Abstract: An intrusion detection system (IDS) that uses application monitors for detecting application-based attacks against computer systems. The IDS implements application monitors in the form of a software program to learn and monitor the behavior of system programs in order to detect attacks against computer hosts. The application monitors implement machine learning algorithms to provide a mechanism for learning from previously observed behavior in order to recognize future attacks that it has not seen before. The application monitors include temporal locality algorithms to increased the accuracy of the IDS. The IDS of the present invention may comprise a string-matching program, a neural network, or a time series prediction algorithm for learning normal application behavior and for detecting anomalies.

Abstract: This invention relates to reprogramming of in-circuit programmable chips installed in video lottery terminals (VLTs) by downloading electronic information (software) to such chips. Encrypted electronic information is downloaded from a host device to a gaming terminal through a communications link. The terminal comprises a decryption component configured for decrypting the encrypted electronic information using at least two security keys, at least one said key being resident in the terminal and at least another said key being delivered to the terminal at the time of the downloading (the downloading facilitating a replacement of existing software in terminal with corresponding decrypted software obtained from decrypting the encrypted information). The encrypted information transmitted to the terminal comprises at least one next version key for later use by the decryption component in decrypting a next version of encrypted electronic information.

Abstract: A method for ensuring the integrity of a receiving system in a distributed computing environment includes receiving information from a transmitting system. The method also includes testing whether the information is preverified information. If the information is not preverified, the method includes verifying the information or rejecting receipt of the information. If the information is preverified, the method includes testing if the information was received from a trusted transmitting system. If the information was received from a trusted transmitting system, the method includes accepting receipt of the information without reverifying. If the information was not received from a trusted transmitting system, the method includes verifying the information or rejecting receipt of the information.

Abstract: A computer network is disclosed comprising a plurality of interconnected network devices including a plurality of client computers, an authentication server computer operated by a system administrator, and a disk drive connected to the authentication server computer. The disk drive comprises an interface for receiving the personal authentication data and user access data from the system administrator, a disk for storing data, and a disk controller for controlling access to the disk. An authenticator within the disk drive, responsive to the personal authentication data, enables the disk controller, and cryptographic circuitry encrypts the user access data received from the system administrator into encrypted data stored on the disk.

Abstract: A method for secure transmission of data, like e-mail and other secure documents, over a computer network includes the use of biometrics to verify that the sender of the data is confirmed as an individual authorized for secure access transmission of data over the network and by verifying that the recipient of the data is also an individual authorized to receive data by secure access transmission over the network. The methodology comprises creating a database containing the biometric templates of all individuals authorized for secure access transmission of data over the network and connecting the database to a data processor. The transmission of counterfeit messages is prevented by confirming the identity of the sender as an individual authorized for secure access transmission over the network by scanning a predetermined biometric of the sender, and comparing the biometric of the sender with the predetermined biometric of all individuals who are authorized for secure access transmission over the network.

Abstract: A symmetric-key cryptographic technique capable of realizing both high-speed cryptographic processing having a high degree of parallelism, and alteration detection. The invention includes dividing plaintext composed of redundancy data and a message to generate plaintext blocks each having a predetermined length, generating a random number sequence based on a secret key, generating a random number block corresponding to one of the plaintext blocks from the random number sequence, outputting a feedback value obtained as a result of operation on the one plaintext blocks and the random number block, the feedback value being fed back for using in the operation on another plaintext blocks, and performing an encryption operation using the one plaintext blocks, random number block, and feedback value.

Abstract: A system and method for allowing roaming of a subscriber and password authentication a non-LDAP region. A user signs onto a network access server which in turn connects to the regional LDAP RADIUS server. Password authentication occurs by hashing a transmitted password and comparing it to a clear text password from an LDAP database that has been hashed in the same manner as the transmitted password. When the subscriber is in a non-LDAP region, The password proceeds trough a proxy server to a regional RADIUS server which connects to a non-LDAP server. The non-LDAP server connects to and SMS database and retrieve the clear text password associated with the non-LDFSAP user, hashes it according the same method as the transmitted hashed password and formats the password for comparison in the regional RADIUS server. If the hashed passwords compare, the access is permitted.

Abstract: This invention uses network stack information to enforce context-based policies. The combination of policies, user/application context information and packet filtering is used to enable fine-grained control of network resources.

Abstract: A method and apparatus for deploying configuration instructions to security devices in order to implement a security policy on a network are disclosed. An address translation alteration performed on packets communicated between a management source and a plurality of security devices, resulting from implementation of a proposed new network security policy, is detected. One or more sets of security devices are identified that would each have one or more configuration dependencies as a result of the address translation alteration. Configuration instructions are sent from the management source to each of the one or more sets of security devices using an order determined by the identified configuration dependencies. The configuration instructions are used to implement the security policy on the network. As a result, firewalls and similar devices are properly configured for a new policy without inadvertently causing traffic blockages arising from configuration dependencies.

Abstract: In one embodiment, a method comprises configuring an access transaction generated by a processor by a configuration storage containing configuration parameters. The processor has a normal execution mode and an isolated execution mode. The access transaction has access information. In a further embodiment, a method comprises checking the access transaction by an access checking circuit using at least one of the configuration parameters and the access information.

Abstract: An execution management utility designed to prevent software from executing without the prior approval of system administrative or other security staff. For example, the present invention can assist corporations by enforcing policies regarding unauthorized, unlicensed, or pirated software, such as, but not limited to, games; entertainment software; and non-standard utilities, such as advertising-enhanced browsers. A Windows NT based system is disclosed in which a kernel module selectively intercepts process creation requests.

Abstract: A method for verifying bus performance in a multiple initiator environment is provided. A first initiator generates a key data pattern including a key header and a pattern. The first initiator then writes the key data pattern to an echo buffer of a target after which the first initiator reads the key data pattern. The first initiator also examines the key header to ascertain a level of communication integrity of a physical connection with the target.

Abstract: An apparatus and a method for enabling the secure installation and use of an information system having a plurality of nodes, where the plurality of nodes include at least one information appliance (100) and at least one security console (200). The apparatus includes at least one data-carrying object, referred to as a “key” (301), that contains security-related data, and further includes at least one key receptacle (103, 203) that forms a portion of at least one of the nodes. The key is inserted into the receptacle for reading-out the security-related data for indicating to the information system a desired security configuration. The key is not intended to primarily establish the identity of a particular user or principal, but is instead intended to provide and be instrumental in defining, using a tangible medium, a security configuration that bestows a certain level of authorization or access to a particular user or principal.

Abstract: A method and computer program in which a user (132) may have a digital certificate created using a strong authentication technique. Once the user has the digital certificate he may then request the generation of a “single sign-on” certificate that will allow the user (132) access to a foreign computer networks. This is accomplished by the user (132) contacting a registration web server (124) and requesting the generation of “single sign-on” for the foreign computer network. Thereafter, the registration web server (124) may take a public key generated based on the digital certificate and request the creation of a “single sign-on” by simply creating a public key from the digital certificate.

Abstract: An image encoding/decoding system and method for producing a computer-generated security device which can be printed onto a document, such as a passport, to secure the document against data alteration. Deflection encoding means comprises means for applying a selected software lens to a source image and producing a deflected image. Encryption encoding means comprises means for applying an encryption function to the deflected image or a source image and producing an encrypted image. Overlaying means is provided for overlaying the deflected and encrypted images and producing therefrom the security device image. The deflected image may be detected from the security device image both by means of a manual lenticular lens corresponding to the software lens applied to a printing of the security image and by means of computer decoding processing applying the software lens.

Abstract: A message to be transmitted through a network is encrypted such that the resulting encrypted message has associated therewith a proof of correctness indicating that the message is of a type that allows decryption by one or more escrow authorities. Each of at least a subset of the servers of the network includes a module for checking the proof of correctness if the corresponding encrypted message passes through the corresponding server in being transmitted from a sender to a recipient through the network. The encrypted message is therefore transmitted through the network to the recipient such that in traversing the network the proof of correctness associated with the encrypted message is checked by a designated check module of at least one server of the network. If the check of the proof of correctness indicates that the proof is invalid, the module of the server performing the check may direct that the encrypted message be discarded.

Abstract: An information processing apparatus and method consisting of the modules 1) peripheral control including power management resulting in increased battery life where a plurality of peripherals use a single power source to eliminate external power supplies, 2) universal conversion, an extensible system for taking any information as input and converting to any desired feasible output, 3) virtual user production, which creates a digital representation of a user through constant recording and analysis of completed work, which is disintegrated and stored in lists comprising tasks and related options. A list captures and represents the user's preferences. Dynamic and evolving lists define a virtual user capable of repeating any previously recorded task. A corresponding Web based communication provider automatically feeds additional tasks and options to the invention, which can grow substantially unassisted by the user.

Abstract: A method of the Virtual Private Network (VPN) communication employed for a security gateway apparatus and the security gateway apparatus using the same, which allow a personal computer outside a local area network (LAN) to access, via a WAN, to a terminal on the LAN, virtually regarding the outside PC as a terminal on the LAN. The communication method is employed for a security gateway apparatus to connect, through concentration and conversion process, between a LAN and a WAN including a public network. Security Architecture for the Internet Protocol (IPsec) establishes VPN with an outside PC having a dialup connection to the WAN. During an Internet Key Exchange (IKE) communication that is performed prior to the IPsec communication, the security gateway apparatus integrates a Dynamic Host Configuration Protocol (DHCP) communication option into an IKE data, and designates the IP address of the outside PC from a tunneled IP packet.

Abstract: The invention relates to a method for personalization of GSM chips. At least one subscriber identification character (TMSI) and a card number (ICCID) are stored in the memory area of said chips in addition to a secret key (KI) and other optional data for personalization purposes. The invention aims to eliminate an unnecessarily high degree of complexity linked to management of all card data in an authentication centre (AC) and to preserve secret chip data in a more secure manner. According to the invention, final data is only written on the chip when the subscriber logs into a subscriber network. One advantage is that only initial data is written into the card enabling the customer to contact the computer centre of the information provider. During first contact the final data is traded between the card and the computer centre and written into the card. The computer centre is simply required to manage cards which have really been issued to customers.

Abstract: A chipset is initialized in a secure environment for an isolated execution mode by an initialization storage. The secure environment has a plurality of executive entities and is associated with an isolated memory area accessible by at least one processor. The at least one processor has a plurality of threads and operates in one of a normal execution mode and the isolated execution mode. The executive entities include a processor executive (PE) handler. PE handler data corresponding to the PE handler are stored in a PE handler storage. The PE handler data include a PE handler image to be loaded into the isolated memory area after the chipset is initialized. The loaded PE handler image corresponds to the PE handler.