Abstract: A flexible aes instruction for a general purpose processor is provided that performs aes encryption or decryption using n rounds, where n includes the standard aes set of rounds {10, 12, 14}. A parameter is provided to allow the type of aes round to be selected, that is, whether it is a “last round”. In addition to standard aes, the flexible aes instruction allows an AES-like cipher with 20 rounds to be specified or a “one round” pass.

Abstract: A mobile computing device is authenticated to a user using an NFC tag embedded within or attached to an object that is commonly carried or worn by the user. The NFC tag may be initially associated when an NFC reader of the device senses the NFC tag and wirelessly retrieves a tag identifier from the tag. The tag identifier is stored for subsequent retrieval. The authentication process begins by positioning the device proximate the object such that the NFC reader of the device retrieves the tag identifier from the NFC tag. In the event that the retrieved tag identifier matches the stored tag identifier, the mobile computing device is unlocked and the user may access the mobile computing device. If the retrieved tag identifier does not match the stored tag identifier, the user is not authenticated and the mobile computing device remains locked.

Abstract: A method and a system for distributing an encryption key for service protection and content protection in a mobile broadcasting system are provided where a network generates a first encryption key when a broadcasting service is first provided to the terminal, and transmits a long term key message including the generated first encryption key to the terminal. Also, the network generates a second encryption key before the lifetime of a first access value pair expires, and transmits a long term key message including the generated second encryption key to the terminal.

Abstract: A method and system for securely enrolling personal identity credentials into personal identification devices. The system of the invention comprises the manufacturer of the device and an enrollment authority. The manufacturer is responsible for recording serial numbers or another unique identifier for each device that it produces, along with a self-generated public key for each device. The enrollment authority is recognized by the manufacturer or another suitable institution as capable of validating an individual before enrolling him into the device. The enrollment authority maintains and operates the appropriate equipment for enrollment, and provides its approval of the enrollment. The methods described herein discuss post-manufacturing, enrollment, backup, and recovery processes for the device.

Abstract: Provided are system, methods, and computer-readable media for systems, methods, and computer-readable media for secure digital communications and networks. The system provides for secure communication between nodes through the use of a subscription between two nodes based on unique identifiers that are unique to each node, and communication between nodes without a subscription may be blocked. Additionally, secure communications between a node and a remote node are dynamically encrypted using asymmetric and symmetric encryption. The encryption algorithms and key lengths may be changed at each subsequent negotiation between a node and a remote node.

Abstract: A method and apparatus for managing a memory at an electronic device is provided. A first number of new media files that can be stored in the memory in a current format is determined. It is determined if a memory management condition is met. If the memory management condition is met, the current format is setting to a second format such that the memory can store a second number of new media files, if acquired, a given new media file in the second format occupying less of the memory than if the given new media file is in the current format, such that the second number is greater than the first number.

Abstract: Systems and methods providing content having digital rights management (DRM) applications separable from other authorization applications are provided. A system may include a distribution service provider system in communication with a content provider system and consumer premise equipment (CPE) for the transmission of content from the content provider system to the CPE device. The distribution service provider system may: receive A/V content provided by the content provider system, wherein the A/V content includes a DRM application; apply a conditional access system (CAS) application to the A/V content that is independent of the DRM application; and transmit the A/V content including the CAS and the DRM applications to the CPE for presentation. The CPE device can perform DRM authorizations with the content provider or a third-party DRM provider.

Abstract: Embodiments of the present invention address deficiencies of the art in respect to trusted platform module (TPM) unification in a trusted computing environment and provide a novel and non-obvious method, system and computer program product for trusted platform module data harmonization. In one embodiment of the invention, a TPM log harmonization method can include designating both a single master TPM for a master node among multiple nodes, and also a multiplicity of subsidiary TPMs for remaining ones of the nodes. The method further can include extending the single master TPM with a measurement representing a rendezvous operation for the nodes.

Abstract: A secure portable electronic device for providing secure services when used in conjunction with a host computer. The secure portable device includes a read-only memory partition, a read/write memory partition, and a secure memory partition. The secure portable device includes instructions stored in the read-only partition including a host agent containing instructions executable by the host computer. The secure portable device also includes instructions stored in the secure memory partition. These instructions include a card agent containing instructions executable by central processing units secure portable electronic device, and includes a card agent communications module for communicating with the host agent; and a security module for accessing private information stored in the secure memory partition.

Abstract: A global response network collects, analyzes, and distributes “cross-vector” threat-related information between security systems to allow for an intelligent, collaborative, and comprehensive real-time response.

Abstract: A cryptanalysis method comprising: (A) Performing a ciphertext-only direct cryptanalysis of A5/1 and (B) Using results of Step (A) to facilitate the decryption and/or encryption of further communications that are consistent with encryption using the session key and/or decryption using the session key, wherein the cryptanalysis considers part of the bits of the session key to have a known fixed value, and wherein the cryptanalysis finds the session key. An efficient known plaintext attack on AS/2 comprises trying all the possible values for R4, and for each such value solving the linearized system of equations that describe the output; The solution of the equations gives the internal state of RI, R2, and R3; Together with R4, this gives the full internal state which gives a suggestion for the key.

Abstract: A communication terminal that can adjust which section of a one-time pad cipher key is used and achieve cipher communication when there is a possibility that the one-time pad cipher keys are not completely matched between communication terminals. A cipher key transfer device acquires a one-time pad cipher key from a key sharing system, divides the acquired one-time pad cipher key with a predetermined number of bits, and transfers the same to a mobile communication terminal after converting the same into one-time pad cipher key cartridges. Along with the partner's terminal, the mobile communication terminal negotiates which one-time pad cipher key cartridge will be used to perform cipher communication, decides the one-time pad cipher key cartridge to be used, and begins cipher communication.

Abstract: A receiving device receives messages, detects the priority levels set in the headers of the messages, and reads the first and second messages. When the receiving device receives the header of the second message during reading of the first message, it controls, in accordance with the priority levels of the first and second messages, the reading rates at which the first and second messages are read.

Abstract: Methods and apparatuses that enroll a wireless device into an enterprise service with a management server addressed in a management profile are described. The enrollment may grant a control of configurations of the wireless device to the management server via the management profile. In response to receiving a notification from the management server, a trust of the notification may be verified against the management profile. If the trust is verified, a network session may be established with the management server. The network session may be secured via a certificate in the management profile. Management operations may be performed for management commands received over the secure network session to manage the configurations transparently to a user of the wireless device according to the control.

Abstract: A system and method for realizing specific security features for a mobile device that may store sensitive and private data by providing secured communications to a paired remote device. In this respect, both the mobile device (which may be a mobile phone, for example) and the paired remote device (which may be a keychain, for example) include a SIM card that may have identification data stored therein. Once paired, the two devices may communicate encrypted security messages back and forth in order to implement various security measures to protect data and wireless communications. Such messages may be generated from initial information known only to each respective device such as a randomly generated offset number and a common time reference.

Abstract: According to one embodiment, in a key scheduling device, a non-linear transformation unit non-linearly transforms at least one of partial keys resulting from dividing an expanded key. A first linear transformation unit includes first and second circuits. The second circuit linearly transforms the partial key by directly using a transformation result from the non-linear transformation unit. A first storage stores the partial key linearly transformed by the first linear transformation unit. A second linear transformation unit linearly transforms, inversely to the first linear transformation unit, each of partial keys other than the partial key linearly transformed by the second circuit out of the partial keys stored in the first storage, and outputs inversely transformed partial keys. A second storage stores one of inputs to the second circuit. An outputting unit connects the respective inversely transformed partial keys and the input stored in the second storage to be output as a second key.

Abstract: A key delivery mechanism that delivers keys to an OS platform (e.g., iOS platform) devices for decrypting encrypted HTTP live streaming data. An HTTPS URL for a stateless HTTPS service is included in the manifest for an encrypted HTTP live stream obtained by an application (e.g., a browser) on an OS platform device. The URL includes an encrypted key, for example as a query parameter value. The application passes the manifest to the OS. The OS contacts the HTTPS service to obtain the key using the URL indicated in the manifest. Since the encrypted key is a parameter of the URL, the encrypted key is provided to the HTTPS service along with information identifying the content. The HTTPS service decrypts the encrypted key and returns the decrypted key to the OS over HTTPS, thus eliminating the need for a database lookup at the HTTPS service.

Abstract: A mobile communication terminal used in wideband code division multiple access (WCDMA) 3G mobile communication includes: a communication terminal unit configured to receive a short text message from a user and transmit encrypted data generated by encrypting the short text message; and a secure-universal subscriber identity module (S-USIM) unit configured to generate a session key for encrypting the short text message, when receiving a request to encrypt the short text message from a communication terminal unit.

Abstract: A method for secure cryptographic communication comprises transmitting information that identifies a group key from a first device to a second device. The method further comprises, in the first device, using the group key to encrypt an input vector, transmitting the encrypted input vector, encrypting privacy-sensitive information using a device key, an encryption algorithm, and the input vector, and transmitting the encrypted privacy-sensitive information to the second device.

Abstract: Detecting a speed violation of a vehicle traveling from a first roadside system to a second roadside system comprises: protecting evidence data collected at two roadside systems by encrypting each set of data with random session keys at each roadside system, and then encrypting the random session keys with a public key generated from an identity that may include a vehicle identifier and a timestamp. A ratio of the public keys is calculated and used to detect a violation, whereupon a private key is obtained for decrypting at least one of the encrypted session keys, and decrypting at least one of the encrypted evidence data with the decrypted session key.

Abstract: A method and apparatus for obtaining an encryption key for an item of data transmitted from a client to a server. The method includes: determining a number R of registers available within the client for carrying out a plurality of calculations of encryption keys; determining a maximum number N of iterations necessary for obtaining at least one encryption key at the server; obtaining a structure of data representative of a key calculation state effected within the R available registers; calculating the at least one encryption key as a function: —of the number of available registers R, by performing at most N calls to a pseudo-random function F and —of the data structure; so that the at least one encryption key can be obtained from a combination of at most T=CR+NN?1 encryption keys based on a secret previously shared between the server and client.

Abstract: The present invention is directed to a method for establishing a symmetric encryption key between a first device and a second device. The symmetric encryption key is a function of a phase difference of the signals emitted between the first device and the second device and distance between the first device and the second device.

Abstract: Certain embodiments provide a set top box, comprising: a processing entity configured to obtain data for a channel stacking switch, to obtain a security data element and to formulate a message for the channel stacking switch by combining the security data element with the data; a communications interface configured to send the message to channel stacking switch. Other embodiments provide a channel stacking switch, comprising: a communication interface configured to receive a message from a set top box; a processing entity configured to determine whether or not the message is legitimate and to take an action that depends on whether or not the message is legitimate. Still further embodiments provide a satellite signal receiving system comprising a channel stacking switch and at least one set top box in secure communication with the channel stacking switch.

Abstract: Methods and systems are described for format-preserving encryption. Format-preserving encryption on an entire format F may be achieved by performing format-preserving encryption on one or more subsets of F and then applying one or more permutation rounds in such a way that all elements of F enter a subset to be encrypted. A predetermined number of encryption rounds and a predetermined number of permutation rounds may be interleaved until all elements are thoroughly mixed. The resultant output data may be saved in a database in the same format as the original input data, meet all constraints of the database, and pass all validity checks applied by software supporting the database.

Abstract: A method and system for hybrid encryption wherein all of the round function variables including the encryption algorithm change for each round. This permits the generation of block sizes and key sizes of any length and use standard block sizes and key sizes for the respective symmetric algorithm for each round function.

Abstract: The present invention relates to a method for transferring content to a device, the method including the steps of: receiving a request for content from the device; delivering a uniquely identifiable, ephemeral player to the device; and transferring content to the device, for presentation on the device by the player. The invention has particular application to digital rights management in respect of the distribution of audiovisual content such as film and television programs, advertisements and live event broadcasts over communication networks such as the Internet.

Abstract: Various techniques, including a method, system and computer program product for restoring encrypted files are disclosed. The method includes accessing a file table record for an encrypted file. The file table record includes an encrypted file stream and extent information identifying a location of one or more portions of the encrypted file in a virtual machine image. In response to accessing the file table record a consecutive data stream is stored. Storing the consecutive data stream includes encapsulating the encrypted file stream and the one or more portions of the encrypted file.

Abstract: Techniques and tools for implementing protocols for secure multi-party communication after quantum key distribution (“QKD”) are described herein. In example implementations, a trusted authority facilitates secure communication between multiple user devices. The trusted authority distributes different quantum keys by QKD under trust relationships with different users. The trusted authority determines combination keys using the quantum keys and makes the combination keys available for distribution (e.g., for non-secret distribution over a public channel). The combination keys facilitate secure communication between two user devices even in the absence of QKD between the two user devices. With the protocols, benefits of QKD are extended to multi-party communication scenarios. In addition, the protocols can retain benefit of QKD even when a trusted authority is offline or a large group seeks to establish secure communication within the group.

Abstract: A system and method of encrypting digital content in a digital container and securely locking the encrypted content to a particular user and/or computer or other computing device is provided. The system uses a token-based authentication and authorization procedure and involves the use of an authentication/authorization server. This system provides a high level of encryption security equivalent to that provided by public key/asymmetric cryptography without the complexity and expense of the associated PKI infrastructure. The system enjoys the simplicity and ease of use of single key/symmetric cryptography without the risk inherent in passing unsecured hidden keys. The secured digital container when locked to a user or user's device may not open or permit access to the contents if the digital container is transferred to another user's device. The digital container provides a secure technique of distributing electronic content such as videos, text, data, photos, financial data, sales solicitations, or the like.

Abstract: Methods and mechanisms for transmitting secure data. An apparatus includes a storage device configured to store data intended to be kept secure. Circuitry is configured to receive bits of the secure data from the storage device and invert the bits prior to transmission. The circuitry may invert the bits prior to conveyance if more than half of the bits are a binary one, set an inversion signal to indicate whether the one or more bits are inverted, and convey both the one or more bits and inversion signal. Embodiments also include a first source configured to transmit Q bits of the secure data on an interface on each of a plurality of clock cycles. The first source is also configured to generate one or more additional bits to be conveyed concurrent with the Q bits such that a number of binary ones transmitted each clock cycle is constant.

Abstract: An arrangement on monitoring of authentication, in particular for motor vehicles, includes a first communication apparatus and at least a second communication apparatus, between which a wireless communication channel can be set up. The communication apparatus items have means for authentication and encryption, with which the exchangeable data may be encrypted via the communication channel. The items of communication apparatus have storage means in which one of the digital keys usable for authentication and encryption can be stored, and in that in the storage device there is either in addition to the digital key and/or in the individual key at least one piece of information regarding at least one past communication between the first communication apparatus and the second apparatus that can be stored in memory.

Abstract: A wireless universal serial bus (WUSB) security is provided. A method of providing a session key to be used during a session between a host and a device creates the session key based on a seed key stored in a region that is not allowed by the device; and provides the session key to the device. Therefore, a user does not need to distribute information necessary for creating the session key (i.e., a connection context) to a guest device.

Abstract: Embodiments described herein are generally directed to methods and devices in which computing devices, and mobile devices in particular, establish a shared encryption key for a device group comprising at least three mobile devices. In accordance with one example embodiment, a public key of a mobile device is computed using a shared password as performed in accordance with authentication acts of a password-authenticated key exchange protocol, and transmitted to at least one other mobile device of the group. A public value is computed as a function of a mobile device private key and of a public key of at least one other mobile device of the device group, in accordance with a group key establishment protocol. The public values of the mobile devices of the device group are used to compute a shared encryption key.

Abstract: According to one embodiment, a cryptographic apparatus includes: cryptographic cores (“cores”), an assigning unit, a concatenating unit, and an output controlling unit. If a CTS flag thereof is on, each core encrypts using a symmetric key cipher algorithm utilizing CTS, while using a symmetric key. When an input of a CTS signal is received, the assigning unit assigns first input data to a predetermined core and turns on the CTS flag thereof. The concatenating unit generates concatenated data by concatenating operation data generated during encrypting the first input data, with second input data that is input immediately thereafter. The output controlling unit controls outputting the concatenated data to the predetermined core, outputting first encrypted data obtained by encrypting the concatenated data, and over outputting second encrypted data obtained by encrypting the first input data, and further turns off the predetermined core's CTS flag.

Abstract: Methods and algorithms for generating identical symmetrical cryptographic keys. In a method for generating a symmetrical cryptographic key, a first profile is generated, the first profile comprising a series of data points collected over a first period of time. A start time of the first profile is identified and the first profile divided into a sequence of time-based segments, each time-based segment comprising at least one data point. A first symmetrical cryptographic key is calculated from the sequence of time-based segments, and the first symmetrical cryptographic key is stored for at least one of encrypting and decrypting data in cooperation with a second symmetrical cryptographic key substantially identical to the first symmetrical cryptographic key.

Abstract: In an embodiment, a method for generating and distributing keys retains the scalability of a group VPN, but also provides true pair-wise keying such that an attacker who compromises one of the devices in a VPN cannot use the keys gained to decrypt the packets from the other gateways in the VPN, or spoof one of the communicating gateways. The method is collusion resistant when co-operating attackers overtake several VPN gateways and observe the keys stored in those gateways. In an embodiment, a VPN gateway comprises a cryptographic data processor configured to encrypt and to decrypt data packets; group key management logic; and Key Generation System logic. In one approach a gateway performs, in relation to adding a group member, receiving in a security association message secret data for use in the KGS; and derives keys for secure communication with one or more peer VPN gateways using the secret data.

Abstract: A method of segregating a hybrid fiber cable network involves assigning a packet identifier (PID) to each of a plurality of hubs on the hybrid fiber cable network; assigning a distinct decryption method to each of the plurality of hubs, so that each of the plurality of hubs is identifiable by its associated decryption method and PID; generating selectively multiple encrypted content for transmission to the hubs, where content encrypted for use by each hub is identified by the hub's assigned PID; and transmitting the selectively multiple encrypted content over the hybrid fiber cable network to the plurality of hubs. This abstract is not to be considered limiting, since other embodiments may deviate from the features described in this abstract.

Abstract: Embodiments provide for using two encryption keys to encrypt data instead of only one as is customarily used in the industry. According to various embodiments, a default encryption key is generated and is initially used to encrypt data, while a second encryption key is available for generation by an end user. Embodiments provide that data is encrypted with the default key until the user generates their own key, after this event, all data is encrypted with key generated by the user.

Abstract: Implementations of the system and method use an existing management server infrastructure to deliver video-on-demand or streaming content, including real-time live streaming. Existing client content playback devices, such as IPTVs, may be employed to stream content items, obtain advertisements, track user's viewing behaviors, and the like. By reusing existing client devices, there is no need for additional hardware purchases on the user side. By reusing existing management server infrastructures, capital expenses are also reduced. In such a system, a user can watch both video-on-demand and streaming audiovisual content.

Abstract: A key recovery request for a device is received at a key recovery service and a particular one-time recovery credential in a sequence of multiple one-time recovery credentials is identified. In the sequence of multiple one-time recovery credentials, previous one-time recovery credentials in the sequence are indeterminable given subsequent one-time recovery credentials in the sequence. A recovery key associated with the device is also identified. The particular one-time recovery credential in the sequence is generated based on the recovery key, and is returned in response to the key recovery request. The particular one-time recovery credential can then be used by the device to decrypt encrypted data stored on a storage media of the device.

Abstract: A 3D object is protected by a first device that receives the 3D object, generates translation vectors that are added to the points of the 3D object to obtain a protected 3D object, and outputs the protected 3D object. The protected 3D object is unprotected by a second device by receiving the protected 3D object, generating translation vectors that are subtracted from the points of the protected 3D object to obtain an unprotected 3D object, and outputting the unprotected 3D object. Also provided are the first device, the second device and computer readable storage media.

Abstract: A control unit for controlling a card reader. The control unit includes an authentication management unit for transmitting/receiving information to/from a host and each of a first encryption magnetic head device and a second encryption magnetic head device to mutually authenticate each other. The authentication management unit includes (1) a commanding means for commanding one of the first encryption magnetic head device and the second encryption magnetic head device to create lower-level information for authentication, according to a request on authentication from the host, (2) a sharing means for transmitting the lower-level information for authentication received from the above-mentioned one device to the other device for the purpose of sharing it and (3) a transmission means for transmitting the lower-level information for authentication, having been shared in all of the first encryption magnetic head device and the second encryption magnetic head device, to the host.

Abstract: The present invention disclose a system for securing managing usage rights of plurality of software applications in plurality of client computers devices to be authorized by a server application.

Abstract: A method for data transmission between a sensor and an electronic control and/or regulating unit (ECU), the transmitted sensor data (x1, . . . , xt) and the sensor being secured against a manipulation. The system provides a particularly simple, but very secure method for manipulation protection, the sensor data (x1, . . . , xt) being transmitted via a first logical data transmission channel at a first data transmission rate, and security data (MAC; CMAC) for securing the transmitted sensor data and/or the sensor being transmitted via a second logical data transmission channel at a second data transmission rate from the sensor to the ECU. At least once at the beginning of a data transmission session, a session key is transmitted from the ECU to the sensor via a third logical data transmission channel and received by the latter, the session key being used at least for the ongoing session to generate the security data.

Abstract: Systems and methods for reducing problems and disadvantages associated with traditional approaches to encryption and decryption of data are provided. An information handling system may include a processor, a memory communicatively coupled to the processor, an encryption accelerator communicatively coupled to the processor, and a computer-readable medium communicatively coupled to the processor. The encryption accelerator may be configured to encrypt or decrypt data in response to a command from the processor to perform an encryption or decryption task upon data associated with an input/output operation.

Abstract: Embodiments are directed to towards cloud scale automatic identity management. A floating network may be established using agents operative on hosts across one or more networks. Each node of the floating network is resident on host (computer or cloud instance) that includes an agent configured to perform one or more networking tasks that establish the floating network. Parent nodes may be nodes designated as points in the floating network for adding additional nodes. Accordingly, each parent node includes at least one parent agent that includes at least parent credentials. Agent installers provided to a host may generate a child agent for the host that includes child credentials generated based on its parent credentials. An unambiguous identity value for the new child node may be determined by tracing a trust relationship path from the child node to the root node of the floating network.

Abstract: A method for verifying the integrity of a key implemented in a symmetrical ciphering or deciphering algorithm, including the steps of complementing to one at least the key; and verifying the coherence between two executions of the algorithm, respectively with the key and with the key complemented to one.

Abstract: Disclosed are a method and apparatus for a data storage library comprising a plurality of drives and a combination bridge controller device adapted to direct and make compatible communication traffic between a client and the plurality of drives. The combination bridge controller device is further adapted to encrypt a first data package received from the client. The combination bridge controller device is further adapted to transmit the encrypted first data package, a first moniker and a first message authentication code to one of the plurality of drives for storage to a cooperating mobile storage medium. The combination bridge controller device is further adapted to decrypt the first data package when used in combination with a first key associated with the first moniker and guarantee the decryption of the first data package was successfully accomplished with authentication of the first message authentication code.

Abstract: A method, system, and apparatus for agile generation of one time passcodes (OTPs) in a security environment, the security environment having a token generator comprising a token generator algorithm and a validator, the method comprising generating a OTP at the token generator according to a variance technique; wherein the variance technique is selected from a set of variance techniques, receiving the OTP at a validator, determining, at the validator, the variance technique used by the token generator to generate the OTP, and determining whether to validate the OTP based on the OTP and variance technique.

Abstract: A method of improving privacy by hiding, in an ordered sequence of messages M[x(1), D(1)], M[x(2), D(2)], etc, communicated between a first and at least one second party sharing a key k, metadata x(i) descriptive of message processing, wherein D(i) denotes payload data. The method comprises the first and the second party agreeing on a pseudo random mapping depending on a shared key k, Fk, mapping at least x(i) to y(i), and the first party modifying the messages by replacing x(i) by y(i) in each message M(x(i), D(i)). The first party then transmits the modified messages maintaining their original order, and on reception of a message M(y(m), D), the second party uses a mapping Gk to retrieve position m of received value and the original value x(m).