Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
  • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
  • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/16—Implementing security features at a particular protocol layer
  • H04L63/168—Implementing security features at a particular protocol layer above the transport layer

Definitions

• FIG. 1 shows a system for resident or roaming user being fixed or mobile to securely get access to sensitive stored information whether online or offline according to one or more embodiments of the present disclosure:
• FIG. 2 shows a flow chart of the St
• FIG. 3 shows a flow chart of the St
• entry sensitive information to its account private data list according to one or more embodiments of the present disclosure.
• FIG. 4 shows a flow chart of the steps for a user to select an existing entry from its private data list for update or deletion according to one or more embodiments of the present disclosure.
• FIG. 5 shows a flow chart of the steps for a user to select from personal mailbox an email with crypted sensitive information according to one or more embodiments of the present disclosure.
• the information required is user email address as login and password with mandatory strong validation scheme.
• a 2 nd factor protection key is required too, such that only the user is owner of a private key and no reverse deciphering is possible. So the system is unaware of user private data, a token is encrypted using AES 256 bits PCKBS#12 for identifying the user.
• a proprietary combination of existing and new implemented ciphering algorithm is used to protect both user sensitive private data & stored data in the database. If any intrusion & /or spoofing - phishing on user identity occurs, depending a security level set by the user, the 2 nd factor protection prevent anyone to get access to its account information.
• the system on subscription ask user to accept terms of usage and that it shall not store and / or write down its private key same as a bank card code.
• No cookies nor cache form data are stored locally on user's devices, if user loses its private key, the account could be locked on its demand and / or a renewal key shall be provided to the user, but all its sensitive data information would be lost. A restoration of lost data could be possible but would require some time to recover.
• FIG.2 The system and methods described in FIG.2 explain how the user get authenticated through the Authentication Service and Validation Service, and Resource Protection Service.
• the user provides its credentials using email login and two factor protection keys format being validated by the Validation service.
• the Authentication service checks the user credentials, and checks if the user account is active and / or locked. On successful authentication and active account the user get access to its dashboard being displayed.
• the notification service based on user preferences and activation may display miscellaneous informations on the top toolbar.
• the Resource protection service loads the user private data list into its
• the system and methods described in FIG.3 explain how the user adds a new entry to its list of private data.
• the user can extend its data catalog with a new private data type through iconic representation. If not a predefined set of data (iconically represented or not) based on user service level subscription could be loaded by the Resource protection service into user's data catalog, then the user can select one type of private data to add a new entry in its list of private data.
• the Validation service on user preferences and activation applies validation constraints on entered sensitive information, moreover based on the input type such as password text field is not cleared type but in wildcard.
• the QR Code generator service based on user preferences and activation applies on the new sensitive
• the user Before submit, the user has the possibility to validate the veracity of the information encrypted under its secured account by reading it with the Qr Code reader.
• the Email service could be used at this step to send to user's subscription email box the new encrypted and ciphered private data with or without a resource mapping such as an icon for quick identification.
• the system and methods described in FIG.4 explains what user can do on entry selection.
• the entry is loaded from the private data list, where its representation in the list is completely informative, no sensitive information is displayed to prevent eye sneaking over the shoulders.
• the entry information being displayed are not in clear and resolution of Qr Code could not allow long distance reader to scan it.
• the Notification service based on user preferences and activation provides the possibility for the user to set the expiration date or being notified either through alert under its secured account and / or email.
• the QR Code generator service based on user preferences and activation applies on update over sensitive information.
• the system provides an easy switching between data type through a combo box representing all user's data catolog so that the user can update not only the sensitive information but change its type.
• An optional version information field is handled too that is global in the catalog and different in the entry.
• the Validation service based on user preferences and activation applies validation constraints to updated sensitive information before submit.
• An URL input field is provided with its format constraints for the Automatic Secured Login service system (ASL) with optional conjunction with the QR Code generator service (ASLQ) .
• the data entry input fields can be extended on demand with proper sets of validation constraints .
• the Email service based on user preferences and activation can send to user's subscription email box the new encrypted and ciphered private data with or without a resource mapping such as an icon for quick identification.
• FIG. 1 shows a system for a user to use a trusted device to scan QR code displayed on a display of an
• untrusted device to supply sensitive information to an identity provider for the identity provider to broker a login to a Website according to one or more embodiments of the present disclosure.
• a user 100 carries a trusted device 102.
• Trusted device 102 may be a smart phone (e. g., iPhone, Google phone, or other phones running Android, Window Mobile, or other operating systems), a tablet computer
• trusted device 102 may be referred to as a mobile device without departing from the scope of the present disclosure.
• Trusted device 102 may have a camera.
• Trusted device 102 may communicate over a net Work 106 with an identity provider 108.
• a Website server 116 hosts a Website and may also communicate with identity provider 108 over network 106.
• the Website may be operated by a financial institution, a merchant, or other entities providing secured access to authorized users .
• a financial institution e.g., iPad, Galaxy
• PDA personal digital assistant
• identity provider 108 may broker a login session to
• Website server 116 by user 100 Website server 116 by user 100.
• the present disclosure relates generally to systems and methods for user to access securely sensitive personal data offline & online. More precisely the present disclosure relates to methods and systems providing resident & roaming user being fixed or mobile to get access to their private secured sensitive information data from a certified website server.
• the weakness on user credentials is resolved by a 2 nd factor protection with a mandatory high strength level validation of the main system user account through secured web server HTTPS. Then the second level once authenticated of applications' protection goes through the same 2 nd factor protection and optional strength level validation. From main system user account, some sensitive information can be sent to its mailbox in one click, therefore user being offline through its email client mailbox can get access to sensitive information that was set with lower level of protection on QR Code scanning, if highest level was setup then user must be online for 2 nd factor protection

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Theoretical Computer Science (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• Computing Systems (AREA)
• Software Systems (AREA)
• Physics & Mathematics (AREA)
• Health & Medical Sciences (AREA)
• General Physics & Mathematics (AREA)
• General Health & Medical Sciences (AREA)
• Bioethics (AREA)
• Databases & Information Systems (AREA)
• Medical Informatics (AREA)
• Information Transfer Between Computers (AREA)

Priority Applications (1)

Applications Claiming Priority (1)

Publications (1)

Family

ID=52774301

Family Applications (1)

Country Status (1)

• 2015
  • 2015-03-02 WO PCT/IB2015/051518 patent/WO2016139505A2/fr not_active Ceased

Non-Patent Citations (1)

Similar Documents

Legal Events