Abstract: A tamper evident electronic module comprises an electronic component, a tamper evident sheet, and encapsulant material. Said component is encapsulated in the encapsulant material and the sheet overlies the component, and the sheet comprises a flexible multi-layer sheet, a plurality of the layers of the sheet being selected from the group below: (i) an electromagnetic radiation shield layer; (ii) a tell-tale electrically conductive trip wire defining a convoluted meandering pathway on the layer, the trip wire meandering in a pattern which substantially covers the electronic component in a space filled area if the layer; (iii) a layer having the features of (ii), and in which the pathway comprises a fractual pattern; (iv) a layer having the features of (ii), and in which a second tell-tale trip wire extends alongside a first tell-tale trip wire so that they meander as a spaced pair. (v) an active electromagnetic marking layer adapted to emitt electromagnetic radiation.

Abstract: A distributed storage system for storing at least one credential (46), provided by an issuing authority and relating to an identity (42, 44), is described. The system comprises: a plurality of unique identities (42, 44) each having a local store (40). Each local store (40) securely stores credentials (46) relating to the owner of the identity (42, 44). The system also comprises one or more security certificates (66) provided at each identity (42, 44) for ensuring the authenticity of the credentials (46). The security certificates (66) provide secure references to the issuers of the credentials (46) and this can be used in verifying the origin of each credential (46). The identity can be provided a website or a mobile phone for example.

Abstract: A distributed data processing system includes individual data processing units that automatically communicate with a centralised data management unit in response to information objects being received or accessed by the data processing units. Data associated with information objects is communicated to the data management unit, thereby facilitating the automatic management of the information objects within the system.

Abstract: A mediated RSA cryptographic method and system is provided in which a sender encrypts a message using an encryption exponent e and a public modulus n, and a recipient and a trusted authority cooperate with each other to decrypt the encrypted message by using respective components dU, dT of a decryption exponent. In order to prevent the trusted authority from reading the message in the event that it has access to the recipient decryption exponent components dU, the recipient blinds the encrypted message before passing it to the trusted authority. This blinding is effected by a modulo-n blinding operation using a factor re where r is a secret random number. The trusted authority then applies its decryption exponent component dT to the message and returns the result to the recipient who cancels the blinding and applies its decryption exponent component dU.

Abstract: A security document, comprises a printed document and one or more memory circuits adapted to be read wirelessly attached to or incorporated within the printed document, wherein data in the memory circuit is protected from access by an unauthorised reader, and wherein the memory circuit is physically isolated so as to inhibit physical tampering or to indicate when physical tampering has occurred. Methods of publishing and of reading such security documents are described.

Abstract: A method and apparatus are provided for generating a cryptographic key from multiple data sets each related to a respective association of a trusted party and user identity. The cryptographic key is, for example, one of an encryption key, a decryption key, a signature key and a verification key, and is preferably generated by applying Tate or Weil bilinear mappings to the data sets. At least two of the data sets may relate to different user identities and/or different trusted authorities. Where multiple trusted authorities are involved, these authorities may be associated with different elements to which the bilinear mapping can be applied, each trusted authority having an associated public key formed from its associated element and a secret of that trusted authority.

Abstract: A first party has a first and a second cryptographic key. A second party has a third and a fourth cryptographic key, the fourth cryptographic key being derived from the first and third cryptographic keys thereby providing an association between the parties. To enable a third party to verify the existence of an association between the first and second parties, the second party generates a number that in association with the second cryptographic key, the third cryptographic key and the fourth cryptographic key define a first cryptographic parameter, a second cryptographic parameter and a third cryptographic parameter respectively. By using these parameters and the second and third cryptographic keys, the third party can verify if the first and second parties are associated.

Abstract: A software application to be performed by a second computing resource on behalf of a first computing resource is transmitted to and installed on the second computing resource, and is run thereon using inputs received via a user interface. The software application includes a verification module for creating a sequence of data consisting of a plurality of choice points defining the sequence of events which occurred during the running of the software application. The sequence of data is transmitted to the first computing resource together with the result of the execution of the software application, the first computing resource being adapted to check the sequence of data to determine whether or not the software application was executed correctly.

Abstract: A method and apparatus is provided for securely transferring first and second data from a user to first and second parties respectively. More particularly, the user encrypts the first data using a first encryption key associated with the first party, and then encrypts the second data using, as encryption parameters, both public data of the first party and third data comprising the encrypted first data. The third data is then provided, preferably via the second party, to the first party, and the encrypted second data is provided to the second party. The first party uses a first decryption key to decrypt the encrypted first data, as provided to the first party in the third data, whereby to recover the first data. The first party also uses the third data, along with private data related to the aforesaid public data, to generate a second decryption key which is then provided to the second party to enable it to decrypt the encrypted second data.

Abstract: A long-term digital document storage system, comprising means for receiving one or more digital documents for storage in a storage means, one or more storage sites for storing, in association with the one or more digital documents, metadata defining a data management strategy or “agreement” with respect to the one or more digital documents, the “agreement including one or more “clauses” defining respective constraints to be applied by the storage system to the one or more digital documents, the system further comprising means for configuring the data management strategy or agreement by defining or specifying at least some of the constraints individually according to specific requirements related to said one or more pieces of digital data. As such, the invention is concerned with the fine-grained management of documents within a storage system by the flexible definition and association with a document of a number of clauses (i.e.

Abstract: A computer system comprises a first computer entity arranged to encrypt data using an encryption key comprising a time value, and a second computer entity arranged to generate, at intervals, a decryption key using a current time value. The encryption and decryption processes are such that the decryption key generated using a current time value corresponding to that used for the encryption key, is apt to decrypt the encrypted s data.

Abstract: A method of certifying by a certification authority that two or more first digitally signed certificates or identities are held by the same authorised signatory, the method comprising the steps of determining that said two or more identities or digitally signed certificates refer to the same authorised signatory, creating a digital verification certificate including data relating to said two or more identities or first digitally signed certificates and data representative of evidence or facts used to determine that said two or more identities or digitally signed certificates relate to the same authorised signatory, applying a digital signature of the certification authority to said verification certificate, and linking or otherwise associating said verification certificate to said two or more identities or first digitally signed certificates.

Abstract: A software system for installation on computing apparatus (and a method of installing such a software system on computing apparatus), wherein the software system is provided in the form of a software package (10) including a plurality of software components (12), one or more of the software components (12) being provided as a plurality of different implementations (14), the apparatus including an installation engine (20) for installing the software system only a selected one implementation of the or each of the software components having multiple implementations, and a random selector module (22) for selecting one of the plurality of implementations of a software component for installation.

Abstract: A computer system comprising a trust engine for determining a trust level associated with a computer node and a policy engine for setting access requirements to a personal profile, from the computer node, based upon the determined trust level of the computer node and respective sensitivity levels associated with sub-components of the personal profile.

Abstract: A digital storage system for storing digital documents, the system comprising a trusted storage service provider including an encryption module for encrypting a digital document prior to storage thereof using an encryption key generated using a random number generator, remote archive storage sites for storing the encrypted item of data, and a corporate key store for storing an n-bit decryption key (which maybe the same as the encryption key or maybe different, but mathematically related thereto) for use in decrypting a document if required, the system further comprising a key degrading module for progressively degrading said decryption key by periodically discarding or changing at least one bit at a time thereof.

Abstract: A method for encrypting data comprising deriving a public key using a first data set that defines an instruction; encrypting a second data set with the public key; providing the encrypted third data set to a recipient; providing the public key to a third party such that on satisfaction of the instruction the third party provides an associated private key to the recipient to allow decryption of the encrypted second data set.

Abstract: A method for encrypting data comprising deriving a public key using a first data set provided by a second party; encrypting a second data set with the public key; providing the encrypted third data set to the second party; providing the public key to a third party to allow validation of the first data set such that on validation of the first data set the third party provides an associated private key to the second party to allow decryption of the encrypted second data set.

Abstract: A method for encrypting data comprising dividing a first data set into a second data set and a third data set; deriving a first value using the second data set as an input into a polynomial equation; deriving a second value using the third data set as an input into the polynomial equation; deriving a first encryption key associated with a first party; deriving a second encryption key associated with a second party; encrypting the first value with the first encryption key; encrypting the second value with the second encryption key.

Abstract: A method and apparatus that allows renewal of encoded data in a long-term storage. Original user data 200 is encrypted to form encrypted data 211 which can be accessed using one or more encryption secrets 213 stored separately, and optionally validated using context data 212. At renewal, the encrypted data 211, the context data 212, and the or each encryption secret 213 are combined to form a first encryption layer 210 and the first encryption layer 210 is itself encrypted to form the encrypted data 221 of an immediately succeeding second encryption layer 220. The encrypted data 221 of this second encryption layer 220 is accessible with a renewed encryption secret 223, and optionally is validated by context data 222 such as a time stamp and trusted signature. The method may be repeated recursively, forming third and subsequent encryption layers 230 at each renewal.

Abstract: A tamper-evident and/or tamper-resistant electronic module comprising an electronic component embedded in an encapsulant material and at least one thin sheet of frangible material contacting and overlying said encapsulant material and overlying said component, said sheet being sufficiently thin that it is likely to crack or break if an attempt is made to drill or cut through it with a laser drill.