Abstract: A cuvette (10) for storing a biological sample to be analyzed by means of a predefined detection technique is disclosed. The cuvette (10) is formed from a moldable material that contains particles (15a, 15b) at a concentration within a predefined range. The particles (15a, 15b) are randomly distributed, in order to form a unique pattern. Moreover, the particles (15a, 15b) have measurable physical properties, so that the unique pattern is detectable using the detection technique that is used to analyze the biological sample. The unique properties obtained by the randomly distributed particles (15a, 15b) render copying nearly impossible, since it is more complicated to distribute the particles in a predetermined pattern than to let them distribute randomly.

Abstract: A method of authenticating a device and a user comprises receiving a user input, generating a first key from the user input, performing a physical measurement of the device, obtaining helper data for the device, computing a second key from the physical measurement and the helper data, and performing an operation using the first and second keys. In a preferred embodiment, the method comprises performing a defined function on the first and second keys to obtain a third key. Additionally security can be provided by the step of receiving a user input comprising performing a biometric measurement of the user and the step of generating a first key from the user input comprises obtaining helper data for the user and computing the first key from the biometric measurement and the user helper data.

Abstract: The present invention relates to a method, a device and a system for preventing unauthorized introduction of content items in a network containing compliant devices and enabling users in the network to be anonymous. A basic idea of the present invention is to provide a CA (206) with a fingerprint of a content item to be introduced in a network at which the CA is arranged. Further, the CA is provided with an identifier of a content introducer (201), which introduces the particular content item in the network. The CA compares the fingerprint to a predetermined set of fingerprints, and content item intro?duction is allowed if the content item fingerprint cannot be found among the fingerprints comprised in the set. On introduction of the content item, the CA generates a pseudonym for the content introducer and creates a signed content ID certificate comprising at least said fingerprint and a unique content identifier for the content item and the pseudonym of the content introducer.

Abstract: This invention relates to a method of healthcare data handling by a trusted agent possessing or having an access to decryption keys for accessing healthcare data. A request is received from a requestor requesting accessing healthcare data. A log is generated containing data relating to the request or the requestor or both. Finally, the requestor is provided with an access to the healthcare data.

Abstract: The invention uses the concept of identity-based encryption in the context of data-centric protection of electronic health records, where each data item is encrypted by using its own identifier as a public key. The corresponding decryption keys are managed by special trusted entities, which distribute the keys to authorized parties and provide logging facilities. This approach has the particular advantage that emergency access mechanisms can 5 be implemented in a secure and extremely efficient way. In contrast to previous approaches, it requires no large-scale distribution of secret decryption keys. Furthermore, the scheme allows limiting the impact of a compromised decryption key, as one key can only be used to decrypt one single document.

Abstract: To overcome the drawback of difficulties when interchanging a patient's health record among different health information management systems and yet keep the patient's privacy, this invention proposes a method comprising the steps of: extracting, from a certificate, a signature of a first service provider and a first identifier; generating a second identifier corresponding to the first identifier; sending a request to any one of a second identifier manager and the first service provider so as to request a record associated with the first identifier; receiving the requested record from any one of the second identifier manager and the first service provider; and associating the requested record with the second identifier.

Abstract: This invention relates to a system and a method for providing a measure of reliability on a first set of health data (102) on a patient (103) provided by a data provider. An assigner (105) is used for assigning at least one first rating element to the first set of health data or the data provider. A reputation-indicator (106) uses the at least one first rating element as input data in determining a first reputation measure indicating the reliability of the data provider. A comparer (107) then compares the determined first reputation measure with a pre-defined reputation threshold measure, the reputation threshold measure being a measure of a pre-set reliability level of the data provider.

Abstract: A system, device and method for keeping the identity of a user secret, while managing requests for information, in an information distribution system. The identity of the user is kept secret by the use of a persistent pseudonym and a temporary pseudonym, which are associated with a user identity device. The process of information distribution is enhanced by the use of licenses and certificates, which the user obtains by representing himself with the permanent pseudonym. When accessing the requested information, the user is represented by the temporary pseudonym.

Abstract: A method and device for making pre-scheduled recordings of broadcasted content in a recording device, comprising receiving (step S2) a scheduled recording request with a privacy setting from an authenticated user, determining (step S3) that said requested scheduled recording conflicts with a previously scheduled recording, communicating (step S5) a request to a remote receiver to record content according to the scheduled recording that is found to be in conflict with previously scheduled recordings, receiving (step S6) said recorded content from said remote receiver, storing said recorded content, and controlling access to the stored content based on said privacy setting. According to the invention, a network of recording devices are used to avoid conflicts. Instead of dealing with increased security and privacy of recording schedules when a conflict arises on a device, the present invention aims at making more recording resources available, thus reducing the risk for a conflict.

Abstract: A user interface and a processor coupled to the user interface wherein the processor receives access requests through the user interface and authorizes access through the user interface. The processor associates a rights request with a role based policy to determine access rights, modifies the determined access rights in accordance with an exception list related to particular users and records, and authorizes access to a record based upon the modified determined access rights.

Abstract: An apparatus for recording a signal having a signal content, where the apparatus comprises a receiver for receiving the signal, a processor configured to determine rights to the signal content received with the received signal, and a recorder for recording the received signal and a signal representing the determined rights to the signal content, wherein the processor is configured to give, to right holders, individual rights to the content respecting the determined rights to the content. A user who receives the signal can give individual rights to right holders respecting the rights to the content. The given rights comprise full rights and restricted rights such as owner rights corresponding to the rights to the content received with the received signal, and user rights that allow the right holder to use, such as view, the signal content. Use of the individual rights requires a corresponding individual key.

Abstract: A hierarchical tree structure is used to facilitate the communication of encrypted keys to particular users having access to the tree. All users are in communication with a root node, but the information content of the material at the root node is decipherable only by the intended users of this information. Protected data is encrypted using a variety of data-keys specific to the data. These data-keys are encrypted using a combination of node-keys that are specific to particular users or groups of users. Users having access to the node-key associated with a particular encrypted data-key are able to decipher the data associated with the data-key; users without access to the particular node-key are unable to decrypt the data-key, and thus unable to decipher the data. The hierarchical tree is preferably structured based on a similarity of access rights among users, to minimize the overhead associated with providing user-specific access rights.

Abstract: A system and method for transferring licenses from a first user to one or several other users in an information distribution system, while providing privacy for said users. The level of privacy is enhanced by the license format and the use of a master license, an anonymous license and by the inclusion of a revocation lists in the certificate corresponding to a license.

Abstract: The present invention relates to a method and a device of enabling inheritance of a digital content item. There is provided a method and a device by which inheritance of a digital content item is enabled by means of acquiring an inheritance license for an encrypted digital content item. The inheritance license specifies operations that are allowed to be performed on the content item after the death of its proprietor. Further, a death certificate of the proprietor of the encrypted content item is accessed, wherein authorization is given to perform at least a subset of the operations specified in the inheritance license on the encrypted content item.

Abstract: The present invention relates to a method, a device and a system for preventing unauthorized introduction of content items in a network containing compliant devices and enabling users in the network to be anonymous. A basic idea of the present invention is to provide a CA (206) with a fingerprint of a content item to be introduced in a network at which the CA is arranged. Further, the CA is provided with an identifier of a content introducer (201), which introduces the particular content item in the network. The CA compares the fingerprint to a predetermined set of fingerprints, and content item intro duction is allowed if the content itemfingerprint cannot be found among the fingerprints comprised in the set. On introduction of the content item, the CA generates a pseudonym for the content introducer and creates a signed content ID certificate comprising at least said fingerprint and a unique content identifier for the content item and the pseudonym of the content introducer.

Abstract: This invention relates to a method of processing rights relating to content, that can be communicated between devices. Typically, a Digital Rights Management (DRM) system imposes limitations of use and distribution, imposed by the service provider, content provider or distributor. The method of the invention renders it possible for a user who has received DRM rights to restrict the right further. The invention is more particularly related to the receipt of DRM rights to Authorized Domain Digital Rights Management (AD-DRM) systems and the introduction of user attributed rights in the form of further restrictions introduced to the received DRM rights. The invention further relates to a Rights Program Template (RPT) facilitating the introduction of such further restrictions in a user friendly way. Finally, the invention relates to a system supporting the method of the invention.