Crypto4a Technologies Inc.

Safenet, Inc.

Safenet Canada. Inc.

Ciypto4a Technologies Inc.

Bruno Couillard

James Ross Goodman

Bradley Clare Ritchie

Jean-Pierre Fiset

Described are various embodiments of a digital data comparison filter, system and method, and applications therefor. In one embodiment, a digital data comparator system comprises two or more transformation engines each having securely stored in association therewith a common key, a common designated comparator threshold number, and a respective identifier; and a reconstitution engine operable to access partial encryption information from each transformation engine and, only upon relating to identical digital data, process each partial encryption information to successfully release the identical digital data.

Digital data comparison filter, system and method, and applications therefor

Described are various embodiments of an integrated network appliance and system. In one embodiment, the appliance comprises: a hardware-integrated processing engine operable to implement a trusted network-related resource; an integrated digital data processor operable to execute said processing engine; an integrated data storage resource accessible to said processing engine to implement said trusted network-related resource; an integrated location sensor; and an embedded hardware security module (HSM) hardwired to interface with said hardware-integrated processing engine via a dedicated hardware-isolated communication path, and operable to execute a trusted internal cryptographic process associated with said trusted network-related resource as a function of location data output from said integrated location sensor.

Integrated network security appliance, platform and system

Described are various embodiments of a hardware security module, hardwired port interconnection matrix, and embedded communication channel resources operable on selected hardware port-specific data communicated via this matrix.

Hardware security module, and trusted hardware network interconnection device and resources

Described are various embodiments of a secure cloud-based system. In one such embodiment, the secure cloud-based system includes a distribution of digital network processing resources and a central digital processing environment. The central processing environment includes a secure network interface to each of said digital processing resources; a digital hardware processor; and a deployment engine operable to serially deploy a unique ephemeral machine executable code instance, via said secure network interface, to a given one of said digital processing resources to be executed thereon for a predetermined runtime period, wherein execution of each said unique ephemeral machine executable code instance is automatically terminated after said predetermined runtime period to be operatively replaced by a subsequent unique ephemeral machine executable code instance.

Secure cloud-based system, and security application distribution method to be automatically executed therein

Described are various embodiments of an integrated multi-level or cross-domain network security appliance and system. In one embodiment, a cross-domain network traffic management appliance comprises: an external hardware network domain port to interface with an external network corresponding with a first network security domain, and exchange domain-specific data therethrough; a cross-domain hardware port to interface with a second network security domain and exchange cross-domain data therethrough; one or more hardware-integrated processing engines; and a hardware-integrated interconnection matrix configured to define, in hardware, designated data communication paths to interconnect said processing engines; wherein said one or more hardware-integrated processing engines are operable to: process and validate ingress first domain data received from said first network security domain via said external hardware port for cross-domain egress via said cross-domain hardware port; and process cross-domain ingress data received via said cross-domain hardware port for dispatch to said first network security domain via said external hardware network port; wherein cross-domain egress and ingress data is internally encrypted and decrypted, respectively, in accordance with a designated destination-domain encryption process.

Integrated multi-level or cross-domain network security management appliance, platform and system, and remote management method and system therefor

Described are various embodiments of a machine executable code deployment method and system. In one such embodiment, a machine executable code deployment method is described to comprise: compiling machine readable code in a secure digital processing environment to produce a unique ephemeral machine executable code instance representative thereof; deploying the unique ephemeral machine executable code instance to a distinct digital processing environment to be executed thereon for a predetermined runtime period, wherein execution of the unique ephemeral machine executable code instance is automatically terminated after the predetermined runtime period; and repeating the deploying for subsequent unique ephemeral machine executable code instances.

Secure machine executable code deployment and execution method and system

Described include various embodiments of an integrated multi-level network appliance and system, and remote management system and method therefor. In one embodiment, the appliance can comprise: two or more hardware-integrated processing engines each operable to implement a corresponding network-related resource associated with a respective network level in accordance with a designated multi-level network architecture; an integrated processor operable to execute the processing engines; one or more integrated data storage resources accessible to the processing engines to implement each corresponding network-related resource; and a trusted single-chip switch having a plurality of hardware ports associated therewith and configured to define in hardware multiple data communication paths embedded therein.

Integrated multi-level network appliance, platform and system, and remote management method and system therefor

Described are various embodiments of a hardware security module. For example, in one embodiment, a hardware security module is described to comprise: two or more hardware ports, each one of which operable to electronically receive given input hardware port-specific cryptographic data thereon to initiate execution of an internal cryptographic process as a function thereof; two or more segregated hardware port-specific storage spaces each operatively linked to a corresponding one of said hardware ports via a corresponding hardware link, and storing respective secured hardware port-specific cryptographic data thereon exclusively retrievable as a function of said given input hardware port-specific cryptographic data corresponding thereto; and a cryptographic engine operable to execute said cryptographic process based on said secured port-specific cryptographic data retrieved from said segregated hardware port-specific storage spaces as a function of said given input port-specific cryptographic data.

Hardware security module

Disclosed are a system and a method for transferring with improved security root keys from a key provider system to a customer system via an information network that is other than secure. The key provider provides a secure module having a super-root key stored therein within the customer system. The super-root key is accessible internally to the module only by program code executable on a processor internal to the module, and only in response to a request from a corresponding module of the key provider system. The super-root key is only for use in decrypting encrypted root keys that are provided from the key provider system, which decrypted root keys are stored internally to the secure module.

Method and system providing improved security for the transfer of root keys

A method and system for securely timestamping digital data is disclosed. A secure encryption key is provided within a timestamping module. The timestamping module comprises a processor for performing security functions with the secure encryption key. The processor is operable in a first mode wherein the secure encryption key is used for encryption operations and for test operations and in a second mode in which the secure encryption key is only used for timestamping operations. Once the processor performs a function with the secure encryption key in the second mode it is precluded from performing further functions in the first mode with the secure encryption key. After the processor has been placed in the second mode of operation a unique code for being embedded within timestamped digital data is generated. Data indicative of a real time a request for a timestamping operation has been received is then provided to the processor from a real time clock. Based on the data indicative of a real time a timestamp is generated using the secure encryption key. The timestamp is embedded within the digital data and the unique code is inserted within the digital data. The digital data with the inserted data therein are then encoded to form timestamped digital data. Upon receipt of the securely timestamped digital data the unique code is retrieved from the securely timestamped digital data in order to verify the authenticity of the time data.

Method and system for securely timestamping digital data

A method for synchronizing a timing device of a client station via a communications network is disclosed. A plurality of packets is sent from a time server to the client station via the communications network. Upon receipt of the plurality of packets at the client station a time indicative of a local time of receipt of the plurality of packets is determined and the plurality of packets are returned to the time server via the communications network. Upon receipt of the plurality of packets at the time server data in dependence upon round trip delay of the packets and variance in packet spacing are determined and compared to threshold values. If the determined data are within the threshold values data indicative of a time correction are determined and sent from the time server to the client station.

Method and system for time synchronization

A biometrically secured memory IC is disclosed for biometrically securing digital data stored therein. The memory IC comprises a biometric sensing device such as a fingerprint imager and an integrated circuit. The biometric sensing device and the integrated circuit are irremovably bonded together such that the sensing device and the integrated circuit form a single physical unit. Biometric information provided to the sensing device is captured and a signal indicative of the biometric information is provided to the integrated circuit. The signal is then converted into digital data indicative of the signal using an A/D converter. A processor compares the digital data indicative of the biometric information with first digital data indicative of a biometric characteristic of an authorized user, which is stored in first memory to produce a comparison result. If the comparison result is indicative of a match the processor provides access to second digital data stored in second memory. The integrated circuit further comprises a port for providing and/or receiving second digital data. The circuitry for the A/D converter, the processor, first memory and second memory are all contained within a single integrated circuit. With an aspect of the invention there is further disclosed a method for copying second digital data from a first biometrically secured memory IC to a second void biometrically secured memory IC. The combination of the data storage as well as the biometric security system in a single unit such as a chip provides a substantially tamperproof device making it next to impossible to access the data without destroying the device.

Growing community of inventors

Gatineau, Canada

Bruno Couillard