Abstract: A small program in a browser that a knowledge worker uses to search for content can be activated when the worker wants to determine available rights for a publication that has been found. When activated, the program accesses a rights advisor website that converts the URL of the publication in the browser to standard publication identifiers. The publication identifiers are then used to access a rights database and extract all rights associated with the publication. Based on selected characteristics of the worker and the organization to which the worker belongs, the rights are filtered and placed into a decision tree. The tree is then traversed from its lowest level upward to locate the most favorable rights and the resulting rights are presented to the worker via the browser.

Abstract: Systems and/or methods enabling an individual to digitally sign data using an identifier where the data being digitally signed and the identifier are not accessed at the same location are described. In some cases, the systems and/or methods permit an individual to digitally sign data for an electronic document using an identifier inaccessible by a remote computer where the electronic document is rendered using view information from that remote computer. The systems and/or methods may also enable a network computer to send view information for, and a digital encoding of, an electronic document to a local computer effective to enable the local computer to digitally sign the electronic document by signing the digital encoding of electronic document.

Abstract: A management apparatus reduces the number of pieces of unique information each not generated from another piece of unique information, among unique information being bases of keys assigned to managed apparatuses. The management apparatus calculates, for nodes in layers other than tree structure leaves, subsets of apparatus identifiers subordinate to the nodes, searches for a subset wholly containing another subset in the lowermost layer other than a leaf layer from an immediately-upper layer and mutually associates these subsets, searches for another subset wholly containing the containing subset from a same or an immediately-upper layer and mutually associates these subsets, controls this processing to repeat up to the uppermost layer, controls these processings to repeat on all subsets in the lowermost layer, makes unique information correspond to subsets in the lowermost layer, and makes information derivatively obtained from the unique information correspond to subsets connected due to the associating.

Abstract: A machine-actionable memory comprises one or more machine-actionable records arranged according to a data structure. Such a data structure may include links that respectively map between: a RID field, the contents of which denote an identification (ID) of a remediation (RID); at least one TID field, the contents of which denotes an ID of at least two technologies (TIDs), respectively; and at least one ACTID field, the contents of which denotes an ID of an action (ACTID). A method, of selecting a remediation that is appropriate to a technology present on a machine to be remediated, may include: providing such a machine-actionable memory; and indexing into the memory using a given RID value and a given TID value to determine values of the at-least-one ACTID corresponding to the given RID value and appropriate to the given TID value.

Abstract: A computer-implemented method of providing security for an application running on a messaging based operating system is provided. The method includes obtaining a first message from a message queue for the application. Then, it is determined whether the first message is of a type registered by the application as being a potential security threat. Next, the first message is processed based upon the determination of whether it is of a type registered by the application as being a potential security threat. Security framework and application program embodiments are also provided.

Abstract: The present invention is directed to a distributed architecture of an information handling system, including a buried nucleus inaccessible for inspection without heroic means while the buried nucleus is in operation, and a trusted authority for generating a secure protocol. The secure protocol controls the operation of the buried nucleus.

Abstract: Various systems, methods, and programs embodied in computer-readable mediums are provided for digital authentication using digitally signed images. In one representative embodiment, a method includes extracting a first image portion from an image selected by a first party, where the first image portion including a first encoded part of an second party digital signature, and obtaining a second image portion associated with the first image portion, where the second image portion including a second encoded part of the second party digital signature. The first and second encoded parts of the second party digital signature are decoded and validity of the second party digital signature is confirmed based upon a second party public key.

Abstract: Embodiments of the disclosure provide systems, methods, and computer readable instructions for non-repudiation communications, including provisions for non-repudiation of the identities of the sender and receiver, non-repudiation of the information sent and the information received, the time that various portions of the transaction or communication occurred, and other parameters associated therewith. Embodiments of the disclosure can be readily implemented in conjunction with public key systems to advantageously provide complete non-repudiation of origin and delivery of digital data.

Abstract: A multimodal system that employs a plurality of sensing modalities which can be processed concurrently to increase confidence in connection with authentication. The multimodal system and/or set of various devices can provide several points of information entry in connection with authentication. Authentication can be improved, for example, by combining face recognition, biometrics, speech recognition, handwriting recognition, gait recognition, retina scan, thumb/hand prints, or subsets thereof. Additionally, portable multimodal devices (e.g., a smartphone) can be used as credit cards, and authentication in connection with such use can mitigate unauthorized transactions.

Abstract: A protocol framework for a Secure IP Access (SIA) method, and supporting components deployed on IP hosts and IP networks. Using this method, an IP host can establish a secure data channel within an IP network over an insecure shared link while requesting IP address and networking configuration parameters from the IP network. A system administrator can implement strong access control against various attacks that an edge IP network may have to face, such as a denial-of-service attack that exhausts assignable IP addresses. This is a lightweight, scalable, and backward-compatible solution that can improve security performance for public and corporate LANs having open access such as wireless access points and Ethernet jacks.

Abstract: An electronic certificate issuance system comprising at least one communication device, and an electronic certificate issuing device for issuing a set of an electronic certificate and a private key corresponding to the electronic certificate as a certification set for each of the at least one communication device, is provided. The electronic certificate issuing device includes a first connecting interface, an obtaining system, which is adapted to obtain a node ID assigned to each of the at least one communication device, a generating system, and a writing system. The at least one communication device includes a second connecting interface, a judging system, and an installing system.

Abstract: Disclosed are a method and system for managing access to and verifying personal identity. A person is provided with a private key that uniquely identifies that person, and that person uses the private key to access an identity manager. The person then uses the identity manager to specify a desire to establish a business relationship with a business entity. The user can then contact that business entity. The business entity is provided with a private key that uniquely identifies the business entity. That business entity then receives a request to conduct business with the entity from a person alleging to have the personal identity. The business entity then accesses the identity manager using the private key, and that entity then determines if a person having the personal identity has used the identity manager to specify a desire to conduct business with the business entity.

Abstract: A system-on-a-chip (SoC) to process digital audio-video content includes one or more input/output (I/O) interfaces to transmit the digital audio-video content to corresponding I/O devices coupled to the SoC and to receive the digital audio-video content from the corresponding I/O devices. The SoC also includes a cryptographic engine to encrypt the digital audio-video content being transmitted via the I/O interfaces to the corresponding I/O devices and to decrypt the digital audio-video content received via the I/O interfaces from the corresponding I/O devices.

Abstract: An information recording device uses a data storage device such as media having a built-in flash memory. When data is stored in the data storage device, different encryption keys are used for different sectors. Each encryption key is stored in the header of content. By using a single encryption key for a sector consisting of different blocks, the number of stored encryption keys is limited, and the amount of stored key data is reduced. In accordance with the type of encryption processing, for example, the single DES or the triple DES, one or at least two keys are selected for each sector in order to execute encryption or decryption processing on sector data.

Abstract: A method of identifying material which includes the step of inserting an identifying code into a signal as a watermark, and deriving a signature from the material. The code and signature are stored in a database. The watermarked signal may be distributed and/or transmitted through a network. The signal may be processed in the network. A monitor derives from the received signal, the signature and the code. The derived signature and the derived code are compared with the stored signature and code to check the provenance of the material. The watermark contains an authorization code allowing duplication of the material.

Abstract: An information recording medium contains a semiconductor memory as a storage device for storing data and having plural areas to be managed by mutually independent file systems, an area information storage for storing information about size and position of each area of the semiconductor memory, a host interface for receiving a command for setting each area size of the semiconductor memory from an accessing device, and an area size setter for setting the size and position of each area of the semiconductor memory. The area size setter sets the area size of each area in the semiconductor memory based on the specified setting condition according to the command received from the accessing device.

Abstract: Methods and systems for reducing the spread of malware in communication between an instant message (IM) client and an IM server are described. An IM filter module (IM FM) is configured to examine incoming messages from an IM server to an IM client and outgoing messages from the IM client to the IM server. The IM filter module is further configured to analyze relationship among the incoming and outgoing messages and determine whether one or more messages contain malware based on the analysis of relationship among the incoming and outgoing messages.

Abstract: A method of identifying material comprises the step of inserting an identifying code into a signal as a watermark, and deriving a signature from the material. The code and signature are stored in a database. The watermarked signal may be distributed and/or transmitted through a network. The signal may be processed in the network. A monitor derives from the received signal, the signature and the code. They are compared with the stored signature and code to check the provenance of the material.

Abstract: A system includes hosts that may be infected with mobile logic. One type of mobile logic is a worm, which can be a process that is capable of causing a (possibly evolved) copy of itself to execute on one or more hosts of the system. An infected host of the system can infect other hosts based on criteria, such as targeting, visibility, vulnerability, or infectability of the other hosts. A worm can be represented as a Turing Machine whose state can be determined using computational methods. A worm can be emulated in the system to determine worm detection capabilities of the system. Emulating the worm can allow the system to be tested with less negative impact than using the actual worm.

Abstract: A device for locating a DES key value that corresponds to a packet identification (PID) contained at a variable possible location which comprises part only of a 32-bit packet header. A table stored in memory contains for each DES key: (i) a packet header having 32 bits with a PID of either 12, 9 or 8 bits contained at a defined location and with zero values elsewhere, and (ii) a mask value also having 32 bits with ones contained at the said defined location of the PID and zeros elsewhere. The table is divided into regions for respective packet format types. An incoming packet header at an input is combined with a first one of the mask values from the table to provide a combined value that consists of the value held in the input packet header at the defined location and zeros elsewhere. This combined value is compared with the corresponding packet header stored in the table. When they are not equal, the combining and comparison is repeated for the next row of the table.