Abstract: At a network node separate from a subscriber configuration network node configured to store subscriber configuration data for a plurality of subscriber devices, a request to access configuration data associated with a subscriber stored at the subscriber configuration network node is received. In response to the received access request comprising a private user identity for the subscriber, but not a public user identity for the subscriber, the network node retrieves, from a user identity database configured to store user identity data for identifying subscribers in the network, a public user identity for the subscriber, the retrieval being carried out on the basis of the private user identity for the subscriber comprised in the received access request, and transmits an authorization request to the subscriber configuration network node comprising the public user identity retrieved from the user identity database and the private user identity comprised in the received access request.

Abstract: The present invention is related to a wireless transmit/receive unit (WTRU) for providing advanced security functions. The WTRU includes trusted platform module (TPM) for performing trusted computing operations; and a secure time component (STC) for providing a secure measurement of a current time. The STC and the TPM are integrated to provide accurate trusted time information to internal and external to the WTRU. The STC may be located on an expanded a subscriber identity module (SIM), on the WTRU platform, or two STCs may be used, one in each location. Similarly, the TPM may be located on an expanded SIM, on the WTRU platform, or two TPMs may be used, one in each location. Preferably, the STC will include a real time clock (RTC); a tamper detection and power failure unit; and a time report and sync controller.

Abstract: A method for exchanging strong encryption keys between devices using alternate input methods. At least two devices that want to communicate with one another are set in key exchange mode. The at least two devices are to communicate with one another using a short range radio or personal area network. The at least two devices negotiate with one another to determine which of the at least two devices will generate an encryption key, wherein device A represents the negotiated device and device B represents the non-negotiated device. Device A generates the encryption key and transmits the encryption key to device B using an out-of band transmission channel. The out-of-band transmission channel may be transmitting the encryption key via audio tones. A validation process determines whether the transmission of the encryption key via the out-of-band transmission channel was successful.

Abstract: Transponder (104), comprising a storage unit (106) having stored a number of different applications, a processing unit (108) which, on request of a reader (102), is adapted to generate a response interpretable using an encryption scheme known by both the transponder (104) and the reader (102) so that the reader (102) is capable of determining whether an application is supported by the transponder (104) by analyzing the response using the encryption scheme, and a transmission unit (110) adapted to send the response to said reader (102).

Abstract: This disclosure relates to a system and related operating methods. A computer-implemented server device receives a request from a device that includes an identifier proposed for a potential account holder. The computer-implemented server device determines whether the identifier is available for use with a new account, and communicates a response to the device that indicates whether the identifier is available for use with the new account. The response is presented at the device and includes an image that contains a visually obfuscated representation of an alphanumeric message that indicates either a success or a failure.

Abstract: Systems and methods for strong user authentication for accessing protected applications by mobile computing devices. An example method may comprise: receiving, by a mobile computing device, a cryptographic nonce via a first communication interface; transmitting, via a second communication interface, an authentication request using the cryptographic nonce, to an authentication server via an HTTP proxy server; receiving a resource access token from the authentication server; and transmitting a computing resource access request using the resource access token.

Abstract: A method for data privacy in a VoIP system includes: generating a private key for an additive homomorphic encryption scheme; sending the private key to a plurality of client terminals to be used by each of the plurality of client terminals to encrypt a respective VoIP streaming data; receiving an encrypted VoIP streaming data from each of the plurality of client terminals, wherein each of the VoIP streaming data is encrypted using the same private key; performing an encrypted homomorphic addition on the encrypted VoIP streaming data to generate a mixed encrypted VoIP data stream; and sending the mixed encrypted VoIP data stream to the plurality of client terminals to be played back.

Abstract: A multi-die chip assembly is described, the multi-die chip assembly including at least one detection apparatus which detects manipulations of the multi-die chip assembly, the detection apparatus including a distributed circuit including a circuit whose elements are distributed among those dies which include the elements of a local reference circuit, the distributed circuit including a free running clock, at least one local reference circuit disposed in at least one die of the multi-die chip assembly, each of the local reference circuits including a free running clock, and at least one non-volatile memory, in which is stored during manufacture of the multi-die chip assembly, an allowed range of a result of a function having at least two arguments for each reference circuit a value of the frequency of the local reference circuit as manufactured, and a value of the frequency of the distributed circuit as manufactured, at least one element of the plurality of memories being disposed in each die including the elem

Abstract: The present invention is directed towards systems and methods for providing multiple modes of a zone for DNSSEC by an intermediary device. The method includes providing, by a device intermediary to a plurality of clients and a plurality of servers, a plurality of modes of a zone for Domain Name Service. The device receives a selection of a first mode of the zone of the plurality of modes of the zone. The device receives information identifying to enable DNS Security for the selected first mode. The device establishes the zone for DNS in accordance with the selected first mode and with DNS Security enabled.

Abstract: A method and system for authenticating a user at a first computer to first and second applications installed in a second computer. The second computer receives from the user a first request to access the first application, and in response, the second computer redirects the first request to a third computer, and in response, the third computer determines that the user was previously authenticated and so notifies the second computer, and in response, the second computer returns a first session key to the third computer. The first session key enables a session with the first application but not with the second application. The second computer receives from the user a second request with a second session key to access the first and/or second application, and in response the second computer determines that the user is authentic and notifying the first and/or second application that the user is authentic.

Abstract: A computationally implemented method includes, but is not limited to: acquiring one or more indicators that suggest that a computing device has been transferred to a first user from a second user, the first user having at least greater accessing rights than the second user to one or more items via the computing device; detecting, in response to said acquiring, input that verifies that the computing device has been transferred to the first user; and providing at least greater access via the computing device to the one or more items in response to detecting the input verifying that the computing device has been transferred to the first user. In addition to the foregoing, other method aspects are described in the claims, drawings, and text forming a part of the present disclosure.

Abstract: A method and system for generating and processing an authenticity certificate. A request for a step certificate is received from a requester entity. The step certificate authenticates an involvement of the requester entity about an object. The request includes an object identifier, a requester entity type of the requester entity, and a requester identity certificate of the requester entity. The object identifier is hashed. A signature is created and includes the hashed object identifier, the requester entity type, a certifier identity certificate, and the requester identity certificate. A hashing result is generated by hashing a concatenation of the object identifier, the requester entity type, the certifier entity certificate, the requester identity certificate, and the signature. The step certificate is generated and includes the hashing result. The step certificate is encrypted. The encrypted step certificate is sent to the requester entity for subsequently storing the step certificate on a media.

Abstract: In an embodiment of the invention, a method includes: determining, in a computer, an area where an undesired computer program will reside; and providing a data object in the area, so that the data object is an antibody that provides security to the computer and immunity against the undesired program. Another embodiment of the invention also provides an apparatus (or system) that can be configured to perform at least some of the above functionalities.

Abstract: In a power-line communication system, a data processing electronic circuitry can receive a plurality of symbols from a plurality of endpoint circuits and over a plurality of communications channels on power lines in a power-line communication system. A first symbol of the plurality of symbols can be decrypted using a first decryption key that is assigned to a first endpoint circuit. From the first decryption, a first measure of error is computed that includes a first bit error rate. The first symbol is decrypted using a second decryption key that is assigned to a second endpoint circuit. From the second decryption, a second measure of error is computed that includes a second bit error rate. The first and second bit error rates are compared to a threshold error measure to determine validity.

Abstract: Binding a security artifact to a service provider. A method includes generating a pseudonym for a security artifact. The pseudonym is an identifier of the security artifact to the service provider that is unique to the service provider in that the pseudonym is not used to identify the security artifact to other service providers. Further, the pseudonym uniquely identifies the particular security artifact to the service provider even when a user has available a number of different security artifacts to authenticate to the same service provider to access a user account for the user. The method further includes providing the pseudonym for the security artifact to the service provider. The pseudonym for the security artifact is bound with a user account at the service provider for a user associated with the security artifact.

Abstract: Methods, systems, and products are disclosed in which generating evidence of web services transactions are provided generally by receiving in an ultimate recipient web service from an initial sender a request, the request containing a proof of message origin (‘PMO’). The PMO contains an element addressed to the ultimate recipient web service and the element bears a first signature, the first signature having a value. Embodiments also include authenticating the identity of the initial sender; creating a proof of message receipt (‘PMR’) including signing the value of the first signature; sending the PMR to the initial sender, receiving, by the initial sender, the PMR; and saving, by the initial sender, the PMR.

Abstract: The authentication system includes a plurality of user terminals that are used by the same user, and a server capable of communicating with the plurality of user terminals. A user terminal transmits, to the server, an identification ID of the user terminal, a first code that is used in common in the plurality of user terminals, and a second code that was encrypted using the first code. The server is configured to decrypt the encrypted second code using the first code, and perform authentication of the user terminal using the identification ID and the decrypted second code. The server, upon receiving a second code that is not encrypted from one of the plurality of user terminals, transmits the second code that was encrypted using the first code to the one of the user terminals.

Abstract: A system and method provide efficient, secure, and highly reliable authentication for transaction processing and/or access control applications. A personal digital key (PDK) is programmed using a trusted programming device to initialize and/or register the PDK for use. In one embodiment, the initialization and registration processes are administered by a specialized trusted Notary to ensure the processes follow defined security procedures. In a biometric initialization, the programming device acquires a biometric input from a user and writes the biometric data to a tamperproof memory in the PDK. In registration, the Programmer communicates to one or more remote registries to create or update entries associated with the user PDK. Once initialized and registered, the PDK can be used for various levels of secure authentication processes.

Abstract: Methods, systems, and computer-readable media are provided. In some embodiments, a first computing system receives a credential from a browser on a second computing system, determines whether the credential is valid, generates a string of numeric characters, associates the string of numeric characters with the credential, and sends the string of numeric characters to the second computing system. Furthermore, in some embodiments, the first computing system receives an identifier that identifies a security token, determines whether the identifier matches an entry in a data store, prompts a user to input information via a user interface, receives a string of characters via the user interface, determines whether the string of characters received via the user interface matches the string of numeric characters, and performs a registration process such that the identifier is associated with a user account in the data store, the user account associated with the credential.

Abstract: Organizations maintain and generate large amounts of sensitive information using computer hardware resources and services of a service provider. Furthermore, there is a need to be able to delete large amounts of data securely and quickly by encrypting the data with a key and destroying the key. To ensure that information stored remotely is secured and capable of secure deletion, cryptographic keys used by the organization should be prevented from being persistently stored during serialization operations. Signaling methods are used to notify virtual machine instances of serialization events in order to prevent keying material from being stored persistently.