Abstract: An apparatus includes a key mixing circuit to generate N groups of decryption seeds, each generated based upon a predetermined key, a transmitter address, and a predetermined start value for a packet number. An input circuit receives N encrypted packets, each including the transmitter address and one of N values for the packet number. A decryption circuit decrypts each of the N encrypted packets using one of the N groups of decryption seeds that was generated based on the one of the N values in a respective one of the N encrypted packets. The key mixing circuit generates each of the N groups of decryption seeds before the input circuit receives the respective one of the N encrypted packets of the data. The predetermined start value is initialized when the apparatus is initialized and incremented when each of the N groups of decryption seeds is generated.

Abstract: A packet traversing on the computer network is received; session information is generated from the packet with the session information including a client network address and a server network address; the packet is associated with at least one object attribute from the directory by using the session information; and a security policy defined for the network environment is enforced by using the session information and the object attribute(s) to determine whether the packet violates the security policy.

Abstract: The convenience of a wireless network is tempered by the concern that a rogue device can listen in on the wireless communications. Determining the position of the home device and other devices within range allows the user of the home device to choose the specific wireless devices with which to communicate. The distance to the other devices within wireless communications range is helpful and allows the user to sort between safe and unsafe or rogue devices. Distance can be determined by a variety of methods including use of trusted references, signal strength, and error rate. Once the safe device is selected, the system will then establish a communications path with that device.

Abstract: A cryptographic method for enhancing computation performance of a central processing unit involves the execution of a conversion function of the cryptographic method by the central processing unit. The conversion function computation requires the use of a plurality of substitution boxes. The method comprises the steps of: (A) detecting a processing bit length of the central processing unit; (B) generating at least one new substitution box from original substitution boxes according to the processing bit length and a bit permutation sequence, each of the at least one new substitution box containing a plurality of new substitution values whose bit length is equal to the processing bit length; and (C) using a bit expansion operation, a bitwise exclusive OR operation, the selection operations that use the at least one new substitution box generated in step (B), a plurality of bitwise AND operations, and at least one bitwise OR operation to conduct the conversion function computation.

Abstract: A video processing method for detecting significant events from a video program includes computing short-time sub-band energies in the audio for plural audio sub-bands, detecting scene boundaries where a weighted sum of these short-time sub-band energies are less energy threshold for longer than an time interval, segmenting the video program into a plurality of scenes by the boundaries, removing scenes shorter than a segment time interval and classifying and ranking the remaining scenes by audio. A second segmenting and removal is based upon a second energy threshold and a second time interval or when energy in a lowest frequency sub-band is greater than a predetermined bass energy threshold. The first segment time interval may be recomputed based upon the distribution of length of the remaining scenes.

Abstract: A security module identifies symbols within an executable file. The security module compares these identified symbols to a set of symbols expected to be present in a legitimate executable file. Based at least in part on an identified symbol not being within the set of expected symbols, the security module determines that the executable file poses a heightened security risk. In one embodiment, a remediation module takes an appropriate response to prevent potential malware exploits by the executable file.

Abstract: A scanned image disclosure apparatus has a disclosure unit that encrypts and discloses to a disclosure destination a scanned image by using a public key or a private key relating to a public key certificate that has been verified to be valid, a re-verification unit that judges whether or not re-verification of the validity of the public key certificate is necessary during execution for the disclosure unit and performs re-verification if it is judged to be necessary, a termination unit that terminates the execution for the disclosure unit if the public key certificate was judged to be invalid by the re-verification unit.

Abstract: What is proposed is a method of implementing a security system (Packet Sentry) addressing the internal security problem of enterprises having a generalized approach for inferential determination and enforcement of network policy with directory service based group correlation with transparent authentication of the connected customer and the policy enforcement inside the network. The security system enables the network to analyze and enforce policy using any bit or bits in a stream or a packet, conduct Flow Vector analysis on the data traffic, provide Application Monitoring, Normalization and user authentication validation. The system enables the network to implement Group relationship Analysis and correlation using combination of Network inferences and Directory service data resulting in generation of Group norms using statistically significant relationships.

Abstract: A method of backing up domain information relating to the construction of a domain is provided. In the method, the domain information is encrypted and the encrypted domain information is stored in a predetermined storage device in the domain the encrypted domain information to the predetermined storage device, thereby securely backing up the domain information without the help of an external network. Accordingly, even when the existing domain server malfunctions, a new domain server is capable of obtaining the domain information.

Abstract: A method for protecting traffic in a radio access network connected to at least two core networks. The method comprises maintaining a corenetwork-specific authentication protocol and a radio-bearer-specific ciphering process, and generating, for each ciphering process, a count parameter comprising a cyclical sequence number and a hyperframe number (HFN) which is incremented each time the cyclical sequence number completes one cycle. For each core network or authentication protocol, a first radio bearer of a session is initialized with a HFN exceeding the highest HFN used during the previous session. When a new radio bearer is established, the mobile station selects the highest HFN used during the session for the core network in question, increments it and uses it for initializing the count parameter for the new radio bearer. At the end of a session, the mobile station stores at least part of the highest HFN used during the session.

Abstract: The present invention relates to systems and methods to identify a level of access for a resource being accessed via a secure socket layer virtual private network (SSL VPN) connection to a network, and to control the action on the resource based on the identified level of access. The appliance described herein provides intelligent secure access and action control to resources based on a sense and respond mechanism. When a user requests access to a resource via the SSL VPN connection of the appliance, the appliance obtains information about the client to determine the user access scenario—the location, device, connection and identify of the user or client.

Abstract: A system and method for implementing an enhanced transport layer security (ETLS) protocol is provided. The system includes a primary server, an ETLS servlet and an ETLS software module. The primary server operates on a computer network and is configured to communicate over the computer network using a non-proprietary security protocol. The ETLS servlet also operates on the computer network and is securely coupled to the primary server. The ETLS servlet is configured to communicate over the computer network using an ETLS security protocol. The ETLS software module operates on a mobile device, and is configured to communicate over the computer network using either the non-proprietary security protocol or the ETLS security protocol. Operationally, the ETLS software module initially contacts the server over the computer network using the non-proprietary security protocol, and subsequently contacts the server through the ETLS servlet using the ETLS security protocol.

Abstract: Provided is a binding update method in MIPv6 which includes: a first step of generating, with a mobile node, a HoTI (Home Test Init) message and transmitting the HoTI message to a corresponding node; a second step of generating a CoTI (Care of Test Init) message and transmitting the CoTI message to the corresponding node; a third step of generating, with the corresponding node, a HoT (Home of Test) message and transmitting the HoT message to the mobile node; a fourth step of generating a CoT (Care-of Test) message and transmitting the CoT message to the mobile node; a fifth step of generating, with the mobile node, a BU (Binding Update) message and transmitting the BU message to the corresponding node; and a sixth step of verifying, with the corresponding node, the BU message and transmitting a BA (Binding Ack) message to the mobile node.

Abstract: A computer system encrypts write-data to be written to the volume in response to a write command. The system transmits a rekey command from host computer system to the storage system when the key data stored in the host key data memory is changed to second key data. The storage system receives the rekey command transmitted from host computer system and stores the first and second key data contained in the received rekey command to a volume key data memory of the storage system. The storage system reads out data encrypted with the first key data from an original block address in the volume. The storage system decrypts the data read out from the volume using the first key data. The storage system encrypts the data decrypted by the first key data using the second key data, and writs the data encrypted with the second key data to the original block address.

Abstract: One embodiment of the invention is a method for providing media content while preventing its unauthorized distribution. The method includes transmitting from a client to an administrative node a request for delivery of an instance of media content (IMC); determining which content source (CS) of a plurality of CSs to provide delivery of the IMC, provided the client is authorized to receive the IMC; transmitting to the client an access key and a location of the IMC; transmitting from the client to the CS a second request and the access key; in response to receiving the second request and the access key, transferring the IMC from the CS to the client; transmitting from the client to the administrative node an indicator indicating a successful transfer of the IMC; and generating a transaction applicable to the client and associated with the transfer of the IMC to the client.

Abstract: One embodiment of the invention is a method for providing media content while preventing its unauthorized distribution. The method includes transmitting from a client to an administrative node a request for delivery of an instance of media content (IMC); determining which content source (CS) of a plurality of CSs to provide delivery of the IMC, provided the client is authorized to receive the IMC; transmitting to the client an access key and a location of the IMC; transmitting from the client to the CS a second request and the access key; in response to receiving the second request and the access key, transferring the IMC from the CS to the client; transmitting from the client to the administrative node an indicator indicating a successful transfer of the IMC; and generating a transaction applicable to the client and associated with the transfer of the IMC to the client.

Abstract: One embodiment of the invention is a method for providing media content while preventing its unauthorized distribution. The method includes transmitting from a client to an administrative node a request for delivery of an instance of media content (IMC); determining which content source (CS) of a plurality of CSs to provide delivery of the IMC, provided the client is authorized to receive the IMC; transmitting to the client an access key and a location of the IMC; transmitting from the client to the CS a second request and the access key; in response to receiving the second request and the access key, transferring the IMC from the CS to the client; transmitting from the client to the administrative node an indicator indicating a successful transfer of the IMC; and generating a transaction applicable to the client and associated with the transfer of the IMC to the client.

Abstract: Provided are a method and apparatus for managing a station by providing an encrypted key to the station in a wireless network under a Wi-Fi Protected Pre-Shared Key (WPA-PSK) environment. In the method, a registrar determines whether a new station is a guest station, based on user input. If the new station is a guest station, the registrar includes a session key (and not a shared key) into an M8 message according to a Wi-Fi Alliance (WFA) Simple Config protocol and transmits the M8 message to the station. Accordingly, it is possible to permit a guest station to temporarily access the network without a user's management of information regarding the guest station.

Abstract: The present invention provides systems and methods for risk detection and analysis in a computer network. Computerized, automated systems and methods can be provided. Raw vulnerability information and network information can be utilized in determining actual vulnerability information associated with network nodes. Methods are provided in which computer networks are modeled, and the models utilized in performing attack simulations and determining risks associated with vulnerabilities. Risks can be evaluated and prioritized, and fix information can be provided.

Abstract: Provided is a storage system that includes a first storage apparatus and a second storage apparatus each connected to a host computer. The first and second storage apparatuses each include a controller and a disk drive. The controller manages an encryption status and an encryption key for each of a data volume and a journal volume in the disk drive. The controller in the first storage apparatus receives a write request from the host computer, creates a journal based on write data, encrypts the journal, and stores in an order the journal in a storage area in the journal volume. The controller in the order the encrypted journal stored in the journal volume, decrypts the journal, and transmits the decrypted journal to the second storage apparatus.