Guardtime IP Holdings Limited

Guardtime Sa

Garrett Day

Jeffrey Pearce

David E Hamilton, Jr

Kevin Zawicki

Roger Guseman

Hema Krishnamurthy

Matthew Johnson

Gregory Raymond

Initial data is included in a data structure such as an initial container at an initial entity, along with rules and a data signature of at least a portion of the initial data and other container contents relating to the initial entity and the initial data. Each rule defines at least one condition governing the permissible transfer and processing of the initial data by other entities in a provenance chain. Each receiving entity creates a container of its own to encapsulate received containers, and, after optional processing of its own, such as adding or altering data and rules, digital signature for its container. The digital signatures may be obtained from a hash tree-based signing infrastructure that returns data signatures enabling recomputation of a logically uppermost value of the hash tree. A lineage map of any given container may also be displayed for analysis by a user.

Data and data lineage control, tracking, and verification

Access by a requesting entity to an asset is authorized by an access-controlling entity, which transmits to the requesting entity a challenge data set and then receives from the requesting entity a response purportedly corresponding to a representation of the challenge data set in a non-repudiatable form, obtained from an event validation system. The access-controlling entity queries the event validation system to determine whether the response does correspond to a correct representation of the challenge data set in the non-repudiatable form, and authorizes the requesting entity for access only if the response is correct representation. Non-repudiation can be established through entry into a blockchain, or using a hash-tree-based digital signature infrastructure.

Challenge-response access control using context-based proof

Data acquired, for example by a mobile platform, such as a sequence of images observed by a mobile platform, is grouped. A signature is computed for each group and is transmitted along with frame data to a reception system, which verifies correct transmission based on the group signature. The signature may be a root value of a hash tree that has at least selected ones of each group as inputs. Transmission events may also be separately signed as a whole using an event validation system. Although the signature maybe computed for all frames in a group, it may also be computed based on only a subset, selected pseudo-randomly.

System and method for secure transmission of streamed data frames

Control of access by a requesting entity to an asset includes defining an approved state of the requesting entity. A validation of a representation of the approved state of in a non-repudiatable form in obtained from an event validation system. The requesting entity is triggered to determine its current state by an access-control entity, which compares the current state with the approved state and allows access by the requesting entity to the asset only if the current state is the same as the approved state. In a pre-authorization procedure, one or both of the entities issues a data set challenge to the other, which then validates the challenge via the event validation system and returns this validation to the challenging entity, which then checks the validation to see if it is correct. Data sets may be validated, for example, with hash tree based signatures or blockchain entries.

Growing community of inventors

Arlington, VA, United States of America

Garrett Day