Abstract: To reduce a frequency of recording communication management information for communication disconnection countermeasure. A digital content distribution system includes a license server (101) that issues a license, and a user terminal (103) that controls use of content based on the issued license. The license server (101) judges, according to the license to be issued, whether or not the communication management information for the communication disconnection countermeasure needs to be recorded, and notifies the user terminal of a result of the judgment. This enables the user terminal (103) to reduce the frequency of recording the communication management information.

Abstract: A communication system and a security assurance device are proposed, which are capable of assuring that a target party for communication is implementing security countermeasures. A server 3 transmits information 104 necessary for AC issuance to a security assurance authority 2. The security assurance authority 2 verifies the security of the server 3 during communication based upon this information necessary for AC issuance 104. And, when the security of the server 3 during communication is confirmed, the security assurance authority 2 issues an AC 105 which proves the security of the server 3 during communication, and transmits it to the server 3. Upon receipt of this AC 105, the server 3 transmits the AC 105 to a client 4, according to a connection request from the client 4. And, upon receipt of this AC 105, the client 4 verifies the security during communication of the server 3, based upon the AC 105.

Abstract: An intelligent electronic cryptographic module comprising a processor in communication with data storage, a cryptography chip for encrypting and decrypting messages and responses, at least one server-side port for receiving and transmitting encrypted and non-encrypted messages and responses between the intelligent electronic cryptographic module and an enterprise server, and at least one non-encrypted port for receiving and transmitting decrypted and non-encrypted messages and responses between the intelligent electronic cryptographic module and at least one intelligent electronic device. The data storage comprises computer instructions for instructing the processor to select a protocol module and telemetry method, authenticate the enterprise server and intelligent electronic cryptographic module, encrypt and decrypt messages and responses using the cryptography chip, and transmit and receive messages and responses.

Abstract: A system for online configuration and communication for a supervisory control and data acquisition system comprising an online configurable enterprise server, at least one intelligent electronic device, an online configurable intelligent electronic cryptographic module, and a configurable server interface. Both the online configurable enterprise server and the online configurable intelligent electronic cryptographic module include respective cryptography chips and computer instructions for instructing respective processors to selectively encrypt and decrypt commands, messages, data, and responses, allowing non-encrypted transmissions between the at least one intelligent electronic device and the online configurable intelligent electronic cryptographic module, and selectively encrypted transmission between the intelligent electronic cryptographic module and the online configurable enterprise server.

Abstract: There is disclosed a method for switching access folders in accordance with a confidential mode. In this method, a confidential root directory is located below a normal root directory. A directory structure constituted by the at least one confidential folder other than a confidential root directory is the same as that constituted by at least one normal folder other than a normal root directory. A file access request from an application program to a disk device is received. If the application program is operating as a process in a confidential mode, file access to the confidential file in the confidential folder is executed through a kernel, by rewriting a specified file path name with a file path name corresponding to the confidential folder below the confidential root directory. If the application program is operating as a process in the normal mode, file access to the confidential file in the confidential folder is not permitted.

Abstract: Mechanisms for enforcing permissions on stored data. Prior to storing the data, a data structure containing the data is accessed, and then modified to include a license that represents permission(s) for how the data should be used when the data structure is later accessed. The modified data structure is then stored, after perhaps some optional transformation. When the data structure is later accessed, the license is acquired from the data structure. The license is then used to determine whether or not to honor specific requests to use the data. This determination may be made based on license validation instructions executed from a removable media. Furthermore, the license may be the exclusive determining factor for the license validation instructions in determining whether or not to honor specific requests.

Abstract: The method, program and information processing system secures data, and particularly security sensitive words, characters or data objects in the data, in a computer system with multiple independent levels of security (MILS). Each level of MILS has a computer sub-network with networked workstations. The MILS sub-networks are connected together via security guard computer(s) and each guard computer has separate memories for each level (TS, S, C, UC (or remainder)). The method extracts the security sensitive words/data (a granular action), from the source document for each MILS level, stores the extracted data in a corresponding extract store for each level and permits reconstruction/reassembly of the dispersed data via said extracted data at each said level of said multiple security levels and remainder data only in the presence of a predetermined security clearance commensurate with each MILS level.

Abstract: A system and method helps to control “read” and/or “write” access to electronic paper (e-paper). Informational data may be on a restricted portion of e-paper material that is protected by a security methodology accessible to authorized entities. Some embodiments maintain a record of access activity regarding the restricted portion, and a record of access activity regarding use of an item or product or service related to the e-paper informational data. Some implementations include an authorization listing of a person or entity having a particular access privilege or a supervisory privilege to make authorization and data changes. Authorization records may involve an access privilege to receive a status output regarding prior access activity and/or current status.

Abstract: Systems and methods for operation upon a mobile device to handle a duress situation caused by another person. An input password is received from a user. The input password is decoded by the device. Responsive to the input password being a duress indication, a duress operation is performed to protect data on the mobile device.

Abstract: A system and method for providing, managing, and accessing a multi-user secure portable database using secure memory cards is provided. The database has a secure portion for storing security keys and a non-secure portion for encrypted data files. Access to the encrypted data files is controlled by assigning access rights through an access control matrix to each encrypted data file according to a hierarchical structure of users. A user requesting access is identified in the hierarchy, associated with a key for allowing the requested access, and the requested access allowed to a file in accordance with the rights allocated through the access control matrix. A patient can selectively grant access to encrypted medical records on his card to a physician. Authentication of the owner/patient is preferably required. Other records required by emergency medical personnel are readable from the same card without requiring permission from the patient.

Abstract: The present invention provides an apparatus for verifying the authority of an owner, in terms of an identifier of a product, the first verification information for verifying the authority held at a terminal for an owner with the authority involving the product, and the second verification information for verifying the authority concerning the identifier of the product stored in a product database. The apparatus comprises means for receiving the identifier and the first verification information, means for acquiring the second verification information from the product DB, and means for determining whether or not there is the authority from the first verification information and the second verification information. A hash value acquired from a one-way hash function is employed as a verification key of the verification information.

Abstract: A distributed access control technique assigns permission to a user without permission explosion, thereby facilitating the system administration of user access to a piece of content represented by a Web service. Permissions are granted to pieces of content through expressions rather than explicitly coupled between a piece of content and a user. Each expression defines an access scope for either a user or a piece of content. An expression defining the access scope for a user can be created and maintained independently of an expression defining the access scope to a piece of content, hence simplifying management information system implementation and administration.

Abstract: The current society can be referred to as a card society, since people can use various types of cards for a variety of applications. However, card users must always carry a number of cards depending upon the application, and must use different cards according to the purpose, which can bother such users. A memory of an IC chip of an IC card includes a fingerprint information area to verify the identity of a card owner, a personal information area in which personal information of the card owner is classified and recorded with different security levels set up, a company information area in which each company writes information of the company using an “encryption key” unique to the company, and a public organization information area in which each public organization writes information of the public organization using an “encryption key” unique to the public organization.

Abstract: An image forming apparatus is disclosed, the image forming apparatus including a storing unit that stores a program in accordance with which the image forming apparatus operates, an acquiring unit that acquires an update program from an external source, and an updating unit. Before updating the program stored in the storing unit, the updating unit determines whether the update program acquired by the acquiring unit is authentic by checking the electronic signature of the update unit. If the updating unit determines that the update program acquired by the acquiring unit is authentic, the updating unit updates the program stored in the storing unit. Accordingly, the image forming apparatus can improve the reliability of the update program.

Abstract: A system, method and computer program product for detection of false positives occurring during execution of anti-malware applications. The detection and correction of the false positives is implemented in two phases, before creation of new anti-virus databases (i.e., malware black lists) or before creation of new white lists, and after the anti-virus databases or new white lists are created and new false positives are detected. The system calculates a probability of detection of a certain potential malware object. Based on this probability, the system decides to either correct a white list (i.e., a collection of known clean objects) or update a black list (i.e., a collection of known malware objects). A process is separated into a several steps: creation and update (or correction) of white lists; creation and update of black lists; detection of collisions between these lists and correction of black lists or white lists based on the detected collisions.

Abstract: A firewall protects an Ethernet network from a first larger network, e.g., the Internet. A first server on the Ethernet network stores an encrypted private key, decrypts the private key using a passphrase, and communicates with clients on the first network using the private key. A second server on the Ethernet network determines whether an intrusion has occurred from the first network into the first server and provides the passphrase to the first server only when no intrusion has occurred from the first network into the first server. The invention can be realized in apparatuses, methods, and/or instruction sets.

Abstract: Embodiment provide a surveillance camera adapted to be connected to an internet protocol network, the surveillance camera including at least one facial processor, at least one facial recognition algorithm embodied in suitable media, at least one facial recognition algorithm executable with digital format image data by at least one facial processor detecting faces, execution of at least one facial recognition algorithm producing unique facial image data, execution of at least one facial separation algorithm producing facial separation data, at least one facial processor in communication with at least one facial signature database to obtain reference data, execution of at least one facial signature algorithm comparing facial separation data and reference data to identify correlations, at least one compression algorithm producing compressed image data, and a network stack configured to transmit to the network unique facial image data for each detected face and compressed image data.

Abstract: A service discovery system including a client terminal and a service providing device which provides data or a function to the client terminal, including: a service request unit which generates a message requesting a service of the service providing device; a communication unit which sends the message generated by the service request unit to the service providing device and which receives from the service providing device a problem imposing a load on the client terminal; and a solution unit which solves the problem.

Abstract: A method of authenticating a device's access to a communications node is disclosed. The method of operation includes the communications node generating a first value for use in the derivation of a first encryption key, the first encryption key being at least partially used to authenticate the device's access to the communications node in a first communications exchange. The method of operation includes the communications node modifying the first value, independent of the device, to create a second value. The method includes the communications node using the second value in authenticating the device's access to the communications node in a second communications exchange. Embodiments of the present invention include but are not limited to communications nodes and devices, subsystems, and systems equipped to operate in the above-described manner.

Abstract: In a signature-based duplicate detection system, multiple different lexicons are used to generate a signature for a document that comprises multiple sub-signatures. The signature of an e-mail or other document may be defined as the set of signatures generated based on the multiple different lexicons. When a collection of sub-signatures is used as a document's signature, two documents may be considered as being duplicates when a sub-signature generated based on a particular lexicon in the collection for the first document matches a signature generated based on the same lexicon in the collection for the second document.