Abstract: Methods and apparatuses for obfuscating computer instruction streams. In one aspect of the invention, an exemplary method includes breaking each of at least two operative instruction streams into a plurality of parts and interleaving the parts into a new instruction stream. In another aspect of the invention, an exemplary method includes breaking each of at least two operative instruction streams into a plurality of parts and interleaving the parts with obfuscation codes into a new instruction stream. The obfuscation codes interrelate the parts from different instruction streams to prevent reversal of interleaving.

Abstract: Method and system aspects for authenticated communication of messages among computer systems in an insecure network are described. These aspects include building a first signed object message in a first computer system, the first signed object message including a first sequence number, a first object and a first signature. Further included is sending the first signed object message to a second computer system, verifying the first signed object message in the second computer,system, and building a second signed object message in the second computer system for replying to the first computer system when the first signed object message is verified, the second signed object message including a second sequence number, a second object, and a second signature.

Abstract: A method for operating a data processing system of a type that includes a first data processing entity located within a trusted environment and a second data processing entity located within an untrusted environment. The method includes a first step, executed at the first data processing entity, of operating a first software agent for detecting a presence of an information container of interest and for producing a modified information container by automatically identifying and at least one of removing, masking, or replacing at least one predetermined type of restricted or private information in the information container. A second step of the method transports the modified information container from the first data processing entity to the second data processing entity for further processing. The further processing may entail an analysis of the modified information container to locate and/or identify an undesirable software entity, such as a computer virus.

Abstract: Cyclotomic polynomials are used to construct subgroups of multiplicative groups of finite fields that allow very efficient implementation of discrete logarithm based public key cryptosystems, including public key encryption schemes and digital signature schemes. A field is represented with an optimal normal basis, and a generator of a subgroup of the multiplicative group of the field is used to form a public key.

Abstract: Described are a method of programming a programmable logic device using encrypted configuration data and a programmable logic device (PLD) adapted to use such encrypted data. A PLD is adapted to include a decryptor having access to a non-volatile memory element programmed with a secret decryption key. Some or all of the decryptor can be instantiated in configurable logic on the FPGA. Encrypted configuration data representing some desired circuit functionality is presented to the decryptor. The decryptor then decrypts the configuration data, using the secret decryption key, and configures the FPGA with the decrypted configuration data. Some embodiments include authentication circuitry that performs a hash function on the configuration data used to instantiate the decryptor on the PLD. The result of the hash function is compared to a proprietary hash key programmed into the PLD. Only those configuration data that produce the desired hash result will instantiate decryptors that have access to the decryption key.

Abstract: A sender driven certificate enrollment system and methods of its use are provided, in which a sender controls the generation of a digital certificate that is used to encrypt and send a document to a recipient in a secure manner. The sender compares previously stored recipient information to gathered information from the recipient. If the information matches, the sender transfers key generation software to the recipient, which produces the digital certificate, comprising a public and private key pair. The sender can then use the public key to encrypt and send the document to the recipient, wherein the recipient can use the matching private key to decrypt the document.

Abstract: A method for protecting an item of software, wherein at least one challenge is associated with the protected item of software, and at least one response accesses one private keying material. The challenge has no access to the private keying material. The challenge and the response are generating shared secret information, respectively, in accordance with an asymmetric confidentiality scheme. The response proves that it discovered the shared secret and the challenge validates the proof. The challenge proof validation procedure uses the public keying material that corresponds to the response private keying material.

Abstract: A computerized method is provided for certifying a digital object. The digital object is uniquely identified with an identification. The identification is registered with a certification authority using a first public/private key exchange to receive a certificate of the digital object. Authenticity of the object is addressed by means of certification of the supplier's identity, in conjunction with integrity validation of the object. The digital object is tested to receive a compliance label using a second public/private key information exchange. The digital object is then distributed along with the certificate, and the label using a third public/private key information exchange. Ongoing confidence in object compliance is sustained by re-affirmation and/or notification mechanisms.

Abstract: In the method for establishing a session key, a network and a mobile transfer codes between one another. The mobile and the network perform mutual authentication based on the codes. Besides performing this mutual authentication, the mobile and the network to establish the session key based on the codes. In one embodiment, the messages forming part of the intended session are sent with the codes, and form a basis upon which the codes for authentication have been derived.

Abstract: The invention is a cryptographic system using chaotic dynamics. A set of initial conditions is generated from the private key and becomes input to the chaotic system. The chaotic system generates a set of final conditions from which the public key is derived. The public key is distributed to the public. The public key can be used to encrypt a message that is then decrypted using the private key. An adjustable back door of the invention derived from a set of interim conditions can be used in conjunction with the public key to derive the private key. The degree of difficulty involved in deriving the private key is dependent on the adjustable back door. That is the value of the back door can be adjusted to vary the difficulty involved in deriving the private key. In one embodiment of the invention, the chaotic system is based on the “N-body” problem to provide cryptographic security.

Abstract: Remote configuration and utilization of an emulated device controller via communication of encrypted data external to the controller. In a preferred embodiment, first and second software means executing within a server central processing unit facilitates secured and verified access to emulated input/output devices on behalf of a user community. The emulated input/output devices are further associated with session oriented application programs executed on one or more host central processing units. A user requests utilization of one or more emulated input/output device types whereupon the security software validates the user's request. If authorized, a hardware adaptor card is initialized with an input/output device configuration reflecting the user's request and control is passed to session oriented programs whereupon the user input/output requests are facilitated via an emulated device as opposed to physical devices associated with the host processors.

Abstract: A technique which implements a primitive for computing, e.g., a checksum. Specifically, this primitive replaces a mod(M) operation with a series of simple elementary register operations. These operations include mod 2n multiplications, order manipulations (e.g., byte or word swaps), and additions—all of which are extremely simple to implement and require very few processing cycles to execute. Hence, use of our inventive technique can significantly reduce the processing time to compute various cryptographic parameters, such as, e.g., a message authentication code (MAC), or to implement a stream cipher, over that conventionally required. This technique has both invertible and non-invertible variants.

Abstract: An apparatus and methods for facilitating a reduction in data transmission bandwidth removes unnecessary data relating to encryption keys prior to sending a message or storing the encrypted information for a recipient. Encrypted data, such as message data for multiple recipients, is analyzed to determine whether encryption related data for other recipients may be removed.

Abstract: A method and an apparatus for generating encryption stream ciphers are based on a recurrence relation designed to operate over finite fields larger than GF(2). A non-linear output can be obtained by using one or a combination of non-linear processes to form an output function. The recurrence relation and the output function can be selected to have distinct pair distances such that, as the shift register is shifted, no identical pair of elements of the shift register are used twice in either the recurrence relation or the output function. Under these conditions, the recurrence relation and the output function also can be chosen to optimize cryptographic security or computational efficiency. Moreover, it is another object of the present invention to provide a method of assuring that the delay that results for the encryption process does not exceed predetermined bounds.

Abstract: There is provided an apparatus for summing bivectors, e.g. double vectors (alternatively referred to as bivectors) each having a plurality of pairs of elements selected from a predetermined finite field, the apparatus including (a) a device for inputting bivectors X1 and X2, and parameters A (e.g., a3 to a13) for defining a curve therethrough, (b) a first memory for storing the bivector X1 therein, (c) a second memory for storing the bivector X2 therein, (d) a third memory for storing the parameters A therein, and (e) a device for reading the bivectors X1 and X2, and the parameters A out of the first, second and third memories, respectively, and, when the bivectors X1 and X2 are supposed to be coordinate value rows of points in point-sets Q1 and Q2 on the curve defined with the parameters A, operating a bivector X3 comprised of coordinate value row of points in a point-set Q3 equal to a sum of the point-sets Q1 and Q2 in Jacobian group of the curve defined with the parameters A.

Abstract: A trainable transmitter comprises a transmitter, code-generation circuitry and a removable, plug-in data module. The data module includes information necessary for generating a code for a specific security system, such as a garage door opener. Preferably, the data includes a cryptographic algorithm and the frequency at which the wireless signal is to be generated. The code-generation circuitry accesses the data in the data module to generate a code, which is then transmitted by the transmitter. A variety of data modules are provided. A user installs a data module which corresponds to the security system to be accessed.

Abstract: A signal transmission method applicable to prevention of modification or alteration of the playback mode information, such as copying management information or charging information. The playback mode information form a terminal 15P is data-converted for ciphering by a playback mode information appendage circuit 14 in a header appendage circuit 13 responsive to the key information from a terminal 15K and the resulting information comprised of the data and the playback mode information is outputted. The reproducing side effects data conversion on the ciphered playback mode information for deciphering, by a playback mode information detection circuit 26 in a header separation circuit 25, using the key information from a terminal 27K, for taking out the original playback mode information at a terminal 27P.

Abstract: A computer system has a program module verifier and at least first and second program modules. Each program module includes a digital signature and an executable procedure. The first program module furthermore includes a procedure call to the second procedure module, a procedure call to the program module verifier that is logically positioned in the first program module so as to be executed prior to execution of the procedure call to the second program module, and instructions preventing execution of the procedure call to the second program module when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier.

Abstract: Methods and apparatuses for increasing the leak-resistance of cryptographic systems using an indexed key update technique are disclosed. In one embodiment, a cryptographic client device maintains a secret key value as part of its state. The client can update its secret value at any time, for example before each transaction, using an update process that makes partial information that might have previously leaked to attackers about the secret no longer usefully describe the new updated secret value. By repeatedly applying the update process, information leaking during cryptographic operations that is collected by attackers rapidly becomes obsolete. Thus, such a system can remain secure (and in some embodiments is provably secure) against attacks involving analysis of measurements of the device's power consumption, electromagnetic characteristics, or other information leaked during transactions. The present invention can be used in connection with a client and server using such a protocol.

Abstract: In a public key encryption system where an individual is used as a unit, an idea of “group” is newly introduced. Then, both an encryption process operation of a plain text by an arbitrary member belonging to the group, and a decryption process operation of cryptogram information can be executed by employing such a combination key made from a group public key and a group secret key, which are produced in unit of “group”, and further an individual public key and an individual secret key. With employment of this encryption system, while high secrecies can be maintained inside and outside the group, the cryptogram information can be commonly shared based upon a confirmation of a member among members within the group. Also, an electronic signature can be made by a member belonging to the group.