Massachusetts Institute of Technology

Cambridge Interactive Development Corp.

Grand Virtual, Inc.

Daniil M Utin

Roger I Khazan

David Whelihan

Joshua Kramer

Mankuan Michael Vai

Adam Shawn Petcher

A circuit for secure operation includes a plurality of mutually exclusive circuit zones including a first circuit zone having a first level of security and a second circuit zone having a second level of security less than the first level of security and one or more gate circuits each providing limited transfer of data between the circuit zones, the gate circuits providing all data connectivity between the first circuit zone and the second circuit zone and statically configured to prevent unmodified transfer of data from the first circuit zone to the second circuit zone.

Data security using inter-zone gate circuits

A method for establishing a secure communication session over communication paths between one or more client devices and one or more server computers according to a communication protocol includes initiating the session including passing communication through a proxy on a device on the communication paths, passing session initiation information between the client devices and the server computers via the proxy, passing encrypted content between the client devices and the server computers over secure communication sessions, each established for exclusive access from one client device and one server computer based on the exchanged session initiation information between said client device and said server computer whereby the proxy does not have access to the content, and modifying, using the proxy, at least some information passing between a client device and a server computer such that the communication to and from the server computer adheres to the communication protocol.

Optimized transport layer security

A method for operating a secure device having a plurality of mutually exclusive circuit zones, including a first circuit zone having a first level of security and a second circuit zone having a second level of security less than the first level of security, the method including unpacking a key exchange package including receiving a key exchange package in the second circuit zone, the key exchange package including encrypted key data and processing the encrypted key data using a content key in the first circuit zone to generate decrypted key data and storing the decrypted key data in the first circuit zone without disclosing the decrypted key data into the second circuit zone.

Cryptography and key management device verification

Cryptography and key management device and architecture

A password-encrypted key (PEK) is generated from a user-supplied password or other identifying data and then used to encrypt the user's password. The encrypted password is stored in a user record on a server. At login a would-be user's password is again used to make a key, which is then used to decrypt and compare the stored encrypted password with the would-be user's password to complete the login. The successful PEK is stored in a temporary session record and can be used to decrypt other sensitive user information previously encrypted and stored in the user record as well as to encrypt new information for storage in the user record. A public/private key system can also be used to maintain limited access for the host to certain information in the user record.

Password encryption key

A method for transportation of material includes operating a material transportation vehicle according to a material transportation plan. The plan includes a representation of one or more regions within a geographical area, each of the regions being associated with a group of one or more communication stations and a representation of a route of travel within the geographical area. The route of travel traverses a first region of the one or more regions within the geographical area. The operating includes causing the vehicle to travel along the route of travel including causing the vehicle to enter the first region, accepting control information originating from a first communication station of the communication stations associated with the first region, the first communication station being authorized to control a material transportation resource of the vehicle in the first region, and causing an exchange of the material according to the accepted control information.

Location based access control of material transportation vehicle resources

A tamperproof ClientID system to uniquely identify a client machine is invoked upon connection of a client application to a backend. Upon initial connection, the backend issues a unique ClientID containing a checksum. The client application prepares at least two different scrambled versions of the ClientID and stores them in respective predetermined locations on the client machine. Upon subsequent connection to the backend, the client application retrieves and unscrambles the values at the two locations, verifies the checksums and compares the values. If the checksums are both correct and the values match, the ClientID value is sent to the backend, otherwise the client application sends an error code.

Fixed client identification system for positive identification of client to server

In an aspect, the invention features a method for mission planning. The method includes displaying a graphical representation of a geographical area and displaying a graphical representation of one or more regions within the geographical area. The method also includes accepting a specification of geographical regions from a user, accepting a specification of a set of one or more receivers from the user, and accepting a specification of resource access rights associated with the specific one of the geographical regions from the user. The method also includes remotely causing access to a vehicle's resources to be provided or denied to the specified set of one or more receivers based on their association with the specific one of the geographical regions specified by the user when the vehicle is within the specific one of the geographical regions specified by the user.

Mission planning interface for accessing vehicle resources

A tamperproof ClientID system to uniquely identify a client machine is invoked upon connection of a client application to a backend. Upon initial connection, the backend issues a unique ClientID containing a checksum. The client-application prepares at least two different scrambled versions of the ClientID and stores them in respective predetermined locations on the client machine. Upon subsequent connection to the backend, the client application retrieves and unscrambles the values at the two locations, verifies the checksums and compares the values. If the checksums are both correct and the values match, the ClientID value is sent to the backend, otherwise the client application sends an error code.

Growing community of inventors

Waban, MA, United States of America

Daniil M Utin