# US 8,543,806 B2 · System, method and apparatus for electronically protecting data and digital content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,806 B2 - Document ID: US8543806B2 - Status: Granted - Kind: B2 - Application number: 13/563,379 - Filed: 2012-07-31 - Published: 2012-11-22 - Granted: 2013-09-24 - Earliest claimed: 2005-03-16 - Assignees: DT Labs Development, LLC - Applicants: Douglas Peckover - Inventors: Douglas Peckover - Web page: https://patentgrep.com/patent/US8543806B2 ## CPC - G16H 40/67: for remote operation - G06F 21/60: Protecting data - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G16H 20/13: delivered from dispensers - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 2221/2153: Using hardware token as a secondary aspect - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods and apparatus for protecting sensitive data in a file that has been replaced with pointer(s) for each sensitive data. The sensitive data items are protected by restricting subsequent access to and use of the sensitive data items via the pointers by: receiving a first request for data stored in a file on the data storage, determining whether the requested data includes at least one of the pointers, providing the requested data whenever the requested data does not include any of the pointers, and performing the following steps whenever the requested data includes at least one of the pointers: sending a second request containing the pointer(s) included in the requested data to the server that authenticates the second request, denying the first request whenever the authentication fails, and receiving and providing the extracted data item(s) corresponding to the pointer(s) included in the requested data whenever the authentication succeeds. ## Claims ### Claim 1 A system for protecting sensitive data comprising: one or more clients, each client having a data storage and a processor, wherein two or more items of sensitive data within a file have been replaced with a pointer for each item of sensitive data, wherein the pointer indicates where the item of sensitive data item has been stored in a secure storage by a server; the server communicably coupled to the one or more clients; and wherein the processor and the server protect the sensitive data items within the file by restricting subsequent access to and use of the sensitive data items via the pointers by: receiving a first request for data stored in the file on the data storage, determining whether the requested data includes at least one of the pointers, providing the requested data whenever the requested data does not include any of the pointers, and performing the following steps whenever the requested data includes at least one of the pointers: sending a second request containing the pointer(s) included in the requested data to the server that authenticates the second request, denying the first request whenever the authentication fails, and receiving and providing the extracted sensitive data item(s) corresponding to the pointer(s) included in the requested data whenever the authentication succeeds. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein: the client comprises a computer, a laptop computer, a handheld computer, a desktop computer, a workstation, a data terminal, a phone, a mobile phone, a personal data assistant, a media player, a gaming console, a security device, a surveillance device or a combination thereof; and the server is communicably coupled to the one or more clients via a computer network, a telecommunications network, a wireless communications link, a physical connection, a landline, a satellite communications link, an optical communications link, a cellular network or a combination thereof. ### Claim 3 (depends on 1) The system as recited in claim 1, wherein the communications between the server and the client are encrypted. ### Claim 4 (depends on 1) The system as recited in claim 1, wherein the server further comprises: an application program interface layer; an authentication layer coupled to the application program interface layer; a plug-in layer coupled to the authentication layer; a data layer coupled to the plug-in layer; and an events layer coupled to the data layer, the plug-in layer and the authentication layer. ### Claim 5 (depends on 1) The system as recited in claim 1, wherein the received sensitive data items can only be viewed or used in an application that submitted the first request. ### Claim 6 (depends on 1) The system as recited in claim 1, wherein the received sensitive data items cannot be further transferred or stored. ### Claim 7 (depends on 1) The system as recited in claim 1, wherein the pointer comprises random data that is of a same data type as the sensitive data. ### Claim 8 (depends on 1) The system as recited in claim 1, wherein the pointer is subsequently used to access the sensitive data item after proper authentication. ### Claim 9 (depends on 1) The system as recited in claim 1, wherein storage of the sensitive data items and subsequent access to the sensitive data are governed by one or more rules. ### Claim 10 (depends on 1) The system as recited in claim 1, wherein the sensitive data items comprises personal data, financial data, corporate data, legal data, government data, police data, immigration data, military data, intelligence data, security data, surveillance data, technical data, copyrighted content or a combination thereof. ### Claim 11 An apparatus for protecting sensitive data comprising: a data storage comprising a file stored therein having two or more items of sensitive data that have been replaced with a pointer for each item of sensitive data, wherein the pointer indicates where the item of sensitive data item has been stored in a secure storage by a server; a communications interface to the server having the secure storage; a processor communicably coupled to the data storage and the communications interface, wherein the processor controls access to the data storage; and wherein the processor and the server protect the sensitive data items within the file by restricting subsequent access to and use of the sensitive data items via the pointers by: receiving a first request for data stored in the file on the data storage, determining whether the requested data includes at least one of the pointers, providing the requested data whenever the requested data does not include any of the pointers, and performing the following steps whenever the requested data includes at least one of the pointers: sending a second request containing the pointer(s) included in the requested data to the server that authenticates the second request, denying the first request whenever the authentication fails, and receiving and providing the extracted sensitive data item(s) corresponding to the pointer(s) included in the requested data whenever the authentication succeeds. ### Claim 12 (depends on 11) The apparatus as recited in claim 11, wherein: the apparatus comprises a computer, a laptop computer, a handheld computer, a desktop computer, a workstation, a data terminal, a phone, a mobile phone, a personal data assistant, a media player, a gaming console, a security device, a surveillance device or a combination thereof; and the server is communicably coupled to the one or more clients via a computer network, a telecommunications network, a wireless communications link, a physical connection, a landline, a satellite communications link, an optical communications link, a cellular network or a combination thereof. ### Claim 13 (depends on 11) The apparatus as recited in claim 11, wherein the communications between the server and the client are encrypted. ### Claim 14 (depends on 11) The apparatus as recited in claim 11, wherein the received sensitive data items can only be viewed or used in an application that submitted the first request. ### Claim 15 (depends on 11) The apparatus as recited in claim 11, wherein the received sensitive data items cannot be further transferred or stored. ### Claim 16 (depends on 11) The apparatus as recited in claim 11, wherein the pointer comprises random data that is of a same data type as the sensitive data. ### Claim 17 (depends on 11) The apparatus as recited in claim 11, wherein the pointer is subsequently used to access the sensitive data item after proper authentication. ### Claim 18 (depends on 11) The apparatus as recited in claim 11, wherein storage of the sensitive data items and subsequent access to the sensitive data are governed by one or more rules. ### Claim 19 (depends on 11) The apparatus as recited in claim 11, wherein the sensitive data items comprises personal data, financial data, corporate data, legal data, government data, police data, immigration data, military data, intelligence data, security data, surveillance data, technical data, copyrighted content or a combination thereof. ### Claim 20 A method for protecting sensitive data comprising the steps of: providing a file on a data storage having two or more items of sensitive data that have been replaced with a pointer for each item of sensitive data, wherein the pointer indicates where the item of sensitive data item has been stored in a secure storage by a server; and protecting the sensitive data items by restricting subsequent access to and use of the sensitive data items via the pointers by: receiving a first request for data stored in a file on the data storage, determining whether the requested data includes at least one of the pointers, providing the requested data whenever the requested data does not include any of the pointers, and performing the following steps whenever the requested data includes at least one of the pointers: sending a second request containing the pointer(s) included in the requested data to the server that authenticates the second request, denying the first request whenever the authentication fails, and receiving and providing the extracted data item(s) corresponding to the pointer(s) included in the requested data whenever the authentication succeeds. ### Claim 21 (depends on 20) The method as recited in claim 20, wherein the received sensitive data items can only be viewed or used in an application that submitted the first request. ### Claim 22 (depends on 20) The method as recited in claim 20, wherein the received sensitive data items cannot be further transferred or stored. ### Claim 23 (depends on 20) The method as recited in claim 20, wherein the pointer comprises random data that is of a same data type as the sensitive data item. ### Claim 24 (depends on 20) The method as recited in claim 20, wherein the pointer is subsequently used to access the sensitive data item after proper authentication. ### Claim 25 (depends on 20) The method as recited in claim 20, wherein storage of the sensitive data items and subsequent access to the sensitive data are governed by one or more rules. ### Claim 26 (depends on 20) The method as recited in claim 20, wherein the sensitive data items comprises personal data, financial data, corporate data, legal data, government data, police data, immigration data, military data, intelligence data, security data, surveillance data, technical data, copyrighted content or a combination thereof. ### Claim 27 A non-transitory computer readable storage medium for protecting sensitive data comprising program instructions when executed by a client causes the client to perform the steps of: providing a file on a data storage having two or more items of sensitive data that have been replaced with a pointer for each item of sensitive data, wherein the pointer indicates where the item of sensitive data item has been stored in a secure storage by a server; and protecting the sensitive data items by restricting subsequent access to and use of the sensitive data items via the pointers by: receiving a first request for data stored in the file on the data storage, determining whether the requested data includes at least one of the pointers, providing the requested data whenever the requested data does not include any of the pointers, and performing the following steps whenever the requested data includes at least one of the pointers: sending a second request containing the pointer(s) included in the requested data to the server that authenticates the second request, denying the first request whenever the authentication fails, and receiving and providing the extracted data item(s) corresponding to the pointer(s) included in the requested data whenever the authentication succeeds. ### Claim 28 (depends on 27) The computer readable storage medium as recited in claim 27, wherein the received sensitive data items can only be viewed or used in an application that submitted the first request. ### Claim 29 (depends on 27) The computer readable storage medium as recited in claim 27, wherein the received sensitive data items cannot be further transferred or stored. ### Claim 30 (depends on 27) The computer readable storage medium as recited in claim 27, wherein the pointer comprises random data that is of a same data type as the sensitive data item. ### Claim 31 (depends on 27) The computer readable storage medium as recited in claim 27, wherein the pointer is subsequently used to access the sensitive data item after proper authentication. ### Claim 32 (depends on 27) The computer readable storage medium as recited in claim 27, wherein storage of the sensitive data items and subsequent access to the sensitive data are governed by one or more rules. ### Claim 33 (depends on 27) The computer readable storage medium as recited in claim 27, wherein the sensitive data items comprises personal data, financial data, corporate data, legal data, government data, police data, immigration data, military data, intelligence data, security data, surveillance data, technical data, copyrighted content or a combination thereof.