Abstract: A method, system, computer program product, and method of doing business by providing a provable chain of evidence for data stream(s) created by one or more components (such as input/output devices and application processing components). Components that create the evidence collection are authenticated. A unique identifier of each such component is included within cryptographically-protected information that is added to the evidence collection. A digital signature is preferably used for the cryptographic protection, thereby digitally notarizing the evidence collection. The authenticity and integrity of the evidence collection can be verified. In preferred embodiments, the authenticated identities of components providing the evidence can also be determined from the cryptographically-protected information.

Abstract: A method, system, computer program product, and method of doing business by improving the security of transactions performed using smart cards, and also a card with an integrated biometric sensor. The disclosed techniques also improve the security of transactions carried out with devices such as personal or “pervasive computing” devices. Biometric sensors are used for obtaining identifying information from users of smart cards. In one aspect, this may be done by securely attaching a smart card reader and a biometric sensor to a security core which authenticates these devices using public key infrastructure techniques, and which securely controls information exchanged with these devices. In another aspect, this is done by integrating a biometric sensor with a smart card.

Abstract: A method, system, computer program product, and method of doing business by improving security of a computing device. Continuous authentication of a user of the computing device, which may be (for example) a portable or personal computing device (also known as a “pervasive computing device”), is performed. The disclosed techniques also improve the security of operations or transactions carried out with such computing devices. Biometric sensors are preferably used for obtaining identifying information from users of computing devices, and this obtained information is compared to previously-stored biometric information which identifies the legitimate owner of the device. If the information matches, then it can be assumed that this user is the device owner, and a security-sensitive transaction is allowed to proceed so long as the biometric input is uninterrupted.

Abstract: A multinode, multicast communications network has a distributed control for the creation, administration and operational mode selection operative in each of the nodes of the network. Each node is provided with a Set Manager for controlling either creation of, administration or access to a set of users to whom a multicast is to be directed. The Set Manager maintains a record of the local membership of all users associated with the node in which the Set Manager resides. A given Set Manager for each designated set of users is assigned the task of being the Set Leader to maintain membership information about the entire set of users in the multicast group. One of the Set Managers in the communications network is designated to be the Registrar which maintains a list of all the Set Leaders in the network. The Registrar insures that there is one and only one Set Leader for each set of users, answers inquiries about the membership of the sets and directs inquiries to appropriate Set Leaders if necessary.

Abstract: Method and apparatus for managing internal-node communications in a packet switching network by calculating optimal routes for packets and addressing subnodes within packet nodes using a specific message format. Internal communication facilities called intranode links connect multiple subnodes within nodes. Each subnode contains a switching mechanism and routes packet to other nodes, subnodes, or user applications using a specific message format. The message format allows specific subnodes anywhere in the network to the addressed by any other subnode, making communications more efficient and simplifying the management of internode links.

Abstract: Method and apparatus for making limited internal-node communication facilities externally visible in a packet switching network. Internal-node communication facilities are called intranode links, can include any cable, channel, bus, etc. over which data passes, and are used to connect the multiple subnodes within a given node. Each subnode contains a switching mechanism and routes packets to other nodes, subnodes, or user applications. Each node provides network control functions such as topology, directory, path selection, and bandwidth management which can manage intranode links in the same manner that internode links are currently managed.

Abstract: Access agents in nodes at the LAN/WAN interface are formed into a group of access agents so that the access agents may be managed by the WAN as a group. The group must maintain group operation integrity in that if communications between agents in the group are broken, the access agents will coalesce into subgroups and continue performing communication jobs as a group activity. Each of the access agents contains a finite state machine to perform the tasks of group formation and maintenance. The formation of interconnected access agents into a group is accomplished by one access agent being identified as a group leader. All other access agents communicating with the group leader within the LAN may then join the group. The maintenance of group activity integrity is accomplished by detecting a break in group communication integrity and thereafter reforming the group into multiple smaller groups.

Abstract: In a multicast network communication system, administration of the communication path making up the multicast tree itself has been separated from control and administration of the network. Creation of a multicast distribution tree and control over the membership thereof, is separately controlled independently from the creation and use of the tree transmission path used to communicate among the members of a multicast set. Transmission distribution trees are set up when a transmission request is received and the properties of the transmission path that is required are known. Transmission paths are created and controlled by all nodes in the communications system, each node having necessary control code and processors for responding to requests from set members to transmit a message to groups of users by creating and activating the necessary tree communication path distribution linkages. A distribution tree is created by the Tree Leader by generating a tree address using a random number generator.