Abstract: A system for loading application identifiers to a mobile device includes a mobile device, a card device insertable into the mobile device, and an application center. The card device is adapted to determine an effective mobile device identifier of the mobile device, and transmit the effective mobile device identifier to the application center. The effective mobile device identifier is based at least in part on the result of a process performed by the card device. The application center is adapted to (1) determine zero or more allotted application identifiers and zero or more application identifiers of applications loaded on the mobile device based at least in part on the effective mobile device identifier, (2) identify at least one application identifier of the zero or more allotted application identifiers which does not form part of the zero or more application identifiers of applications loaded on the mobile device, and (3) load the at least one application identifier to the mobile device.

Abstract: Access to digital content may be controlled by determining a digital content specification and associated authenticated rights locker access request, sending the authenticated rights locker access request and the digital content specification, and receiving a new authenticated rights locker access request and a Web page with clickable links in response to the sending, where at least one of the clickable links is associated with an authenticated digital content request. When an indication of a user selection of one of the clickable links is received, an authenticated digital content request associated with the user-selected clickable link is sent to a digital content repository. The digital content is received in response to the sending of the authenticated digital content request.

Abstract: A method for managing identification in a data communications network includes receiving a user-controlled secure storage device and enrolling the user with an authority network site. The enrolling includes providing information requested by the authority network site. The method also includes receiving user data in response to the enrolling, storing the user data in the user-controlled secure storage device, enabling the user-controlled secure storage device to release the user data and using the user data at a service provider network site to obtain a service.

Abstract: Executing an obfuscated application program comprises receiving an application program comprising application program instructions and application program data, determining an application program instruction location permutation to apply to a current instruction counter value, determining an application program data location permutation to apply to a current data location counter value, receiving the current instruction counter value, and applying the application program instruction location permutation to the current instruction counter value to obtain a reference to an application program instruction in an instruction stream to execute. If the application program instruction references application program data, the application program data location permutation is applied to data referenced by the application program instruction to obtain a reference to data to access. The data to access is interleaved with application program instructions in the instruction stream.

Abstract: Obfuscating an application program comprises reading an application program comprising code, transforming the application program code into transformed application program code that uses one of multiple opcode value encoding schemes of a dispatch table associated with the application program, and sending the transformed application program code. Executing an obfuscated application program comprises receiving an obfuscated application program comprising at least one instruction opcode value encoded using one of multiple instruction set opcode value encoding schemes, determining a dispatch table associated with the application program, and executing the application program using the associated dispatch table. The dispatch table corresponds to the one of multiple instruction set opcode value encoding schemes.

Abstract: A method of exchanging a series of communication primitives during one or more communication sessions between two or more communication units is provided. In one embodiment, the method includes providing a first communication primitive including at least a first destination ID identifying at least a first communication unit as a receiver of the first communication primitive. The method also includes providing first data in the first communication primitive that reflects a first return destination ID identifying at least a second communication unit as a sender of the first communication primitive. Further, using the first data, a second destination ID is determined that is included in a second communication primitive sent from the first communication unit to the second communication unit.

Abstract: Access to digital content may be controlled by determining digital content to be made accessible via a rights locker describing a user's access rights for digital content associated with the rights locker, determining enrollment authentication data, and sending a rights locker enrollment request to a rights locker provider, where the rights locker enrollment request comprises a digital content request and the enrollment authentication data. An authenticated rights locker access request is received in response to the sending, where the authenticated rights locker access request is for subsequent use in accessing digital content associated with the rights locker.

Abstract: Access to digital content may be controlled by receiving a rights locker enrollment request from a user device associated with a user, where the rights locker enrollment request comprises a digital content request and enrollment authentication data. A determination of whether the user is authorized comprises determining the rights of the user to access the rights locker and the rights of the user to digital content specified by the digital content request. If the user is authorized, the rights locker is initialized with rights to the digital content. If a first token used to create the authenticated rights locker access request has been fully redeemed, a new token that authenticates future access to a rights locker corresponding to the digital content is obtained. An authenticated rights locker access request that is based at least in part on the new token is created and then sent.

Abstract: An application identifier (AID) for an application installed on a smart card comprises a registered application provider identifier (RID). The AID may be processed by determining the RID for an application from the AID of the application, generating an identifier for a network resource from the RID, transmitting a request to the network resource using the identifier, and receiving a response to the request. The response comprises material for use in handling the application on the smart card.

Abstract: Obfuscating an application program comprises reading a first application program, determining an application program instruction location permutation that transforms the first application program into an obfuscated application program having at least one application program instruction stored at a memory location that is based at least in part on a permutation of the memory location where the corresponding application program instruction is stored in the first application program, applying the application program instruction location permutation to the first application program to create an obfuscated application program, and sending the obfuscated application program.

Abstract: Obfuscating an application program comprises reading an application program comprising code, determining multiple dispatch tables associated with the application program, transforming the application program into application program code configured to utilize the dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value, and sending the application program code.

Abstract: Verification of a software program may be automated by receiving a program source file comprising program source code and at least one formal specification annotation, extracting the at least one formal specification annotation from the program source file, compiling the program source code and linking the compiled program and the at least one extracted formal specification annotation to create an executable program that includes at least one reference to an executable formal specification module. According to one aspect, a virtual machine includes a target virtual machine for executing one or more program implementation instructions, and a formal virtual machine for executing one or more formal specification modules corresponding to one or more program implementation instructions and configured to call a formal specification module, and to compare a first result obtained by executing the program implementation instructions with a second result obtained by the call to the formal specification module.

Abstract: A method for enhanced privacy protection in identification in a data communications network includes enrolling for a service on the data communications network, receiving a randomized identifier (ID) in response to the enrolling, storing the randomized ID and using the randomized ID to obtain services on the data communications network. An apparatus for obtaining a service on a data communications network includes an enrollment authority configured to accept an enrollment request. The enrollment authority is further configured to return enrollment results in response to the enrollment request. The enrollment results include user data and the enrollment results may be used obtaining a service from a service provider.

Abstract: A smart card contains potentially multiple applications, each containing an application identifier (AID). Each application also incorporates an AID interpreter for providing access to the AID. This is achieved by making a request to the AID interpreter to provide the AID for the application. In response, the AID interpreter retrieves a first component of the AID. This first component is logically internal to the AID interpreter. The AID interpreter also retrieves a second component of the AID. This second component is logically external to the AID interpreter and is indicative of a state relevant to the application, such as a current balance in the card. The first and second components of the AID are then combined in order to generate the AID for providing in response to the request.

Abstract: An application identifier (AID) comprises at least one customization parameter for an application to be installed onto a smart card. The application may be installed onto the smart card by providing the AID, instantiating the application onto the smart card, storing the AID onto the card, and configuring the application in accordance with the stored AID, wherein the application is configured in accordance with the at least one customization parameter.

Abstract: Where there are potentially two or more applications installed on a smart card, with each application having a stored application identifier (AID), a desired application may be selected by specifying a desired application in terms of multiple parameters, retrieving multiple parameters from a stored AID for an application on the smart card, and comparing the specified multiple parameters with the retrieved multiple parameters to determine whether there is a match.

Abstract: A method for enhanced quality of identification in a data communications network includes obtaining a user identifier that includes an identification server ID and an identification randomized ID. The identification server ID identifies an identification server peer group. The identification server peer group includes at least one server that maintains a mapping between an identification randomized ID and a user authentication peer group capable of authenticating a user associated with a particular randomized ID, and a mapping between the identification randomized ID and user information. The method also includes requesting authorization of the user by presenting the user identifier to a corresponding identification server peer group. Each server in the identification server peer group is configured to search for one or more matching entries including the randomized ID.

Abstract: A card device for communication with an electronic device comprises a memory for storing a capabilities list associated with an application program. The capabilities list comprises information regarding access to one or more resources for use by the application program. The memory is also for storing the application program and a security manager. The card device comprises a processing unit for executing the application program and the security manager, for selectively granting access to the one or more resources for use by the application program based at least in part on the capabilities list.

Abstract: Verification of a software program may be automated by receiving a program source file comprising program source code and at least one formal specification annotation, extracting the at least one formal specification annotation from the program source file, compiling the program source code and linking the compiled program and the at least one extracted formal specification annotation to create an executable program that includes at least one reference to an executable formal specification module. According to one aspect, a virtual machine includes a target virtual machine for executing one or more program implementation instructions, and a formal virtual machine for executing one or more formal specification modules corresponding to one or more program implementation instructions and configured to call a formal specification module, and to compare a first result obtained by executing the program implementation instructions with a second result obtained by the call to the formal specification module.

Abstract: Access to digital content may be controlled by determining digital content to be made accessible via a rights locker describing a user's access rights for digital content associated with the rights locker, determining enrollment authentication data, and sending a rights locker enrollment request to a rights locker provider, where the rights locker enrollment request comprises a digital content request and the enrollment authentication data. An authenticated rights locker access request is received in response to the sending, where the authenticated rights locker access request is for subsequent use in accessing digital content associated with the rights locker.