Abstract: A new system for information sharing is described which uses human judgement to accelerate the flow of information, while simultaneously applying brakes to restrict the velocity. This combination results in a system where information is shared judiciously while minimizing the likelihood of information leakage or information overload. A built in monitor allows for the detection over time of sharing characteristics. Information in this system is stored on a server, however, is optionally encrypted in a fashion that makes it impossible for the server to actually see the information. Further innovations are also described including the ability to overlay incentive mechanisms to facilitate appropriate information sharing, and the notion of introducing automated bots into the system to augment human filter based information sharing.

Abstract: To obtain user approval of network transactions at different levels of security, a network site selects a form in which a transaction with be presented to the user from a group of transaction presentation forms including presentation of the transaction in a browser pop-up window on a user network device, in a security software application window on the user network device, and in a security application window on another user network device. The network site also selects a type of approval of the transaction required from the user from a group of transaction approval types including approval requiring no action by the user after presentation of the transaction, the user to actively approve the presented transaction, and the user to sign the presented transaction. The transaction, the selected transaction presentation form, and the selected type of user transaction approval, are transmitted to obtain approval of the transaction by the user.

Abstract: A portable apparatus is removably and communicatively connectable to a network device to communicate authentication or authorization credentials of a user in connection with the user logging into or entering into a transaction with a network site. The apparatus includes a communications port to connect and disconnect the apparatus to and from the network device and to establish a communication link with the network device when connected thereto. A processor receives a secure message from the network security server via the port. The message has a PIN for authenticating the user to the network site, and is readable only by the apparatus. The processor either transfers, via the port, the received PIN to an application associated with the network site that is executing on the network device or causes the apparatus to display the received PIN for manual transfer to the application associated with the network site.

Abstract: The present invention provides a new method for user centered privacy which works across all 3rd party sites where users post content, or even for encryption of emails. Users have an identity with a Hyde-It Identity provider (HIP) which authenticates the user to a Hyde-It Service (HITS) which performs key distribution. The functionality can be invoked through a user toolbar, built into the browser or be downloaded on demand via a bookmarklet.

Abstract: To obtain user approval of network transactions at different levels of security, a network site selects a form in which a transaction with be presented to the user from a group of transaction presentation forms including presentation of the transaction in a browser pop-up window on a user network device, in a security software application window on the user network device, and in a security application window on another user network device. The network site also selects a type of approval of the transaction required from the user from a group of transaction approval types including approval requiring no action by the user after presentation of the transaction, the user to actively approve the presented transaction, and the user to sign the presented transaction. The transaction, the selected transaction presentation form, and the selected type of user transaction approval, are transmitted to obtain approval of the transaction by the user.

Abstract: A network server is operated so as to facilitate legal eavesdropping by receiving, from the first user via a network, a session key (SK) encrypted with a second user's public key, kpubU2, and the SK encrypted with an escrow server's (ES) public key, kpubES. The kpubU2 key is the public key of the second user asymmetric private/public key pair kpriU2/kpubU2. The kpubES key is the public key of the ES asymmetric private/public key pair kpriES/kpubES. The received SK encrypted with kpubES is stored. The SK encrypted with kpubU2 is transmitted to the second user via the network. A message encrypted with the SK is received from one of the first and the second users via the network, stored, and transmitted to the other of the first and the second users via the network.

Abstract: A new system for information sharing is described which uses human judgement to accelerate the flow of information, while simultaneously applying brakes to restrict the velocity. This combination results in a system where information is shared judiciously while minimizing the likelihood of information leakage or information overload. A built in monitor allows for the detection over time of sharing characteristics. Information in this system is stored on a server, however, is optionally encrypted in a fashion that makes it impossible for the server to actually see the information. Further innovations are also described including the ability to overlay incentive mechanisms to facilitate appropriate information sharing, and the notion of introducing automated bots into the system to augment human filter based information sharing.

Abstract: A new system for information sharing is described which uses human judgement to accelerate the flow of information, while simultaneously applying brakes to restrict the velocity. This combination results in a system where information is shared judiciously while minimizing the likelihood of information leakage or information overload. A built in monitor allows for the detection over time of sharing characteristics. Information in this system is stored on a server, however, is optionally encrypted in a fashion that makes it impossible for the server to actually see the information. Further innovations are also described including the ability to overlay incentive mechanisms to facilitate appropriate information sharing, and the notion of introducing automated bots into the system to augment human filter based information sharing.

Abstract: To authenticate a user of a mobile communication device for login or transaction authorization, a first application on the device directs transmission of a request for authentication of the user to a security server. A second application on the device receives the request for authentication from the security server and directs presentation of the received request for authentication to the user by the device. The second application receives a user input to the device indicating that the requested authentication should proceed and in response directs transmission of an indication that the requested authorization should proceed, to the security server. In response to this latter transmission, the second application receives a PIN from the authentication server. The first application directs transmission of the PIN received by the second application to the network site, which validates the transmitted PIN, in order to authenticate the user or the transaction to the network site.

Abstract: To provide a user signature on a network transaction, a security server receives transaction information representing a transaction between a network user and a network site, such as a website, directly from the network site. The security server calculates a one-time-password based on the received transaction information and a secret shared by the security server and the network site, but not by the user. The security server transmits the calculated one-time-password for application as the user's signature on the transaction. The one-time-password is independently calculable by the network site based on the shared secret.

Abstract: A method for verifying instructions communicated from a user to a relying entity is described. A trusted entity receives a request from the relying entity to verify instructions received from the user wherein the request includes verification information corresponding to the instructions communicated to the relying entity from the user. The trusted entity sends a request to the user to provide verification information corresponding to the instructions. The trusted entity receives the verification information from the user and compares it to the verification information received from the relying entity. The trusted entity then verifies the instructions based on the comparing.

Abstract: To provide a user signature on a network transaction, a security server receives transaction information representing a transaction between a network user and a network site, such as a website. The security server calculates a one-time-password based on the received transaction information and a secret shared by the security server and the network site, but not by the user. The security server transmits the calculated one-time-password for application as the user's signature on the transaction. The one-time-password is independently calculable by the network site based on the shared secret.

Abstract: A portable apparatus is removably and communicatively connectable to a network device to communicate authentication or authorization credentials of a user in connection with the user logging into or entering into a transaction with a network site. The apparatus includes a communications port to connect and disconnect the apparatus to and from the network device and to establish a communication link with the network device when connected thereto. A processor receives a secure message from the network security server via the port. The message has a PIN for authenticating the user to the network site, and is readable only by the apparatus. The processor either transfers, via the port, the received PIN to an application associated with the network site that is executing on the network device or causes the apparatus to display the received PIN for manual transfer to the application associated with the network site.

Abstract: To provide key management layered on a quasi-out-of-band authentication system, a security server receives a request for activation of a user interface window for a particular user from a network device via a communication channel. It then transmits an activation PIN to an out of band authentication system for forwarding to the user's telephone via a voice or text message. It next receives the previously transmitted PIN from the network device via the communication channel, and authenticates the user based on the received PIN. After authenticating the user, it establishes a secure, independent, encrypted communication channel between the user interface window and the security server on top of the original communication channel. It then generates and transmits to the user interface window and/or receives from the user interface window via the secure communication channel, key material and certificate material for public key and/or symmetric key cryptography based operations.

Abstract: To obtain user approval of network transactions at different levels of security, a network site selects a form in which a transaction with be presented to the user from a group of transaction presentation forms including presentation of the transaction in a browser pop-up window on a user network device, in a security software application window on the user network device, and in a security application window on another user network device. The network site also selects a type of approval of the transaction required from the user from a group of transaction approval types including approval requiring no action by the user after presentation of the transaction, the user to actively approve the presented transaction, and the user to sign the presented transaction. The transaction, the selected transaction presentation form, and the selected type of user transaction approval, are transmitted to obtain approval of the transaction by the user.

Abstract: To authenticate a user of a mobile communication device for login or transaction authorization, a first application on the device directs transmission of a request for authentication of the user to a security server. A second application on the device receives the request for authentication from the security server and directs presentation of the received request for authentication to the user by the device. The second application receives a user input to the device indicating that the requested authentication should proceed and in response directs transmission of an indication that the requested authorization should proceed, to the security server. In response to this latter transmission, the second application receives a PIN from the authentication server. The first application directs transmission of the PIN received by the second application to the network site, which validates the transmitted PIN, in order to authenticate the user or the transaction to the network site.

Abstract: To provide key management layered on a quasi-out-of-band authentication system, a security server receives a request for activation of a user interface window for a particular user from a network device via a communication channel. It then transmits an activation PIN to an out of band authentication system for forwarding to the user's telephone via a voice or text message. It next receives the previously transmitted PIN from the network device via the communication channel, and authenticates the user based on the received PIN. After authenticating the user, it establishes a secure, independent, encrypted communication channel between the user interface window and the security server on top of the original communication channel. It then generates and transmits to the user interface window and/or receives from the user interface window via the secure communication channel, key material and certificate material for public key and/or symmetric key cryptography based operations.

Abstract: To notify a person of the availability of electronic billing information, billing information associated with bills of a biller for its customers is stored in a first data store, and identify information identifying unregistered persons having billing information stored in the first data store, is stored in a second data store. Registration information identifying a person who is currently unregistered is received via a wide area network. The received registration information is compared with the identity information stored in the second data store. Based on the comparison, it is determined if the received registration information identifies a customer of the biller. If so, a notice of the availability of the stored billing information of the biller is transmitted to the person via the wide area network.

Abstract: Systems and methods for electronic billing activation are provided. A request on behalf of a payer to activate electronic billing from a biller for the payer is received by a first electronic financial service provider (EFSP) that supports a first of a plurality of electronic financial service networks (EFSNs) from a second EFSP that supports a second of the plurality of EFSNs. Each of the plurality of EFSNs includes a respective plurality of billers or payers, and the biller is associated with the first EFSN and not associated with the second EFSN, while the payer is not associated with the first EFSN. In response to the received request, activation confirmation information is transmitted by the first EFSP to the second EFSP. The electronic billing activation enables subsequent electronic transmission of a bill from the biller for the payer.

Abstract: To notify a person of the availability of electronic billing information, billing information associated with bills of a biller for its customers is stored in a first data store, and identify information identifying unregistered persons having billing information stored in the first data store, is stored in a second data store. Registration information identifying a person who is currently unregistered is received via a wide area network. The received registration information is compared with the identity information stored in the second data store. Based on the comparison, it is determined if the received registration information identifies a customer of the biller. If so, a notice of the availability of the stored billing information of the biller is transmitted to the person via the wide area network.