record identifier, by means of which the record can be identified. Example:
DATA ELEMENT TYPE RECORD ID SOCIAL ALLOWANCE CAR XXXX XXXXX encrypted data encrypted data element value element value YYYY YYYYY encrypted data encrypted data element value element value -
- “Protection attribute indicating rules of processing” may concern:
- data stored in the data element protection catalogue and providing complete information on the rule or rules applying to the processing of the corresponding data element, and/or
- data stored in the data element protection catalogue and requiring additional callings to information stored in some other place, which, optionally in combination with the protection attributes, states the processing rules involved.
- “Collection of protection attributes” may concern:
- collection of the protection attributes in the form as stored in the data element protection catalogue, and/or
- collection of data recovered from the protection attributes, for instance by decryption thereof.
- “Encryption” may concern any form of encryption, tricryption, conversion of coding of plain-text data to non-interpretable (encrypted) data, and is especially to concern also methods of conversion including hashing.
- “Protection attribute indicating rules of processing” may concern:
- The inventive method offers a new type of protection, which differs essentially from the prior-art shell protection and which works on the cell or data element level. Each data element type used in the records in the first database is thus associated with one or more protection attributes, which are stored in a separate data element protection catalogue and which protection attributes state rules of how to process the corresponding data element values. It should be particularly noted that the calling to the data element protection catalogue is required, or in other words compelling. This means that in a system, in which the method according to the invention is implemented, a user, who for instance wants to read a certain data element value in a given record in the first database, by his attempt to access to the element value automatically produces a system calling to the data element protection catalogue in the second database for collecting the protection attributes associated with the corresponding data element types. The continued processing procedure (reading of data element value) of the system is also controlled compellingly in accordance with the collected protection attribute/attributes applying to the corresponding data element types.
- The term “data element protection catalogue” and the use thereof according to the invention must not be confused with the known term “active dictionary”, which means that, in addition to an operative database, there is a special table indicating different definitions or choices for data element values in the operative database, for instance that a data element value “yellow” in terms of definition means a color code which is within a numeric interval stated in such a reference table.
- Preferably, the processing rules stated by the protection attributes are inaccessible to the user, and the read or collected protection attributes are preferably used merely internally by the system for controlling the processing. A given user, who, for instance, wants to read information stored in the database regarding a certain individual, thus need not at all be aware of the fact that certain protection attributes have been activated and resulted in certain, sensitive information for this individual being excluded from the information that is made available on e.g. a display. Each user-initiated measure aiming at processing of data element values thus involves on the one hand a compelling calling to the data element protection catalogue and, on the other hand, a continued processing which is compellingly subjected to those processing rules that are stated by the protection attributes, and this may thus be accomplished without the user obtaining information on what rules control the processing at issue, and especially without the user having any possibility of having access to the rules.
- By altering, adding and removing protection attributes in the data element protection catalogue, the person responsible for the system or an equivalent person may easily determine, for each individual data element type, the processing rules applying to data element values associated with the individual data element type and thus easily maintain a high and clear safety quality in the system.
- According to the invention, it is thus the individual data element (date element type) and not the entire register that becomes the controlling unit for the way in which the organization, operator etc. responsible for the system has determined the level of quality, responsibility and safety regarding the management of information.
- To obtain a high level of protection, the data element protection catalogue is preferably encrypted so as to prevent unauthorized access thereto.
- As preferred protection attributes, the present invention provides the following possibilities, which, however, are to be considered an incomplete, exemplifying list:
- 1. Statement of what “strength” or “level” (for instance none, 1, 2 . . . ) of encryption is to be used for storing the corresponding data element values in the database. Different data element values within one and the same record may thus be encrypted with mutually different strength.
- 2. Statement of what “strength” or “level” (for in-stance none, 1, 2, . . . ) of encryption is to be used for the corresponding data element values if these are to be transmitted on a net.
- 3. Statement of program and/or versions of program that are authorised to be used for processing the corresponding data element values.
- 4. Statement of “owner” of the data element type. Different data element values within one and the same record can thus have different owners.
- 5. Statement of sorting-out rules for the corresponding data element values, for instance, statement of method and time for automatic removal of the corresponding data element values from the database.
- 6. Statement whether automatic logging is to be made when processing the corresponding data element values.
- According to a specially preferred embodiment of the invention, the above-described PTY storing method is used for encryption of all data that is to be encrypted in both the database (i.e. the data element values) and the data element protection catalogue (i.e. the protection attributes). In the normal case where each record has a record identifier (corresponding to SID) above), preferably also the record identifier is protected by means of PTY. Specifically, a floating alteration of the record identifiers in both the operative database and the data element protection catalogue can be made at desired intervals and at randomly selected times, in accordance with the above-described PTY principle. In the preferred embodiment, especially the encapsulated processor which is used for the PTY encryption can also be used for implementation of the callings to the data element protection catalogue and the procedure for processing according to the collected protection attributes.
- The invention will now be explained in more detail with reference to the accompanying drawings, which schematically illustrate the inventive principle implemented in an exemplifying data system.
-
FIG. 1 (prior art) schematically shows the principle of storing of data information according to the PTY principle in WO95/15628. -
FIG. 2 (prior art) schematically shows the principle of producing floating storing identities according to the PTY principle in WO95/15628. -
FIG. 3 schematically shows a computer system for implementing the method according to the invention. -
FIG. 4 schematically shows the principle of data processing according to the invention with compelling callings to a data element protection catalogue. -
FIG. 5 shows an example of a display image for determining of protection attributes in the data element protection catalogue. - In the following, the designation IAM (which stands for Information Assets Manager) will be used for the components and applications which in the embodiment are essential to the implementation of the invention.
- Reference is first made to
FIG. 3 , which schematically illustrates a data managing system, in which the present invention is implemented and in which the following databases are included for storing information, in this example person-related information: -
- An open database P-DB which contains generally accessible data, such as personal name, article name, address etc. with the personal code number Pcn as plain text as record identifier;
- An operative database O-DB, which contains data that is to be protected. Encrypted identification, in this case an encrypted personal code number, is used as record identifier (=storage identity SID). O-DB is used by authorised users for processing of individual records, such as reading and update;
- An archive-database A-DB, which contains data transferred (sorted out) from the operative database O-DB and which is used for statistic questions, but not for questions directed to individual records. The transfer from O-DB to A-DB may take place in batches.
- A database IAM-DB, which is a database essential to the implementation of the invention. This database contains a data element protection catalogue with protection attributes for such data element types as are associated with data element values in records—in the operative database O-DB. This database IAM-DB is preferably physically separated from the other O-DB and is inaccessible to the user. However, two or more sets of the data element protection catalogue may be available: on the one hand an original version to which only an authorised IAM operator has access and, on the other hand, a copy version which imports the data element protection catalogue from the original version and which may optionally be stored on the same file storage as the operative database O-DB. The two versions may be remote from each other, for instance be located in two different cities.
- The data system in
FIG. 3 further comprises a hardware component 10, a control module 20 (IAM-API), and a program module 30 (PTY-API). The function of these three components will now be described in more detail. - Hardware Component 10
- The hardware component 10 acts as a distributed processor of its own in a computer. It has an encapsulation that makes it completely tamper-proof, which means that monitoring by so-called trace tools will not be possible.
- The hardware component 10 can as an independent unit perform at least the following functions:
- Creating variable, reversible and non-reversible encrypting algorithms for the PTY encryption and providing the algorithms with the necessary variables;
- Initiating alterations of storage identities (SID) in stored data according to PTY, on the one hand data in O-DB and, on the other hand, data in the data element protection catalogue of IAM-DB;
- Storing user authorizations having access to records in O-DB; and
- Linking original identities OID to the correct record in O-DB.
- Control Module 20 (IAM-API)
- The control module 20 controls the handling of the types of data protection that the system can supply.
- The control module carries out the processing requested via API (Application Program Interface) programming interface.
- Program Module 30 (PTY-API) 30
- The program module (PTY-API) 30 handles the dialogue between the application 40 involved (including ACS) and the hardware component 10. This module may further log events and control sorting out/removal of data from the operative database O-DB.
- Reference is now made to
FIG. 4 , which illustrates the same four databases (P-DB, O-DB, A-DB, IAM-DB) as inFIG. 3 and which schematically illustrates how the processing of individual data elements are, according to the invention, controlled according to the rules that are stated by protection attributes in the data element protection catalogue, which is stored in the database IAM-DB. - The data that is to be stored concerns in this example a certain individual and contains: (1) generally accessible data such as name and address, (2) identifying information, such as personal code number (Pcn), and (3) descriptive information (DI). The generally accessible data name and address is stored together with personal code number (Pcn) in the open database P-DB, said storage being performable as plain text since this information is of the type that is generally accessible.
- For storing the identifying information in combination with the descriptive information DI, the following steps will, however, be made, in which the following designations are used to describe encrypting and decrypting algorithms. Generally speaking, the encrypting and decrypting algorithms can be described as follows:
F Type(Random number, Input data)=Results wherein: - F designates a function.
- Type indicates the type of function as follows:
-
- FKIR=Non-reversible encrypting algorithm
- FKR=Reversible encrypting algorithm
- FDKR=Decrypting algorithm
- Random number
-
- represents one or more constants and/or
- variables included in the function F.
- Input data
-
- are the data to be encrypted or decrypted, and
- Results indicate a unique function value for a given function
-
Step 1 Division of the information -
- Identifying information is separated from descriptive information;
- Step 2 Preparation of storage identity SID:
-
- An original identity OID is selected based on the identifying information. OID is here selected to be equal to the personal code number Pcn of the individual. OID is encrypted by means of a non-reversible encrypting algorithm ALG1, pre-pared randomly by the hardware component 10, to an update identity UID as follows:
ALG1: F KIR(Random number, OID)=UID - ALG1 is such that attempts at decryption of UID to OID result in a great number of identities, which makes it impossible to link a specific UID to the corresponding OID.
- Then UID is encrypted by means of a reversible algorithm ALG2, which is also produced at random by the hardware component 10, for generating a storage identity SID as follows:
ALG2: F KR R(Random number, UID)=SID - ALG2 is such that there exists a corresponding decrypting algorithm ALG3, by means of which SID can be decrypted in order to recreate UID.
- The storage identity SID is used, as described in
step 4 above, as encrypted record identifier when storing encrypted data element values DV in the operative database O-DB.
- An original identity OID is selected based on the identifying information. OID is here selected to be equal to the personal code number Pcn of the individual. OID is encrypted by means of a non-reversible encrypting algorithm ALG1, pre-pared randomly by the hardware component 10, to an update identity UID as follows:
-
Step 3 Production of encrypted data element values DV: The descriptive information DI associated with the original identity OID is converted into one or more encrypted data element values DV linked to a data element type DT each. - The encryption takes place as described below with a reversible encryption function FKR, which like the algorithms ALG1 and ALG2 above is also produced at random by the hardware component 10. The invention is distinguished by a compelling calling here being sent to the data element protection catalogue in the database IAM-DB for automatic collection of the protection attribute which is linked to the data element type at issue and which indicates “strength” or degree with which the encryption of the descriptive data is to be performed so as to generate the data element value DV.
- The table, which in
FIG. 4 is shown below the database IAMDB, symbolizes an exemplifying content of the data element protection catalogue, here designated DPC. As an example, it may here be assumed that the protection function Funcl corresponds to “degree of encryption”. If the descriptive information DI at issue is to be stored as a data element value DV associated with the specific data element type DT1 in the data element protection catalogue, the protection attribute “5” registered in the data element protection catalogue is collected automatically in this case. The descriptive information DI at issue will thus, automatically and compellingly, be encrypted with the strength “5” for generating an encrypted data element value DV as follows:
F KR(Random number, DI)=encrypted data element value DV -
- For storing a less sensitive data element, for instance a data element of the data element type DT3, the compelling calling to the data element protection catalogue in IAM-DB would instead have resulted in the protection attribute “no” being collected, in which case no encryption would have been made on the descriptive data at issue, which then could be stored as plain text in the operative database ODE.
-
Step 4 Storing of records in the operative database O-DB: The encrypted storage identity SID according to step 2 in combination with the corresponding encrypted data element value or data element valuesDV according step 3 are stored as a record in the operative database O-DB. - As appears from the foregoing, a stored information record P has the following general appearance:
Descript. information in the form of encrypted data element values Storage identity (SID) DV1 DV2 DV3 DV4 - The original identity OID is encrypted according to the PTY principle in two steps, of which the first is non-reversible and the second is reversible. Thus, it is impossible to store the descriptive information DI along with a storage identity SID that never can be linked to the original identity OID, as well as to create “floating”, i.e. which change over time, storage identities SID while retaining the possibility of locating, for a specific original identity OID, the associated descriptive information DI stored.
- The descriptive data DI is stored in accordance with protection attributes linked to each individual data element. This results in a still higher level of protection and a high degree of flexibility as to the setting up of rules, and continuous adaptation thereof, of how sensitive data is allowed to be used and can be used, down to the data element level.
- To increase the level of protection still more, the data element protection catalogue DPC is preferably stored in IAM-DB in encrypted form in accordance with the PTY principle, in which case for instance the data element types correspond to the above storage identity and the protection attributes correspond to the descriptive information or data element values above, as schematically illustrated in
FIG. 4 . This efficiently prevents every attempt at circumventing the data element protection by unauthorized access and interpretation of the content of the data element protection catalogue. - In the illustrated embodiment, PTY can thus have the following functions:
- Protecting the original identity OID in encrypted form (SID) on the operative database O-DB (as is known from said WO95/15628),
- Protecting information in IAM-DB, particularly the protection attributes of the data element protection catalogue and the associated record identifier, and
- Protecting descriptive information DI in the form of encrypted data element values DV for the data element types that have the corresponding protection activated in the data element protection catalogue, and in accordance with the corresponding protection attributes.
- Functionality Protection
- In the above embodiment of the procedure for inputting data in the operative database O-DB, only “degree of encryption” has so far been discussed as data element protection attribute in the data element protection catalogue DC. However, this is only one example among a number of possible protection attributes in the data element protection catalogue, which normally offers a plurality of protection attitudes for each data element. Preferred protection attributes have been indicated above in the general description.
- A particularly interesting protection attribute is “protected programs”. The use of this data element protection attribute means that the data system may offer a new type of protection, which is here called “functionality protection and which means that only accepted or certified programs are allowed to be used and can be used in the system in the processing of data. It should be noted that this type of protection is still, according to the invention, on the data element level.
- Now assume for the purpose of illustration that Func2 in the data element protection catalogue DPC in
FIG. 4 corresponds to this protection attribute and that data elements of the data element type DTI and DT2, respectively, are only allowed to be processed with the accepted applications or programs P1 and P2, respectively. Unauthorized handling of the corresponding data elements by means of, for instance, a different program P3, or a modified version P1′ of P1, should be prevented. As protection attribute in the data element protection catalogue, data identifying PI and P2 is therefore stored. In a preferred example, an encryptographic check sum P1* and P2*, respectively, is created, in a manner known per se, based on every accepted program P1 and P2, respectively. These check sums may be considered to constitute a unique fingerprint of the respective accepted programs, and these fingerprints can be stored as protection catalogue as illustrated schematically inFIG. 4 . It should however be noted that such check sums for accepted programs can optionally be stored in a data element protection attributes in the data element protection catalogue of their own for registering of accepted programs, separately from the data element protection catalogue with protection attributes for encryption strength. - If the last-mentioned type of protection “protected programs” is used, it should also be noted that the system, in connection with a user-initiated measure aiming at processing of a given data element, for instance in-putting a new data element value in a certain record, need not, carry out a complete examination of all programs accepted in the system. If, for instance, the user tries to use a program P3 for inputting in the operative database O-DB a new data element value, a compelling calling is sent to the data element protection catalogue in connection with the corresponding data element type, for instance DTI. The associated protection attribute P1* is then collected from the data element protection catalogue, which means that such a data element value is only allowed to be stored by means of the program P1. The attempt at registering the data element value by means of the program P3 would therefore fail.
- By periodic use of the above-described functionality protection, it is possible to reveal and/or prevent that an unauthorized person (for instance a “hacker”) breaks into the system by means of a non-accepted program and modifies and/or adds descriptive data in such a manner that the descriptive data will then be identifying for the record. The data element values are thus not allowed to become identifying in the operative database O-DB.
- Traceability/Logging
- “Logging” or “traceability” is another type of protection which according to the invention can be linked to a data element type in the data element protection catalogue. If this protection is activated for a certain data element type, each processing of the corresponding data element values in the operative database O-DB will automatically and compellingly result in relevant information on the processing (“user”, “date”, “record”, “user pro-gram” etc.) being logged in a suitable manner, so that based on the log, it is possible to investigate after-wards who has processed the data element values at issue, when, by means of which program etc.
- Reading of Data from the Operative Database O-DB
- In connection with a user-initiated measure aiming at reading/altering data element values in the stored records in the operative database O-DB, the following steps are carried out, which specifically also comprise a compelling calling to the data element protection catalogue and “unpacking” of the data which is controlled automatically and compellingly by collected protection attributes.
-
Step 1 The record is identified by producing the storage identity SID at issue based on the original identity OID, (Pcn) that is associated with the data element value DV which is to be read, as follows
F KR(F KIR(OID))=SID - Step 2 When the record has been found by means of SID, the encrypted data element value DV (i.e. the encrypted descriptive data that is to be read) is decrypted as follows by means of a decrypting algorithm FDKR:
F DKR(DV)=descriptive data (plain text) - The carrying out of this decryption of the data element value, however, requires that the encryption-controlling protection attribute of the data element is first collected by the system from the data element protection catalogue DC, i.e. the attribute indicating with which strength or at which level the data element value DV stored in O-DB has been encrypted. Like in the above procedure for inputting of data in O-DB, also when reading, a compelling calling thus is sent to the data element protection catalogue DC for collecting information which is necessary for carrying out the processing, in this case the unpacking.
- It will be appreciated that such a compelling calling to the data element protection catalogue DPC, when making an attempt at reading, may result in the attempt failing, wholly or partly, for several reasons, depending on the protection attribute at issue, which is linked to the data element value/values that is/are to be read. For instance, the attempt at reading may be interrupted owing to the user trying to use a non-accepted program and/or not being authorized to read the term involved.
- If the data element protection catalogue is encrypted, the decoding key can be stored in a storage position separate from the first and the second database.
-
FIG. 5 shows an example of a user interface in the form of a dialogue box, by means of which a person responsible for IAM, i.e. a person responsible for security, may read and/or alter the protection attributes stated in the data element protection catalogue. In the Example inFIG. 5 , the data element types “Housing allowance” and “Social allowance” have both been provided with protection attributes concerning encryption, sorting out, logging and owner. Moreover, registration of authorized users and protected programs linked to the data element type “Social allowance” has taken place in submenus.
Claims (81)
1-8. (canceled)
9. A data processing method comprising:
maintaining a database containing a table of data in row and column format, at least portion of the data being encrypted;
maintaining, separate from the table of data, information for controlling access to a specified proper subset of data in the table; and
controlling access to the specified proper subset of data in the table according to the separately maintained information.
10. The method of claim 9 , wherein controlling access comprises controlling access by a specified user or group of users.
11. The method of claim 9 , wherein controlling access comprises controlling access by a specified program or group of programs.
12. The method of claim 9 , wherein the separately maintained information comprises a separate table inaccessible to a user seeking access to the data.
13. The method of claim 9 , wherein the separately maintained information comprises a separate table inaccessible to a program seeking access to the data.
14. The method of claim 9 , wherein controlling access to the specified proper subset of the data comprises using a tamper-resistant hardware module.
15. The method of claim 14 , wherein the tamper-resistant hardware module is used to perform a cryptographic operation on the data.
16. The method of claim 14 , wherein the tamper-resistant hardware module is used to store at least a portion of the separately maintained information.
17. The method of claim 14 , wherein the tamper-resistant hardware module comprises a hardware security module.
18. The method of claim 14 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
19. The method of claim 9 , wherein the specified proper subset of data comprises a specified column of data.
20. The method of claim 9 , wherein the information for controlling access comprises information used in encrypting or decrypting data in the proper subset of data.
21. The method of claim 20 , wherein the information used in encrypting or decrypting data comprises information identifying a way of encrypting or decrypting data in the proper subset of data.
22. The method of claim 9 , wherein the information for controlling access comprises information identifying an owner of the proper subset of data.
23. The method of claim 9 , wherein the information for controlling access comprises encrypted information.
24. The method of claim 9 , further comprising:
receiving a request for access to a particular data element in the table, the particular data element containing encrypted data;
obtaining, from the separately maintained data, cryptographic information associated with a proper subset of data in the table, the proper subset containing the particular data element; and
decrypting the data in the particular data element using the cryptographic information.
25. The method of claim 24 , wherein decrypting the data is done using a tamper-resistant hardware module.
26. The method of claim 25 , wherein the tamper-resistant hardware module comprises a hardware security module.
27. The method of claim 25 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
28. The method of claim 9 , further comprising
receiving a request for access to a particular data element in the table, the particular data element containing encrypted data; and
obtaining, from the separately maintained data, information associated with a proper subset of data in the table, the proper subset containing the particular data element; and
providing decrypted data from the particular data element when the information from the separately maintained data indicates that the request for access to the particular data element is an authorized request.
29. The method of claim 28 , further comprising decrypting the data from the particular data element using a tamper-resistant hardware module.
30. The method of claim 29 , wherein the tamper-resistant hardware module comprises a hardware security module.
31. The method of claim 29 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
32. A method comprising:
providing a database containing a table having at least two columns of data; encrypting data in a first column using first cryptographic information; encrypting data in a second column using second cryptographic information; storing first and second cryptographic information outside of the table;
controlling access to data in the first column using the first cryptographic information stored outside of the table; and
controlling access to data in the second column using the second cryptographic information stored outside of the table.
33. The method of claim 32 , further comprising storing the first and second cryptographic information in a separate table inaccessible to a user seeking access to the data.
34. The method of claim 32 , further comprising storing the first and second cryptographic information in a separate table inaccessible to a program seeking access to the data.
35. The method of claim 32 , wherein the first and second cryptographic information are stored, in encrypted form, outside of the table.
36. The method of claim 32 , wherein at least a portion of the data is encrypted using a tamper-resistant hardware module.
37. The method of claim 36 , wherein the tamper-resistant hardware module comprises a hardware security module.
38. The method of claim 36 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
39. A database management system comprising:
a database containing a table having at least two columns of data, at least one column of data being encrypted; and
information stored outside of the table for controlling access to at least one column of data, the information including cryptographic information associated with the encrypted column of data.
40. The system of claim 39 , wherein the information is stored in a separate table inaccessible to a user seeking access to the data.
41. The system of claim 39 , wherein the information is stored in a separate table inaccessible to a program seeking access to the data.
42. The system of claim 39 , wherein the information is stored in encrypted form.
43. The system of claim 39 , further comprising a tamper-resistant hardware module for performing cryptographic operations on the encrypted column of data.
44. The system of claim 43 , wherein the tamper-resistant hardware module comprises a hardware security module.
45. The system of claim 43 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
46. A data processing method comprising:
maintaining a first set of data as a collection of records having fields, at least a portion of the data being encrypted;
maintaining, separate from the first set of data, information for controlling access to a specified proper subset of the first data; and
controlling access to the specified proper subset of the first set of data according to the separately maintained information.
47. The method of claim 46 , wherein controlling access comprises controlling access by a specified user or group of users.
48. The method of claim 46 , wherein controlling access comprises controlling access by a specified program or group of programs.
49. The method of claim 46 , wherein the separately maintained information comprises information that is inaccessible to a user seeking access to the data.
50. The method of claim 46 , wherein the separately maintained information comprises information that is inaccessible to a program seeking access to the data.
51. The method of claim 46 , wherein controlling access to the specified proper subset of the data comprising using a tamper-resistant hardware module.
52. The method of claim 51 , wherein the tamper-resistant hardware module is used to perform a cryptographic operation on the data.
53. The method of claim 51 , wherein the tamper-resistant hardware module is used to store at least a portion of the separately maintained information.
54. The method of claim 51 , wherein the tamper-resistant hardware module comprises a hardware security module.
55. The method of claims 51, wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
56. The method of claim 46 , wherein the specified proper subset of data comprises a specified field of data.
57. The method of claim 46 , wherein the information for controlling access comprises information used in encrypting or decrypting data in the proper subset of data.
58. The method of claim 46 , wherein the information for controlling access comprises information identifying an owner of the proper subset of data.
59. The method of claim 46 , wherein the information for controlling access comprises encrypted information.
60. The method of claim 46 , further comprising:
receiving a request for access to a particular data element in the first set of data, the particular data element containing encrypted data;
obtaining, from the separately maintained data, cryptographic information associated with a proper subset of the first set of data, the proper subset containing the particular data element; and
decrypting the data in the particular data element using the cryptographic information.
61. The method of claim 60 , wherein decrypting the data is done using a tamper-resistant hardware module.
62. The method of claim 61 , wherein the tamper-resistant hardware module comprises a hardware security module.
63. The method of claim 61 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
64. The method of claim 60 , wherein the proper subset comprises data in one or more specified fields.
65. The method of claim 46 , further comprising
receiving a request for access to a particular data element in the first set of data, the particular data element containing encrypted data; and
obtaining, from the separately maintained data, information associated with a proper subset of data in the first set of data, the proper subset containing the particular data element; and
providing decrypted data from the particular data element when the information from the separately maintained data indicates that the request for access to the particular data element is an authorized request.
66. The method of claim 65 , further comprising decrypting the data from the particular data element using a tamper-resistant hardware module.
67. The method of claim 66 , wherein the tamper-resistant hardware module comprises a hardware security module.
68. The method of claim 66 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
69. A method comprising:
providing a database containing at least two columns of data;
encrypting data in a first column using first cryptographic information;
encrypting data in a second column using second cryptographic information;
storing the first and second cryptographic information apart from the two columns of data;
controlling access to data in the first column using the first cryptographic information; and
controlling access to data in the second column using the second cryptographic information.
70. The method of claim 69 , further comprising storing the first and second cryptographic information in a location that is inaccessible to a user seeking access to the data.
71. The method of claim 69 , further comprising storing the first and second cryptographic information in a location that is inaccessible to a program seeking access to the data.
72. The method of claim 69 , wherein the first and second cryptographic information are stored, in encrypted form, outside of the first and second column.
73. The method of claim 69 , wherein at least a portion of the data is encrypted using a tamper-resistant hardware module.
74. The method of claim 73 , wherein the tamper-resistant hardware module comprises a hardware security module.
75. The method of claim 73 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
76. A database management system comprising:
a database containing at least two columns of data, a first column of data being encrypted; and
information stored outside of the first column of data for controlling access to the first column of data, the information including cryptographic information associated with the first column of data.
77. The system of claim 76 , where in the information is stored in a location that is inaccessible to a user seeking access to the first column of data.
78. The system of claim 76 , where in the information is stored in a location that is inaccessible to a program seeking access to the first column of data.
79. The system of claim 76 , wherein the information is stored in encrypted form.
80. The system of claim 76 , further comprising a tamper-resistant hardware module for performing cryptographic operations on the first column of data.
81. The system of claim 80 , wherein the tamper-resistant hardware module comprises a hardware security module.
82. The system of claim 80 , wherein the tamper-resistant hardware module is selected from the group consisting of a hardware security appliance and a cryptographic card.
83. The method of claim 9 , further comprising revealing an unauthorized access to the data.
84. The method of claim 32 , wherein controlling access to data in the first column comprises revealing unauthorized access to the data.
85. The method of claim 46 , wherein controlling access comprising revealing unauthorized access to the first set of data.
86. The method of claim 69 , wherein controlling access to data in the first columns comprises revealing unauthorized access to the data.
87. The system of claim 39 , wherein the information stored outside of the table comprises information for revealing unauthorized access to the database.
88. The system of claim 76 , wherein the information stored outside of the table comprises information for revealing unauthorized access to the database.
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/603,967 US20070180240A1 (en) | 1996-06-20 | 2006-11-21 | Data security system for a database |
US12/916,274 US8402281B2 (en) | 1996-06-20 | 2010-10-29 | Data security system for a database |
Applications Claiming Priority (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
SE9602475A SE506853C2 (en) | 1996-06-20 | 1996-06-20 | Method of data processing |
SE9602475-7 | 1996-06-20 | ||
PCT/SE1997/001089 WO1997049211A1 (en) | 1996-06-20 | 1997-06-18 | Method and apparatus for data processing |
US09/027,585 US6321201B1 (en) | 1996-06-20 | 1998-02-23 | Data security system for a database having multiple encryption levels applicable on a data element value level |
US09/840,188 US20020174352A1 (en) | 1996-06-20 | 2001-04-24 | Data security system for a database |
US11/603,967 US20070180240A1 (en) | 1996-06-20 | 2006-11-21 | Data security system for a database |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/840,188 Continuation US20020174352A1 (en) | 1996-06-20 | 2001-04-24 | Data security system for a database |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/916,274 Continuation US8402281B2 (en) | 1996-06-20 | 2010-10-29 | Data security system for a database |
Publications (1)
Publication Number | Publication Date |
---|---|
US20070180240A1 true US20070180240A1 (en) | 2007-08-02 |
Family
ID=20403120
Family Applications (4)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/027,585 Expired - Lifetime US6321201B1 (en) | 1996-06-20 | 1998-02-23 | Data security system for a database having multiple encryption levels applicable on a data element value level |
US09/840,188 Abandoned US20020174352A1 (en) | 1996-06-20 | 2001-04-24 | Data security system for a database |
US11/603,967 Abandoned US20070180240A1 (en) | 1996-06-20 | 2006-11-21 | Data security system for a database |
US12/916,274 Expired - Fee Related US8402281B2 (en) | 1996-06-20 | 2010-10-29 | Data security system for a database |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/027,585 Expired - Lifetime US6321201B1 (en) | 1996-06-20 | 1998-02-23 | Data security system for a database having multiple encryption levels applicable on a data element value level |
US09/840,188 Abandoned US20020174352A1 (en) | 1996-06-20 | 2001-04-24 | Data security system for a database |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/916,274 Expired - Fee Related US8402281B2 (en) | 1996-06-20 | 2010-10-29 | Data security system for a database |
Country Status (18)
Country | Link |
---|---|
US (4) | US6321201B1 (en) |
EP (2) | EP1477881A3 (en) |
JP (1) | JP4167300B2 (en) |
KR (1) | KR20000022057A (en) |
CN (1) | CN1146178C (en) |
AT (1) | ATE274264T1 (en) |
AU (1) | AU724388B2 (en) |
BR (1) | BR9710694A (en) |
CZ (1) | CZ288947B6 (en) |
DE (1) | DE69730321T2 (en) |
ES (1) | ES2230609T3 (en) |
IL (1) | IL127645A (en) |
NO (1) | NO985985L (en) |
PT (1) | PT891661E (en) |
RU (1) | RU2198423C2 (en) |
SE (1) | SE506853C2 (en) |
SK (1) | SK174898A3 (en) |
WO (1) | WO1997049211A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20090187553A1 (en) * | 2008-01-21 | 2009-07-23 | Suman Kumar Sarkar | Method and system for facilitating verification of an entity based on business requirements |
US9524345B1 (en) | 2009-08-31 | 2016-12-20 | Richard VanderDrift | Enhancing content using linked context |
US9639707B1 (en) | 2010-01-14 | 2017-05-02 | Richard W. VanderDrift | Secure data storage and communication for network computing |
Families Citing this family (145)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
SE506853C2 (en) * | 1996-06-20 | 1998-02-16 | Anonymity Prot In Sweden Ab | Method of data processing |
US7233912B2 (en) | 1997-08-26 | 2007-06-19 | Walker Digital, Llc | Method and apparatus for vending a combination of products |
US6430549B1 (en) | 1998-07-17 | 2002-08-06 | Electronic Data Systems Corporation | System and method for selectivety defining access to application features |
DE19925910B4 (en) | 1999-06-07 | 2005-04-28 | Siemens Ag | Method for processing or processing data |
US6938022B1 (en) * | 1999-06-12 | 2005-08-30 | Tara C. Singhal | Method and apparatus for facilitating an anonymous information system and anonymous service transactions |
AU5135400A (en) | 1999-06-30 | 2001-01-22 | Walker Digital, Llc | Vending machine system and method for encouraging the purchase of profitable items |
EP1247221A4 (en) | 1999-09-20 | 2005-01-19 | Quintiles Transnat Corp | System and method for analyzing de-identified health care data |
SE9904094D0 (en) * | 1999-11-12 | 1999-11-12 | Protegrity Research & Dev | Method for reencryption of a database |
US7111005B1 (en) * | 2000-10-06 | 2006-09-19 | Oracle International Corporation | Method and apparatus for automatic database encryption |
US7362868B2 (en) | 2000-10-20 | 2008-04-22 | Eruces, Inc. | Hidden link dynamic key manager for use in computer systems with database structure for storage of encrypted data and method for storage and retrieval of encrypted data |
US20030021417A1 (en) * | 2000-10-20 | 2003-01-30 | Ognjen Vasic | Hidden link dynamic key manager for use in computer systems with database structure for storage of encrypted data and method for storage and retrieval of encrypted data |
SE516452C2 (en) * | 2000-11-16 | 2002-01-15 | Protegrity Res & Dev | Method for changing encryption status in a relational database in continuous process |
SE517808C2 (en) * | 2000-11-16 | 2002-07-16 | Protegrity Res & Dev | Combined hardware and software based encryption of databases |
US7325129B1 (en) | 2000-11-16 | 2008-01-29 | Protegrity Corporation | Method for altering encryption status in a relational database in a continuous process |
US20070079119A1 (en) * | 2000-11-16 | 2007-04-05 | Ulf Mattsson | Encryption key rotation |
US6963980B1 (en) | 2000-11-16 | 2005-11-08 | Protegrity Corporation | Combined hardware and software based encryption of databases |
US7418098B1 (en) | 2000-11-27 | 2008-08-26 | Protegrity Corporation | Data type preserving encryption |
SE518166C2 (en) | 2000-11-27 | 2002-09-03 | Protegrity Res & Dev | Data type encryption |
US20020066038A1 (en) * | 2000-11-29 | 2002-05-30 | Ulf Mattsson | Method and a system for preventing impersonation of a database user |
US7315859B2 (en) * | 2000-12-15 | 2008-01-01 | Oracle International Corp. | Method and apparatus for management of encrypted data through role separation |
US7454796B2 (en) * | 2000-12-22 | 2008-11-18 | Canon Kabushiki Kaisha | Obtaining temporary exclusive control of a printing device |
US7757278B2 (en) * | 2001-01-04 | 2010-07-13 | Safenet, Inc. | Method and apparatus for transparent encryption |
EP1315065B1 (en) | 2001-11-23 | 2007-10-10 | Protegrity Research & Development | Method for intrusion detection in a database system |
US20030200216A1 (en) * | 2002-01-22 | 2003-10-23 | Recording Industry Association Of America | Method and system for identification of music industry releases and licenses |
WO2003098898A1 (en) * | 2002-05-13 | 2003-11-27 | Rappore Technologies, Inc. | Clearance-based method for dynamically configuring encryption strength |
US20030226024A1 (en) * | 2002-06-04 | 2003-12-04 | Qwest Communications International Inc. | Secure internet documents |
WO2004019182A2 (en) * | 2002-08-24 | 2004-03-04 | Ingrian Networks, Inc. | Selective feature activation |
US20040193871A1 (en) * | 2003-03-28 | 2004-09-30 | Broadcom Corporation | System and method for transmitting data using selective partial encryption |
US7346160B2 (en) * | 2003-04-23 | 2008-03-18 | Michaelsen David L | Randomization-based encryption apparatus and method |
US7155612B2 (en) * | 2003-04-30 | 2006-12-26 | International Business Machines Corporation | Desktop database data administration tool with row level security |
US8862866B2 (en) | 2003-07-07 | 2014-10-14 | Certicom Corp. | Method and apparatus for providing an adaptable security level in an electronic communication |
CA2534987A1 (en) * | 2003-07-09 | 2005-01-27 | Cross Match Technologies, Inc. | Systems and methods for facilitating transactions |
US7725947B2 (en) * | 2003-08-06 | 2010-05-25 | Sap Ag | Methods and systems for providing benchmark information under controlled access |
US7617177B2 (en) * | 2003-08-06 | 2009-11-10 | Sap Ag | Methods and systems for providing benchmark information under controlled access |
DE102004040312B4 (en) | 2003-08-19 | 2018-11-15 | Certicom Corp. | Method and device for synchronizing an adaptable security level in an electronic data transmission |
US20080270806A1 (en) * | 2004-04-02 | 2008-10-30 | Tomonori Nakamura | Execution Device |
US7519835B2 (en) * | 2004-05-20 | 2009-04-14 | Safenet, Inc. | Encrypted table indexes and searching encrypted tables |
US7681042B2 (en) | 2004-06-17 | 2010-03-16 | Eruces, Inc. | System and method for dis-identifying sensitive information and associated records |
US7383462B2 (en) * | 2004-07-02 | 2008-06-03 | Hitachi, Ltd. | Method and apparatus for encrypted remote copy for secure data backup and restoration |
SE527925C2 (en) * | 2004-07-09 | 2006-07-11 | Infinisec Holding Ab | Procedure for decryption and database of encrypted data information |
DE102004063964B4 (en) * | 2004-10-20 | 2010-12-16 | Vita-X Ag | computer system |
PL372686A1 (en) * | 2005-02-09 | 2006-08-21 | Piotr Grabowski | Recoil mechanism for the fire arms |
US20070174271A1 (en) * | 2005-02-18 | 2007-07-26 | Ulf Mattsson | Database system with second preprocessor and method for accessing a database |
US20060259950A1 (en) | 2005-02-18 | 2006-11-16 | Ulf Mattsson | Multi-layer system for privacy enforcement and monitoring of suspicious data access behavior |
US20080022136A1 (en) * | 2005-02-18 | 2008-01-24 | Protegrity Corporation | Encryption load balancing and distributed policy enforcement |
US7788184B2 (en) * | 2005-09-23 | 2010-08-31 | Kane Larry J | Method for preventing identity theft |
US20070079140A1 (en) * | 2005-09-26 | 2007-04-05 | Brian Metzger | Data migration |
US20070079386A1 (en) * | 2005-09-26 | 2007-04-05 | Brian Metzger | Transparent encryption using secure encryption device |
US20070156606A1 (en) * | 2005-12-29 | 2007-07-05 | Larry Kane | Method of securing a check transaction |
US20070180275A1 (en) * | 2006-01-27 | 2007-08-02 | Brian Metzger | Transparent encryption using secure JDBC/ODBC wrappers |
US8386768B2 (en) * | 2006-02-08 | 2013-02-26 | Safenet, Inc. | High performance data encryption server and method for transparently encrypting/decrypting data |
US7717333B2 (en) * | 2006-02-15 | 2010-05-18 | Kane Larry J | Method and means for registering a debit card |
US7958091B2 (en) | 2006-02-16 | 2011-06-07 | Ingrian Networks, Inc. | Method for fast bulk loading data into a database while bypassing exit routines |
CN101496338B (en) | 2006-04-13 | 2013-08-21 | 塞尔蒂卡姆公司 | Method and apparatus for providing an adaptable security level in an electronic communication |
US8826449B2 (en) * | 2007-09-27 | 2014-09-02 | Protegrity Corporation | Data security in a disconnected environment |
US7904732B2 (en) * | 2006-09-27 | 2011-03-08 | Rocket Software, Inc. | Encrypting and decrypting database records |
US20080116258A1 (en) * | 2006-10-25 | 2008-05-22 | Kane Larry J | Multi-purpose payment card and method of using same |
US8379865B2 (en) * | 2006-10-27 | 2013-02-19 | Safenet, Inc. | Multikey support for multiple office system |
US8380841B2 (en) * | 2006-12-07 | 2013-02-19 | Microsoft Corporation | Strategies for investigating and mitigating vulnerabilities caused by the acquisition of credentials |
US9355273B2 (en) | 2006-12-18 | 2016-05-31 | Bank Of America, N.A., As Collateral Agent | System and method for the protection and de-identification of health care data |
US8639948B2 (en) * | 2006-12-28 | 2014-01-28 | Teradata Us, Inc. | Encrypted data management in database management systems |
US9218500B2 (en) * | 2007-02-26 | 2015-12-22 | Secure Islands Technologies Ltd. | System and method for automatic data protection in a computer network |
US20100031321A1 (en) | 2007-06-11 | 2010-02-04 | Protegrity Corporation | Method and system for preventing impersonation of computer system user |
US20090030840A1 (en) * | 2007-07-24 | 2009-01-29 | Kane Larry J | Method for limiting debit card transactions |
US20090132804A1 (en) * | 2007-11-21 | 2009-05-21 | Prabir Paul | Secured live software migration |
US8225106B2 (en) | 2008-04-02 | 2012-07-17 | Protegrity Corporation | Differential encryption utilizing trust modes |
US20100030644A1 (en) * | 2008-08-04 | 2010-02-04 | Rajasekaran Dhamodharan | Targeted advertising by payment processor history of cashless acquired merchant transactions on issued consumer account |
JP5419886B2 (en) * | 2008-10-08 | 2014-02-19 | インターナショナル・ビジネス・マシーンズ・コーポレーション | Information processing apparatus, document search system, document search method, and program |
WO2010071972A1 (en) | 2008-12-23 | 2010-07-01 | J.J.Mackay Canada Limited | Low power wireless parking meter and parking meter network |
US20100211445A1 (en) * | 2009-01-15 | 2010-08-19 | Shaun Bodington | Incentives associated with linked financial accounts |
US20100306029A1 (en) * | 2009-06-01 | 2010-12-02 | Ryan Jolley | Cardholder Clusters |
US9443253B2 (en) | 2009-07-27 | 2016-09-13 | Visa International Service Association | Systems and methods to provide and adjust offers |
US9841282B2 (en) | 2009-07-27 | 2017-12-12 | Visa U.S.A. Inc. | Successive offer communications with an offer recipient |
US10546332B2 (en) | 2010-09-21 | 2020-01-28 | Visa International Service Association | Systems and methods to program operations for interaction with users |
US20110029367A1 (en) * | 2009-07-29 | 2011-02-03 | Visa U.S.A. Inc. | Systems and Methods to Generate Transactions According to Account Features |
US20110035280A1 (en) | 2009-08-04 | 2011-02-10 | Visa U.S.A. Inc. | Systems and Methods for Targeted Advertisement Delivery |
US20110035278A1 (en) | 2009-08-04 | 2011-02-10 | Visa U.S.A. Inc. | Systems and Methods for Closing the Loop between Online Activities and Offline Purchases |
US20110047072A1 (en) * | 2009-08-07 | 2011-02-24 | Visa U.S.A. Inc. | Systems and Methods for Propensity Analysis and Validation |
SK5496Y1 (en) | 2009-08-10 | 2010-08-09 | Komensky S R O | System for virtual library |
US9031860B2 (en) * | 2009-10-09 | 2015-05-12 | Visa U.S.A. Inc. | Systems and methods to aggregate demand |
US20110087530A1 (en) * | 2009-10-09 | 2011-04-14 | Visa U.S.A. Inc. | Systems and Methods to Provide Loyalty Programs |
US20110087547A1 (en) * | 2009-10-09 | 2011-04-14 | Visa U.S.A. | Systems and Methods for Advertising Services Based on a Local Profile |
US9342835B2 (en) * | 2009-10-09 | 2016-05-17 | Visa U.S.A | Systems and methods to deliver targeted advertisements to audience |
US20110087519A1 (en) * | 2009-10-09 | 2011-04-14 | Visa U.S.A. Inc. | Systems and Methods for Panel Enhancement with Transaction Data |
US20110087546A1 (en) * | 2009-10-09 | 2011-04-14 | Visa U.S.A. Inc. | Systems and Methods for Anticipatory Advertisement Delivery |
US8595058B2 (en) * | 2009-10-15 | 2013-11-26 | Visa U.S.A. | Systems and methods to match identifiers |
US20110093324A1 (en) | 2009-10-19 | 2011-04-21 | Visa U.S.A. Inc. | Systems and Methods to Provide Intelligent Analytics to Cardholders and Merchants |
US20110093335A1 (en) * | 2009-10-19 | 2011-04-21 | Visa U.S.A. Inc. | Systems and Methods for Advertising Services Based on an SKU-Level Profile |
US8676639B2 (en) | 2009-10-29 | 2014-03-18 | Visa International Service Association | System and method for promotion processing and authorization |
US8626705B2 (en) | 2009-11-05 | 2014-01-07 | Visa International Service Association | Transaction aggregator for closed processing |
US20110125565A1 (en) | 2009-11-24 | 2011-05-26 | Visa U.S.A. Inc. | Systems and Methods for Multi-Channel Offer Redemption |
US20110231225A1 (en) * | 2010-03-19 | 2011-09-22 | Visa U.S.A. Inc. | Systems and Methods to Identify Customers Based on Spending Patterns |
US8639567B2 (en) * | 2010-03-19 | 2014-01-28 | Visa U.S.A. Inc. | Systems and methods to identify differences in spending patterns |
US20110231224A1 (en) * | 2010-03-19 | 2011-09-22 | Visa U.S.A. Inc. | Systems and Methods to Perform Checkout Funnel Analyses |
US20110231258A1 (en) * | 2010-03-19 | 2011-09-22 | Visa U.S.A. Inc. | Systems and Methods to Distribute Advertisement Opportunities to Merchants |
US20110231305A1 (en) * | 2010-03-19 | 2011-09-22 | Visa U.S.A. Inc. | Systems and Methods to Identify Spending Patterns |
US8738418B2 (en) | 2010-03-19 | 2014-05-27 | Visa U.S.A. Inc. | Systems and methods to enhance search data with transaction based data |
US9697520B2 (en) | 2010-03-22 | 2017-07-04 | Visa U.S.A. Inc. | Merchant configured advertised incentives funded through statement credits |
US9471926B2 (en) | 2010-04-23 | 2016-10-18 | Visa U.S.A. Inc. | Systems and methods to provide offers to travelers |
US8359274B2 (en) | 2010-06-04 | 2013-01-22 | Visa International Service Association | Systems and methods to provide messages in real-time with transaction processing |
US8781896B2 (en) | 2010-06-29 | 2014-07-15 | Visa International Service Association | Systems and methods to optimize media presentations |
US9760905B2 (en) | 2010-08-02 | 2017-09-12 | Visa International Service Association | Systems and methods to optimize media presentations using a camera |
US9972021B2 (en) | 2010-08-06 | 2018-05-15 | Visa International Service Association | Systems and methods to rank and select triggers for real-time offers |
US9679299B2 (en) | 2010-09-03 | 2017-06-13 | Visa International Service Association | Systems and methods to provide real-time offers via a cooperative database |
US10055745B2 (en) | 2010-09-21 | 2018-08-21 | Visa International Service Association | Systems and methods to modify interaction rules during run time |
US9477967B2 (en) | 2010-09-21 | 2016-10-25 | Visa International Service Association | Systems and methods to process an offer campaign based on ineligibility |
US9558502B2 (en) | 2010-11-04 | 2017-01-31 | Visa International Service Association | Systems and methods to reward user interactions |
US10007915B2 (en) | 2011-01-24 | 2018-06-26 | Visa International Service Association | Systems and methods to facilitate loyalty reward transactions |
CA3178279A1 (en) | 2011-03-03 | 2012-09-03 | J.J. Mackay Canada Limited | Parking meter with contactless payment |
US10438299B2 (en) | 2011-03-15 | 2019-10-08 | Visa International Service Association | Systems and methods to combine transaction terminal location data and social networking check-in |
US10223707B2 (en) | 2011-08-19 | 2019-03-05 | Visa International Service Association | Systems and methods to communicate offer options via messaging in real time with processing of payment transaction |
US9466075B2 (en) | 2011-09-20 | 2016-10-11 | Visa International Service Association | Systems and methods to process referrals in offer campaigns |
US10380617B2 (en) | 2011-09-29 | 2019-08-13 | Visa International Service Association | Systems and methods to provide a user interface to control an offer campaign |
US9009473B2 (en) | 2011-10-13 | 2015-04-14 | International Business Machines Corporation | Providing consistent cryptographic operations across several applications |
US9009472B2 (en) | 2011-10-13 | 2015-04-14 | International Business Machines Corporation | Providing consistent cryptographic operations |
US10290018B2 (en) | 2011-11-09 | 2019-05-14 | Visa International Service Association | Systems and methods to communicate with users via social networking sites |
US10497022B2 (en) | 2012-01-20 | 2019-12-03 | Visa International Service Association | Systems and methods to present and process offers |
US10672018B2 (en) | 2012-03-07 | 2020-06-02 | Visa International Service Association | Systems and methods to process offers via mobile devices |
CA145137S (en) | 2012-04-02 | 2013-07-22 | Jj Mackay Canada Ltd | Single space parking meter |
US20150206152A1 (en) * | 2012-07-31 | 2015-07-23 | New York University | Anti-counterfeiting technique via attributes |
US9087209B2 (en) * | 2012-09-26 | 2015-07-21 | Protegrity Corporation | Database access control |
US10360627B2 (en) | 2012-12-13 | 2019-07-23 | Visa International Service Association | Systems and methods to provide account features via web based user interfaces |
CN103020269B (en) * | 2012-12-26 | 2016-09-07 | 广州市西美信息科技有限公司 | A kind of method of data verification and device |
EP2757467A1 (en) * | 2013-01-22 | 2014-07-23 | Siemens Aktiengesellschaft | Management apparatus and method for managing data elements of a version control system |
US20140258720A1 (en) * | 2013-03-11 | 2014-09-11 | Barracuda Networks, Inc. | Systems and methods for transparent per-file encryption and decryption via metadata identification |
US10489754B2 (en) | 2013-11-11 | 2019-11-26 | Visa International Service Association | Systems and methods to facilitate the redemption of offer benefits in a form of third party statement credits |
US10380352B2 (en) | 2014-02-04 | 2019-08-13 | International Business Machines Corporation | Document security in enterprise content management systems |
US10419379B2 (en) | 2014-04-07 | 2019-09-17 | Visa International Service Association | Systems and methods to program a computing system to process related events via workflows configured using a graphical user interface |
US10354268B2 (en) | 2014-05-15 | 2019-07-16 | Visa International Service Association | Systems and methods to organize and consolidate data for improved data storage and processing |
CN105205060A (en) * | 2014-06-12 | 2015-12-30 | 中兴通讯股份有限公司 | Method and device for generating word document database dictionary |
US10650398B2 (en) | 2014-06-16 | 2020-05-12 | Visa International Service Association | Communication systems and methods to transmit data among a plurality of computing systems in processing benefit redemption |
US10438226B2 (en) | 2014-07-23 | 2019-10-08 | Visa International Service Association | Systems and methods of using a communication network to coordinate processing among a plurality of separate computing systems |
US11210669B2 (en) | 2014-10-24 | 2021-12-28 | Visa International Service Association | Systems and methods to set up an operation at a computer system connected with a plurality of computer systems via a computer network using a round trip communication of an identifier of the operation |
US9792454B2 (en) | 2015-01-16 | 2017-10-17 | Protegrity Corporation | Record level data security |
US9691085B2 (en) | 2015-04-30 | 2017-06-27 | Visa International Service Association | Systems and methods of natural language processing and statistical analysis to identify matching categories |
CA2894350C (en) | 2015-06-16 | 2023-03-28 | J.J. Mackay Canada Limited | Coin chute with anti-fishing assembly |
USRE48566E1 (en) | 2015-07-15 | 2021-05-25 | J.J. Mackay Canada Limited | Parking meter |
USD813059S1 (en) | 2016-02-24 | 2018-03-20 | J.J. Mackay Canada Limited | Parking meter |
US9930070B2 (en) | 2015-11-11 | 2018-03-27 | International Business Machines Corporation | Modifying security policies of related resources |
US10515077B2 (en) * | 2017-06-14 | 2019-12-24 | Microsoft Technology Licensing, Llc | Execution optimization of database statements involving encrypted data |
CN110019273A (en) * | 2017-12-28 | 2019-07-16 | 北京京东尚科信息技术有限公司 | Data processing method, device and system for database |
US11263332B2 (en) * | 2018-07-31 | 2022-03-01 | International Business Machines Corporation | Methods to discourage unauthorized register access |
US11922756B2 (en) | 2019-01-30 | 2024-03-05 | J.J. Mackay Canada Limited | Parking meter having touchscreen display |
CA3031936A1 (en) | 2019-01-30 | 2020-07-30 | J.J. Mackay Canada Limited | Spi keyboard module for a parking meter and a parking meter having an spi keyboard module |
WO2024044522A1 (en) * | 2022-08-24 | 2024-02-29 | Arthur Hustad | Method and system for providing control over storage of and access to user data |
Citations (43)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4218582A (en) * | 1977-10-06 | 1980-08-19 | The Board Of Trustees Of The Leland Stanford Junior University | Public key cryptographic apparatus and method |
US4375579A (en) * | 1980-01-30 | 1983-03-01 | Wisconsin Alumni Research Foundation | Database encryption and decryption circuit and method using subkeys |
US4405829A (en) * | 1977-12-14 | 1983-09-20 | Massachusetts Institute Of Technology | Cryptographic communications system and method |
US4417338A (en) * | 1981-04-13 | 1983-11-22 | Wisconsin Alumni Research Foundation | Cryptographic key sharing circuit and method using code correction |
US4424414A (en) * | 1978-05-01 | 1984-01-03 | Board Of Trustees Of The Leland Stanford Junior University | Exponentiation cryptographic apparatus and method |
US4649233A (en) * | 1985-04-11 | 1987-03-10 | International Business Machines Corporation | Method for establishing user authenication with composite session keys among cryptographically communicating nodes |
US4757534A (en) * | 1984-12-18 | 1988-07-12 | International Business Machines Corporation | Code protection using cryptography |
US4850017A (en) * | 1987-05-29 | 1989-07-18 | International Business Machines Corp. | Controlled use of cryptographic keys via generating station established control values |
US4876716A (en) * | 1986-08-22 | 1989-10-24 | Nec Corporation | Key distribution method |
US4935961A (en) * | 1988-07-27 | 1990-06-19 | Gargiulo Joseph L | Method and apparatus for the generation and synchronization of cryptographic keys |
US4955082A (en) * | 1988-01-14 | 1990-09-04 | The Tokyo Electric Power Company Ltd. | Mobile communication system |
US4956769A (en) * | 1988-05-16 | 1990-09-11 | Sysmith, Inc. | Occurence and value based security system for computer databases |
US5136642A (en) * | 1990-06-01 | 1992-08-04 | Kabushiki Kaisha Toshiba | Cryptographic communication method and cryptographic communication device |
US5148481A (en) * | 1989-10-06 | 1992-09-15 | International Business Machines Corporation | Transaction system security method and apparatus |
US5150411A (en) * | 1990-10-24 | 1992-09-22 | Omnisec | Cryptographic system allowing encrypted communication between users with a secure mutual cipher key determined without user interaction |
US5265221A (en) * | 1989-03-20 | 1993-11-23 | Tandem Computers | Access restriction facility method and apparatus |
US5271007A (en) * | 1990-12-25 | 1993-12-14 | Fuji Xerox Co., Ltd. | Network system having controlled access to available resources |
US5283830A (en) * | 1991-12-17 | 1994-02-01 | International Computers Limited | Security mechanism for a computer system |
US5369702A (en) * | 1993-10-18 | 1994-11-29 | Tecsec Incorporated | Distributed cryptographic object method |
US5375169A (en) * | 1993-05-28 | 1994-12-20 | Tecsec, Incorporated | Cryptographic key management method and apparatus |
US5438508A (en) * | 1991-06-28 | 1995-08-01 | Digital Equipment Corporation | License document interchange format for license management system |
US5446903A (en) * | 1993-05-04 | 1995-08-29 | International Business Machines Corporation | Method and apparatus for controlling access to data elements in a data processing system based on status of an industrial process by mapping user's security categories and industrial process steps |
US5459860A (en) * | 1992-10-05 | 1995-10-17 | International Business Machines Corporation | Computerized system and process for managing a distributed database system |
US5493668A (en) * | 1990-12-14 | 1996-02-20 | International Business Machines Corporation | Multiple processor system having software for selecting shared cache entries of an associated castout class for transfer to a DASD with one I/O operation |
US5504814A (en) * | 1991-07-10 | 1996-04-02 | Hughes Aircraft Company | Efficient security kernel for the 80960 extended architecture |
US5606610A (en) * | 1993-11-30 | 1997-02-25 | Anonymity Protection In Sweden Ab | Apparatus and method for storing data |
US5659614A (en) * | 1994-11-28 | 1997-08-19 | Bailey, Iii; John E. | Method and system for creating and storing a backup copy of file data stored on a computer |
US5661799A (en) * | 1994-02-18 | 1997-08-26 | Infosafe Systems, Inc. | Apparatus and storage medium for decrypting information |
US5680452A (en) * | 1993-10-18 | 1997-10-21 | Tecsec Inc. | Distributed cryptographic object method |
US5699428A (en) * | 1996-01-16 | 1997-12-16 | Symantec Corporation | System for automatic decryption of file data on a per-use basis and automatic re-encryption within context of multi-threaded operating system under which applications run in real-time |
US5751949A (en) * | 1995-05-23 | 1998-05-12 | Mci Corporation | Data security system and method |
US5757908A (en) * | 1994-04-25 | 1998-05-26 | International Business Machines Corporation | Method and apparatus for enabling trial period use of software products: method and apparatus for utilizing an encryption header |
US5768276A (en) * | 1992-10-05 | 1998-06-16 | Telefonaktiebolaget Lm Ericsson | Digital control channels having logical channels supporting broadcast SMS |
US5915025A (en) * | 1996-01-17 | 1999-06-22 | Fuji Xerox Co., Ltd. | Data processing apparatus with software protecting functions |
US5915017A (en) * | 1996-03-13 | 1999-06-22 | Altera Corporation | Method and apparatus for securing programming data of programmable logic device |
US5917915A (en) * | 1994-06-24 | 1999-06-29 | Sony Corporation | Scramble/descramble method and apparatus for data broadcasting |
US5933498A (en) * | 1996-01-11 | 1999-08-03 | Mrj, Inc. | System for controlling access and distribution of digital property |
US5940507A (en) * | 1997-02-11 | 1999-08-17 | Connected Corporation | Secure file archive through encryption key management |
US5963642A (en) * | 1996-12-30 | 1999-10-05 | Goldstein; Benjamin D. | Method and apparatus for secure storage of data |
US6098172A (en) * | 1997-09-12 | 2000-08-01 | Lucent Technologies Inc. | Methods and apparatus for a computer network firewall with proxy reflection |
US6172664B1 (en) * | 1993-12-07 | 2001-01-09 | Sharp Kabushiki Kaisha | Electronic apparatuses capable of scrambling confidential data for display |
US6199582B1 (en) * | 1998-12-25 | 2001-03-13 | Advance Denki Kougyou Kabushiki | Flow control valve |
US6321201B1 (en) * | 1996-06-20 | 2001-11-20 | Anonymity Protection In Sweden Ab | Data security system for a database having multiple encryption levels applicable on a data element value level |
Family Cites Families (35)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4827508A (en) | 1986-10-14 | 1989-05-02 | Personal Library Software, Inc. | Database usage metering and protection system and method |
GB9003112D0 (en) | 1990-02-12 | 1990-04-11 | Int Computers Ltd | Access control mechanism |
JPH03276936A (en) * | 1990-03-27 | 1991-12-09 | Nippon Telegr & Teleph Corp <Ntt> | Communication system |
RU2022343C1 (en) | 1990-08-01 | 1994-10-30 | Серпуховское высшее военное командно-инженерное училище ракетных войск им.Ленинского комсомола | Storage protective device |
GB2248951B (en) | 1990-10-17 | 1994-04-06 | Computer Resources Research Li | Retrieval of data from a stored database |
US5355474A (en) | 1991-09-27 | 1994-10-11 | Thuraisngham Bhavani M | System for multilevel secure database management using a knowledge base with release-based and other security constraints for query, response and update modification |
US5265164A (en) | 1991-10-31 | 1993-11-23 | International Business Machines Corporation | Cryptographic facility environment backup/restore and replication in a public key cryptosystem |
IL100238A (en) * | 1991-12-04 | 1995-01-24 | Labaton Isaac J | Device and method for credit accounts charging |
US5396623A (en) | 1992-10-30 | 1995-03-07 | Bmc Software Inc. | Method for editing the contents of a DB2 table using an editproc manager |
JPH06175842A (en) | 1992-12-07 | 1994-06-24 | Ricoh Co Ltd | Integrated document processor |
US5343527A (en) | 1993-10-27 | 1994-08-30 | International Business Machines Corporation | Hybrid encryption method and system for protecting reusable software components |
CA2149866C (en) | 1993-11-15 | 1999-04-27 | John L. Hayes | A method and system for maintaining access security of input and output operations in a computer system |
GB9402935D0 (en) | 1994-02-16 | 1994-04-06 | British Telecomm | A method for controlling access to a database |
JPH07262072A (en) | 1994-03-16 | 1995-10-13 | Fuji Xerox Co Ltd | File controller |
JPH07295876A (en) | 1994-04-20 | 1995-11-10 | Fuji Xerox Co Ltd | Access right controlling device |
JP3453842B2 (en) | 1994-04-26 | 2003-10-06 | 三菱電機株式会社 | Secure system |
CA2683230C (en) | 1995-02-13 | 2013-08-27 | Intertrust Technologies Corporation | Systems and methods for secure transaction management and electronic rights protection |
RU2067313C1 (en) | 1995-03-29 | 1996-09-27 | Акционерное общество закрытого типа "Особое конструкторское бюро систем автоматизированного проектирования" | Device for protection against unauthorized access to information that is stored in personal computer |
US6078925A (en) | 1995-05-01 | 2000-06-20 | International Business Machines Corporation | Computer program product for database relational extenders |
US5678041A (en) | 1995-06-06 | 1997-10-14 | At&T | System and method for restricting user access rights on the internet based on rating information stored in a relational database |
US5706507A (en) | 1995-07-05 | 1998-01-06 | International Business Machines Corporation | System and method for controlling access to data located on a content server |
US6112199A (en) | 1995-10-18 | 2000-08-29 | Nelson; Paul M. | Data item values |
US5787175A (en) | 1995-10-23 | 1998-07-28 | Novell, Inc. | Method and apparatus for collaborative document control |
SE9603753L (en) | 1996-10-14 | 1998-04-06 | Mirror Image Internet Ab | Procedure and apparatus for information transmission on the Internet |
WO1998051095A2 (en) | 1997-05-09 | 1998-11-12 | Dsc Telecom L.P. | Scp database migration |
US6397330B1 (en) | 1997-06-30 | 2002-05-28 | Taher Elgamal | Cryptographic policy filters and policy control method and apparatus |
US6122640A (en) | 1998-09-22 | 2000-09-19 | Platinum Technology Ip, Inc. | Method and apparatus for reorganizing an active DBMS table |
AU760436B2 (en) | 1998-10-16 | 2003-05-15 | Matsushita Electric Industrial Co., Ltd. | Production protection system dealing with contents that are digital production |
US6421688B1 (en) | 1999-10-20 | 2002-07-16 | Parallel Computers Technology, Inc. | Method and apparatus for database fault tolerance with instant transaction replication using off-the-shelf database servers and low bandwidth networks |
SE9904094D0 (en) | 1999-11-12 | 1999-11-12 | Protegrity Research & Dev | Method for reencryption of a database |
SE516452C2 (en) | 2000-11-16 | 2002-01-15 | Protegrity Res & Dev | Method for changing encryption status in a relational database in continuous process |
SE517808C2 (en) | 2000-11-16 | 2002-07-16 | Protegrity Res & Dev | Combined hardware and software based encryption of databases |
SE518166C2 (en) | 2000-11-27 | 2002-09-03 | Protegrity Res & Dev | Data type encryption |
SE524522C2 (en) | 2000-11-29 | 2004-08-24 | Protegrity Res & Dev | Method and system for preventing an administrator from mimicking a database user |
US8316051B1 (en) * | 2001-11-30 | 2012-11-20 | Oralce International Corporation | Techniques for adding multiple security policies to a database system |
-
1996
- 1996-06-20 SE SE9602475A patent/SE506853C2/en not_active IP Right Cessation
-
1997
- 1997-06-18 DE DE69730321T patent/DE69730321T2/en not_active Expired - Lifetime
- 1997-06-18 EP EP04019479A patent/EP1477881A3/en not_active Withdrawn
- 1997-06-18 RU RU99100700/09A patent/RU2198423C2/en not_active IP Right Cessation
- 1997-06-18 KR KR1019980710460A patent/KR20000022057A/en active IP Right Grant
- 1997-06-18 CZ CZ19984158A patent/CZ288947B6/en not_active IP Right Cessation
- 1997-06-18 CN CNB971956685A patent/CN1146178C/en not_active Expired - Lifetime
- 1997-06-18 BR BR9710694A patent/BR9710694A/en not_active IP Right Cessation
- 1997-06-18 WO PCT/SE1997/001089 patent/WO1997049211A1/en active IP Right Grant
- 1997-06-18 AU AU32823/97A patent/AU724388B2/en not_active Expired
- 1997-06-18 EP EP97928615A patent/EP0891661B1/en not_active Expired - Lifetime
- 1997-06-18 AT AT97928615T patent/ATE274264T1/en not_active IP Right Cessation
- 1997-06-18 JP JP50281898A patent/JP4167300B2/en not_active Expired - Lifetime
- 1997-06-18 PT PT97928615T patent/PT891661E/en unknown
- 1997-06-18 SK SK1748-98A patent/SK174898A3/en unknown
- 1997-06-18 ES ES97928615T patent/ES2230609T3/en not_active Expired - Lifetime
- 1997-06-18 IL IL12764597A patent/IL127645A/en not_active IP Right Cessation
-
1998
- 1998-02-23 US US09/027,585 patent/US6321201B1/en not_active Expired - Lifetime
- 1998-12-18 NO NO985985A patent/NO985985L/en not_active Application Discontinuation
-
2001
- 2001-04-24 US US09/840,188 patent/US20020174352A1/en not_active Abandoned
-
2006
- 2006-11-21 US US11/603,967 patent/US20070180240A1/en not_active Abandoned
-
2010
- 2010-10-29 US US12/916,274 patent/US8402281B2/en not_active Expired - Fee Related
Patent Citations (45)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4218582A (en) * | 1977-10-06 | 1980-08-19 | The Board Of Trustees Of The Leland Stanford Junior University | Public key cryptographic apparatus and method |
US4405829A (en) * | 1977-12-14 | 1983-09-20 | Massachusetts Institute Of Technology | Cryptographic communications system and method |
US4424414A (en) * | 1978-05-01 | 1984-01-03 | Board Of Trustees Of The Leland Stanford Junior University | Exponentiation cryptographic apparatus and method |
US4375579A (en) * | 1980-01-30 | 1983-03-01 | Wisconsin Alumni Research Foundation | Database encryption and decryption circuit and method using subkeys |
US4417338A (en) * | 1981-04-13 | 1983-11-22 | Wisconsin Alumni Research Foundation | Cryptographic key sharing circuit and method using code correction |
US4757534A (en) * | 1984-12-18 | 1988-07-12 | International Business Machines Corporation | Code protection using cryptography |
US4649233A (en) * | 1985-04-11 | 1987-03-10 | International Business Machines Corporation | Method for establishing user authenication with composite session keys among cryptographically communicating nodes |
US4876716A (en) * | 1986-08-22 | 1989-10-24 | Nec Corporation | Key distribution method |
US4850017A (en) * | 1987-05-29 | 1989-07-18 | International Business Machines Corp. | Controlled use of cryptographic keys via generating station established control values |
US4955082A (en) * | 1988-01-14 | 1990-09-04 | The Tokyo Electric Power Company Ltd. | Mobile communication system |
US4956769A (en) * | 1988-05-16 | 1990-09-11 | Sysmith, Inc. | Occurence and value based security system for computer databases |
US4935961A (en) * | 1988-07-27 | 1990-06-19 | Gargiulo Joseph L | Method and apparatus for the generation and synchronization of cryptographic keys |
US5265221A (en) * | 1989-03-20 | 1993-11-23 | Tandem Computers | Access restriction facility method and apparatus |
US5148481A (en) * | 1989-10-06 | 1992-09-15 | International Business Machines Corporation | Transaction system security method and apparatus |
US5136642A (en) * | 1990-06-01 | 1992-08-04 | Kabushiki Kaisha Toshiba | Cryptographic communication method and cryptographic communication device |
US5150411A (en) * | 1990-10-24 | 1992-09-22 | Omnisec | Cryptographic system allowing encrypted communication between users with a secure mutual cipher key determined without user interaction |
US5493668A (en) * | 1990-12-14 | 1996-02-20 | International Business Machines Corporation | Multiple processor system having software for selecting shared cache entries of an associated castout class for transfer to a DASD with one I/O operation |
US5271007A (en) * | 1990-12-25 | 1993-12-14 | Fuji Xerox Co., Ltd. | Network system having controlled access to available resources |
US5438508A (en) * | 1991-06-28 | 1995-08-01 | Digital Equipment Corporation | License document interchange format for license management system |
US5504814A (en) * | 1991-07-10 | 1996-04-02 | Hughes Aircraft Company | Efficient security kernel for the 80960 extended architecture |
US5283830A (en) * | 1991-12-17 | 1994-02-01 | International Computers Limited | Security mechanism for a computer system |
US5459860A (en) * | 1992-10-05 | 1995-10-17 | International Business Machines Corporation | Computerized system and process for managing a distributed database system |
US5768276A (en) * | 1992-10-05 | 1998-06-16 | Telefonaktiebolaget Lm Ericsson | Digital control channels having logical channels supporting broadcast SMS |
US5446903A (en) * | 1993-05-04 | 1995-08-29 | International Business Machines Corporation | Method and apparatus for controlling access to data elements in a data processing system based on status of an industrial process by mapping user's security categories and industrial process steps |
US5375169A (en) * | 1993-05-28 | 1994-12-20 | Tecsec, Incorporated | Cryptographic key management method and apparatus |
US5369702A (en) * | 1993-10-18 | 1994-11-29 | Tecsec Incorporated | Distributed cryptographic object method |
US5680452A (en) * | 1993-10-18 | 1997-10-21 | Tecsec Inc. | Distributed cryptographic object method |
US5898781A (en) * | 1993-10-18 | 1999-04-27 | Tecsec Incorporated | Distributed cryptographic object method |
US5717755A (en) * | 1993-10-18 | 1998-02-10 | Tecsec,Inc. | Distributed cryptographic object method |
US5606610A (en) * | 1993-11-30 | 1997-02-25 | Anonymity Protection In Sweden Ab | Apparatus and method for storing data |
US6172664B1 (en) * | 1993-12-07 | 2001-01-09 | Sharp Kabushiki Kaisha | Electronic apparatuses capable of scrambling confidential data for display |
US5661799A (en) * | 1994-02-18 | 1997-08-26 | Infosafe Systems, Inc. | Apparatus and storage medium for decrypting information |
US5757908A (en) * | 1994-04-25 | 1998-05-26 | International Business Machines Corporation | Method and apparatus for enabling trial period use of software products: method and apparatus for utilizing an encryption header |
US5917915A (en) * | 1994-06-24 | 1999-06-29 | Sony Corporation | Scramble/descramble method and apparatus for data broadcasting |
US5659614A (en) * | 1994-11-28 | 1997-08-19 | Bailey, Iii; John E. | Method and system for creating and storing a backup copy of file data stored on a computer |
US5751949A (en) * | 1995-05-23 | 1998-05-12 | Mci Corporation | Data security system and method |
US5933498A (en) * | 1996-01-11 | 1999-08-03 | Mrj, Inc. | System for controlling access and distribution of digital property |
US5699428A (en) * | 1996-01-16 | 1997-12-16 | Symantec Corporation | System for automatic decryption of file data on a per-use basis and automatic re-encryption within context of multi-threaded operating system under which applications run in real-time |
US5915025A (en) * | 1996-01-17 | 1999-06-22 | Fuji Xerox Co., Ltd. | Data processing apparatus with software protecting functions |
US5915017A (en) * | 1996-03-13 | 1999-06-22 | Altera Corporation | Method and apparatus for securing programming data of programmable logic device |
US6321201B1 (en) * | 1996-06-20 | 2001-11-20 | Anonymity Protection In Sweden Ab | Data security system for a database having multiple encryption levels applicable on a data element value level |
US5963642A (en) * | 1996-12-30 | 1999-10-05 | Goldstein; Benjamin D. | Method and apparatus for secure storage of data |
US5940507A (en) * | 1997-02-11 | 1999-08-17 | Connected Corporation | Secure file archive through encryption key management |
US6098172A (en) * | 1997-09-12 | 2000-08-01 | Lucent Technologies Inc. | Methods and apparatus for a computer network firewall with proxy reflection |
US6199582B1 (en) * | 1998-12-25 | 2001-03-13 | Advance Denki Kougyou Kabushiki | Flow control valve |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20090187553A1 (en) * | 2008-01-21 | 2009-07-23 | Suman Kumar Sarkar | Method and system for facilitating verification of an entity based on business requirements |
US7836046B2 (en) * | 2008-01-21 | 2010-11-16 | Oracle Financial Services Software Limited | Method and system for facilitating verification of an entity based on business requirements |
US9524345B1 (en) | 2009-08-31 | 2016-12-20 | Richard VanderDrift | Enhancing content using linked context |
US9639707B1 (en) | 2010-01-14 | 2017-05-02 | Richard W. VanderDrift | Secure data storage and communication for network computing |
Also Published As
Publication number | Publication date |
---|---|
US20020174352A1 (en) | 2002-11-21 |
CZ288947B6 (en) | 2001-10-17 |
AU3282397A (en) | 1998-01-07 |
DE69730321T2 (en) | 2005-09-08 |
US6321201B1 (en) | 2001-11-20 |
US8402281B2 (en) | 2013-03-19 |
CN1146178C (en) | 2004-04-14 |
IL127645A0 (en) | 1999-10-28 |
WO1997049211A1 (en) | 1997-12-24 |
PT891661E (en) | 2005-01-31 |
SE9602475D0 (en) | 1996-06-20 |
US20110246788A1 (en) | 2011-10-06 |
EP0891661B1 (en) | 2004-08-18 |
ES2230609T3 (en) | 2005-05-01 |
CN1222272A (en) | 1999-07-07 |
SE506853C2 (en) | 1998-02-16 |
JP4167300B2 (en) | 2008-10-15 |
SK174898A3 (en) | 2000-02-14 |
SE9602475L (en) | 1997-12-21 |
EP1477881A2 (en) | 2004-11-17 |
RU2198423C2 (en) | 2003-02-10 |
ATE274264T1 (en) | 2004-09-15 |
BR9710694A (en) | 1999-08-17 |
NO985985D0 (en) | 1998-12-18 |
NO985985L (en) | 1999-02-19 |
EP0891661A1 (en) | 1999-01-20 |
DE69730321D1 (en) | 2004-09-23 |
CZ415898A3 (en) | 1999-07-14 |
JP2000512785A (en) | 2000-09-26 |
KR20000022057A (en) | 2000-04-25 |
AU724388B2 (en) | 2000-09-21 |
IL127645A (en) | 2002-12-01 |
EP1477881A3 (en) | 2013-02-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6321201B1 (en) | Data security system for a database having multiple encryption levels applicable on a data element value level | |
US5606610A (en) | Apparatus and method for storing data | |
Saltzer et al. | The protection of information in computer systems | |
US5414852A (en) | Method for protecting data in a computer system | |
US5822771A (en) | System for management of software employing memory for processing unit with regulatory information, for limiting amount of use and number of backup copies of software | |
EP0885417B1 (en) | Access control/crypto system | |
Mukherjee | Popular SQL server database encryption choices | |
GB2392277A (en) | A method of controlling the processing of data | |
Grachev et al. | Data security mechanisms implemented in the database with universal model | |
US10970408B2 (en) | Method for securing a digital document | |
CA2257975C (en) | Method and apparatus for data processing | |
Gangwar et al. | Database Security Measurements Issues in Adhoc Network | |
CN117494163A (en) | Data service method and device based on security rules | |
Serban | Frequently Used Methods for Securing Databases | |
Bottger et al. | Oracle Database 2 Day+ Security Guide, 12c Release 1 (12.1) E17609-14 | |
Farooqui et al. | An Empirical View of Database Security Measurements | |
Schweitzer | A management view: computer security as a discretionary decision | |
Gopal et al. | Oracle Database 2 Day+ Security Guide, 11g Release 2 (11.2) E10575-09 | |
Gopal et al. | Oracle Database 2 Day+ Security Guide, 11g Release 2 (11.2) E10575-08 | |
Pangalos | A tutorial on secure database systems | |
Syalim | Controlling Access to Encrypted Databases Using Multipolicy Access Control System | |
Gopal et al. | Oracle Database 2 Day+ Security Guide, 11g Release 2 (11.2) E10575-05 | |
Paans | With MVS/ESA security labels towards B1 | |
Van Rooyen | Evaluation of access control within the Millennium software package | |
Gopal et al. | Oracle Database 2 Day+ Security Guide, 11g Release 1 (11.1) B28337-07 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |