Patents by Inventor David M. Balenson
David M. Balenson has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 6272632Abstract: A system and method for data recovery is described. In one embodiment, an encrypting system encrypts a message or file using a secret key (KS) and attaches a key recovery field (KRF), including an access rule index (ARI) and KS, to the encrypted message or file. To access the encrypted message or file, a decrypting system must satisfactorily respond to a challenge issued by a key recovery center. The challenge is based on one or more access rules that are identified by the ARI included within the KRF.Type: GrantFiled: February 12, 1998Date of Patent: August 7, 2001Assignee: Network Associates, Inc.Inventors: David W. Carman, David M. Balenson, Homayoon Tajalli, Stephen T. Walker
-
Patent number: 5991406Abstract: A system and method for data escrow cryptography are described. An encrypting user encrypts a message using a secret storage key (KS) and attaches a data recovery field (DRF), including an access rule index (ARI) and KS, to the encrypted message. The DRF and the encrypted message are stored in a storage device. To recover KS, a decrypting user extracts and sends the DRF to a data recovery center (DRC) that issues a challenge based on access rules (ARs) originally defined by the encrypting user. If the decrypting user meets the challenge, the DRC sends KS in a message to the decrypting user. Generally, KS need not be an encryption key but could represent any piece of confidential information that can fit inside the DRF. In all cases, the DRC limits access to decrypting users who can meet the challenge defined in either the ARs defined by the encrypting user or the ARs defined for override access.Type: GrantFiled: April 20, 1998Date of Patent: November 23, 1999Assignee: Network Associates, Inc.Inventors: Steven B. Lipner, David M. Balenson, Carl M. Ellison, Stephen T. Walker
-
Patent number: 5956403Abstract: A system and method for key escrow cryptography for use in a system comprising a sender and a receiver. Only public escrow keys are stored in the sender and the receiver. The sender encrypts a message using a secret session key (KS), and generates a leaf verification string (LVS) by combining an unique program identifier (UIP), a public portion of a program unique key (KUpub), and a signature. The sender encrypts the KS using the KUpub to generate a first encrypted session key (EKS), and generates a first law enforcement access field (LEAF) by encrypting a combination of the first EKS and the UIP with a copy of a public portion of a family key (KFpub) stored in the sender. The encrypted message, the LVS, and the first LEAF are transmitted from the sender to the receiver. The receiver stores therein a public portion of the KEPF key (KEPFpub). The receiver extracts the UIP, KUpub, and the signature from the LVS, and then encrypts the KS using the extracted KUpub to generate a second encrypted session key (EKS).Type: GrantFiled: June 16, 1997Date of Patent: September 21, 1999Assignee: Network Association, Inc.Inventors: Steven B. Lipner, David M. Balenson, Carl M. Ellison, Stephen T. Walker
-
Patent number: 5745573Abstract: A system and method for data escrow cryptography are described. An encrypting user encrypts a message using a secret storage key (KS) and attaches a data recovery field (DRF), including an access rule index (ARI) and KS, to the encrypted message. The DRF and the encrypted message are stored in a storage device. To recover KS, a decrypting user extracts and sends the DRF to a data recovery center (DRC) that issues a challenge based on access rules (ARs) originally defined by the encrypting user. If the decrypting user meets the challenge, the DRC sends KS in a message to the decrypting user. Generally, KS need not be an encryption key but could represent any piece of confidential information that can fit inside the DRF. In all cases, the DRC limits access to decrypting users who can meet the challenge defined in either the ARs defined by the encrypting user or the ARs defined for override access.Type: GrantFiled: January 10, 1997Date of Patent: April 28, 1998Assignee: Trusted Information Systems, Inc.Inventors: Steven B. Lipner, David M. Balenson, Carl M. Ellison, Stephen T. Walker
-
Patent number: 5640454Abstract: A cryptographic communications system and method is provided for access field verification. A key exchange field which includes an encryption of at least part of a first encryption key using a public portion of a second encryption key, an access field which includes an encryption of at least part of the first encryption key using a public portion of a third encryption key, and a verification field which is created from at least one value used to create at least one of the key exchange field and the access field are provided to a receiver. Using the verification field, the receiver verifies that at least part of the first encryption key contained within the key exchange field and at least part of the first encryption key contained within the access field are equivalent. If the receiver's verification is successful, the access field is determined to be authentic.Type: GrantFiled: September 12, 1996Date of Patent: June 17, 1997Assignee: Trusted Information Systems, Inc.Inventors: Steven B. Lipner, David M. Balenson, Carl M. Ellison, Stephen T. Walker
-
Patent number: 5557346Abstract: A system and method for key escrow cryptography for use in a system comprising a sender and a receiver. Only public escrow keys are stored in the sender and the receiver. The sender encrypts a message using a secret session key (KS), and generates a leaf verification string (LVS) by combining an unique program identifier (UIP), a public portion of a program unique key (KUpub), and a signature. The sender encrypts the KS using the KUpub to generate a first encrypted session key (EKS), and generates a first law enforcement access field (LEAF) by encrypting a combination of the first EKS and the UIP with a copy of a public portion of a family key (KFpub) stored in the sender. The encrypted message, the LVS, and the first LEAF are transmitted from the sender to the receiver. The receiver stores therein a public portion of the KEPF key (KEPFpub). The receiver extracts the UIP, KUpub, and the signature from the LVS, and then encrypts the KS using the extracted KUpub to generate a second encrypted session key (EKS).Type: GrantFiled: August 11, 1994Date of Patent: September 17, 1996Assignee: Trusted Information Systems, Inc.Inventors: Steven B. Lipner, David M. Balenson, Carl M. Ellison, Stephen T. Walker
-
Patent number: 5557765Abstract: A system and method for dam escrow cryptography are described. An encrypting user encrypts a message using a secret storage key (KS) and attaches a data recovery field (DRF), including an access rule index (ARI) and KS, to the encrypted message. The DRF and the encrypted message are stored in a storage device. To recover KS, a decrypting user extracts and sends the DRF to a data recovery center (DRC) that issues a challenge based on access rules (ARs) originally defined by the encrypting user. If the decrypting user meets the challenge, the DRC sends KS in a message to the decrypting user. Generally, KS need not be an encryption key but could represent any piece of confidential information that can fit inside the DRF. In all cases, the DRC limits access to decrypting users who can meet the challenge defined in either the ARs defined by the encrypting user or the ARs defined for override access.Type: GrantFiled: February 21, 1995Date of Patent: September 17, 1996Assignee: Trusted Information Systems, Inc.Inventors: Steven B. Lipner, David M. Balenson, Carl M. Ellison, Stephen T. Walker