Abstract: The invention is a cryptographic system using chaotic dynamics. A chaotic system is used to generate a public key and an adjustable back door from a private key. The public key is distributed and can be used in a public key encryption system. The invention can also be used for authentication purposes. The adjustable back door of the invention can be used in conjunction with the public key to derive the private key. The degree of difficulty involved in deriving the private key is dependent on the adjustable back door. That is the value of the back door can be adjusted to vary the difficulty involved in deriving the private key.

Abstract: A method for ciphering multimedia includes the entering of an ciphering index in a definition data block of the multimedia data, this index pointing to an ciphering algorithm which is to be used. In response to the ciphering index in the definition data block one of a plurality of ciphering algorithms is selected. The multimedia data are ciphered using the selected ciphering algorithm. Various additional entries in the definition data block which is assigned to the multimedia data permit the clearing or enabling of a deciphering device, rapid access to a database of ciphered multimedia data and a customer- and data-specific use of the multimedia data while taking copyright aspects into account.

Abstract: A method and a system for disabling execution of a software application stored within a computer absent data indicative of an authorized use of the software application are disclosed. At start up or during execution of a software application a user is prompted for user authorization information. Using a processor within a smart card the received user authorization information is compared with user authorization information stored in memory of the smart card to produce a comparison result. If the comparison result is indicative of an authorized user of the software application, then data indicative of the authorized use of the software application is provided from the smart card to the computer. Upon receipt of the data indicative of the authorized use of the software application execution of the software application is continued. When the data is not data indicative of the authorized use of the software application further execution of the software application is disabled.

Abstract: A system and method grants security privilege in a communication system by providing privilege test criteria data for a subscriber unit so that the subscriber unit or some other entity can select among subscriber privilege data based on the privilege test criteria data, so that only the necessary privilege information is communicated between the relying party and the subscriber unit of interest. A privilege data selector selects, for example, among a plurality of attribute certificates associated with a selected subscriber unit or among sets of privilege data within an attribute certificate, the certificate (or certificates) that matches the privileged test criteria data. This pre-selected certificate is then communicated for use by the relying unit and verified that it meets the test selected by the relying party unit.

Abstract: A secure accounting and operational method, whereby process elements are provided to a process, selected process elements are manipulated, a scheduled condition of the process is sampled at a predetermined point in the process, and the process sample is encrypted to provide an encrypted output. As a result, an authorized recipient has a high level of confidence in the reliability of the scheduled condition samples due to the integrity provided by the encryption process.

Abstract: An encryption system for restricted-access television systems. Multiple decryption keys are used to decrypt encrypted material which is transmitted to customers of a restricted-access television system.

Abstract: A method for operating a data processing system of a type that includes a first data processing entity located within a trusted environment and a second data processing entity located within an untrusted environment. The method includes a first step, executed at the first data processing entity, of operating a first software agent for detecting a presence of an information container of interest and for producing a modified information container by automatically identifying and at least one of removing, masking, or replacing at least one predetermined type of restricted or private information in the information container. A second step of the method transports the modified information container from the first data processing entity to the second data processing entity for further processing. The further processing may entail an analysis of the modified information container to locate and/or identify an undesirable software entity, such as a computer virus.

Abstract: A method, apparatus, article of manufacture, and a memory structure for a USB-compliant personal key has been described. The personal key includes an integrated connector design that is simple and easy to manufacture, and allows broken or defective connecting pins to be easily replaced. In the several embodiments disclosed, the personal key also comprises a biometric sensor for authenticating the identity of the user, and visual and aural sensors for providing information to the user.

Abstract: Described are a method of programming a programmable logic device using encrypted configuration data and a programmable logic device (PLD) adapted to use such encrypted data. A PLD is adapted to include a decryptor having access to a non-volatile memory element programmed with a secret decryption key. Some or all of the decryptor can be instantiated in configurable logic on the FPGA. Encrypted configuration data representing some desired circuit functionality is presented to the decryptor. The decryptor then decrypts the configuration data, using the secret decryption key, and configures the FPGA with the decrypted configuration data. Some embodiments include authentication circuitry that performs a hash function on the configuration data used to instantiate the decryptor on the PLD. The result of the hash function is compared to a proprietary hash key programmed into the PLD. Only those configuration data that produce the desired hash result will instantiate decryptors that have access to the decryption key.

Abstract: A sender driven certificate enrollment system and methods of its use are provided, in which a sender controls the generation of a digital certificate that is used to encrypt and send a document to a recipient in a secure manner. The sender compares previously stored recipient information to gathered information from the recipient. If the information matches, the sender transfers key generation software to the recipient, which produces the digital certificate, comprising a public and private key pair. The sender can then use the public key to encrypt and send the document to the recipient, wherein the recipient can use the matching private key to decrypt the document.

Abstract: A method and a system for authentication whereby authentication characteristic information is not disclosed to a third party when a verifier uses a verification device of a limited scale to authenticate a user's rights or qualifications. A ticket issuing device interacts with the user's interactive device having a secret function f to calculate document secret information &mgr; based on a document m (data) to be transmitted to the interactive device, whereby the user is issued a ticket t generated from authentication characteristic information x and the document secret information &pgr;. Upon receipt of the document m, the interactive device generates the document secret information using its unique secret function f to perform an interaction based on the generated information. The interaction involves output of a commitment r, input of a challenge c, and an output of a response &sgr;.

Abstract: The present invention relates to a network system, the network system of the present invention comprises an authorized client terminal which is connected to a network, a server which is connected to the network, and a firewall which is interposed between the server and the network. The client terminal accesses the server by means of a publicly known protocol via a port having a publicly known port number in the firewall. In the case in which the accessing client terminal is authorized, the server downloads program for realizing effective dedicated protocols solely between the client terminal and itself to the client terminal via the port having the publicly known port number. Furthermore, the server access with the client terminal conducts data communication by executing the program and by means of the dedicated protocols, via the network and the port having the publicly known port number.

Abstract: A method for protecting an item of software, wherein at least one challenge is associated with the protected item of software, and at least one response accesses one private keying material. The challenge has no access to the private keying material. The challenge and the response are generating shared secret information, respectively, in accordance with an asymmetric confidentiality scheme. The response proves that it discovered the shared secret and the challenge validates the proof. The challenge proof validation procedure uses the public keying material that corresponds to the response private keying material.

Abstract: Method and system aspects for securely transferring a computer system are described. A computer system is disabled at a shipping point via an RFID (radio frequency identification) interface and re-enabled at a receiving point via the RFID interface. Disabling the computer system includes selecting a boot password, writing the boot password to storage in the computer system via the RFID interface, and setting a disable bit in the storage via the, RFID interface. Re-enabling the computer system includes entering the boot password via the RFID interface and clearing the disable bit.

Abstract: A method for providing single step log-on access for a subscriber to a computer network. The computer network is differentiated into public and private areas. Secure access to the private areas is provided by a Service Selection Gateway (SSG) Server, introduced between a conventional Network Access Server (NAS) and an Authentication Authorization and Accounting (AAA) Server. The SSG Server intercepts and manipulates packets of data exchanged between the NAS and the AAA Server to obtain all the information it needs to automatically log the user on when the user logs on to the NAS. An authorized user is thus spared the task of having to re-enter username and password data or launch a separate application in order to gain secure access to private areas of the network.

Abstract: A system and method employs a password rule data provider that provides password generation rule data to a notification device, such as visual display device or audible output device. A password data evaluator, such as a per character password data evaluator, continuously evaluates password character data as its being entered and compares each character to the password generation rule data. A dynamic status data generator dynamically generates password rule status data, such as visual indication of which rule has been met or which rule has not been met as password data is being entered.

Abstract: Virtual Private Networking (VPN) is an emerging technology area enabling e-business on the Internet. A key underlying VPN technology is IP Security (IPsec), a means of providing private (encrypted and authenticated) secure data transmission over public (Internet) networks. The definition of what data to protect ultimately results in IP filter rules, loaded to the operating system kernel. These are used to select the correct IP datagrams and cause each to be processed by the correct IPsec Security Associations. Along with other attributes, a VPN connection can be started, stopped, and monitored. Connection filters which are used to implement VPN connections are dynamic, and must be inserted and deleted within the currently installed set of IP filters (non-VPN related). Since IP filter order is crucial to proper functioning, the basic problem is, where to place these dynamic filters. This filter placement problem has a macro and a micro part.

Abstract: When a remote access terminal connected to a first Intranet receives provision of services from a second Intranet, a web server of the first Intranet loads a remote service execution environment to the remote access terminal. The second Intranet dynamically installs a service proxy on the second dynamic proxy server. Next, the second Intranet supplies a remote service interface to the remote access terminal via a first dynamic proxy server and second dynamic proxy server. The service proxy receives provision of services from the second Intranet instead of the remote service interface. The network of the present invention dynamically install service proxies on a dynamic proxy server when multiple Intranets are connected, and therefore, firewall tunneling by service unit is possible.

Abstract: A method and computer program product for accessing a secure resource using a certificate bound with authentication information. In one implementation, the method includes receiving a certificate request from a user, the certificate request including identification information and authentication information associated with the user; verifying the identification information; issuing a certificate to the user when the identification information is verified; and sending the authentication information and a certificate identifier for the certificate to an authentication server. According to one aspect, the sending step includes signing a combination of the authentication information and the certificate identifier to form a unique user identifier; signing the authentication information; and sending the unique user identifier to the authentication server.

Abstract: A computer network includes at least one client computer coupled to a server computer that dynamically changes a user's password each time the user logs on to the computer network. By changing the password during the log on process, network security is increased. The server computer includes a users databases that contains a password, a username (if desired) and a biometrics template value associated with each user registered to access the computer network. A biometrics sensing device, such as a fingerprint sensor, is connected to each client computer. The user attempts to log on the server by entering a username which is optional and activating the biometrics sensing device. Appropriate software and/or hardware in the client and server computers capture a sample from the biometrics sensing device and create a template value from the captured sample.