Granted Patent B2

US 12,711,251 · App. 18/623,627 · Granted Aug 18, 2026

Inventors: Gregory Scott Smith (Madison, TN); Melani Leigh Smith Weed (Franklin, TN); Daniel Michael Fischer (Brentwood, TN); Elke M. Ridenour (Brentwood, TN)

Assignee: Sertainty Corporation

G06F21/604G06F21/606H04L63/104H04L63/20H04W4/185G06F2221/2107G06F2221/2141H04L63/0428

Abstract

Claims (26)

1 . A computer-implemented method for creating digitally secured data, the method comprising:

constructing a self-protected data object comprising at least one delegate object and an access list built into the self-protected data object, wherein the at least one delegate object comprises an externally addressable network address and wherein the delegate object communicates with a remote delegate service at the externally addressable network address, wherein the self-protected data object is protected using a protection scheme independent of an operating system, application, or environment;

initializing the remote delegate service with one or more user authentication credentials specific to the access list built into the self-protected data object such that access to the self-protected data object is limited to users associated with the user authentication credentials stored at the remote delegate service; and

updating the one or more user authentication credentials specific to the self-protected data object, wherein updating the one or more user authentication credentials specific to the self-protected data object comprises adding new user credentials to the one or more user authentication credentials specific to the self-protected data object such that additional users are provided with authenticated access to the data object.

2 . The method of claim 1 wherein updating the one or more user authentication credentials specific to the self-protected data object comprises removing user credentials from the one or more user authentication credentials specific to the self-protected data object such that users associated with the removed user credentials are no long authenticated to access to the data object.

3 . The method of claim 1 wherein the one or more user authentication credentials specific to the self-protected data object comprise at least one static user credential.

4 . The method of claim 3 wherein the at least one static user credential is incorporated into the self-protected data object, thereby allowing users associated with the at least one static user credential to access the data object without requiring authentication the remote delegate service.

5 . The method of claim 1 wherein the self-protected data object comprises a plurality of delegate objects, each comprising a different externally addressable network address such that the remote delegate service applies a different access policy to the self-protected data object for each of the plurality of delegate objects.

6 . The method of claim 5 wherein at least a subset of the plurality of data objects are instantiated until a successful authentication is encountered.

7 . The method of claim 1 further comprising incorporating a copy of the one or more user authentication credentials specific to the self-protected data object into the self-protected data object such that the one or more user authentication credentials are available as a cached copy absent access to the remote delegate service.

8 . The method of claim 7 wherein the cached copy of the authentication credentials are disabled upon expiration of a time to live period.

9 . The method of claim 7 wherein the cached copy of the authentication credentials are disabled an attempt to access the data object from an unauthorized domain.

10 . A system for creating digitally secured data, the method comprising:

one or more processors; and

a memory coupled with the one or more processors wherein the one or more processors executes computer-executable instructions stored in the memory, that when executed:

constructs a self-protected data object comprising at least one delegate object and an access list built into the self-protected data object, wherein the at least one delegate object comprises an externally addressable network address and wherein the delegate object communicates with a remote delegate service at the externally addressable network address wherein the self-protected data object is protected using a protection scheme independent of an operating system, application, or environment;

initializes the remote delegate service with one or more user authentication credentials specific to the access list built into the self-protected data object such that access to the self-protected data object is limited to users associated with the user authentication credentials stored at the remote delegate service; and

updates the one or more user authentication credentials specific to the self-protected data object, wherein updating the one or more user authentication credentials specific to the self-protected data object comprises adding new user credentials to the one or more user authentication credentials specific to the self-protected data object such that additional users are provided with authenticated access to the data object.

11 . The system of claim 10 wherein updating the one or more user authentication credentials specific to the self-protected data object comprises removing user credentials from the one or more user authentication credentials specific to the self-protected data object such that users associated with the removed user credentials are no long authenticated to access to the data object.

12 . The system of claim 10 wherein the one or more user authentication credentials specific to the self-protected data object comprise at least one static user credential.

13 . The system of claim 12 wherein the at least one static user credential is incorporated into the self-protected data object, thereby allowing users associated with the at least one static user credential to access the data object without requiring authentication the remote delegate service.

14 . The system of claim 10 wherein the self-protected data object comprises a plurality of delegate objects, each comprising a different externally addressable network address such that the remote delegate service applies a different access policy to the self-protected data object for each of the plurality of delegate objects.

15 . The system of claim 14 wherein at least a subset of the plurality of data objects are instantiated until a successful authentication is encountered.

16 . The system of claim 10 wherein execution of the instructions further incorporates a copy of the one or more user authentication credentials specific to the self-protected data object into the self-protected data object such that the one or more user authentication credentials are available as a cached copy absent access to the remote delegate service.

17 . The system of claim 16 wherein the cached copy of the authentication credentials are disabled upon expiration of a time to live period.

18 . The system of claim 16 wherein the cached copy of the authentication credentials are disabled an attempt to access the data object from an unauthorized domain.

Continuity (9)

References Cited (400)