Abstract: A method and apparatus for establishing a secure tunnel through a proxy between a user device and a secure server on a network are described. The method comprises storing information retrievable by the proxy server, in the event of the user device sending a request to the proxy server to access the secure server during a current session with the proxy server. The information indicates that the user device wishes to access the secure server. Thereafter, the current session between the user device and the proxy server is terminated. A tunnel is set through the proxy server between the user device and the secure server (via a trusted domain proxy/firewall) in the event of the user device sending a further request to the proxy server to access the secure server.

Abstract: The present invention is a method and system for establishing an authenticated and secure communication session for transactions between a server and a client in a wireless data network that generally comprises an airnet, a landline network and a link server therebetween. The client having limited computing resources is remotely located with respect to the server and communicates to the server through the wireless data network. To authenticate each other, the client and the server conduct two rounds of authentication, the client authentication and the server authentication, independently and respectively, each of the authentication processes is based on a shared secret encrypt key and challenge/response mechanism. To reach for a mutually accepted cipher in the subsequent transactions, the server looks up for a commonly used cipher and forwards the cipher along with a session key to the client.

Abstract: Aliasing techniques that permit flexibly linking to remotely located resources are disclosed. The aliasing techniques are used by a browser application to link to a remote resource located on a network (e.g., the Internet) when the location of the remote resource is initially unknown or likely to be changed based on events external to the browser application. For example, the external events can include: relocation of the remote resource, use of a different device, user or carrier service to access the remote resource, or selection of different service levels. In one embodiment, a browser application executes on a wireless remote computing device and couples to a network gateway via a carrier network. The aliasing techniques are provided by sending alias information from the network gateway to the browser application, and then having the browser application form an alias table and store the alias table in the wireless remote computing device.

Abstract: A secure push server is disclosed. The push server is used for sending notifications to different wireless clients on different wireless networks. The push server allows information service providers to send notifications to the wireless clients. The information service providers initiate a request to the push server that includes updated information. The request also includes a certificate from the information service provider. The push server authenticates the request from the information service provider by verifying the certificate. The push server also determines if the certificate was issued from an acceptable certificate authority by examining an acceptable certificate authority list. Finally, the push server checks the content of the notification to be sure it does not interfere with other information service providers. After performing the security checks, the push server processes the notification request.

Abstract: To accept, store, and use dynamic information within a markup language, a markup language variable system is introduced. The markup language variable system allows variable scopes to be created within markup language user agents. Variables can then be assigned using static variable assignment via markup language tags or dynamic variable assignment via user requests. Variables can be used within markup language displays or within addresses such as Uniform Resource Locators (URLs). Automatic escaping ensures that variables are correctly modified for use within certain contexts such as URLs.

Abstract: Improved techniques for facilitating secure data transfer over one-way data channels or narrowband channels are disclosed. Often, these channels are wireless channels provided by wireless data networks. The techniques enable cryptographic handshake operations for a one-way data channel to be performed over a companion two-way data channel so that the one-way data channel is able to effectively satisfy security protocols that require two-way communications for the cryptographic handshake operations. Once the cryptographic handshake operations are complete, data can be transmitted over the one-way data channel in a secure manner. Additionally, the techniques also enable the cryptographic handshake operations to be performed more rapidly because the two-way channel is typically a wideband channel.

Abstract: Techniques for ensuring secure access to local service of mobile devices of a wireless communication system are disclosed. The techniques control access to local services of mobile devices such that only authorized services are able to remotely alter the local services of the mobile devices. Before permitting access to local services of a mobile device, the identity of the network site seeking to have access is checked to determine whether the network site is authorized for such access. If the network site is authorized, then access is permitted and the network site is able to modify or alter the local services of the mobile device. On the other hand, when the network site is not authorized, then the network site is denied access to the local service so that the local services provided by the network site are not open to attack or corruption from unscrupulous network sites.

Abstract: Improved techniques for providing electronic mail services across a network are disclosed. A mail server and its clients communicate through a network. Although the mail server centrally manages the electronic mail services, the clients are able to themselves locally perform certain electronic mail services when the network is unavailable. Accordingly, clients seeking to perform electronic mail services no longer endure significant delays when the network is unavailable. The network can be unavailable for a variety of reasons, including: congestion, out of range, network failure, etc. The network can be wired or wireless. The invention is particularly well suited for networks having sporadic connectivity, high latencies or excessive traffic.

Abstract: Access to hypermedia servers connected to networks such as the Internet can be provided through mobile devices such as wireless telephones. Unfortunately, limitations in processing power and memory space of the mobile device and limitations bandwidth of the communication channels connecting the mobile devices to the rest of the network cause long wait times for many types of requests to be serviced. In one application, a user is notified that unsolicited electronic mail has arrived in the user's mail box on a computer connected directly a network and, in response, the user requests the mail to be sent to the mobile device. The perceived latency in servicing such a request can be reduced by delivering at least a portion of the unsolicited electronic mail to mobile device before notifying the user that the mail has arrived in the mail box. In this manner, at least a portion of that mail can be presented to the user in response to a request with little delay.

Abstract: A crypto-ignition process is needed to establish an encrypted communication protocol between two devices connected by an insecure communication link. The present invention introduces a method of creating an identical secret key to two communicating parties is conducted between a thin device and a server computer over an insecure data network. The thin device generally has limited computing power and working memory and the server computer may communicate with a plurality of such thin devices. To ensure the security of the secret key on both sides and reduce traffic in the network, only a pair of public values is exchanged between the thin device and the server computer over the data network. Each side generates its own secret key from a self-generated private value along with the received counterpart's public value according to a commonly used key agreement protocol, such as the Diffie-Hellman key agreement protocol.

Abstract: Access to hypermedia servers connected to networks such as the Internet can be provided through mobile devices such as wireless telephones. Unfortunately, limitations in processing power and memory space of the mobile device and limitations bandwidth of the communication channels connecting the mobile devices to the rest of the network cause long wait times for many types of requests to be serviced. In one application, a user is notified that unsolicited electronic mail has arrived in the user's mail box on a computer connected directly a network and, in response, the user requests the mail to be sent to the mobile device. The perceived latency in servicing such a request can be reduced by delivering at least a portion of the unsolicited electronic mail to mobile device before notifying the user that the mail has arrived in the mail box. In this manner, at least a portion of that mail can be presented to the user in response to a request with little delay.

Abstract: The present invention discloses a central certificate management system for thin client devices in data networks and has particular applications to systems having a large number of the thin clients serviced by a proxy server through which the thin clients communicate with a plurality of secure server computers over a data network. According to one aspect, the present invention provides a certificate management module that causes the server device to manage digital certificates for each of the thin client devices. To minimize the latency of obtaining certificates for each of the thin client devices, the certificate management module reserves a fixed number of free certificates signed by a certificate authority and their respective private keys in a certificate database and frequently updates the free certificate according to a certificate updating message.

Abstract: The present invention is a method and system for establishing an authenticated and secure communication session for transactions between a server and a client in a wireless data network that generally comprises an airnet, a landline network and a link server therebetween. The client having limited computing resources is remotely located with respect to the server and communicates to the server through the wireless data network. To authenticate each other, the client and the server conduct two rounds of authentication, the client authentication and the server authentication, independently and respectively, each of the authentication processes is based on a shared secret encrypt key and challenge/response mechanism. To reach for a mutually accepted cipher in the subsequent transactions, the server looks up for a commonly used cipher and forwards the cipher along with a session key to the client.

Abstract: The present invention has particular applications to the navigation of Internet web pages using two-way interactive communication devices, such as a mobile device, a mobile phone, a landline telephone, and an Internet capable remote controller. According to one aspect of the present invention, each of the two-way interactive communication devices is a node in a distributed network, thus the devices can access hypermedia or hierarchic layers of information stored in server devices on the network. When one or more pages of information are updated, rather than sending the entire updated information to users of the devices subscribing to the updated information through the network, the present invention sends a notification to a proxy server that forwards the notification to the users using a messaging system via a low cost narrowband channel. Upon receiving the notification, the users can fetch the updates, when needed, through a wideband channel.

Abstract: Data are pushed from a source to a destination via an intermediate computer system. If the intermediate computer system is unable to forward the pushed data to the destination for a predetermined length of time, the intermediate system deletes the pushed data and never forwards the data to the destination. According to another aspect, the intermediate system receives a command, e.g. from a server originating the data, to delete the data if the data has not yet been forwarded to the destination. According to another aspect, the intermediate system receives data whose identifier (e.g. source URL) matches an identifier of data pushed earlier to the same destination but not yet forwarded. The intermediate system deletes the earlier pushed data and never forwards the earlier pushed data.

Abstract: Access to hypermedia servers connected to networks such as the Internet can be provided through mobile devices such as wireless telephones. Hypermedia links such as Uniform Resource Locators (URL) are used to identify and control access to resources on the network. These links are usually very long, are difficult to remember, and are difficult to enter into many mobile devices. These difficulties could be overcome by storing lists of frequently used links or "bookmarks" in the mobile device but limited memory in the device generally prevents this. This limitation is overcome by storing designated hypermedia links on a bookmark server. In one embodiment, the URL of the bookmark server is sent to the mobile device during initialization of the device. By allowing a user can to save, retrieve and maintain lists of frequently used links on the bookmark server, access to favorite resources on a network is greatly simplified.

Abstract: An effective lubricant for cold working of metals is provided by a combination of a water soluble copolymer of styrene with maleic anhydride, maleic acid, and/or an ammonium or substituted ammonium maleate salt with an ethoxylated alcohol, preferably an alcohol with at least 40 carbon atoms before ethoxylation and about 50% of its mass in the polyoxyethylene block in the molecule.

Abstract: A composition and process for treating ferrous substrates including black plate container bodies to inhibit in-process corrosion or rusting of the surfaces thereof by contacting the ferrous substrate with aqueous acidic composition containing controlled effective amounts of aluminum, fluoride, optionally a second metal selected from the group consisting of zirconium, titanium, hafnium and mixtures thereof and hydrogen ions to provide a pH on the acid side.

Abstract: An aqueous alkaline cleaning composition and process for cleaning aluminum container surfaces in a manner to inhibit objectionable white-etch staining during prolonged cleaning cycles and brown oxide discoloration during prolonged rinse cycles in which the cleaning solution contains an alkalinity agent or agents present in an amount sufficient to remove aluminum fines from the surfaces thereof, a complexing agent present in an amount to complex at least some of the metal ions in the cleaning solution which tend to form insoluble precipitates and at least one surfactant present in an amount sufficient to remove organic soils from the surfaces being cleaned and to suppress the formation of white-etch staining of the surfaces during prolonged cleaning cycles. The surfactant or blend of surfactants employed are further characterized by at least one having a Hydrophile-Lipophile Balance (HLB ratio) of at least about 12.

Abstract: An alkaline cleaner particularly useful for cleaning steel cans containing an alkali metal silicate, an alkali metal phosphate, a sequestering agent, an ethoxylated linear alcohol and a chloride derivative of a polyethoxylated phenol or a polyethoxylated aliphatic alcohol.