Hewlett-packard Development Company, L.P.

Cheh Goh

Liqun Chen

Marco Casassa Mont

Stephen James Crane

Keith Alexander Harrison

Adrian John Baldwin

David Joel Clarke

Casassa Mont Marco

Data to be output to a removable storage medium is encrypted for sending to an output device by an encryption process based on encryption parameters comprising public data of a trusted party and an encryption key string comprising a policy for allowing the output of the data. The trusted party provides a decryption key to the output device but only after being satisfied that the policy has been met. The decryption key is generated in dependence on the encryption key string and private data of the trusted party. The output device uses the decryption key in decrypting the data to be output. Embodiments are provided that involve multiple policies and trusted parties.

Data output method, system and apparatus

To control access to target data whilst relieving the data provider of policing obligations, the data provider provides the target data in encrypted form to a requesting party as part of a data set with which first and second trusted authorities are associated in a non-subvertible manner. Recovery of the target data in clear by the party requires the first trusted authority to verify that a specific individual is a professional accredited with it, the second trusted authority to verify that a particular organisation is accredited with it, the particular organisation to verify that the specific individual is engaged by it, and at least one of the particular organisation and the first trusted authority to verify that the party is the specific individual. Various ways of encrypting the target data are provided, the preferred ways being based on Identifier-Based Encryption schemas.

Secure data provision method and apparatus and data recovery method and system

A trusted authority delegates authority to a device. This delegation of authority is effected by providing a yet-to-be completed chain of public/private cryptographic key pairs linked in a subversion-resistant manner. The chain terminates with a penultimate key pair formed by public/private data, and a link towards an end key pair to be formed by an encryption/decryption key pair of an Identifier-Based Encryption, IBE, scheme. The private data is securely stored in the device for access only by an authorized key-generation process that forms the link to the end key pair and is arranged to provide the IBE decryption key generated using the private data and encryption key. This key generation/provision is normally only effected if at least one condition, for example specified in the encryption key, is satisfied. Such a condition may be one tested against data provided by the trusted authority and stored in the device.

Method, system and device for enabling delegation of authority and access control methods based on delegated authority

A method of printing a document () stored at a home computing system () on a printer () of a remote computing system, the home and remote computing system including a home trusted print proxy (HTPP) () and a remote trusted print proxy (RTPP) (), respectively, which are configured to be able to establish communication via a communications link, in which the printer () includes a digital identification device () configured to provide a printer public key of a cryptographic public key/private key pair and the RTPP () is configured to supply a one time token on request, the method including the steps of using a mobile device () to interrogate the RTPP () and printer () to obtain a one time token and the printer public key using the mobile device () to transmit to the home computing system () a print request including the one time token and printer public and identification of the document () to be printed establishing a secure communications channel between the home and remote computing system via at least the HTPP and RTPP the home computing system () transmitting the document encrypted by the printer public key to the printer () via the secure communications channel and the printer () decrypting the encrypted document and initiating printing of the document only if the mobile device is in communication with the printer ().

Method of printing a document

An apparatus () is described for use in generating configuration information for a computer system () employing hierarchical entities. A policy template () is employed which contains a definition of an abstract high-level policy, for the configuration of the system, and permitted refinements to that policy, the definition referring to a plurality of the entities. An information and system model () contains information about the computer system and its environment including the entities referred to in the high-level policy definition, the hierarchy thereof and non-hierarchical relations between the entities. A policy authoring engine () refines the high-level policy definition with reference to the permitted refinements thereto and the stored information about the entities to which the high-level policy definition relates in order to produce a refined policy definition. In doing this, the engine presents refinement options to a user () via a user interface () and refines the high-level policy definition in dependence upon options selected by the user via the user interface. Some of the entities stored in the model () may be abstract entities, but with pointers to data in the computer system representing an instance of that abstract entity. The refined policy may be in terms of a policy context, referring to unbound entities, and a policy statement. A policy deployer () stores rules for interpreting the policy statement as instructions executable by the computer system and is operable, with reference to the information and system model (), to bind the unbound entities in the policy context to instances of those entities, and, with reference to the stored rules, to interpret the policy statement into a series of instructions to the computer system referring to the bound instances or derivatives of them. The apparatus facilitates the refinement of abstract policies and implementation of the refined policies.

Configuring computer systems

A method of printing a token by printer ( ), in which the printer ( ) includes a digital identification device ( ) configured to generate a series of distinct print job counter numbers and to provide a public key of a cryptographic public key/private key pair. The method includes the steps of sending a printer generated print job counter number and an encryption key to a token issuer ( ) the token issuer ( ) sending to the printer ( ) a message encrypted by the encryption key, the message including the print job counter number and information representative of the token ( ) to be printed and the printer ( ) decrypting the encrypted message and printing the token using the information representative of the token ( ) if the print job counter number is valid.

Growing community of inventors

Singapore, Singapore

Cheh Goh