Abstract: Copy-Protected Audio, Video and or Data Optical Disk and the Protection Process for such Disk includes a TSR (Terminate and Stay Resident) program which when once installed onto a computer system blocks any attempt to copy any designated Audio, Video or any Data on such Copy-Protected Optical Disk and or the Hard Drive. Additionally this system further includes a means of an optional Password Key which could be a Key Floppy or any suitable media. Optionally the password could be obtained by logging-on to an Internet based authentication terminal that unlocks the system and allows access to the stored contents on the disk for the first time user of the Copy-Protected Optical Disk thus increasing the pay per use revenues for Audio, Video and or Software Sales, Registration and or Rentals.

Abstract: A method and apparatus are used in determining authorization to perform tasks in a computer environment, and specifically requiring multiple parties to authorize a task before access is granted. The present system provides for substantially real time communication to a second party authorizer when a task owner is attempting to perform a task.

Abstract: A method for authenticating an identity involves first receiving a first credential over a first communications channel, and determining a second communications channel provisionally associated with the first credential. The second communications channel is different from the first communications channel, and the first credential is provisionally associated with an identity. Then, a second credential is received over the second communications channel, and the identity is authenticated based on a verification of the second credential.

Abstract: A restricted web site has features that are selectively exposed to clients. A screening web site interacts with clients and collects data about the clients using passive and/or active techniques. The screening site generates a token for the client, and includes data in the token identifying the token and describing the client. The token is encoded in a cookie and saved in the client's web browser. The client subsequently provides the token to the restricted site. The restricted site validates the token to ensure that it is legitimate, has not expired, and has not been used before. The restricted site selects one or more features to provide to the client based on the data about the client in the token and/or on other information. If the client does not present a token or the token is invalid, the restricted site does not expose any features to the client.

Abstract: A distributed subscriber management system and method that controls access to a network preventing unauthorized traffic through the access network and providing centralized access control between user networks are disclosed. The controlled access is provided through the use of one of several technologies including user authentication, using PAP, CHAP, RADIUS, TACACS+. The method includes the steps of receiving a connection request from a user located on one of the User Networks; interrogating the user for userid and password information; encrypting the userid and password information; transmitting the encrypted information, via the access network, to an authentication server attached to one of a plurality of external networks; decrypting the information at the authentication server; and transmitting an authentication message from the authentication server of the external network to the access control node via the access network.

Abstract: A method for authenticating address ownership using a Care-of Address (CoA) binding protocol, the method includes a comparison of two hash-function-processed result values, i.e., a first hash-function-processed result value transmitted from a home agent, the first hash-function-processed result value encrypted by a public key of a correspondent node and decrypted by a secret key of the correspondent node, and a second hash-function-processed result value piggybacked in a binding update message transmitted from a mobile node. The hash-function-processed result values are obtained by applying hash functions to a care-of address of a mobile node to be used in a foreign link, a random number generated by a home agent and a secret key shared by the home agent and the mobile node.

Abstract: Techniques that facilitate pairing of wireless devices with other wireless devices are disclosed. According to one aspect, a pair of wireless devices can be paired for wireless data exchange using an available wired link. Advantageously, the wired link can be used to transport a pin code from one of the wireless devices to the other. Consequently, pairing of the wireless devices can be completed without necessitating user entry of a pin code so long as the wired link is available.

Abstract: A key selection process is provided which secures traffic between VPN end-points using a combination of SVPN group keys and pair-wise keys. The type of key used is based on the dynamic needs of traffic between the end-points, where the needs may include throughput and quality of service. SVPN group keys allow end-points in a group to initiate data communications while obtaining pair-wise keys in the background. Once pair wise keys are obtained, communications can be transferred using the obtained keys. As the throughput, quality of service, routing and other needs of the channel change, the type of keys used for data transfer may concomitantly change between SVPN group keys and pair-wise keys to appropriately utilize network resources. The key selection idea may be extended to allow communication through a hub using a group key while establishing pair-wise channels for group member communications in the background.

Abstract: A probe attached to a customer's network collects status data and other audit information from monitored components of the network, looking for footprints or evidence of unauthorized intrusions or attacks. The probe filters and analyzes the collected data to identify potentially security-related events happening on the network. Identified events are transmitted to a human analyst for problem resolution. The analyst has access to a variety of databases (including security intelligence databases containing information about known vulnerabilities of particular network products and characteristics of various hacker tools, and problem resolution databases containing information relevant to possible approaches or solutions) to aid in problem resolution. The analyst may follow a predetermined escalation procedure in the event he or she is unable to resolve the problem without assistance from others.

Abstract: The detection of devices with duplicate media access controller (MAC) addresses in a cable network. A cable network device (CND) having a MAC address is connected by the cable network to a cable modem termination system (CMTS) having a gateway interface address. A centralized storage of historical cable modem MAC address/giaddr tuple data is used to identify CNDs that report duplicate MAC addresses. The cable network tracks the CND MAC address/giaddr tuple data of all CND requests that it receives and stores the MAC address/giaddr tuple data into a datastore (such as a database). When a CND seeks to access the network, the cable network looks into the datastore to determine whether the CND MAC address of the CND has previously been stored with a different associated giaddr, which would imply that there are multiple CNDs attached to different CMTSs where the CNDs share the same MAC address. If such duplication is detected, an appropriate remedial response is taken.

Abstract: Methods and systems for controlling access to objects of a distributed computing environment are described. In one configuration, a computing device receives a request from a principal to access a protected object and evaluating the transitive closure of the list of group identifiers. The protected object is associated with an access control list and has a time-invariant list of group identifiers. The list of group identifiers includes the access list is associated with the protected object to identify at least one principal authorized to access the protected object.

Abstract: A storage medium is readable by a computer. The storage medium stores a program of instructions executable by the computer to perform a function for data managing. The function includes: receiving an encryption key from a first user terminal; encrypting the encryption key; issuing a first registration code for the encryption key; registering the encrypted encryption key with the encrypted encryption key associated with the first registration code; sending the first registration code to the first user terminal; and when a second registration code sent from a second user terminal is identical with the first registration code, decrypting the registered and encrypted encryption key and sending the decrypted encryption key to the second user terminal.

Abstract: Disclosed are methods, systems, and computer program products for identifying sensitive data from a user-entered input sequence based on user-defined criteria. According to one method, user-defined criteria for identifying sensitive data within user-entered input sequences that include sensitive data and padding data are received. A request for sensitive data from a requesting agent is presented. A user-entered input sequence that includes sensitive data and padding data is received in response to the request for sensitive data. Sensitive data is identified within the user-entered input sequence using the user-defined criteria. The identified sensitive data is provided to the requesting agent in response to the request for sensitive data.

Abstract: A tape system is provided with an encryption capable tape drive and an encryption enabled tape drive device driver for the encryption capable tape drive. The encryption enabled tape drive device driver functions as a proxy which connects the encryption capable tape drive to a key manager which serves keys to the tape drive. When the encryption capable device driver causes a command to be sent to the drive, the tape drive is configured to respond with a message that is intended for a key manager such as an External Key Manager (EKM). The encryption capable device driver recognizes that this is a message intended for the EKM and forwards that message to the EKM (e.g., via an Internet Protocol (IP) connection). The EKM then responds to the key request by issuing a new key (for a new cartridge which is to be written from beginning of tape (BOT)) or an existing key (for a cartridge which needs to be read).

Abstract: The preferred instance of the present invention is a method and computer program product that specifies an array of elements to be incorporated into a firewall configuration protocol. When added to the configuration protocol, these added attributes allow the existing packet filtering mechanism to accommodate a terminal device that has moved and received a new IP address in a timely and efficient manner.

Abstract: Electronic circuit chips which include cryptography functions are arranged in multichip configurations through the utilization of a shared external memory. Security of the chips is preserved via a handshaking protocol which permits each chip to access limited portions of the memory as defined in a way that preserves the same high security level as the tamper proof chips themselves. The chips may be operated to work on different tasks or to work on the same task thus providing a mechanism for trading off speed versus redundancy where desired.

Abstract: In an array of groups of cryptographic processors, the processors in each group operate together but are securely connected through an external shared memory. The processors in each group include cryptographic engines capable of operating in a pipelined fashion. Instructions in the form of request blocks are supplied to the array in a balanced fashion to assure that the processors are occupied processing instructions.

Abstract: Client adapter and method simplify security deployment in an EPN, including the shared services electrical power lines of a premises. With direct coupling, piggybacked adapter receives network signals and electrical from EPN-connected first adapter through a shared medium port. An authenticating adapter exchanges security management services and information with supplicant adapter. Two or more adapters may be piggybacked. Piggybacked adapters exchange security management service information without rogue intrusion. Exchanged information, stored, is later used to communicate securely. Defined adjacency (neighborhood) information can be exchanged, and a neighborhood established on an EPN, where one authorized neighbors securely communicate.

Abstract: Techniques for securing content in an untrusted environment are provided. Content is encrypted and stored with a content delivery service in an encrypted format. Encrypted versions of a content encryption/decryption key and a first key are also housed and distributed by the content delivery service. The first key is used to decrypt the encrypted version of the content encryption/decryption key. The content delivery service is unaware of the content encryption/decryption key and the first key; and the content held by the content delivery service is encrypted with the content encryption/decryption key. Principals securely share, create, manage, and retrieve the encrypted versions of the content encryption/decryption key and the first key from the content delivery service using secure communications. The encrypted content is obtainable via insecure communications from the content delivery service.

Abstract: An elliptic curve cryptosystem includes process to multiply a scalar value with an elliptic curve point. The processes provide a countermeasure against address-bit attacks. The processes have no correlation between the bit values of a scalar and the addresses of the operands of point addition and doubling operations and therefore provide countermeasures against power attacks.