# US 10,484,339 B2 · Pervasive data security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,339 B2 - Document ID: US10484339B2 - Status: Granted - Kind: B2 - Application number: 15/079,410 - Filed: 2016-03-24 - Published: 2017-01-19 - Granted: 2019-11-19 - Earliest claimed: 2015-03-24 - Assignees: Global Data Sentinel, Inc. - Applicants: Global Data Sentinel, Inc. - Inventors: John-Philip Galinski; Nigel Walker - Web page: https://patentgrep.com/patent/US10484339B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/166: {at the transport layer} - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and system of securing data. A security client program stored in a memory of a user device intercepts an operating system call performed by a calling application of the user device for an unencrypted asset. A first key for the unencrypted asset from a server is requested. Upon receiving the first key for the unencrypted asset from a server, a secure resource is created by encrypting the unencrypted asset. Then, the operating system call is completed and an update message is sent to the server. ## Claims ### Claim 1 A computing device comprising: a processor; at least one network interface coupled to the processor configured to enable communications via one or more communication networks; a memory for content and programming; a security client program stored in the memory, wherein execution of the security client program by the processor configures the computing device to perform acts comprising: intercepting an operating system call performed by a calling application to create a particular version of a plurality of versions of an unencrypted asset; requesting a first key for the unencrypted asset from a server, the first key corresponding to a user identity associated with the computing device and the particular version of the unencrypted asset; upon receiving the first key for the particular version of the unencrypted asset from the server: creating a secure resource by encrypting the unencrypted asset; completing the operating system call; sending an update message to the server, the update message including an indication to provide a second user identity with permission to access only the particular version of the unencrypted asset; and upon failing to receive the first key in response to requesting the first key, suspending the operating system until receipt of the first key. ### Claim 2 (depends on 1) The computing device of claim 1, wherein the operating system call includes an instruction to at least one of: (i) edit, (ii) send, and (iii) store encrypted asset. ### Claim 3 (depends on 1) The computing device of claim 1, further comprising a shared storage that is shared between several users. ### Claim 4 (depends on 1) The computing device of claim 1, wherein intercepting the operating system call is performed with an intervening hook, the intervening hook being a web distributed authoring and versioning (WebDav) protocol. ### Claim 5 (depends on 1) The computing device of claim 1, wherein the update message includes a storage at rest location information of the secure resource. ### Claim 6 (depends on 1) The computing device of claim 1, wherein the update message includes an additional indication to provide a plurality of users with access to the secure resource. ### Claim 7 (depends on 1) The computing device of claim 1, further comprising: intercepting, by the security client program, an operating system call performed by the calling application to retrieve, a particular version of a secure resource; receiving, from an appliance server, a digital key that corresponds to the user identity and the particular version of the secure resource; performing a second operating system call to search a shared storage for the particular version of the secure resource; receiving, from the shared storage, an encrypted asset that includes the particular version of the secure resource; and decrypting, via the digital key, the encrypted asset to access the particular version of the secure resource. ### Claim 8 (depends on 7) The computing device of claim 7, wherein the computing device is associated with a first organization, and the particular version of the secure resource is associated with a second organization that is different from the first organization, and wherein the shared storage is associated with the first organization and the second organization. ### Claim 9 An appliance server, comprising: a processor; at least one network interface coupled to the processor configured to enable communications via one or more communication networks; a memory for content and programming; a program stored in the memory, wherein execution of the program by the processor configures the appliance server to perform acts, comprising: receiving a request for access to a particular version of a plurality of versions of a secure resource during an intercepted operating system call on a first user device; upon determining that the first user device is authorized to have access to the secure resource, sending a first encrypted message having a resource key to the first user device, such that the first encrypted message can be decrypted by a private key of the first user device; upon determining that the first user device has decrypted the first encrypted message to access the resource key, sending a second encrypted message having a resource item, such that the second encrypted message can be decrypted by the resource key; upon determining that the first user device has decrypted the second encrypted message to access the resource item, sending a third encrypted message having a resource data, such that the third encrypted message can be decrypted by the resource item, wherein the resource data is configured to decrypt the particular version of the secure resource; and upon determining that the first user device has failed to decrypt the first encrypted message to access the resource key, suspending the operating system until determining that the first user device has access to the resource key. ### Claim 10 (depends on 9) The appliance server of claim 9, wherein the resource item is a single representation of the plurality of versions of the secure resource. ### Claim 11 (depends on 9) The appliance server of claim 9, wherein the resource data is configured to provide a stored at rest location information of the secure resource. ### Claim 12 (depends on 9) The appliance server of claim 9, further comprising a separate resource data stored in the memory of the appliance server for every version of the secure resource. ### Claim 13 (depends on 9) The appliance server of claim 9, wherein the secure resource is stored at a remote server. ### Claim 14 (depends on 9) The appliance server of claim 9, wherein the resource key, the resource item, and the resource data are stored in the memory of the appliance server. ### Claim 15 (depends on 9) The appliance server of claim 9, further comprising: performing a biometric analysis to authenticate a user identity associated with the first user device, the biometric analysis corresponding to at least one of a fingerprint scan, or a retina scan, and wherein, the determining that the first user device is authorized to access the secure resource is based at least in part on the biometric analysis. ### Claim 16 (depends on 9) The appliance server of claim 9, further comprising: receiving, from the first user device, resource information that indicates that a second user device is authorized to access a specific version of the secure resource; and generating an additional resource key that corresponds to a user identity associated with the second user device and the specific version of the secure resource. ### Claim 17 (depends on 16) The appliance server of claim 16, wherein the first user device is associated with a first organization and the second user device is associated with a second organization, the first organization being different from the first organization, and further comprising: propagating the additional resource key to at least a central server associated with the first organization and the second organization. ### Claim 18 (depends on 17) The appliance server of claim 17, wherein, in response to propagating the additional resource key to the central server, further comprising: causing the central server to further update an additional appliance server associated with the second organization. ### Claim 19 A computing device comprising: a processor; at least one network interface coupled to the processor configured to enable communications via one or more communication networks; a memory for content and programming; a security client program stored in the memory, wherein execution of the security client program by the processor configures the computing device to perform acts comprising: intercepting an operating system call performed by a calling application to create a particular version of a plurality of versions of an unencrypted asset; requesting a first key for the unencrypted asset from a server, the first key corresponding to a user identity associated with the computing device and the particular version of the unencrypted asset; upon receiving the first key for the particular version of the unencrypted asset from the server: creating a secure resource by encrypting the unencrypted asset; completing the operating system call; sending an update message to the server, the update message including an indication to provide a second user identity with permission to access only the particular version of the unencrypted asset; and upon failing to receive the first key in response to requesting the first key, encrypting the unencrypted asset using a local key and suspending the operating system until receipt of the first key. ### Claim 20 (depends on 19) The computing device of claim 19, wherein the operating system call includes an instruction to at least one of: (i) edit, (ii) send, and (iii) store encrypted asset.