Abstract: A security method using an electronic signature, which improves the performance of an electronic signature authentication by generating and verifying an electronic signature using a mediator, and acquires a forward security in an electronic signature generation and verification by adding a forward secure signature of semi-trusted party (SEM) to a partial signature value generated based on a secret key piece of the SEM. A public key and an optional secret key composed of two kinds of pieces are generated by a certificate authority in response to a request from a user terminal device. The secret key pieces are issued to the user terminal device and a semi-trusted party not to be overlapped with each other. A first signature piece generated from the issued pieces of the private key is transmitted to the user terminal device from the semi-trusted party when a certificate of the user terminal device is still valid.

Abstract: Methods and systems are disclosed for providing secured data transmission and for managing cryptographic keys. One embodiment of the invention provides secure key management when separate devices are used for generating and utilizing the keys. One embodiment of the invention provides secure storage of keys stored in an unsecured database. One embodiment of the invention provides key security in conjunction with high speed decryption and encryption, without degrading the performance of the data network.

Abstract: The present invention creates a SOAP message without using DOM by generating a body part by sequentially performing such a process of a message as encryption or signing for each piece of the message, generating a header part by using information acquired during the process, and by combining the body part and the header part. The present invention also breaks a SOAP message without using DOM by acquiring header information with parsing a received SOAP message and sequentially performing decode or verification of a signature of a body part according to the header information.

Abstract: A method of digital rights management for a broadcast-multicast service, the method comprising receiving a request from a terminal to join a service domain having a common group key; transmitting encryption of one or more service encryption keys using the common group key to the terminal that requested to join; and allowing the terminal to share the same contents and the same services with one or more other devices within the service domain.

Abstract: The present invention discloses a method and system for remote password based authentication using smart cards for accessing a communications network. The disclosed method does not require a remote authentication sever to maintain a table of passwords for all users. The disclosed method and system also support mutual authentication. It not only prevents the illegal use of system resources by an impersonator, the user can also authenticate the identity of the remote authentication server.

Abstract: A method and apparatus are provided for early distribution of at least one encryption key intended for securing a communication to be set up on the link layer of a cellular network formed of a plurality of cells, each controlled by an attachment point, between a mobile terminal and a set of attachment points, termed the target attachment points. The includes, for at least one target attachment point: creation of an encryption ticket containing an encryption key, enciphered on the basis of at least one authentication key specific to this target attachment point; receipt of the enciphered encryption ticket, by way of a current attachment point to which the mobile terminal is connected; identification, of a means of deciphering the enciphered encryption ticket, with the aid of the at least one authentication key, making it possible to obtain the encryption key.

Abstract: A client receives encrypted content from content server. The header of the content includes license-identifying information for identifying a license required to utilize the content. The client requests a license server to transmit the license identified by the license-identifying information. When receiving the request for a license, the license server carries out a charging process before transmitting the license to the client. The client stores the license received from the license server. The stored license serves as a condition for encrypting and playing back the content. As a result, content can be distributed with a high degree of freedom and only an authorized user is capable of utilizing the content.

Abstract: One embodiment of the present invention provides a system that can expire encrypted-data. During operation, the system receives an expiry-request that includes object-identifying information, which can be used to identify a set of database objects that contain the encrypted-data, wherein a database object can be a table, a partition, a row, or a column in a row. Furthermore, a database object can have an expiration time, and it can be stored in an archive, which is typically used to store large amounts of data for long periods using a slower, but cheaper storage medium than the storage medium used by the database. The system then identifies a set of keys for the encrypted-data using the object-identifying information. Next, the system deletes the set of keys, thereby expiring the encrypted-data. Note that, deleting the set of keys ensures that the secure key repository does not contain any stale keys associated with expired encrypted-data.

Abstract: The present invention uses a group key management scheme for admission control while enabling various conventional approaches toward establishing peer-to-peer security. Various embodiments of the invention can provide peer-to-peer confidentiality and authenticity, such that other parties, such as group members, can not understand communications not intended for them. A group key may be used in combination with known unicast security protocols to establish, implicitly or explicitly, proof of group membership together with bi-lateral secure communication.

Abstract: A method and apparatus for secure storage of data by using redundant keys is provided. The method includes encrypting a data set by using a master key, which can be encrypted by different sync keys. Sync keys can be generated by different supervisor cards. Thereafter, the encrypted master key and the encrypted data set can be stored in a memory. Further, credentials stored in one of the supervisor cards can be encrypted and transferred to other supervisor cards, to provide redundancy of supervisor cards.

Abstract: A system, method, and program product is provided that uses environments to control access to encryption keys. A request for an encryption key and an environment identifier is received. If the encryption key is not associated with the environment identifier, the request is denied. If they are associated, the system receives user-supplied environment authentication data items from a user. Examples of environment authentication data include passwords, user identifiers, user biometric data (e.g., fingerprint scan, etc.), smart cards, and the like. The system retrieves stored environment authentication data items from a secure (e.g., encrypted) storage location. The retrieved stored environment authentication data items correspond to the environment identifier that was received. The received environment authentication data items are authenticated using the retrieved stored environment authentication data items.

Abstract: A home network system includes: a plurality of wireless devices cooperated with a home network, each device having a tag attached thereto to identify it; a tag reader for reading tag information from the tag of each wireless device; and a network manager for storing a shared key and identifying each wireless device connected to the home network using the tag information and supporting information exchange between the wireless devices by using the shared key.

Abstract: Methods and systems for storing data securely in a secure data storage network are disclosed. One method includes receiving at a secure storage appliance a block of data for storage on a volume, the volume associated with a plurality of shares distributed across a plurality of physical storage devices. The method also includes cryptographically splitting the block of data received by the secure storage appliance into a plurality of secondary data blocks. The method further includes encrypting each of the plurality of secondary data blocks with a different session key, each session key associated with at least one of the plurality of shares. The method also includes storing each data block and associated session key at the corresponding share, remote from the secure storage appliance.

Abstract: A system, according to one embodiment, includes a master key for encryption of data; an encryption key site accessible by computer and storing a first piece of the master key; a configuration file resident in a computer file system, the configuration file storing a second piece of the master key; a computer database storing a third piece of the master key; a master-key seal key used to encrypt the master key, wherein a secure self managed data (SSMD) key is obtained by assembling and decrypting the first piece, the second piece and the third piece using the master-key seal key; a unique ID for the data; a classification level for the data; and an expiration time for the data, wherein the data, the unique ID, the classification level, and the expiration time are encrypted together using the SSMD key to form an SSMD encoded data.

Abstract: An information processing apparatus, an information processing method, and an information providing medium are provided. Encrypted information, an encrypted first key for decrypting the encrypted information, and a second key for decrypting the first key are processed to store the information in a storage medium. To be more specific, cross certification is executed with the storage medium, the first key is decrypted by the second key, the decrypted first key is encrypted, and the decrypted first key and the encrypted information are stored in the storage medium. The novel constitution prevents unauthorized replication of information by use of a low-cost, general-purpose semiconductor memory.

Abstract: A method and system for secure processing of authentication key material in an ad hoc wireless network enables secure distribution of the authentication key material between a mesh authenticator (110) and a mesh key distributor (115), which may be separated by multiple wireless links. The method includes deriving a pairwise transient key for key distribution (PTK-KD) using a mesh key holder security information element (MKHSIE). A mesh authenticator pairwise master key (PMK-MA) is then requested using a first mesh encrypted key information element (MEKIE) that includes data origin information. Using the pairwise transient key for key distribution (PTK-KD), a second mesh encrypted key information element (MEKIE) is then decrypted to obtain the mesh authenticator pairwise master key (PMK-MA).

Abstract: According to one embodiment, a method for delivering a mating key to a smart card coupled to a decoding device with a built-in descrambler. The mating key is used by the smart card to encrypt the derived descrambling key for the specific decoder with descrambler. The corresponding mating key is a derivation calculated within the descrambler circuit using a unique value stored in the decoding device, and is of a message that comprises a unique predetermined value that identifies a manufacturer of the decoding device, the digital device targeted to receive the encrypted key data, and the service provider.

Abstract: A system and method are provided for pre-processing encrypted and/or signed messages at a host system before the message is transmitted to a wireless mobile communication device. The message is received at the host system from a message sender. There is a determination as to whether any of the message receivers has a corresponding wireless mobile communication device. For each message receiver that has a corresponding wireless mobile communication device, the message is processed so as to modify the message with respect to one or more encryption and/or authentication aspects. The processed message is transmitted to a wireless mobile communication device that corresponds to the first message receiver. The system and method may include post-processing messages sent from a wireless mobile communications device to a host system. Authentication and/or encryption message processing is performed upon the message. The processed message may then be sent through the host system to one or more receivers.

Abstract: A secure storage appliance is disclosed, along with methods of storing and reading data in a secure storage network. The secure storage appliance is configured to present to a client a virtual disk, the virtual disk mapped to the plurality of physical storage devices. The secure storage appliance is capable of executing program instructions configured to generate a plurality of secondary blocks of data by performing splitting and encrypting operations on a block of data received from the client for storage on the virtual disk and reconstitute the block of data from at least a portion of the plurality of secondary blocks of data stored in shares on corresponding physical storage devices in response to a request from the client.

Abstract: It takes time for an encryption data communication system to transfer encrypted data, because negotiations of security parameters are necessary prior to communications in order to protect security and integrity of a SIP message or public key cryptography is required to be used for an encryption process, a decryption process., an digital signature process and an digital digital signature verification process each time a SIP message is transmitted/received. When a SIP message is transferred between two entities, the message is encrypted by shared information if the information is being shared between the entities, or the message is encrypted by the public key of the transmission destination entity if the shared information is not being shared. The encrypted message contains shared information to be used for the transmission destination entity of the encrypted data to encrypt or decrypt the message, during communications after the encrypted data is generated.

Abstract: A system for encrypting a data encryption key includes a key encryption key generator configured to receive a public portion of a label, the label including an asymmetric key pair of the public portion and a private portion, the key encryption key generator being further configured to process the public portion of the label to obtain a key encryption key, and a data encryption key encoder configured to receive the key encryption key from the key encryption key generator and to receive a data encryption key from a random number generator, the encoder being further configured to encrypt the data encryption key using the key encryption key to produce an encrypted data encryption key and to provide the encrypted data encryption key to an encryption device.

Abstract: A cryptographic coalition administrator for managing information access across multiple organizations includes a communications interface configured to communicate electronically transmit and receive information, a memory configured to store pairs of public and private cryptographic keys associated with different levels of access, and a key manager configured and connected to communicate with the interface and the memory and configured to: distribute cryptographic key sets, of public cryptographic keys and private cryptographic keys, to first and second organizations of members; determine a first group of members in the first organization to have authorization to exchange information with a second group of members in the second organization, the first and second groups sharing cryptographic parameters, and public and private cryptographic keys; and distribute a first cryptographic key set, from the cryptographic key sets, to the first group, the first group having a first sensitivity level at least as high as

Abstract: A multi-tiered server management architecture is employed including an application development tier, an application operations tier, and a cluster operations tier. In the application development tier, applications are developed for execution on one or more server computers. In the application operations tier, execution of the applications is managed and sub-boundaries within a cluster of servers can be established. In the cluster operations tier, operation of the server computers is managed without concern for what applications are executing on the one or more server computers and boundaries between clusters of servers can be established. The multi-tiered server management architecture can also be employed in co-location facilities where clusters of servers are leased to tenants, with the tenants implementing the application operations tier and the facility owner (or operator) implementing the cluster operations tier.

Abstract: A first infrastructure system device other than a mobile station generates an encryption key and encrypts the encryption key with a first intrakey associated with a first zone that includes a second infrastructure system device other than a mobile station, yielding a first encrypted encryption key. The first intrakey is used only by infrastructure system devices other than a mobile station for encrypting at least the encryption key prior to transport within the first zone. The first infrastructure system device forwards the first encrypted encryption key to the second infrastructure system device.

Abstract: A content recording/reproducing system, which records and reproduces a sub-content relating to a main content, includes a distribution device, first and second recording media, a recording device and a reproducing device. The first recording medium that is non-rewritable prestores key data based on which a public key is derivable, and the main content. The distribution device outputs verification information that includes the sub-content and is generated by applying a digital signature to relative information relating to the sub-content based on a secret key corresponding to the public key. The recording device acquires and records the verification information on the second recording medium that is rewritable.

Abstract: A method and apparatus, such as a secure distribution server, receives encrypted information from a sender, wherein the encrypted information is for transmission to a plurality of intended recipients. In addition to the encrypted information, the method includes receiving an encrypted secret key that is encrypted using a public key associated with the secure distribution server. The method and apparatus decrypts the encrypted secret key to produce a decrypted secret key. The method and apparatus then encrypts the decrypted secret key with the corresponding public key of at least one (or each of a plurality of) intended recipient(s) to produce at least one (or plurality of) recipient-specific secure secret keys. The method and apparatus then forwards the received encrypted information sent by the sender and also sends at least one recipient-specific secure secret key to a corresponding intended recipient.

Abstract: To generate and verify signature data using a known signature algorithm whose safety is ensured from the viewpoint of calculation quantity and ensuring the authenticity thereof over a long time period. A message to be signed is transmitted, a padding-data item is added to the message, and a signature-data item of the message with the padding-data item added thereto is generated by using a hash function and a public-key cryptosystem. The addition step and the generation step are performed a predetermined number of times by using the signature-data item, as the padding-data item, and the signature-data items generated the predetermined number of times and the padding-data items added the predetermined number of times are externally transmitted with the message.

Abstract: An electronic device, a control method thereof and a security program are provided which are capable of preventing or suppressing the theft of the electronic device. The electronic device comprises mounting means for loading a portable recording medium and encrypted information write means for encrypting predetermined information using an encryption key unique to the electronic device and writing the encrypted information in the recording medium. The electronic device further comprises encrypted information read means for reading the encrypted information recorded in the recording medium in the case where the recording medium is loaded in the mounting means, decryption execution means for executing the decryption of the encrypted information using the encryption key, and control means for setting the electronic device in usable mode in the case where the encrypted information is decrypted by the decryption execution means.

Abstract: Each participant apparatus (103) encrypts a plaintext by using a secret key of secret key cryptography, encrypts the encryption key by a public key, and sends the plaintext and public key to a substitution/decryption apparatus (112). With this processing, the limitation on the length of a ciphertext to be processed can be eliminated. In this invention, a verifiable proof text using a public key by each substitution/decryption apparatus is verified by a verification apparatus (109) by using the public key. If one of a plurality of organizations to decrypt and shuffle ciphertexts has not correctly executed the operation, a third party can specify it and prove that the specified organization is unauthorized.

Abstract: A method for protecting secret keys, such as HDCP device key sets, during the manufacturing process is disclosed. In particular, the present invention comprises a method for securely sending and receiving data, such as HDCP device key sets, for use in a cryptosystem. In operation, a first party, referred to as a sender (107) is to send original data (106) to a second party, referred to as a recipient (100). To facilitate the secure transmission, the recipient (100) randomly generates (101) a session key (102) and encrypts it with its private key-encryption key (103). The recipient then securely sends both the encrypted and unencrypted session keys to the sender. The sender (107) then encrypts the original data (106) using the unencrypted session key (102) and includes the encrypted data (108) along with the encrypted session key (104) to the recipient (100). The recipient (100) then decrypts the encrypted session key (104) using the private key-encryption key (103) and then decrypts the original data (106).

Abstract: A system and method are described supporting secure implementations of 3DES and other strong cryptographic algorithms. A secure key block having control, key, and hash fields safely stores or transmits keys in insecure or hostile environments. The control field provides attribute information such as the manner of using a key, the algorithm to be implemented, the mode of use, and the exportability of the key. A hash algorithm is applied across the key and control for generating a hash field that cryptographically ties the control and key fields together. Improved security is provided because tampering with any portion of the key block results in an invalid key block. The work factor associated with any manner of attack is sufficient to maintain a high level of security consistent with the large keys and strong cryptographic algorithms supported.

Abstract: One embodiment of the present invention provides a system that maintains keys using limited storage space on a computing device, such as a smart card. During operation, the system receives a request at the computing device to perform an operation involving a key. While processing the request, the system obtains an encrypted key from remote storage located outside of the computing device, wherein the encrypted key was created by encrypting the key along with an expiration time for the key. Next, the system decrypts the encrypted key to restore the key and the expiration time, wherein the encrypted key is decrypted using a computing-device key, which is maintained locally on the computing device. Finally, if the expiration time has not passed, the system uses the key to perform the requested operation. Note that by storing the encrypted key in remote storage, the computing device is able to use the key without consuming local storage space to store the key.

Abstract: Techniques are provided for determining an updated session encryption key. According to one embodiment, a packet index can be computed using a sequence number received in a session data packet during a SRTP session and a predetermined value. The predetermined value can be, for example, a non-zero value from a roll-over-counter that has been set to the non-zero value. The updated session encryption key can then be determined using a master key received from a BCMCS controller and the packet index. The determined updated session key is used to encrypt or de-encrypt content provided by a content server.

Abstract: A method for transmitting groupcast data in a wireless mesh communication network as provided improves security of groupcast data. The method comprises processing, at a supplicant node, authentication handshake data received from an authenticator node, wherein the supplicant node is a next-hop neighbor of the authenticator node away from a root node. The supplicant node then stores a group transient key (GTK) received from the authenticator node. Next, the supplicant node processes authentication handshake data received from a third node, wherein the third node is a next-hop neighbor of the supplicant node away from the root node. The GTK is then transmitted from the supplicant node to the third node. Encrypted groupcast data are then generated at the supplicant node by using the GTK to encrypt groupcast data received from the authenticator node. Finally, the encrypted groupcast data are transmitted from the supplicant node to the third node.

Abstract: Systems and methods are described for performing policy-managed, peer-to-peer service orchestration in a manner that supports the formation of self-organizing service networks that enable rich media experiences. In one embodiment, services are distributed across peer-to-peer communicating nodes, and each node provides message routing and orchestration using a message pump and workflow collator. Distributed policy management of service interfaces helps to provide trust and security, supporting commercial exchange of value. Peer-to-peer messaging and workflow collation allow services to be dynamically created from a heterogeneous set of primitive services. The shared resources are services of many different types, using different service interface bindings beyond those typically supported in a web service deployments built on UDDI, SOAP, and WSDL.

Abstract: In an information input/output system, a user device inputs and outputs information to and from external sources including a key management device. The system includes the key management device that securely outputs invalid-device information specifying an invalid device unit that has been made invalid for use, and the user device that includes an input/output unit and a host unit. Via the input/output unit, input and output of information is enabled between the host unit and the external sources. The host unit securely receives, via the input/output unit, the invalid-device information outputted by the key management device and judges whether or not the input/output unit is an invalid device unit by referring to the received invalid-device information. When judging, that the input/output unit is an invalid device, the host unit thereafter prohibits input and output via the input/output unit.

Abstract: A system for protecting data in a security system generates and encodes a backup key for encoding long-lived secrets. The system generates a distribution plan for distributing cryptographic splits of the encoded backup key to selected persons based on geographic and organizational diversity. The distribution plan specifies a number M of the cryptographic splits to be generated and a number N of the cryptographic splits required to recover the backup key. The system processes utilize an init file comprising system parameters and state files each comprising parameters reflecting a state of the secure system after a transaction. Any of the state files may be used for any of the system processes. The state files and the init file are encoded by the backup key, thus protecting the long-lived secrets.

Abstract: An object of the present invention is to realize a communication apparatus, a communication method, and an integrated circuit, capable of performing a key updating operation, while having resistibility with respect to noises and DoS attacks without increasing a frequency bandwidth. The present invention is such a communication apparatus for transmitting key update information via a transmission line to another communication apparatus, comprising: a key update information producing unit which generates the key update information having a first time width; a code information producing unit which generates code information which is employed so as to code the key update information; a time width expanding unit 20 for expanding the first time width to obtain a second time width; and a coding process unit 21 for performing a coding process with respect to key update information having the second time width by employing the code information.

Abstract: A secure Internet Protocol (IP) telephony system, apparatus, and methods are disclosed. Communications over an IP telephony system can be secured by securing communications to and from a Cable Telephony Adapter (CTA). The system can include one or more CTAs, network servers, servers configured as signaling controllers, key distribution centers (KDC), and can include gateways that couple the IP telephony system to a Public Switched Telephone Network (PSTN). Each CTA can be configured as secure hardware and can be configured with multiple encryption keys that are used to communicate signaling or bearer channel communications. The KDC can be configured to periodically distribute symmetric encryption keys to secure communications between devices that have been provisioned to operate in the system and signaling controllers.

Abstract: A system, apparatus, and method are directed to providing and securely viewing secure content. In one embodiment, a secure player provides secure screening/previewing of secure content, such as a motion picture, by a member of an awards organization. A content key is employed to selectively encrypt at least a portion of a content stream. The content key is encrypted with a screener key. The encrypted content key is embedded into the secure content. The screener key is encrypted using public/private key pair that is bound to the secure player. The secure content may be distributed on a medium, such as a DVD, high definition DVD, and the like. The secure player is configured to receive the medium, screener key, and a screener identity. The screener identity and screener key are employed by the secure player to decrypt and enable secure viewing of the content.

Abstract: Secure key exchange and protected content distribution between a first entity and a second entity in a processing system may be accomplished by generating, by the first entity, a first key, encrypting the first key with a public key of a third entity, and storing the encrypted first key in the third entity. The second entity generates a second key, encrypts the second key with the public key of the third entity, and stores the encrypted second key in the third entity. The third entity decrypts the encrypted first key and the encrypted second key, using the third entity's private key to obtain the first key and the second key, encrypts the first key using the second key, and stores the first key encrypted by the second key in the third entity. The second entity then obtains the first key encrypted by the second key, and decrypts, using the second key, the first key encrypted by the second key. The first key may then be used to encrypt content sent to from the second entity to the first entity.

Abstract: A firewall protects an Ethernet network from a first larger network, e.g., the Internet. A first server on the Ethernet network stores an encrypted private key, decrypts the private key using a passphrase, and communicates with clients on the first network using the private key. A second server on the Ethernet network determines whether an intrusion has occurred from the first network into the first server and provides the passphrase to the first server only when no intrusion has occurred from the first network into the first server. The invention can be realized in apparatuses, methods, and/or instruction sets.

Abstract: An engine, register in a memory, and methods for the same are provided. The engine may include a data encryptor, a key encryptor, a data decryptor, a key decryptor, a register, and a control circuit. The data encryptor may encrypt data using a key. The key encryptor may encrypt the key used by the data encryptor. The data decryptor may receive encrypted data from a storage medium and may decrypt the encrypted data. The key decryptor may receive an encrypted key from the storage medium and may decrypt the encrypted key. The register may indicate the status of the key and/or the encrypted key. The control circuit may control the data encryptor, the data decryptor, the key encryptor, the key decryptor, and the register.

Abstract: A processing system to serve as a source device for protected digital content comprises a processor and control logic. The processing system may generate and save a first master key, and may transmit that key to a first receiving device for use during a first session. During a second session, the processing system may obtain an identifier for a candidate receiving device. The processing system may use the identifier to determine whether the processing system contains a master key for the candidate receiving device. If the processing system such a master key, the processing system may send verification data concerning that key to the candidate receiving device, and may use that key to encrypt a session key for the second session. If not, a second master key may be generated and transmitted to the candidate receiving device for use during the second session. Other embodiments are described and claimed.

Abstract: The present invention provides a data processing method for encrypting or decrypting contents data using contents key data. The method comprises generating the reference information including data encrypted from contents key data using a plurality of device key data proper to a plurality of apparatus, by encrypting the contents key data using the device key data associated with those of the plural apparatus for which recording or reproduction is allowed, supplying the generated reference information along with the device key data to the plural apparatus, decrypting the contents key data from the supplied reference information, by the plural apparatus, using the device key data proper to the plural apparatus, and encrypting or decrypting the contents data using the decrypted contents key data.

Abstract: In service access networks having different key hierarchies that provide broadcast service to a mobile terminal, when switching from a first service access network, from which the mobile terminal receives the data of the broadcast service in an encrypted manner by a first data content encryption key, to a second service access network, from which the mobile terminal receives the data of the same broadcast service in an encrypted manner by a second data content encryption key, the mobile terminal receives a key of the hierarchy of the second service access network which is encrypted by a user-specific key of the first service access network.

Abstract: A system for providing persistent access control of protected content is disclosed. The method on a client system includes sending a first request for authentication of the client to a server system. Subsequently, the client is authenticated by the server. Next, a user on the client attempts to access a file comprising a trailer and content encrypted with an encrypting key. Then, a second request for access to the content is sent to the server by the client, wherein an identifier from the trailer is included in the second request. The identifier identifies the content or an access control policy of the content. The server determines that the second request is in accordance with an access control policy associated with the content, and grants access to the content. Lastly, the client accesses the content in accordance with the access control policy.

Abstract: Controlling delivery of broadcast encryption content for a network cluster from a content server outside the cluster that include receiving in the content server from the network device a key management block for the cluster, a unique data token for the cluster, and an encrypted cluster id and calculating a binding key for the cluster in dependence upon the key management block for the cluster, the unique data token for the cluster, and the encrypted cluster id. In typical embodiments, calculating a binding key includes calculating a management key from the key management block for the cluster; calculating a content server device key from the management key and the content server device id; decrypting the encrypted cluster id with the content server device key; and calculating the binding key with the management key, the unique data token for the cluster, and the cluster id.

Abstract: A system and method for pseudonymizing digital data records sent from a source system to a destination system, using an identity protector client system and an identity protector master system, includes the steps of receiving, at the identity protector client, person-specific data from a source system provided with a source identifier. The digital data records are pre-pseudonymized by the identity protector client, and the processed digital data records are marked with a source identifier which references the source file in the source system. The pre-pseudonymized digital data records are transmitted to the identity protector master. For every data record, a pseudonym is created by the identity protector master from the pre-pseudonym, the source identifier, and at least one other value generated from an erratic value and a time value. The pseudonym is transmitted to the destination system.

Abstract: A communication device, a communication system and an authentication system for preventing a disguising act by an illegal man-in-the-middle and improving the safety and certainty of authentication processing are provided. A slave (20) transmits an authentication request including device information to a master (10). The master (10) receives the authentication request and displays the device information included in the authentication request on a screen of a display section (13). The user visually checks the device information displayed on the screen of the display section 13 (13), determines whether or not to verify the authentication, and instructs the master (10) of the determination result via an input section (14). The master (10), instructed to verify or not to verify the authentication, transmits a response in accordance with the instruction to the slave (20).