Abstract: Network demonstration techniques are disclosed which allow a fully-operational, secure wireless network to be implemented at a customer location. Using only a portable authentication server, a laptop computer, and at least two access points, a wireless network can be set up at the customer location within a matter of minutes, so that a user of a portable computing device having an appropriate network interface card is able to roam throughout the customer location with the benefit of a wireless connection to one of the access points. The laptop computer contains software integrating the functionality of a security server, a user authentication database, and other components necessary to implement the wireless network. The user may also be able to communicate with the laptop computer and authentication server from locations external to the customer location, perhaps using a wireless wide area network or secondary wireless local area network.

Abstract: A system daemon starts through normal system startup procedures and reads its configuration file to determine which data entities (e.g., directories and files) are to be monitored. The monitoring includes a valid MD5 signature, correct permissions, ownership of the file, and an existence of the file. If any modification are made to the data entities, then the system daemon generates an alarm (intended for the administrator of the host) that an intrusion has taken place. Once an intrusion is detected, then the isolating steps or commands are issued in a real-time continuous manner to protect the host system from attack or intrusion.

Abstract: A current verification status of a device (256) is identified out of a plurality of predefined verification data input (250) into the device (256) and data prestored within the device.(254) The indicator (272) reveals neither the prestored data nor the verification data. One of the predefined verification statuses is representative of the verification data being the same as the prestored data, and another verification status is representative of the verification data being different from the prestored data. An identified verification status is used by one entity in determining risk regarding an electronic communication from another entity, especially where the electronic communication comprises a request. The prestored data is for a Secret or a biometric characteristic of the first entity.

Abstract: A method of determining an organization's network identity capability. The organization's relationships with its employees, customers and business partners, and the organization's technological infrastructure, are examined. By examining the organization's use of identity data (e.g., data identifying customers, employees), the organization's management of that data, and the technology infrastructure can be redesigned to enable better network identity capability. Improved network identity capability enables users' access to multiple applications or services through a single authentication process (e.g., a single login or sign-on), device-independent access to those applications and services, greater protection for the data, improved business processes and collaborations with business partners, etc.

Abstract: A video system (100) includes a chrominance processing arrangement (200). The chrominance processing arrangement (200) includes a burst accumulator (240) operative to detect a polarity inversion within a burst interval associated with a horizontal line of video information, and generate at least one output signal that compensates for the detected polarity inversion.

Abstract: A system and method of limiting access from an external network to documents stored on an internal network. A client list is built in which each client is assigned to one or more roles. Each role has access to one or more documents as defined on a document list. A request from an external network is reviewed and, if possible, the request is associated with a client on the client list. The requested document is then compared to the document list associated with the client's role and, if the requested document is in the list of documents available to a client in the client's role, the requested document is fetched, cleaned and sent to the client.

Abstract: A key descriptor structure exchanged between a wireless LAN terminal and an access point, and a method and apparatus for cryptographing wireless data are provided. The key descriptor structure includes a key initial vector which is a random number generated in the access point, a key descriptor type which indicates an encryption algorithm, and a plurality of key materials encrypted according to the encryption algorithm of the key descriptor using the key initial vector and a master session key shared between the wireless LAN terminal and the access point as an encryption key.

Abstract: Methods and devices for controlling access to a service over a network are described. A credential is provided to a device. The credential indicates the device is enrolled in the network. The credential is stored in non-volatile memory on the device. The credential binds the device to the network and prevents the device from accessing another network. The device presents the credential to a provider, and the provider uses the credential to authenticate and authorize the device. Upon authorization, the device is provided access to the service.

Abstract: An authentication protocol can be used to establish a secure method of communication between two devices on a network. Once established, the secure communication can be used to authenticate a client through various authentication methods, providing security in environments where intermediate devices cannot be trusted, such as wireless networks, or foreign network access points. Additionally, the caching of session keys and other relevant information can enable the two securely communicating endpoints to quickly resume their communication despite interruptions, such as when one endpoint changes the access point through which it is connected to the network. Also, the secure communication between the two devices can enable users to roam off of their home network, providing a mechanism by which access through foreign networks can be granted, while allowing the foreign network to monitor and control the use of its bandwidth.

Abstract: A method of securing data on an electronic device comprises allowing a user of the device to select one of an encryption and decryption operating mode and an encryption only operating mode. The encryption and decryption operating mode requires that the device have access to a user passphrase, and the encryption only operating mode does not require that the device have access to the passphrase.

Abstract: In a single machine that has entities running in an untrusted environment and entities running in a trusted environment, the trustworthiness of the entities in the trusted environment is projected to the entities in the untrusted environment. This is applicable, for example, to Microsoft®'s Next Generation Secure Computing Base (NGSCB), where a regular operating system (e.g., the Windows® operating system) hosts a secure operating system (e.g., the nexus).

Abstract: A system and method for securely storing electronic documents is provided. The system includes a client portion and a server portion and the client portion is located at a trusted location. The client portion encrypts each electronic document and produces a list of terms of interest relating to the document, which terms are also encrypted. The encrypted document and the encrypted terms are transferred to a server portion which need not be located at a trusted location. The document is stored at the server portion in a manner which allows for locating the document again via the encrypted terms and returning the encrypted document to the trusted client portion, where it can be decrypted. Attachments to documents can also be encrypted and stored at the server, as can copies of dynamic documents, such as web pages. The server portion can also have a retention manager and encryptor which is used to implement document retention and destruction policies defined by the user of the system.

Abstract: Security keys for the provision of a secure service such as content provision are generated in an ancestral hierarchy, so that invalidation of a key in the hierarchy results in a need to reconfigure all other keys in the hierarchy to the extent they share common ancestry. When a user subscription to the service lapses, a decision on invalidation of their key is based in a determination of whether it's more costly to the subscriber to invalidate the key, or continue providing an unpaid-for service. Keys can be allocated to users from domains of the hierarchy on the basis of their economic value to the provider, with higher value users being allocated keys from domains which share fewer common ancestors with other users of other domains than those users share with each other, to minimise inconvenience to high value users of key reconfiguration.

Abstract: A method and device for creating ciphertext from plaintext, and for decoding ciphertext, utilizing a tree structure for both encoding and decoding, the tree having leaves which are associated with plaintext symbols and the branches having assigned thereto a member of the ciphertext alphabet so that when encoding, a traversal is made between the root and the leaf corresponding to the plaintext and recording the ciphertext associated with each branch traversed, and when decoding, using the ciphertext to determine the branches to be traversed until a leaf is reached and recording the plaintext associated with that leaf.

Abstract: A document distributing method is proposed using access control information separated into invisible data embedded as an electronic watermark and visible data described in a structured document to achieve prevention of unauthorized alteration of document data, authentication thereof, and prevention of unauthorized access thereto.

Abstract: A computer-implemented method for enhancing the security of informational interactions with a biometric device is disclosed. The method includes pre-establishing an encryption relationship between a computing device and the biometric device. An instruction is received to begin an authorization or enrollment session. A session packet is generated and encrypted. The session packet is transmitted to the biometric device. A biometric information packet is received and decrypted. A determination is made, based on a content of the decrypted biometric information packet, as to whether or not to utilize a collection of biometric data contained in the decrypted biometric information packet.

Abstract: The present invention discloses an 802.1X protocol-based multicasting control method. According to the method, an authenticated subscriber intercepts the message while sending a request message for joining in a multicasting group, then obtains the port and MAC address information from the intercepted message, searches corresponding subscriber account information from the authenticated data according to said port and MAC address, then authenticates the subscriber's account number and multicasting IP address, and adds the subscriber to the multicasting group after successful authentication; therefore, controlled multicasting, authentication of the legality of adding to multicasting, and accounting can be achieved according to the method, which can also protect existing investment and compatibility with existing software of the subscriber.

Abstract: A title key protection system includes a title key with recordable media content; storage in a repository is not required. The title key is decrypted when needed by a clearinghouse, and then re-encrypted. The title key confers rights from the content owners to the user to play and copy the content for personal use. A user downloads encrypted content from a content repository. The user's media recording device extracts an encrypted title key from the content and obtains a media key block and media ID from the physical media on which the content will be recorded. The encrypted title key, media key block, and media ID are transmitted to a clearinghouse. The clearinghouse decrypts the title key and derives a media unique key from the media key block and media ID. The clearinghouse re-encrypts the title key with the media unique key and returns this re-encrypted title key to the media recording device for recording with the content on the physical media.

Abstract: The invention relates to a method and an arrangement for increasing the security of circuits against unauthorized access, both of which can be used in particular to improve the security of cards, and particularly smart cards, against attacks in which the differential power analysis approach (DPA) is followed. DPA is a procedure that makes it possible to obtain not only purely functional details but also internal information stored in integrated circuits (e.g. smart-card controllers). The majority of non-clocked classes of circuit have the property that the performance of the circuit adjusts automatically to the voltage available. The invention adopts a new approach to enable integrated circuits and particularly non-clocked handshake logic to be protected against DPA. Advantage is taken in this case of a special property of self-timed logic by using a special power supply.

Abstract: Leveraging an established authenticated session in obtaining authentication to a client application includes receiving a request for access to a client application requiring authentication of a requestor and determining whether there exist characteristics of leverageable authentications corresponding to established sessions having an authenticated state at a time of the determination. When the determination reveals characteristics of at least one leverageable authentication corresponding to an established session, and attempt is made to obtain access for the requester to the client application based on the at least one leverageable authentication, and the requestor is provided with a notification related to the attempt to obtain access for the requester to the client application.