Abstract: Differential power analysis is a powerful cryptanalytic method that can be used to extract secret keys from cryptographic hardware during operation. To reduce the risk of compromise, cryptographic hardware can employ countermeasures to reduce the amount of secret information that can be deduced by power consumption measurements during processing. Such countermeasures can include balancing circuitry inside a cryptographic hardware device to reduce the amount of variation in power consumption that is correlated to data parameters being manipulated. This can be facilitated by using a constant-Hamming-weight representation when representing and manipulating secret parameters. Low-level operation modules, such as Boolean logic gates, can be built to process input parameters in a manner that balances the number of ON transistors while simultaneously maintaining a data-independent number of transistor transitions during computation.

Abstract: A sender driven certificate enrollment system and methods of its use are provided, in which a sender controls the generation of a digital certificate that is used to encrypt and send a document to a recipient in a secure manner. The sender compares previously stored recipient information to gathered information from the recipient. If the information matches, the sender transfers key generation software to the recipient, which produces the digital certificate, comprising a public and private key pair. The sender can then use the public key to encrypt and send the document to the recipient, wherein the recipient can use the matching private key to decrypt the document.

Abstract: Before use, a population of tamper-resistant cryptographic enforcement devices is partitioned into groups and issued one or more group keys. Each tamper-resistant device contains multiple computational units to control access to digital content. One of the computational units within each tamper-resistant device communicates with another of the computational units acting as an interface control processor, and serves to protect the contents of a nonvolatile memory from unauthorized access or modification by other portions of the tamper-resistant device, while performing cryptographic computations using the memory contents. Content providers enforce viewing privileges by transmitting encrypted rights keys to a large number of recipient devices. These recipient devices process received messages using the protected processing environment and memory space of the secure unit.

Abstract: An improved method, system, and computer program product for efficient transmission of data to multiple network nodes is disclosed. A method for transmitting a data block over a network from a first sending node to a first set of recipient nodes, comprises, in the first sending node, a) dividing the first set of recipient nodes into a subset of selected nodes, selected according to scoring criteria associated with each recipient node, and a subset of unselected nodes, b) assigning at least one of the unselected nodes to at least one selected node according to scoring criteria associated with the respective selected nodes, c) transmitting to each selected node a packet including the data block and a list of the nodes assigned to the selected node.

Abstract: An e-mail firewall (105) applies policies to e-mail messages (204) between a first site and a plurality of second sites in accordance with a plurality of administrator selectable policies (216). The firewall comprises a simple mail transfer protocol (SMTP) relay (202) for causing the e-mail messages (204) to be transmitted between the first site and selected ones of the second sites. A plurality of policy managers (216) enforce administrator selectable policies. The policies, such as encryption and decryption policies, comprise at least a first source/destination policy (218), at least a first content policy (220) and at least a first virus policy (224). The policies are characterized by a plurality of administrator selectable criteria (310), a plurality of administrator selectable exceptions (312) to the criteria and a plurality of administrator selectable actions (314, 316, 322) associated with the criteria and exceptions.

Abstract: A light effects projector includes a light source and effect wheels interposed between the light source and an exit aperture of the projector. A gobo wheel includes a plurality of apertures and gobo holders containing gobos. The gobo wheel is adapted to rotate so as to place a gobo, which is retained in one of the holders, within the light path from the light source. The gobo holders of the gobo wheel are removably secured to the gobo wheel by a spring retainer that engages flange portions of a gobo holder. The projector further includes a cooling system to cool the gobos during operation. Additionally, the projector includes an effects wheel that provides a “frost effect” portion to variably distort light from the projector.

Abstract: A taut wire sensor includes an actuator that is movably coupled to a housing. The actuator includes a taut wire terminal. The actuator has two contacts that are maintained in a spaced apart orientation by the mating of parts, which are held in place by a spring element. The actuator deforms when force is applied to the taut wire terminal of the sensor. When the actuator deform, an electrical connection is made between the two contacts to produce an alarm indication by the sensor. The orientation of the actuator is maintained by the mating of parts which are also held by a spring element. One of the contacts in the actuator is a flexible contact pin that is adapted to bend when high force is applied to the taut wire terminal. The sensor housing also includes a movement limiter that overcomes a weakness in prior sensors which employ compensating flowable materials to adjust sensor position.

Abstract: A needle assembly comprises an injection needle and a needle hub, mountable on a syringe, for securing the injection needle. The needle has an injection part extending axially from the hub and terminating in a skin piercing obliquely cut end. The length of the injection part is between 4 and 6 mm, thereby facilitating a proper subcutaneous injection. Also, preferably either (a) the outer diameter of the needle is smaller than 0.320 mm and the bore diameter is larger than 0.165 mm, or (b) the outer diameter is smaller than 0.298 mm and the bore diameter is larger than 0.133 mm. Also, preferably the hub includes an axially extending protrusion, from which the injection part extends, to facilitate insertion of the injection part into the skin of a user at an oblique angle.

Abstract: Methods and apparatuses for increasing the leak-resistance of cryptographic systems using an indexed key update technique are disclosed. In one embodiment, a cryptographic client device maintains a secret key value as part of its state. The client can update its secret value at any time, for example before each transaction, using an update process that makes partial information that might have previously leaked to attackers about the secret no longer usefully describe the new updated secret value. By repeatedly applying the update process, information leaking during cryptographic operations that is collected by attackers rapidly becomes obsolete. Thus, such a system can remain secure (and in some embodiments is provably secure) against attacks involving analysis of measurements of the device's power consumption, electromagnetic characteristics, or other information leaked during transactions. The present invention can be used in connection with a client and server using such a protocol.

Abstract: Methods and apparatus are provided for selecting advertisements and other information from a computer network database based on user defined preferences and transmitting the selected advertisement in background mode over a communications link between the computer network and a local computer with minimal interference with other processes communicating over the communications link. This method includes monitoring the communications link and transmitting portions of the advertisement when the communications link line utilization is below a preestablished threshold. Methods and apparatus are also provided for displaying or otherwise presenting the selected advertisements on the user's computer. Additional methods and apparatus are provided for selecting and presenting information stored on a local storage media based on user defined preferences.

Abstract: A navigable audio delivery system includes an audio application and content. The application includes control data relating to the delivery of audio content to a user replay device. The delivery system facilitates the navigation between logical portions of the audio content by associating tag data with the audio content. The system also facilitates navigation between parallel portions of an audio program by including multiple layers of content in the audio program that is delivered to the user replay device.

Abstract: A document delivery architecture dynamically generates a private Uniform Resource Locator (URL) to distribute information. Each private URL (“PURL”) uniquely identifies an intended recipient of a document, the document or set of documents to be delivered, and (optionally) other parameters specific to the delivery process. The intended recipient of a document uses the PURL to retrieve the document. The server, upon retrieval of the document, customizes the behavior of the retrieval based upon attributes included in the PURL, as well as log information associated with the retrieval in a data base. This architecture and usage of PURLs enables secure document delivery and tracking of document receipt.

Abstract: A method and apparatus is provided for effecting secure document delivery in any of various document formats. A document is encrypted with the public key of a server associated with the recipient of the document, instead of with the public key of the intended recipient. The receiving server is located within a firewall. The encrypted document is forwarded to the server within the firewall. The server decrypts the document using its corresponding private key, converts the document to a now data representation, and then either forwards the document to the recipient inside the firewall, or re-encrypts the document with the public key of an intended recipient outside of the firewall or with the public key of another server that is associated with the intended recipient of the document.