Abstract: An operation of an authentication apparatus is as follows: Moving image data including a plurality of pieces of still image frame data is accepted, and the move locus of at least one person image is detected based on the moving image data. Individual determination processing of adopting at least one piece of the still image frame data as attention frame data and determining the individual corresponding to the detected move locus of the person image in the attention frame data is executed. The result of the individual determination processing is provided for predetermined authentication processing.

Abstract: A technique for securing message traffic in a data network using a protocol such as IPsec, and more particularly various methods for distributing security policies among peer entities in a network while minimizing the passing and storage of detailed policy or key information except at the lowest levels of a hierarchy.

Abstract: A file system in a storage system allows a user to designate data as write-once read-many (WORM) data. The WORM data are stored in a first set of storage media of the storage system. Signature data are generated from the WORM data. Using the signature data, the integrity of the WORM data can be verified.

Abstract: The present invention relates to a method for application layer authentication of subscribers connected to the authenticating network domain by a 2G or 2.5G GPRS core network or a 3G UMTS network, characterised by using data which are assembled by the network layer during establishment of a PDP context in GPRS networks. The invention comprises System of units in a mobile telecommunication network, including at least a first authentication unit which is connected via a data line to a second unit which assembles data according to the described method.

Abstract: A system is provided that uses identity-based encryption (IBE) to support secure communications. Messages from a sender may be encrypted using an IBE public key and IBE public parameter information associated with a recipient. The recipient may decrypt IBE-encrypted messages from the sender using an IBE private key. A host having a service name may be used to store the IBE public parameter information. The sender may use a service name generation rule to generate the service name based on the IBE public key of the recipient. The sender may use the service name to obtain the IBE public parameter information from the host.

Abstract: Enhancing security capability of a network is described. In some embodiments, the method comprises detecting a security threat, sending a request to a networked device on the network to perform a deputized function that is not ordinarily performed by the networked device, receiving response data from the networked device and processing the response data. In some embodiments, the method comprises receiving a request from a security authority on the network to perform a deputized function that is not ordinarily performed, performing the deputized function as requested and sending response data to the security authority to be further processed.

Abstract: Systems and methods for mutual encryption of network nodes are described. One described method includes transmitting a communication from a client to a server, the communication associated with a credential, the credential having a user identifier and a first token and receiving the communication at the server. The method further includes determining a second token associated with the user identifier on the server and on the client and generating an encryption key based at least in part on the second token on the server and on the client. The method further includes generating and encrypting an encrypted authentication request on the client; transmitting the encrypted authentication request to the server; receiving the encrypted authentication request on the server; decrypting the encrypted authentication request using the encryption key on the server; generating and encrypting an encrypted authentication response on the server; and transmitting the encrypted authentication response to the client.

Abstract: A SAM receives a secure container in which content data encrypted with content key data, the encrypted content key data, and UCP data designating a handling policy of the content data are stored, and determines at least one of the purchase mode and the usage mode of the content data based on the UCP data. The SAM serves as a slave for a host CPU, and is also provided with a common memory shared with the host CPU.

Abstract: A secure terminal comprises: primary means consisting of processing means, data and program storage means, security means and data input means, wherein the components of the primary means are interconnected by a first data bus; peripheral means consisting of printing means, means for reading from/writing to a card and means for accessing a telecommunications network, wherein the components of the peripheral means are interconnected by a second data bus; and power supply means connected to the primary and peripheral means. The primary means arc grouped in a main housing that cannot be dismantled without damaging at least one of the components of the primary means, and the peripheral means are grouped in at least one housing capable of being connected to the main housing.

Abstract: To determine whether digital content can be released to an element such as a computer application or module, a scaled value representative of the relative security of the element is associated therewith, and the digital content has a corresponding digital license setting forth a security requirement. The security requirement is obtained from the digital license and the scaled value is obtained from the element, and the scaled value of the element is compared to the security requirement of the digital license to determine whether the scaled value satisfies the security requirement. The digital content is not released to the element if the scaled value does not satisfy the security requirement.

Abstract: A method and system for enhancing security in a database by establishing a bit pattern using secret information, the pattern establishing a watermark that can be detected in a copy (authorized or not) of the database only by using the secret information.

Abstract: One embodiment of the present invention provides a system for managing keys. During operation, the system receives a request from a user at a database to encrypt/decrypt data at the database. In response to this request, the system sends a user-token to the user, wherein the user-token includes a user-key encrypted with a user-secret thereby enabling the user to decrypt the user-key with the user-secret. Next, the system receives the decrypted user-key from the user. The system then uses the user-key to encrypt/decrypt the data at the database. Finally, the system deletes the user-key at the database.

Abstract: A procedure and implementations thereof are disclosed that significantly reduce the amount of time necessary to perform a virus scan. A file signature is created each time a file is modified (i.e., with each “file write” to that file). The file signature is inserted, with a date stamp, into the file attributes. The virus scan program checks the previously-created file signature against the virus signature file instead of creating the file signature for every file during the virus scan. Checks to ensure that the file signature is secure, and is valid and up to date, are also implemented. Only if the file signature is not valid and up-to-date does the virus scan program create a new file signature at the time of the running of the virus scan.

Abstract: A secure communication module is provided for securing communication between a client application and a network service. The secure communication module comprises an authentication identifier provider for providing the client application a pool of authentication identifiers for use in subsequent communication with the network service, and an authentication identifier validator for checking the validity of an authentication identifiers from the pool of authentication identifiers sent with the subsequent communication.

Abstract: Method and system for embedding a unique and different digital watermark in digital contents for each access without increasing the overhear or load at the contents server. The contents server has a digital watermark-embedded contents storage unit for storing a plurality of digital contents where a different digital watermark is embedded, and a fingerprint performing unit for, adding to the digital contents the information specified using a bit row that is formed by a digital watermark being embedded for each part of the digital contents.

Abstract: A security subsystem controls the data transfer rights among components of a secured system via a common bus. The security subsystem includes a secure block that is coupled to an access controller, preferably via a hard-wired connection to the controller. This secure block exclusively controls the access rights among components, and can effectively isolate security functions and data from the main processor. Because the security is provided via access control to components or subsets of components via a common bus, an efficient and effective integration of the security subsystem within the secured system can be achieved.

Abstract: A data distribution system is provided which supplies customers with an executable for requested secured data files to provide the customer with fulfillment software, obviating the need for the customer to download fulfillment software prior to requesting secure data. The data distribution system is characterized by server technology which can dynamically encrypt secured data files just prior to a customer request to download the data file. A framework for building a universal data distribution infrastructure is provided which employs Requesters.

Abstract: A method and apparatus for storing an intrusion rule are provided. The method stores a new intrusion rule in an intrusion detection system having already stored intrusion rules, and includes: generating combinations of divisions capable of dividing the new intrusion rule into a plurality of partial intrusion rules; calculating the frequency of hash value collisions between each of the generated division combinations and the already stored intrusion rules; dividing the new intrusion rule according to the division combination which has the lowest calculated frequency of hash value collisions; and storing the divided new intrusion rule in a corresponding position of the intrusion detection system. According to the method and apparatus, the size of the storage unit occupied by the intrusion rule can be reduced, and by performing pattern matching, the performance of the intrusion detection system can be enhanced.

Abstract: A system, method and programmed article of manufacture to perform efficient encryption key updates in encrypted database-as-a-service (DAS) environments using a key registry and key locks. A database as a service environment allows organizations to send their data management infrastructures to a database service provider. The service provider employs data encryption techniques to ensure the privacy of hosted data. The security of encryption techniques relies on the confidentiality of the encryption keys. The dynamic nature of the encrypted database in the DAS model adds complexity and raises specific requirements on key management techniques. The solution is provided by the key registry and by the key update lock, key management process and log management process to allow data update access to data concurrently with encryption key update for the same data.

Abstract: Methods, systems, and devices are disclosed for detecting encrypted Internet Protocol packet streams. A probe stream having a known observable parameter is generated. The observable parameter exhibits a known characteristic of a known type of data encrypted within a stream of packets. The probe stream is communicated to a network element via a communications network. When the probe stream is received by the network element, the network element can compare the known observable parameter to an actual value. Any difference between the known observable parameter and the actual value can be used to correct for network-induced variation and other effects, thus ensuring accurate detection and identification of data types within encrypted streams of packets.