Abstract: A method of providing secure communications between a first and a second communications unit comprising a key exchange between the communications units resulting in a shared secret key, the? key exchange including a user interaction. The method includes the steps of providing, at least partly by means of a user interaction, a passcode to the first and second communications units; generating a first contribution to the shared secret key by the first communications unit and a second contribution to the shared secret key by the second communications unit, and transmitting each generated contribution to the corresponding other communications unit; authenticating the transmitted first and second contributions by the corresponding receiving communications unit based on at least the passcode: and establishing said shared secret key by each of the communications units from at least the corresponding received first or second contribution, only if the corresponding received contribution is authenticated successfully.

Abstract: A Personal Area Network Security Domain (PSD) is formed between devices (142, 150, 152, 154 and 156). The PSD allows the sharing of data and/or resources between the devices within the PSD. The devices within the PSD are located remotely from one another. For example, communication between device (150 and 156) will be performed via mobile or cellular telephone network (120), the Internet (140) and mobile or cellular telephone network (126). Each network (120, 126) is provided with a PSD Hub, which enables an IPsec secure connection between the devices (150 and 156) to be established.

Abstract: The teachings herein present a method and apparatus for protecting usage restriction data that governs usage of an electronic device. A cryptographic circuit supports secure and non-secure accesses. When non-securely accessed, it is operable only to verify the stored usage restriction data, and, when securely accessed, it is operable to generate a new message authentication code for changed usage restriction data, for subsequent authentication of that data. The usage restriction data may be stored in non-secure memory and may include static and dynamic parts. One or more embodiments include a secure circuit indicating whether the device has been initialized. The cryptographic circuit outputs a message authentication code for the static part using a permanent device key from the secure circuit, only if the device has not been initialized, and outputs a message authentication code for the dynamic part as needed to support authorized changes to the dynamic part.

Abstract: A Personal Area Network Security Domain (PSD) (50) is formed between PDA (52), mobile terminal (54), PC (56) and printer (58). The PSD (50) allows the sharing of resources between the devices within the PSD. If the devices within the PSD (50) are located remotely from one another, communication between those devices will be performed via mobile or cellular telephone network (66) and the Internet (68). For each set or association of similarly located devices within the PSD (50), one of those devices will be a gateway device. The gateway device is a device that is configured to communicate with an external communications medium (mobile network (66) or the Internet (68)). Data transmissions to other devices within the PSD are channelled through the relevant gateway. In another embodiment resources are shared between the two separate PSDs (of which may or may not be remotely located with respect to one another) by means of data exchanges between the respective gateway devices of the two PSDs.

Abstract: The present invention relates to securing information in open systems and more particularly to a method and a system for providing authentication, confidentiality and integrity protection of arbitrary communication services. A client that wishes to communicate with a particular service downloads a signed program code from that service containing code necessary for doing authenticated key exchange with that service. The client is assumed to support only two basic cryptographic functions: signing of arbitrary data by using a public key algorithm together with a one way hash function, and verifying a public key signature of arbitrary data. By allowing the security protocol needed for key exchange and data communication protection to be downloaded the number of predefined security functions that a client or server needs to support is limited. This also makes it much easier to update the communication protection since only the server program needs to be updated.

Abstract: The method and apparatus described herein transfers soft SIM credentials from a transferring mobile device to a target mobile device while ensuring that only one mobile device contains active soft SIM credentials at a time. Broadly, a transferring mobile device securely transfers the soft SIM credentials to a target mobile device either directly or via a network server. Before the target mobile device receives or activates the soft SIM credentials, the transferring mobile device deactivates the soft SIM credentials to ensure that only one mobile device contains the active soft SIM credentials.

Abstract: A method of updating memory content stored in a memory of a processing device, the memory comprising a plurality of addressable memory blocks, the memory content being protected by a current integrity protection data item stored in the processing device, the method comprising determining a first subset of memory blocks that require an update, and a second subset of memory blocks that remain unchanged by said updating; calculating, as parallel processes, a first and a second integrity protection data item over the memory blocks; wherein the first integrity protection data item is calculated over the current memory contents of the first and second subsets of memory blocks; and wherein the second integrity protection data item is calculated over the current memory contents of the second subset of memory blocks and the updated memory block contents of the first subset of memory blocks.

Abstract: A message authentication code, MAC, is generated in an electronic circuit, wherein the MAC integrity protects a data value, PD. A random challenge word, RND, is received from a source that is external to the electronic circuit. A first function G(RND,K) is evaluated that generates a first encrypted value, K?, from RND and K, wherein K is a secret key value that is stored on the electronic circuit. A second function F(RND,K) is evaluated that generates a second encrypted value, K?, from RND and K. The MAC is then generated in accordance with MAC=K?+m1K?+m2K?2+ . . . +MlK?l, wherein m1, m2, . . . , ml are derived by representing the data value, PD, as an l-tuple of elements in a field, GF(2n), wherein n is an integer greater than zero. A hardware-efficient arrangement is also disclosed for generating this and other MACs.

Abstract: One time programming functionality is provided on an integrated circuit by receiving one time programmable (OTP) data from a source that is external to the integrated circuit. It is determined whether the received OTP data is authentic, and if so, the received OTP data is stored in a write-lockable memory device that is located on the integrated circuit. The write-lockable memory device is thereafter locked to prevent any further writing to the write-lockable memory device for so long as power is maintained to the integrated circuit. After locking the write-lockable memory device while power is maintained, the OTP data is retrieved from the write-lockable memory device whenever the OTP data is needed. A key used to authenticate the received OTP data is stored on the integrated circuit within a memory device configured to permit reading of the key only one time.

Abstract: A method for public key certification in a local network environment, wherein a personal certification authority associated with the local network environment is connected with a first device needing to be certified. Responsive to the connection, a certificate is provided to the device to be certified from the personal certification authority. The devices receiving a certificate may then use the certificate to carry out secure information exchange within the local network environment with other devices having a similar certificate.

Abstract: Disclosed is a method of loading data into a data processing device. The method comprises receiving a payload data item by the data processing device; performing a cryptographic authentication process to ensure the authenticity of the payload data item; storing the authenticated received payload data item in the data processing device; and integrity protecting the stored payload data item. The cryptographic authentication process comprises calculating an audit hash value of at least the received data item. Integrity protecting further comprises calculating a reference message authentication code value of at least the audit hash value using a secret key stored in the data processing device as an input.

Abstract: A method of updating/recovering a configuration parameter of a mobile terminal having stored thereon a public key of a public-key cryptosystem and a current terminal identifier, the method comprising determining an updated configuration parameter by an update/recovery server in response to a received current terminal identifier from the mobile terminal; generating an update/recovery data package by a central signing server, the update/recovery data package including the current terminal identifier, the updated configuration parameter, and a digital signature based on a private key, where the digital signature is verifiable by said public key; storing the current terminal identifier and the updated configuration parameter by the central signing server; sending the update/recovery data package by the update/recovery server to the mobile terminal causing the mobile terminal to verify the received update/recovery data package and to store the updated configuration parameter of the verified update/recovery data pa

Abstract: A unique identifier of a remote device is not sent in clear text on a local interlace between the remote device and a device that can communicate with a wireless network, but a procedure for establishing an encryption key in both devices is still based on the unique identifier. Thus, secure binding between the established key and the identifier is achieved. Moreover, the identifier of the remote device is not exposed even to the device that can communicate with a wireless network.

Abstract: A method of providing secure communications between a first and a second communications unit comprising a key exchange between the communications units resulting in a shared secret key, the? key exchange including a user interaction. The method includes the steps of providing, at least partly by means of a user interaction, a passcode to the first and second communications units; generating a first contribution to the shared secret key by the first communications unit and a second contribution to the shared secret key by the second communications unit, and transmitting each generated contribution to the corresponding other communications unit; authenticating the transmitted first and second contributions by the corresponding receiving communications unit based on at least the passcode: and establishing said shared secret key by each of the communications units from at least the corresponding received first or second contribution, only if the corresponding received contribution is authenticated successfully.

Abstract: A method of authenticating a message (111) received via a transmission channel (108) using a Message Authentication Code (MAC). The message comprises a message body (114) and a tag (116) and the method comprises the steps of generating a second tag (115) according to a MAC function (112) on the basis of the received message body and a secret key (113), calculating a distance (117) between the received tag and generated second tag, and comparing (118) the calculated distance with a predetermined threshold value.

Abstract: A method of providing secure communications between a first and a second communications unit comprising a key exchange between the communications units resulting in a shared secret key, the key exchange including a user interaction. The method includes the steps of providing, at least partly by means of a user interaction, a passcode to the first and second communications units; generating a first contribution to the shared secret key by the first communications unit and a second contribution to the shared secret key by the second communications unit, and transmitting each generated contribution to the corresponding other communications unit; authenticating the transmitted first and second contributions by the corresponding receiving communications unit based on at least the passcode; and establishing said shared secret key by each of the communications units from at least the corresponding received first or second contribution, only if the corresponding received contribution is authenticated successfully.

Abstract: A device (e.g., mobile device) and method are described herein that can protect data stored in a rewritable openly accessible memory from replay attacks by using an integrity key and an encryption key to en/decrypt the data, integrity protect the data via a MAC calculation, and verify the data.

Abstract: A method of establishing a secure communications link between a user communications device and a first service communications device; the method comprises the steps of initiating a communications link using a first communications protocol between the user communications device and the first service communications device; performing, based on a PIN value, an initialisation procedure between the user communications device and the first service communications device, the initialisation procedure resulting in an identification key; storing the identification key in the user communications device and the first service communications device; the method is characterised in that it further comprises the steps of using a second communications protocol to perform a transaction between the user communications device and a second service communications device; generating and storing the PIN value; the invention further relates to a communications system and a mobile communications device.

Abstract: Disclosed is a method of establishing a secured peer-to-peer communication between two communications devices, each communications device having stored a respective set of previously established security associations with other communications devices. The method comprises determining whether the two communications devices have a common security association in their respective sets of established security associations; if the devices have determined a common security association, protecting the communications link between the two communications device based on the determined common security association; otherwise establishing a new security association between the two communications devices, and protecting the communications link based on the new security association; and extending the sets of previously established security associations of the two communications devices to the corresponding other exchanging corresponding key data.

Abstract: The present invention relates to establishing security within an ad hoc network. Such ad hoc networks do not have on-line connections to a particular server for getting desired public keys or certificates, thereby requiring them to create trust relations among their respective nodes wherein some of the nodes have a mutual trust relation to each other, thus constituting a trust group. When a particular candidate node desires to join the trust group, an X-node is identified, being a member of a trust group and having a trust relation with the candidate node. The X-node then certifies the candidate node and establishes and distributes trust relations between the members of the trust group and the candidate node.