Abstract: It is described a RFID device (231a, 231b, 231c, 331) comprising a data memory (236) and an electronic circuit arrangement (237, 238, 239, 247) coupled thereto. The electronic circuit arrangement has a first and a second operational configuration, wherein by receiving a control command (250a) the electronic circuit arrangement can be switched irreversibly from the first to the second configuration. The RFID device further comprises a communication interface (245) being coupled to the electronic circuit arrangement. In the first configuration the RFID device is adapted to communicate with a standard RFID reader (110) via the communication interface. In the second configuration the communication with the standard RFID reader is disabled and the RFID device is adapted to communicate with a readout-RFID device (370). The RFID device may be equipped with a secondary communication interface that can be used to communicate with the RFID device in a privacy-preserving manner.

Abstract: A user interface and a processor coupled to the user interface wherein the processor receives access requests through the user interface and authorizes access through the user interface. The processor associates a rights request with a role based policy to determine access rights, modifies the determined access rights in accordance with an exception list related to particular users and records, and authorizes access to a record based upon the modified determined access rights.

Abstract: A method is presented for enabling authentication of a prover in a Radio Frequency Identification system comprising the prover and a verifier, the method comprising the steps of: the prover sending a prover identifier and a parent identifier to the verifier, the verifier sending a verifier identifier to the prover, the prover calculating a first common secret by means of a prover polynomial, where an unknown in the prover polynomial is substituted by a result calculated using a function of at least the verifier identifier, and the verifier calculating the first common secret by means of a first verifier polynomial, wherein a first unknown in the first verifier polynomial is substituted by the prover identifier and a second unknown in the first verifier polynomial is substituted by the parent identifier, the prover creating a first message by modulating a first core secret with regard to at least the first common secret, aid prover sending the first message to the verifier, and the verifier creating a first ca

Abstract: A method for controlling data access to and from an RFID device wherein the RFID reading device authenticates himself to the RFID device before the RFID device communicates with the RFID reading device. The RFID device is equipped with a physically uncloneable function, which is adapted to produce a unique but unpredictable response signal upon receiving a predefined challenging signal. During an enrolement of the RFID device, a first response signal is uniquely associated with a first challenging signal and is stored in a memory of the RFID device. The first challenging signal represents a password for opening further data communication with the RFID device. When a RFID reading device queries the RFID device with a second challenging signal, the RFID device compares a corresponding second response signal with the first response signal stored during enrollment and only if there is a match, responds with its identifier.

Abstract: The present invention relates to a method of authenticating an individual (321) at an authenticating device (311) and an authenticating system for authenticating an individual. A basic idea of the present invention is to store, at a device or a system with which an individual wishes to authenticate herself, one or more data structures each comprising a value based on an identifier pertaining to the individual and an encrypted copy of the identifier. When the individual wants to authenticate herself, she contacts the authenticating device whereby a request is made to attain the encrypted identifier included in a specific data structure stored at the authenticating device. The individual subsequently provides proof to the authenticating device that she actually knows the identifier.

Abstract: The present invention relates to a method, a device and a system for preventing unauthorized introduction of content items in a network containing compliant devices and enabling users in the network to be anonymous. A basic idea of the present invention is to provide a CA (206) with a fingerprint of a content item to be introduced in a network at which the CA is arranged. Further, the CA is provided with an identifier of a content introducer (201), which introduces the particular content item in the network. The CA compares the fingerprint to a predetermined set of fingerprints, and content item intro?duction is allowed if the content item fingerprint cannot be found among the fingerprints comprised in the set. On introduction of the content item, the CA generates a pseudonym for the content introducer and creates a signed content ID certificate comprising at least said fingerprint and a unique content identifier for the content item and the pseudonym of the content introducer.

Abstract: It is described a method for controlling data access to and from an RFID device (230). Thereby, an RFID reading device (210b) authenticates himself to the RFID device (230) before the RFID device (230) communicates with the RFID reading device (210b). The RFID device (230) is equipped with a physically uncloneable function (237), which is adapted to produce a unique but unpredictable response signal (R1, R2) upon receiving a predefined challenging signal (C1, C2). During an enrolment of the RFID device a first response signal (R1) being uniquely associated with a first challenging signal (C1) is stored in a memory (238) of the RFID device (230). The first challenging signal (C1) represents a password for opening further data communication with the RFID device (230).

Abstract: It is described a RFID device (231a, 231b, 231c, 331) comprising a data memory (236) and an electronic circuit arrangement (237, 238, 239, 247) coupled thereto. The electronic circuit arrangement has a first and a second operational configuration, wherein by receiving a control command (250a) the electronic circuit arrangement can be switched irreversibly from the first to the second configuration. The RFID device further comprises a communication interface (245) being coupled to the electronic circuit arrangement. In the first configuration the RFID device is adapted to communicate with a standard RFID reader (110) via the communication interface. In the second configuration the communication with the standard RFID reader is disabled and the RFID device is adapted to communicate with a readout-RFID device (370). The RFID device may be equipped with a secondary communication interface that can be used to communicate with the RFID device in a privacy-preserving manner.

Abstract: A system for secure communication of a message from a first terminal to a second terminal being operatively coupled by means of a communication network comprising an authenticating station for obtaining a random seed and for obtaining a masked seed by applying a masking function to the seed by encrypting the message using the masked seed for transmitting the seed and the encrypted message to the authenticating station; the authenticating station comprising further means for obtaining a further random seed for receiving the seed and the encrypted message for recovering the further masked seed by applying the masking function to the seed by decrypting the encrypted message using the recovered masked seed and by applying a masking function to the further seed by encrypting the recovered message using the further masked seed for transmitting the further seed and the further encrypted message to the second terminal; the second terminal comprising receiving means for receiving the further seed and the further encry

Abstract: A system, device and method for keeping the identity of a user secret, while managing requests for information, in an information distribution system. The identity of the user is kept secret by the use of a persistent pseudonym and a temporary pseudonym, which are associated with a user identity device. The process of information distribution is enhanced by the use of licenses and certificates, which the user obtains by representing himself with the permanent pseudonym. When accessing the requested information, the user is represented by the temporary pseudonym.

Abstract: A method is presented for enabling authentication of a prover in a Radio Frequency Identification system comprising the prover and a verifier, the method comprising the steps of: the prover sending a prover identifier and a parent identifier to the verifier, the verifier sending a verifier identifier to the prover, the prover calculating a first common secret by means of a prover polynomial, where an unknown in the prover polynomial is substituted by a result calculated using a function of at least the verifier identifier, and the verifier calculating the first common secret by means of a first verifier polynomial, wherein a first unknown in the first verifier polynomial is substituted by the prover identifier and a second unknown in the first verifier polynomial is substituted by the parent identifier, the prover creating a first message by modulating a first core secret with regard to at least the first common secret, aid prover sending the first message to the verifier, and the verifier creating a first ca

Abstract: A system and method for transferring licenses from a first user to one or several other users in an information distribution system, while providing privacy for said users. The level of privacy is enhanced by the license format and the use of a master license, an anonymous license and by the inclusion of a revocation lists in the certificate corresponding to a license.

Abstract: The present invention relates to a method, a device and a system for preventing unauthorized introduction of content items in a network containing compliant devices and enabling users in the network to be anonymous. A basic idea of the present invention is to provide a CA (206) with a fingerprint of a content item to be introduced in a network at which the CA is arranged. Further, the CA is provided with an identifier of a content introducer (201), which introduces the particular content item in the network. The CA compares the fingerprint to a predetermined set of fingerprints, and content item intro duction is allowed if the content itemfingerprint cannot be found among the fingerprints comprised in the set. On introduction of the content item, the CA generates a pseudonym for the content introducer and creates a signed content ID certificate comprising at least said fingerprint and a unique content identifier for the content item and the pseudonym of the content introducer.

Abstract: The invention proposes a method to provide privacy for users or a user from a group of users with respect to authorizations they are granted, where such authorizations are expressed using digital authorization certificates, and with respect to domain certificates in case of groups of users. The idea is to conceal the user identity in the certificates, while the certificate itself remains in the clear. In this way, certificates can be widely and openly available, e.g. in a public network, without a random observer being able to link a user to an authorization or to identify a user within a domain. Privacy is also provided towards the certificate verifier by means of zero-knowledge protocols, which are carried out between the user and the verifier in order for the verifier to check a user's entitlement to a certificate. Privacy is further provided towards the certificate issuer as well, by means of a mechanism that allows the anonymous (buying or) issuing of certificates from the issuer.

Abstract: A method of and system for providing a user profile, comprising user profile maintenance means for maintaining the user profile, visualization means for representing a content item visually as an icon and representing the user profile as a corresponding shape comprising at least one icon representing a content item, and consistency guarding means for guarding the consistency between the user profile and the corresponding shape. The consistency is guarded by changing the corresponding shape in dependence on a change in the user profile, and/or by changing the user profile in dependence on a manipulation of the corresponding shape.

Abstract: A method of and system (100) for providing a user profile, comprising user profile maintenance means (110) for maintaining the user profile, visualization means (120) for representing a content item visually as an icon (101) and representing the user profile as a corresponding shape (102) comprising at least one icon (101) representing a content item, and consistency guarding means (130) for guarding the consistency between the user profile and the corresponding shape (102). The consistency is guarded by changing the corresponding shape (102) in dependence on a change in the user profile, and/or by changing the user profile in dependence on a manipulation of the corresponding shape (102).