Gemalto Sa

Thales Dis Cpl Usa, Inc.

Thales Dis France Sa

Thales Dis France Sas

Gemalto Inc.

Asad Mahboob Ali

HongQian Karen Lu

Kapil Sachdeva

Laurent Castillo

Didier Hugot

Michael Hutchinson

Apostol Vassilev

Ed Dolph

Benoît Famechon

Najam Siddiqui

Gorav Arora

Ella Segura

Sylvain Jacques Prevost

Michael Andrew Montgomery

Bertrand Du Castel

Bart J Bombay

Stephane Durand

Lu Karen HongQian

Darmawan Suwirya

Ashish Malpani

Ijaz Muhammad Khan

Yateendra Jaiman

Pranay Shahab Gupta

Karen HongQian Lu

Ensuring user privacy in a publisher-subscriber communications environment. Storing, by a user-identifier mapping server, a user-identity database mapping user identity to subscriber-anonymized user identifier and subscriber identifier for users of said plurality of subscribers. Receiving, by the user-identifier mapping server, an information-request message from a subscriber, the information-request message concerning a notification message from a publisher, the notification message including an anonymized username of a first user of the publisher and wherein the username of the first user is anonymized using the one-way anonymization function. Upon receiving, by the user-identifier mapping server, the information-request message, determining from the user-identity database whether the first user is a user of the subscriber and transmitting a response message to subscriber indicating whether the first user is a user of the subscriber.

Identity and privacy preservation in asynchronous communications

A system or method of image-based login authentication of a user on an access device using a mobile device registered to the user can include receiving login information at the access device, displaying an image reference at the access device, the image reference being one among a plurality of image references provisioned at the mobile device and an authentication authority, displaying the image reference selected by the authentication authority along with other image references, and receiving an authentication token at the authentication authority from the mobile device corresponding to a selection at the mobile device of one of the plurality of image references provisioned at the mobile device. The method can further include receiving validation by the access device of a completed authentication if the selection matches the image reference displayed at the access device and allowing login at the access device if the authentication token is validated.

System and method of imaged based login to an access device

A system or method of secure data entry can include one or more processors and memory having computer instructions which when executed by the one or more processors causes the one or more processors to perform the operations at a client edge device of executing a user interface data entry application on the client edge device, receiving data by the user interface data entry application, wherein the data entered is a graphic input pattern corresponding to characters, communicating the data entered to a server, and receiving access to the server if a data processing application at the server interprets the data entered as a credential based on rules negotiated between the data entry application and the data processing application and a template for the graphic input pattern.

Apparatus, system and method for secure data entry

A system and method for backing up critical data of edge devices includes originator, surrogate, and target edge devices as well as a vault-broker server. The critical data, encrypted, is transmitted to and stored by a surrogate. The association of originator and surrogate is managed by the vault-broker server. Encryption protects the data from recovery by unauthorized parties while allowing surrogate edge devices to determine if recovery attempts are made by authorized parties.

Backup and recovery of private information on edge devices onto surrogate edge devices

A method for providing a user authentication credential comprises a) registering, in a device, at least one reference character, as a first user authentication credential; b) submitting, by the user, to the device, at least one character, as a second user authentication credential; c) retrieving, by the device, each reference character along with a corresponding position within the first user authentication credential; d) comparing, by the device, each submitted character within the second user authentication credential to a corresponding reference character within the first user authentication credential at one and the same position within the second user authentication credential and the first user authentication credential; and e) providing, by the device to the user, if the submitted character does not match the corresponding reference character, an information item for prompting the user to correct the submitted character.

Method and device for providing a user authentication credential

A method, an entity, and a system for managing access to data. The data is associated with metadata. At least one predetermined access policy for accessing metadata includes, for each client, at least one identifier relating to the client. An entity receives from at least one client device, a data access request that includes at least one identifier relating to the client. The entity determines, based on the associated access policy, whether the metadata access is authorized. If yes, the entity determines, based on the associated access policy, associated first data allowing to access the metadata. The entity accesses, based on the first data, the associated metadata. The entity accesses, based on the accessed metadata and the associated access policy, at least a part of the associated data, as a late dynamic binding of the metadata with the associated data (or a part of it).

Method, entity and system for managing access to data through a late dynamic binding of its associated metadata

A method for authenticating a user includes connecting to a server from a user device, loading from the server to the user device data including executable data, detecting by the user device, while executing the executable data, whether an identifier relating to a short range communication device exists in a vicinity of the user device, sending from the user device to the server a user identifier accompanied with the detected short range communication device identifier, verifying by the server for the identified user whether a detected short range communication device identifier matches a predetermined part of a reference short range communication device identifier. Access is granted from the server only if the detected short range communication device identifier matches the predetermined part of the reference short range communication device identifier.

Method for authenticating a user and corresponding user device, server and system

A server accesses a user identifier associated with a first user device and a reference image as a first image set, to be displayed. The server sends to a second user device an image, as a second image set, to be displayed, and a user request to select an image within the first image set. The second user device displays the second image set and the user request. The user of the first user device selects at least one displayed first image, the selected first image matching an image visually selected within the displayed second image set, according to a rule known to the user and the server. The first user device sends to the server the first user device identifier accompanied with data relating to the selected first image. If the data relating to the selected first image matches the data relating to the first reference image the server authenticates the user.

Method for authenticating a user based on an image relation rule and corresponding first user device, server and system

The invention relates to a method for managing data access. The method includes receiving at least one request for accessing data; capturing data relating to at least one current context signal during each data access request; comparing, as a current authorization step, the data relating to at least one captured current context signal to predetermined reference data relating to at least one corresponding context signal according to at least one corresponding predetermined authorization policy; determining, based upon the current authorization result and at least one predetermined dynamic data access policy, whether the data access is or is not authorized, as a data access decision; and issuing the data access decision. The invention also relates to corresponding first device, second device and system.

Method, first device, second device and system for managing access to data

A method provides access to data or a service from a first device relating to a first user. A set of identifiers relating each to a second device is predefined. Each second device is related to a second user. A server receives, from the first device, a request for accessing the data or service from a current location relating to the first user. The server sends, to each selected second device, a request to determine whether the first user is locally present. Each selected second device requests, from to the second device user, whether the first user is locally present. Each selected second device gets, from the second user, a presence response and sends, to the server, the presence response. The server verifies whether the received presence response includes a predefined positive presence response. If yes, the server authorizes the first device to access the data or service.

Method for accessing data or a service from a first user device and corresponding second user device, server and system

The present invention relates to a web server having a web application using published API of one or more cloud storage providers, said web application being dedicated to secure and economical sharing of encrypted files residing at the cloud storage providers, said files being managed under a virtual folder which is shared by a group of different entities.

Server and method for secure and economical sharing of data

A method to manage modification of encryption credentials for an encryption server. The encryption server is used to encrypt data uploaded by a user after provision of user encryption credentials associated with an encryption account. The data is encrypted by using a user encryption key stored in a cloud storage server.

Method to manage modification of encryption credentials

A method to securely and asynchronously provisioning keys from one source secure device to a target secure device through a key provisioning server, in which the keys to be provisioned via the method remain unknown. The method includes the steps of, for the source secure device, encrypting a key to be transferred using a transport key so that only the target secure device can decrypt, and sending the encrypted key to the provisioning server and, for the target secure device, when available, getting the encrypted transferred key, and decrypting the transferred key using the transport key.

Method for asynchronously provisioning keys from one secure device to another

A secure portable electronic device for providing secure services when used in conjunction with a host computer. The secure portable device includes a read-only memory partition, a read/write memory partition, and a secure memory partition. The secure portable device includes instructions stored in the read-only partition including a host agent containing instructions executable by the host computer. The secure portable device also includes instructions stored in the secure memory partition. These instructions include a card agent containing instructions executable by central processing units secure portable electronic device, and includes a card agent communications module for communicating with the host agent; and a security module for accessing private information stored in the secure memory partition. The host agent includes a host agent communications module for communicating with the card agent and at least one function requiring use of private information stored in the secure memory partition of the portable device and operable to transmit a request to the card agent to perform a corresponding function requiring the use of private information stored on the portable device.

Method and system of providing security services using a secure device

A secure portable electronic device for providing secure services when used in conjunction with a host computer having a central processing unit use two hardware device protocols readily supported by computer operating systems. Other systems and methods are disclosed.

Growing community of inventors

Austin, TX, United States of America

Asad Mahboob Ali