Abstract: A video recording apparatus includes an illumination apparatus applying a modulated illumination light, a control apparatus controlling the illumination apparatus, an imaging apparatus imaging the illumination light and an object at the same time to generate video data; and a storage apparatus storing the video data generated by the imaging apparatus. The control apparatus generates encrypted data by using at least a portion of the video data imaged by the imaging apparatus and encryption information generated as information changing in accordance with a date and time and used for encryption and controls the illumination apparatus such that the illumination light is modulated by the generated encrypted data.

Abstract: Systems and method are provided for using chaotic signals for low probability of detection (LPD) communications. Embodiments of the present disclosure provide systems and methods for synchronizing chaotic systems and then encoding information on a signal in a way that produces little or no signature (e.g., using a bit flipping technique or a chaos control encoding technique). Systems and methods in accordance with embodiments of the present disclosure can work with noise larger than the signal, so they are suitable for communication in noisy environments.

Abstract: A signal processing method, and a transmitter and a receiver are disclosed. The signal processing method may include converting a transmission signal to a non-periodic sequence type transmission signal using periodic sequences and transmitting the non-periodic sequence type transmission signal to the receiver, in which the receiver may detect a burst from the received non-periodic sequence type transmission signal.

Abstract: A method for securing communications for a given network is provided. The method comprises by at least one node(i) of the network configured to utilize pairwise keys: generating a set of encryption keys; and transmitting the set of encryption keys to a controller for the network; by the controller, executing a key selection process wherein for each node(j) in the network an encryption key J is selected from the set of encryption keys; assigning the encryption key J to the node(j); and transmitting the selected encryption key J to the node(j); by each node(j), generating an encryption key I for the node(i); and sending the encryption key I to the node(i) via the controller.

Abstract: Methods and systems for securely accessing content irrespective of the security of the environment in which the content is being accessed are described herein. In some embodiments, a mobile computing device may determine whether secure enterprise content is being accessed on a mobile computing device. In response to determining that a private user device (e.g., virtual reality or augmented reality headwear/eyewear), is communicatively coupled to the mobile computing device, the mobile computing device may prevent the secure content from display on the mobile computing device and instead generate the secure enterprise content for presentation in an unencrypted form on the private user device.

Abstract: A method of communicating in a secure communication system, comprises the steps of assembling a message at a sender, then determining a security level, and including an indication of the security level in a header of the message. The message is then sent to a recipient.

Abstract: A method of communicating in a secure communication system, comprises the steps of assembling a message at a sender, then determining a security level, and including an indication of the security level in a header of the message. The message is then sent to a recipient.

Abstract: A data stream with a given data rate is distributed into a plurality of virtual lanes or streams, each with a lower data rate than the data stream. Virtual lanes permit the use of lower cost electronics at the optical-electrical conversion points. Security information is generated that includes a unique initialization vector. The security information is distributed or allocated across some or all of the of the virtual data streams in a virtual lane alignment marker in a portion of the alignment marker used to maintain direct current (DC) transmission balance, but that otherwise does not provide useful information.

Abstract: A cryptanalysis method comprising: (A) Performing a ciphertext-only direct cryptanalysis of A5/1 and (B) Using results of Step (A) to facilitate the decryption and/or encryption of further communications that are consistent with encryption using the session key and/or decryption using the session key, wherein the cryptanalysis considers part of the bits of the session key to have a known fixed value, and wherein the cryptanalysis finds the session key. An efficient known plaintext attack on AS/2 comprises trying all the possible values for R4, and for each such value solving the linearized system of equations that describe the output; The solution of the equations gives the internal state of RI, R2, and R3; Together with R4, this gives the full internal state which gives a suggestion for the key.

Abstract: Private information can be displayed using alternate frame sequencing to prevent unauthorized viewing. The private information can be ascertained by an authorized user using an active shutter viewing device synchronized to the alternate frame sequencing display. Private information can be displayed on a portion of the display, while public information, including a basic user interface, can be displayed on a second portion visible to authorized and unauthorized users. For enhanced security, alternate frame sequencing synchronization parameters can be encrypted and exchanged between a display device and the viewing device. When and where to display private information using alternate frame sequencing can be determined using environmental sensors. A single display screen can be configured to simultaneously present private information to multiple users, each user permitted to view a portion of the private information according to the unique synchronization parameters employed by a user's viewing device.

Abstract: A key recovery request for a device is received at a key recovery service and a particular one-time recovery credential in a sequence of multiple one-time recovery credentials is identified. In the sequence of multiple one-time recovery credentials, previous one-time recovery credentials in the sequence are indeterminable given subsequent one-time recovery credentials in the sequence. A recovery key associated with the device is also identified. The particular one-time recovery credential in the sequence is generated based on the recovery key, and is returned in response to the key recovery request. The particular one-time recovery credential can then be used by the device to decrypt encrypted data stored on a storage media of the device.

Abstract: A method of transmitting messages from a sender to a recipient over a wireless channel, the messages including a sequence counter and a frame counter. The method comprises establishing initial values of the sequence counter and the frame counter at the sender. Initial values of the frame counter and the sequence counter are provided to the recipient. The sender sends compressed messages including the value of the sequence counter and not the frame counter and monitors for an acknowledgement of receipt by the recipient. When no acknowledgment is received, the sender sends uncompressed messages until an acknowledgement of receipt is received from the recipient. The sequence counter is incremented and the next value of the frame counter is established as the integer next larger than previous value of the frame counter which is congruent to the sequence counter modulo 256.

Abstract: Apparatus and method for synchronizing encryption keys among a cluster of security appliances and stand alone lifetime key management, LKM, appliances. The cluster includes security appliances where new encryption keys are generated and assigned to an SNS ID with an SNS CTR (counter). The security appliances inside a cluster have local sequence counters and share their keys. One security appliance is a coordinator with which the LKMs will synchronize. Each LKM also has a SNS ID and local sequence counter from which increasing sequence numbers are generated. In each security appliance in a cluster, the up-to-date stored sets of keys are organized with respect to SNS IDs and SNS CTRs associated with the other cluster members. The object keys are stored in the SNS space and a peer map associates a given peer with a given SNS ID, and version numbers are assigned and incremented when a key is modified.

Abstract: The invention provides a method of recovering from de-synchronization attacks includes registering original and altered digital content using nonlinear transformations to iteratively attempt to provide better-approximated registration. Approximation occurs at more than one level of granularity, by selecting among a greater number of possible transformation functions at each step. Transformations and comparisons might be conducted directly on pixel values, on coefficients for a set of basis wavelets, or on some transformation of the original and altered digital content. A human operator might assist this process, such as by suggesting transformations or providing evaluation of the degree of registration. Upon resynchronization, embedded identifying information in the original digital content is recovered.

Abstract: Nodes of a network are each provided with a seed value and a seed identifier. Each seed value has a corresponding unique seed identifier which is maintained within the system. Within each authorized node, the seed value is combined with a local node identifier, such as a serial number or other unique identifier, to form a cryptographic key that is then used by the node to encrypt and/or decrypt data transmitted and received by that node. The cryptographic key is never transmitted over the network, and each node is able to create a different cryptographic key for use in communicating with other nodes.

Abstract: In an embodiment, a method for generating and distributing keys retains the scalability of a group VPN, but also provides true pair-wise keying such that an attacker who compromises one of the devices in a VPN cannot use the keys gained by that compromise to decrypt the packets from the other gateways in the VPN, or spoof one of the communicating gateways. The method is resistant to collusion when co-operating attackers overtake several VPN gateways and observe the keys stored in those gateways. In an embodiment, a VPN gateway comprises a cryptographic data processor configured to encrypt and to decrypt data packets; group key management logic; and Key Generation System logic. In one approach a gateway performs, in relation to adding a group member, receiving in a security association (SA) message secret data for use in the KGS; and derives keys for secure communication with one or more peer VPN gateways using the secret data.

Abstract: A telephone system comprising switching circuitry configured for coupling a call to a telephone extension coupled to the system, voice processing circuitry configured for automatically interacting with the call, a microprocessor, a first data bus connected between the microprocessor and the switching circuitry, and a second data bus connected between the microprocessor and the voice processing circuitry.

Abstract: A system for transferring verified media data. The system comprising: an item of content storing the media data, and having an associated serial number; a computing device including a first storage device and a network interface; a secure copying application program; a secure copy of the media data generated by the secure copying application program and stored on the first storage device; a verification server including a serial number database and having a network connection to the computing device through the network interface, wherein the secure copying application program generates the secure copy after verifying the serial number is valid and active by communicating with the verification server; and a portable copy of the media data, including license information, generated from the secure copy by the secure copying application program.

Abstract: A network component comprising at least one processor configured to implement a method comprising deriving a Master Session Key (MSK) using a secret key and at least one parameter obtained from an Extensible Authentication Protocol (EAP) sequence, deriving a first Pairwise Master Key (PMK) and a second PMK from the MSK, authenticating with a home gateway (HG) using the first PMK, and authenticating with an end point using the second PMK. Included is an apparatus comprising a node comprising an access controller (AC) and a protocol for carrying authentication for network access (PANA) Authentication Agent (PAA), wherein the AC is configured to manage authentication for a UE, and wherein the PAA is configured to implement a PANA to forward authentication information related to the UE.

Abstract: A method for improving the security of secret authentication data during authentication transactions is provided that includes converting the secret authentication data of a user into scrambled secret authentication data by associating a different text-string with each item of information included in the secret authentication data. The method also includes capturing the scrambled secret authentication data with a communications device, and conducting an authentication transaction with the captured authentication data.

Abstract: An encrypted program received in an MPEG transport stream is decrypted by receiving an address in the MPEG transport stream, reading a key from a memory in accordance with the received address, and decrypting the encrypted program based on the key.

Abstract: Methods for increasing encryption synchronization availability include collecting encryption synchronization data from a first superframe received at a gateway. The encryption synchronization data is for decrypting media in a second superframe also received at the gateway. The encryption synchronization data from the first superframe is used to form a composite encryption synchronization codeword for decrypting media in a third superframe formed by the gateway, wherein the third superframe includes the composite encryption synchronization codeword and at least a portion of the media from the second superframe. The third superframe is sent to a receiving device so that media in the third superframe can be decrypted by the receiving device using the composite encryption synchronization codeword that is included in the same superframe as the media that is being decrypted.

Abstract: Some embodiments of the invention provide a content-distribution system for distributing content under a variety of different basis. For instance, in some embodiments, the content-distribution system distributes device-restricted content and device-unrestricted content. Device-restricted content is content that can only be played on devices that the system associates with the particular user. Device-unrestricted content is content that can be played on any device without any restrictions. However, for at least one operation or service other than playback, device-unrestricted content has to be authenticated before this operation or service can be performed on the content. In some embodiments, the system facilitates this authentication by specifying a verification parameter for a piece of device-unrestricted content.

Abstract: In a transmitter, data is encrypted by use of a data key, the data key is encrypted based on a first modification key, and the first modification key is encrypted based on a second modification key such that the first and second modification keys are different keys. The encrypted data, the encrypted data key, and the encrypted first modification key are transmitted to a receiver. In the receiver, the encrypted first modification key, the encrypted data key, and the encrypted data are received from the transmitter. The encrypted first modification key is decrypted based on the second modification key, the encrypted data key is decrypted based on the decrypted first modification key, and the encrypted data is decrypted by use of the decrypted data key.

Abstract: A cryptographic system (500) that includes a data stream receiving device (502) configured for receiving a modified data stream representing data entries encrypted using a chaotic sequence of digits. The system also includes user processing device (503, 505) configured for receiving user access information specifying an initial value for the chaotic sequence of digits and data field location information associated with selected ones of the data entries. The system further includes a synchronized pair of chaotic sequence generators (300) coupled to the user processing devices configured for generating encryption and decryption sequences based on the initial value and the data field location information. The system additionally includes an encryption device (504) and a decryption device (506) coupled to the chaotic sequence generators and the data stream receiving device, the decrypter configured for generating an output data stream from the modified data stream by applying the decryption sequences.

Abstract: A cryptanalysis method comprising: (A) Performing a ciphertext-only direct cryptanalysis of A5/1 and (B) Using results of Step (A) to facilitate the decryption and/or encryption of further communications that are consistent with encryption using the session key and/or decryption using the session key, wherein the cryptanalysis considers part of the bits of the session key to have a known fixed value, and wherein the cryptanalysis finds the session key. An efficient known plaintext attack on AS/2 comprises trying all the possible values for R4, and for each such value solving the linearized system of equations that describe the output; The solution of the equations gives the internal state of RI, R2, and R3; Together with R4, this gives the full internal state which gives a suggestion for the key.

Abstract: The disclosed is a method for synchronization of the running key that is generated from a shared key and that is used for encryption and decryption in communications encrypted with the shared key using a multi-valued signal. In the method for synchronization, the transmitting node transmits a signal that is formed of a multi-valued signal and that has a predetermined fixed pattern before transmitting data encrypted with the shared key. The receiving node generates a bit discrimination threshold signal that allows for bit discrimination and that has a fixed length, shifts bit by bit the phase of the bit discrimination threshold signal while monitoring bit discrimination with respect to a fixed pattern signal that is to be received, and sets the phase of the bit discrimination threshold signal when the phase of the fixed pattern signal matches the phase of the bit discrimination threshold signal.

Abstract: This invention relates to a method for broadcasting digital data to a targeted set of reception terminals in which said data are previously scrambled by a series of control words transmitted in a conditional access control message. This method comprises the following steps: on transmission, particularise said access control message using a reversible function F for which the inverse function F?1 is executable only in terminals in the targeted set, and on reception, redetermine the original access control message in each terminal in the targeted set using said inverse function.

Abstract: A controlling device provides conditional access to secured content renderable by an appliance. The controlling device transmits a data frame to the appliance and encrypts at least a part of the data frame that includes data to be used by the appliance to provide access to the secured content. At the appliance a decryption key complimentary to the encryption key is used to decrypt the received the data frame. The appliance allows the secured content to be rendered only after the appliance determines that the data in the received, decrypted data frame includes the data the appliance requires to provide access to the secured content.

Abstract: Accountability among Autonomous Systems (ASs) in a network ensures reliable identification of various customers within the ASs and provides defensibility against malicious customers within the ASs. In one implementation, reliable identification is achieved by implementing ingress filtering on data packets originating within individual ASs and defensibility is provided by filtering data packets on request. To facilitate on-request filtering, individual ASs are equipped with a Filter Request Server (FRS) to filter data packets from certain customers identified in a filter request. Thus, when a requesting customer makes a filter request against an offending customer, the FRS within the AS to which the offending customer belongs conducts on-request filtering and installs an on-request filter on a first-hop network infrastructure device for the offending customer. Consequently, the first-hop network infrastructure device filters any data packet sent from the offending customer to the requesting customer.

Abstract: The present invention provides systems and methods for securing communications in a wireless network by utilizing the inherent randomness of propagation errors to enable legitimate users to dynamically create a shared symmetric secret key. In one embodiment, the invention provides a system with two computers each having a wireless network adapter. The sending node encodes the frames, transmits the frames, determines if the frames were correctly received, retransmits the frames if they were not correctly received, stores the frames that were not retransmitted, and uses the stored frames to generate a secret key. The receiving node receives the encoded frames, determines if the frames were retransmitted, stores at least one of the frames that was not retransmitted, and uses the stored frames to generate the same secret key as the receiving node.

Abstract: One embodiment involves encrypting an MPEG transport stream by seeding a random number generator with a seed derived from at least a portion of the MPEG transport stream to produce a random number output. At least one program key and at least one modification key are generated from the random number output. At least portions of the MPEG transport stream are encrypted with the program key. At least one stored key is modified according to the modification key to produce a message segment key. The program key and the modification key are encrypted with the message segment key. The encrypted MPEG transport stream, the encrypted program key, and the encrypted modification key are multiplexed to form a multiplexed output.

Abstract: A method for provisioning a mobile communications device comprises sending a registration request for registration with a registration server, the registration request including a request for a personal information number; receiving a response from the registration server, the response including the personal information number; sending a provisioning request to a network node, the request including the personal information number and at least one device identifier associated with the mobile communications device; receiving a response from the network node, the response including a URL and a session ID based upon the personal information number and the at least one device identifier associated with the mobile communications device; and launching an application on the mobile communication device to establish a communication session between the mobile communication device and a provisioning system.

Abstract: A method and system is provided for encrypting an image compressed with a JPEG2000-based compression with minimal overhead so that the encrypted codestream is compliant with the syntax of the JPEG2000-based compression and can be scaled without decrypting. The encryption system generates, for each independent encryption segment of a codestream for an image, a unique initialization vector from a global initialization vector in such a way that the initialization vectors can be generated during decryption from the global initialization vector, even after truncation. The encryption system encrypts each independent encryption segment using its unique initialization vector. The encryption system ensures that the encrypted codestream is compliant with the syntax of the JPEG2000-based compression both as originally generated and as truncated by an encryption-unaware device.

Abstract: The use of keys to encrypt data in a transmitter and to decrypt encrypted data in a receiver are synchronized in accordance with a synchronization signal that opportunistically replaces a null packet in an MPEG transport stream. Additionally or alternatively, key related information is transmitted and/or received in place of a null packet in the MPEG transport stream and is used to encrypt and/or decrypt data transmitted and/or received in the MPEG transport stream.

Abstract: Aspects of the invention provide a method and system for coding information in a communication channel. More particularly, aspects of the invention provide an method and system for synchronous running encryption and/or encoding and corresponding decryption and decoding in a communication channel or link. Aspects of the method may include encoding and/or encrypting a first data using a first or second encoding table and/or a first or second encryption table. The method may indicate which one of the first or second encoding tables or which one of the first or second encryption tables were utilized for encoding and/or encrypting the said first data. The encoded and/or encrypted first data may subsequently be transferred downstream and decoded by synchronous decoder/decryptor using a corresponding decoding and/or decryption table.

Abstract: In a cellular interception system, an information processing method for converting information of several cellular-network wireless messages from a first encrypted format under a session key, where each message is encrypted by a cellular ciphering algorithm chosen out of a collection of one or more cellular ciphering algorithms under the session key, to a second unencrypted format comprising: (A) divide the messages in the first format into two sets; the first set containing messages encrypted under the same encryption algorithm, and a second set containing the remaining messages. (B) subject the messages in the first set to a ciphertext-only cryptanalysis of a cellular encryption algorithm to recover the session key. (C) for each message in the second set, subject the message together with the recovered session key to the corresponding cellular ciphering algorithm to receive the message's information in the second format.

Abstract: Systems for instant messaging private tags preferably comprise a parser for parsing an instant message for sensitive data and an encryption engine for encrypting the sensitive data. A modified uuencoder is also preferably included for converting the encrypted sensitive data into a data stream that complies with an XML format. Other systems and methods are also provided.

Abstract: Systems and methods of determining the content of frames transmitted on a wireless network through comparison of captured frames to predetermined statistical patterns.

Abstract: A method and system for encrypting a video compressed with MPEG-4 FGS compression with minimal overhead is provided. The encryption system encrypts the video into independently encrypted segments that can be either a video packet or a video block. When the encryption system encrypts based on video packets, it encrypts the data to ensure that the encrypted data does not emulate any video packet delimiting markers. When the encryption system encrypts based on video blocks, it encrypts the coded bitstream for each video block independently, from the most significant bitplane to the least significant bitplane, using either a stream or a block cipher. After all the video blocks are independently encrypted, the encryption system partitions the encrypted data into video packets and adds a buffering bit, if necessary, to prevent emulation of video packet delimiting markers. The encryption system may generate an initialization vector for each independently encrypted segment.

Abstract: Systems and methods are disclosed for enabling encryptor devices to provide real-time messages having offset cryptoperiods according to an offset algorithm within common crypto-sync pulse boundaries. A master clock aligns the encryptor devices to a common crypto-sync pulse. Subsequently, a cryptoperiod offset aligner assigns a different offset value according to an algorithm to each encrypted service. The corresponding encryptor device then begins the cryptoperiod, during which real-time messages are transmitted, at the assigned offset value from the common crypto-sync pulse.

Abstract: Systems for customizing the privatizing of instant messages preferably comprise a processing device configured to detect a marking of select portions of an instant message as sensitive data. The instant message is parsed for marked sensitive data. An encryption engine encrypts the sensitive data. A modified unencoder is also preferably included for converting the encrypted sensitive data into a data stream that complies with an XML format. Other systems and methods are also provided.

Abstract: Data is encrypted according to a plurality of data keys. During the encryption of the data, the data keys are rotated according to a data key rotation pattern, and the rotation of the data keys includes repetitive use of the data keys during the encryption of the data. The encrypted data is transmitted to a receiver. Additionally or alternatively, encrypted data is received from a transmitter. The encrypted data is decrypted according to a plurality of data keys. During the decryption of the encrypted data, the data keys are rotated according to a data key rotation pattern, and the rotating of the data keys includes repetitive use of the data keys during the decryption of the encrypted data.

Abstract: Messages are encrypted/decrypted according to a modified triple wrap procedure in which the messages are encrypted/decrypted in three encryption/decryption operations and are processed in three additional operations using first, second, third, fourth, fifth, and sixth keys.

Abstract: The invention instantiates a Personal VLAN bridge, using IEEE Std. 802.11 elements. The result is a bridge, referred to as a public access point, that is better suited for implementing public wireless data networks than the IEEE Std. 802.11 architecture. The invention also provides a location-update protocol for updating the forwarding tables of bridges that connect public access points together. The invention further provides a method for more controlled bridging, which is referred to as fine bridging.

Abstract: A mobile communications device includes logic means operable to generate a request that is transmitted to a first network node. The request includes a personal information number and at least one device identifier associated with the mobile communications device. The mobile communications device also includes logic means operable to receive a response from the first network node. The response includes a URL and a session ID based upon the personal information number and the at least one device identifier associated with the mobile communications device. The mobile communications device further includes logic means operable to establish a communication session with a second network node to provision at least one aspect of the mobile communications device by transmitting the URL and the session ID to the second network node.

Abstract: A system and method for exchanging a transformed message with enhanced privacy is presented. A set of input messages is defined. A set of output messages is defined. A message is selected from the input messages set. One or more words in the selected message are efficiently transformed directly into a transformed message different from the selected message, wherein the transformed message belongs to the set of output messages, at least one component of the selected message is recoverable from the transformed message, and the cost of determining whether the transformed message belongs to the input messages set or the output messages set exceeds a defined threshold.

Abstract: 23A wireless communications device has a first security key, a second security key, and established channels. Each established channel has a corresponding security count value, and utilizes a security key. At least one of the established channels utilizes the first security key. The second security key is assigned to a new channel. A first set is then used to obtain a first value. The first set has only security count values of all the established channels that utilize the second key. The first value is at least as great as the x most significant bits (MSBx) of the greatest value in the first set. The MSBx of the initial security count value for the new channel is set equal to the first value. If the first set is empty, then the initial security count is set to zero.

Abstract: 23A wireless communications device has a first security key, a second security key, and established channels. Each established channel has a corresponding security count value, and utilizes a security key. At least one of the established channels utilizes the first security key. The second security key is assigned to a new channel. A first set is then used to obtain a first value. The first set has only security count values of all the established channels that utilize the second key. The first value is at least as great as the x most significant bits (MSBx) of the greatest value in the first set. The MSBx of the initial security count value for the new channel is set equal to the first value. If the first set is empty, then the initial security count is set to zero.

Abstract: 23A wireless communications device has a first security key, a second security key, and established channels. Each established channel has a corresponding security count value, and utilizes a security key. At least one of the established channels utilizes the first security key. The second security key is assigned to a new channel. A first set is then used to obtain a first value. The first set has only security count values of all the established channels that utilize the second key. The first value is at least as great as the x most significant bits (MSBx) of the greatest value in the first set. The MSBx of the initial security count value for the new channel is set equal to the first value. If the first set is empty, then the initial security count is set to zero.