Abstract: We disclose methods and apparatuses for securing cryptographic devices against attacks involving external monitoring and analysis. A “self-healing” property is introduced, enabling security to be continually re-established following partial compromises. In addition to producing useful cryptographic results, a typical leak-resistant cryptographic operation modifies or updates secret key material in a manner designed to render useless any information about the secrets that may have previously leaked from the system. Exemplary leak-proof and leak-resistant implementations are shown for symmetric authentication, certified Diffie-Hellman (when either one or both users have certificates), RSA, ElGamal public key decryption.

Abstract: A method of detecting network worms include the following steps: (1) Profiling the TCP connection information collected from the protected network, quantifying the plurality of statuses contained in the TCP connection information; (2) Clustering the connection profiles to discover all the anomaly clusters that are specified by the condition composing of several adaptive thresholds; (3) Correlating the anomaly clusters to result in a new cluster graph or to extend an existing cluster graph; (4) Issuing a security incident about the worm propagation according to the propagation condition that also composes of several adaptive thresholds; and (5) Keeping and maintaining the status of the cluster graphs.

Abstract: A system and methods for detecting malicious executable attachments at an email processing application of a computer system using data mining techniques. The email processing application may be located at the server or at the client or host. The executable attachments are filtered from said email, and byte sequence features are extracted from the executable attachment. The executable attachments are classified by comparing the byte sequence feature of the executable attachment to a classification rule set derived from byte sequence features of a data set of known executables having a predetermined class in a set of classes, e.g., malicious or benign. The system is also able to classify executable attachments as borderline when the difference between the probability that the executable is malicious and the probability that the executable is benign are within a predetermined threshold.

Abstract: The invention is a method of connecting user equipment to at least one network, a communication system, and a user equipment. In a communication system comprising at least one network, including network entities which provide connectivity to user equipment, a method of connecting the user equipment to the at least one network in accordance with the invention includes establishing a secure tunnel which provides connection between the user equipment and one of the network entities; and authenticating the user equipment with another of the network entities; and wherein the authenticating of the user equipment with the another of the network entities occurs at least partially simultaneously with the establishing of the secure tunnel.

Abstract: A system and method providing secure information. An encryption key is regenerated by performing byte addition of an encryption key, encrypted data, and a hash vector based upon an encryption key. A hash vector is hashed by scanning indexed bytes of an encryption key and using indices and associated values of indices of an encryption key as indices of two bytes in the hash vector to be swapped. An authentication key is regenerated by performing byte addition of an authentication key, an auxiliary key, and a hash vector based upon an authentication key.

Abstract: An access control method executed by a computer system, including applying an access rate limit until a user issuing access requests is verified, a first control level involving verifying the user, a second control level applying hack program detection tests to the access requests and verifying the user, a third control level requiring use of predetermined download software for transmitting the access requests and verifying the user, a fourth control level blocking access to the service on the basis of at least one communications address corresponding to the access requests, and invoking the control levels sequentially depending on a number of failed attempts to verify the user.

Abstract: A migration scheme for virtualized Trusted Platform Modules is presented. The procedure is capable of securely migrating an instance of a virtual Trusted Platform Module from one physical platform to another. A virtual Trusted Platform Module instance's state is downloaded from a source virtual Trusted Platform Module and all its state information is encrypted using a hybrid of public and symmetric key cryptography. The encrypted state is transferred to the target physical platform, decrypted and the state of the virtual Trusted Platform Module instance is rebuilt.

Abstract: A system and method for direct authentication and/or authorization of transactions. The system includes a trusted Digital Identity (DID) Network connecting an Originating Participating Financial Institution (OPFI) and a Receiving Participating Financial Institution (RPFI) through a DID Operator. The DID Operator may further be coupled to a DID System that calculates digital identities for Originators. According to the method, direct authentication of the Originator and/or authorization of the transaction is initiated upon the Originator communicating its digital identity to the Receiver. The Receiver subsequently provides the digital identity to the RPFI. The RPFI is then able to communicate with the OPFI for authentication of the Originator and/or authorization of the transaction through the DID Operator based on Originator's digital identity.

Abstract: An apparatus and a corresponding method provide for real-time recovery of compromised information in a computer network. The method includes analyzing data objects in the computer network to determine data objects that comprise minimal essential information, collecting the minimal essential information, and storing the minimal essential information. To limit potential exposure of the minimal essential information, the stored minimal essential information is hidden in the computer network.

Abstract: A system, method and computer program product are provided for scanning for spyware utilizing a virus scanner. In use, at least one computer is scanned for viruses utilizing a virus scanner. Still yet, the computer is further scanned for spyware utilizing the virus scanner. Such computer is scanned for the spyware by scanning a registry associated therewith.

Abstract: An approach for preventing denial-of-service attacks on Secure Sockets Layer (“SSL”) protocol is described. Queues are generated for handshake state connections and data transmission connections. A connection object representing a new SSL connection is time-stamped as it enters the handshake portion of the SSL protocol. A connection pointer to the connection object is placed at the head of the handshake queue. As new SSL messages are transferred between client and SSL server, the time-stamp is updated when the entire message is received, the connection pointer is repositioned to the head of the queue. A timer event periodically surveys the queues. If connection packet transmission gaps remain below a specified maximum handshake gap time, a connection is allowed to progress to the data transmission state. If any connection exceeds the specified gap time, the SSL connection is dropped.

Abstract: A method for controlling connections from an IP entity to a server. Initially, a limit count, representing a number of concurrently allowable connections between the IP entity and the server, is determined. When an incoming IP packet is received, the packet is processed to determine the source and destination IP addresses for the packet. An entry is then created in a limit table for the IP entity, if no entry for that IP entity exists in the table. A determination is made as to whether a pending connection should be allowed for the packet, by referring to the limit count and the entry in the limit table. The connection is allowed, and the limit count for the entry is incremented, if the attempted connection would not exceed the limit count for the IP entity; otherwise, the packet is blocked if the attempted connection would exceed the limit count for the IP entity.

Abstract: Authentication information is generated for a group where members within a group are able to communicate with each other, but a non-members is not able to participate in that communication. The authentication information provides the determination of whether the member belongs to the group.

Abstract: To provide a centralized control system for defending and taking countermeasures against an illegal access. A network device 3 detects an illegal access packet P1 transmitted from an illegal accessor's terminal 6, and transfers an encapsulated packet P2 of the illegal access packet P1 to a data center 1. A control system 11 in the data center 1 analyzes the packet P2, encapsulates a response packet P4 from a decoy server 13 pretending to be a response from a target server to be attacked 5 to acquire a packet P3, and then transmits the packet P3 to the network device 3. The network device 3 decapsulates the packet P3 so as to extract a response packet P4, and transmits the response packet P4 to the illegal accessor's terminal 6. The illegal accessor's terminal 6, upon reception of the response packet P4, would believe that the response packet P4 should be transmitted from the server 5, and start to illegally access the decoy server 13.

Abstract: A method and system is provided by a Central-Entity, for identification and authorization of users over a communication network such as Internet. Central-Entity centralizes users personal and financial information in a secure environment in order to prevent the distribution of user's information in e-commerce. This information is then used to create digital identity for the users. The digital identity of each user is dynamic, non predictable and time dependable, because it is a combination of user name and a dynamic, non predictable and time dependable secure code that will be provided to the user for his identification. The user will provide his digital identity to an External-Entity such as merchant or service provider. The External-Entity is dependent on Central-Entity to identify the user based on the digital identity given by the user. The External-Entity forwards user's digital identity to the Central-Entity for identification and authentication of the user and the transaction.

Abstract: In a client-server system employing protocols such as RTP (real-time protocol), RTCP (real-time control protocol) and RTSP (real-time streaming protocol) for communicating real-time data stream, a method for using the same security parameters to secure by encryption and/or authentication, communication of the real-time data stream.

Abstract: The invention includes various systems, architectures, frameworks and methodologies that can securely enforce a privacy policy. A method is include for securely guaranteeing a privacy policy between two enterprises, comprising: creating a message at a first enterprise, wherein the message includes a request for data concerning a third party and a privacy policy of the first enterprise; signing and certifying the message that the first enterprise has a tamper-proof system with a privacy rules engine and that the privacy policy of the first entity will be enforced by the privacy rules engine of the first enterprise; sending the message to a second enterprise; and running a privacy rules engine at the second enterprise to compare the privacy policy of the first enterprise with a set of privacy rules for the third party.

Abstract: A recording/reproducing apparatus includes: a first storage section for storing data structure information which includes encrypted data; a special information holding section for holding special information associated with the data structure information; and a controller for controlling the first storage section and the special information holding section. The data structure information is associated with the special information such that the special information is updated in response to an update of the data structure information, or such that the data structure information is updated in response to an update of the special information. The controller controls movement of the encrypted data from the first storage section to a second storage section, and the controller updates the special information such that a mismatch occurs between the special information obtained before the movement of the encrypted data and the special information obtained after the movement of the encrypted data.

Abstract: In an authentication system, a key registration apparatus receives input of an identifier unique to a second device, generates first key data from the identifier according to a predetermined key generation algorithm, and transmits the generated first key data to a first device, which receives and stores the first key data, and authenticates the second device with use of the first key data. The second device stores in advance second key data generated from the identifier according to the predetermined key generation algorithm, and is authenticated by the first device with use of the second key data. Accordingly, the first and second devices cannot be registered without using the key registration apparatus, thereby preventing communication with unregistered devices. This enables usage of content to be limited to individual usage in the home of a user, and can be realized even with devices that are not connected outside the home.

Abstract: A computer system and method generates a random output stream of bits. The system comprises an initial evolving state produced from one or more initial keys, one or more round functions, and one or more mask tables. Each round function is part of a step in a sequence of steps. Each step applies the respective round function to a current evolving state to produce a respective new evolving state for processing by the next step in the sequence. The first step in the sequence starts b processing the initial evolving state. The mask tables are produced from one or more of the initial keys. Each of the mask tables has one or more masks. The masks are combined, in each respective step, with the respective new evolving state in a combination operation to create a respective step output. The random output stream bits is a concatenation of each of the respective step outputs.