Abstract: Methods and apparatus are presented for providing local authentication of subscribers travelling outside their home systems. A subscriber identification token 230 provides authentication support by generating a signature 370 based upon a key that is held secret from a mobile unit 220. A mobile unit 220 that is programmed to wrongfully retain keys from a subscriber identification token 230 after a subscriber has removed his or her token is prevented from subsequently accessing the subscriber's account.

Abstract: Another feature provides an efficient encryption method that safeguards the security of encrypted symbols. Each plaintext symbol is encrypted by using a separate pseudorandomly selected translation table. Rather than pre-storing every possible permutation of symbols as translation tables, the translation tables may be efficiently generated on-the-fly based on a pseudorandom number arid a symbol shuffling algorithm. A receiving device may similarly generate reverse translation tables on-the-fly to decrypt received encrypted symbols.

Abstract: Methods and apparatus are presented for encrypting and authenticating data, wherein some data is encrypted and some data is not encrypted, but all of the data is authenticated. Masking modules (410) are used in a partial-block encryption mode to indicate which bits of a data block are to be encrypted.

Abstract: Apparatus and method are disclosed for digital authentication and verification. In one embodiment, authentication involves storing a cryptographic key and a look up table (LUT), generating an access code using the cryptographic key; generating multiple parallel BPSK symbols based upon the access code; converting the BPSK symbols into multiple tones encoded with the access code using the LUT; and outputting the multiple tones encoded with the access code for authentication. In another embodiment, verification involves receiving multiple tones encoded with an access code; generating multiple parallel BPSK symbols from the multiple tones; converting the BPSK symbols into an encoded interleaved bit stream of the access code; de-interleaving the encoded interleaved bit stream; and recovering the access code from the encoded de-interleaved bit stream.

Abstract: In a disclosed embodiment, a visitor location register first initializes an assignment table to store N entries. Next, the visitor location register waits until a TMSI assignment is needed. Then, a counter is maintained in memory and is incremented. The value of the counter is then hashed to produce an assignment table index. Beginning at the assignment table index, the assignment table is searched for an available entry. The counter is then encrypted to produce a TMSI. The IMSI corresponding to the TMSI assignment is then stored in the assignment table.

Abstract: A hand-held token can be operated to generate an acoustic signal representing the digital signature generated by a private key of a public key/private key pair. Verifiers that might be located at, e.g. buildings, in vehicles, at bank ATMs, etc. receive the signal and retrieve the corresponding public key to selectively grant access authorization to components served by the verifiers. Methods and systems permit adding and removing a token from the access list of a verifier. Other methods and systems enable the token to be used with several verifiers that are nearby each other, such as might be the case with multiple vehicles owned by the same user and parked nearby each other, without more than one verifier being operated to grant access.

Abstract: Apparatus and method are disclosed for digital authentication and verification. In one embodiment, authentication involves storing a cryptographic key and a look up table (LUT), generating an access code using the cryptographic key; generating multiple parallel BPSK symbols based upon the access code; converting the BPSK symbols into multiple tones encoded with the access code using the LUT; and outputting the multiple tones encoded with the access code for authentication. In another embodiment, verification involves receiving multiple tones encoded with an access code; generating multiple parallel BPSK symbols from the multiple tones; converting the BPSK symbols into an encoded interleaved bit stream of the access code; de-interleaving the encoded interleaved bit stream; and recovering the access code from the encoded de-interleaved bit stream.

Abstract: Systems and methods of securing wireless communications between a network and a subscriber station are disclosed. One embodiment creates authentication triplets due to expire after a certain amount of time such that they may not be used indefinitely by an attacker who intercepts them.

Abstract: A method for constructing keyed integer permutations over the set ZN. where N can be factored into p and q, or N can be prime. N bits are permuted by deriving a keyed permutation of representative indices. When N is factorable into p and q, the set of indices are divided into two portions. The portions undergo iterative processing called “rounds,” and in each round, a first half-round function operates on the first portion to form a first half-round value; the first half-round value and the second portion are added together by a modulo-p adder to form a first output value; a second half-round function operates on the second portion to form a second half-round value; and the second half-round value and the first portion are added together by a modulo-q adder to form a second output value. In this manner, outputs of the rounds are reordered. If N is prime and not less than 13, then N is separated into composite values s and t, and two sets are formed with s and t elements, respectively.

Abstract: Method and apparatus for secure transmissions. Each user is provided a registration key. A long-time updated broadcast key is encrypted using the registration key and provided periodically to a user. A short-time updated key is encrypted using the broadcast key. The short-time key is available with each broadcast message, wherein sufficient information to calculate the short-time key is provided in an Internet protocol header preceding the broadcast content. Broadcasts are then encrypted using the short-time key, wherein the user decrypts the broadcast message using the short-time key.

Abstract: A visual authentication scheme for websites is provided that binds an image to a website so that a user can by visually authenticate whether he/she is viewing an intended/trusted website. An authentication or cryptographic key (associated with a web page) is rendered as a unique key-identifying image or unique sequence of images. This key-identifying image(s) is then displayed to the user. The user associates this key-identifying image with the originator or source of the web page so that the user can easily recognize the originator by glancing at the key-identifying image. The association between the key-identifying image and the cryptographic/authentication key (and thereby the source of the web page) can be achieved similarly to brand awareness.

Abstract: Methods and apparatus are presented for encrypting and authenticating data, wherein some data is encrypted and some data is not encrypted, but all of the data is authenticated. Masking modules (410) are used in a partial-block encryption mode to indicate which bits of a data block are to be encrypted.

Abstract: A process and device for uniquely identifying an Internet enabled device with a unique identification. The process can include receiving an identification when an Internet user accesses an Internet resource, and determining position-based information for at least one of an Internet user and an Internet enabled device based on the identification. The identification may be authenticated, to reduce fraud. The identification may further be used to determine whether or not the device is in a particular geographic area of interest.

Abstract: A hand-held token can be operated to generate an acoustic signal representing the digital signature generated by a private key of a public key/private key pair. Verifiers that might be located at, e.g., buildings, in vehicles, at bank ATMs, etc. receive the signal and retrieve the corresponding public key to selectively grant access authorization to components served by the verifiers. Methods and systems permit adding and removing a token from the access list of a verifier. Other methods and systems enable the token to be used with several verifiers that are nearby each other, such as might be the case with multiple vehicles owned by the same user and parked nearby each other, without more than one verifier being operated to grant access.

Abstract: A small form-factor security device is provided that may be inserted in series with a telephone line to encrypt dual tone multi-frequency (DTMF) tones from a telephone to prevent unauthorized disclosure of sensitive information. A receiving device decrypts the encrypted DTMF tones to receive the original information sent by the telephone. The security device acts as a second factor in a two-factor authentication scheme with a tele-services security server that authenticates the security device.

Abstract: Prior to transmission, a message is divided into multiple transmission units. A sub-message authentication code is obtained for each of the transmission units. A composed message authentication code is obtained for the whole message based on the sub-message authentication codes of the multiple transmission units. The multiple transmission units and the composed message authentication code are then transmitted. A receiver of the message receives a plurality of transmission units corresponding to the message. A local sub-message authentication code is calculated by the receiver for each transmission unit. A local composed message authentication code is calculated by the receiver based on the local sub-message authentication codes for the plurality of transmission units. The local composed message authentication code is compared to a received composed message authentication code to determine the integrity and/or authenticity of the received message.

Abstract: A method for permitting encrypted communications between two stations which are operable with encryption algorithms that accept encryption keys having work factors with different values, by: in a first determining step, determining the lower one of the different values; providing an initial encryption key having a first work factor value; comparing the first work factor value with the lower one of the work factors determined in the determining step; when, in the comparing step, the first work factor value is greater than the lower one of the work factor values determined in the determining step, performing the following steps: performing a first hash function on the initial encryption key to produce a first output, and deriving from the first output a first intermediate key having a work factor value not greater than the lower one of the different work factor values determined in the determining step; performing the first hash function on the first intermediate key to produce a second output, and deriving fro

Abstract: A stream stretcher is provided for securely expanding a key stream to match fee length of a data block to be encrypted and/or decrypted. A key stream is obtained having a length of LZ bits. A length LD corresponding, to a data block to be encrypted/decrypted is obtained, where LD>LZ. LD?LZ new bits are recursively generated by combining at least two bits of the key stream. The LD?LZ new bits are appended to the key stream to generate a stretched key stream. The data block may then be encrypted/decrypted with the stretched key stream. The at least two bits are selected to have offsets that form a full positive difference set.

Abstract: Method and apparatus for secure transmissions. Each user is provided a registration key. A long-time updated broadcast key is encrypted using the registration key and provided periodically to a user. A short-time updated key is encrypted using the broadcast key. The short-time key is available with each broadcast message, wherein sufficient information to calculate the short-time key is provided in an Internet protocol header preceding the broadcast content. Broadcasts are then encrypted using the short-time key, wherein the user decrypts the broadcast message using the short-time key.

Abstract: Methods and apparatus are presented for secure, authenticated communication and data storage. The methods can be based on other methods such as IAPM, in which the encryption and authentication keys are of the same strength. In the HR-IAPM mode, a sender encrypts the data as in the IAPM mode using two encryption keys K0 and K1. The sender then XORs the plaintexts with corresponding ciphertexts, and combines the results to form a checksum This checksum is encrypted under the authentication key K2, this value is appended to the encrypted message as a message authentication code (MAC). The receiver decrypts as with IAPM, XORs the plaintexts with the corresponding ciphertexts and combines these values to form a checksum. The receiver then encrypts the checksum under the authentication key K2 and verifies that the resulting value agrees with the MAC. The HR mode allows blocks to be sent un-encrypted if desired.