Abstract: A system and method enables efficient transfer and cryptographic processing of data within a security appliance. A network adapter of the security appliance initiates a random access data transfer to a system memory that is illustratively organized into a plurality of blocks of predetermined size. Mapping circuitry of the appliance is configured to track the progress of the data transfer between the adapter and memory such that, once data is stored in a memory block, an encryption processor of the appliance may process the data or the network adapter may retrieve the processed data without having to wait for completion of the data transfer between the adapter and memory, thereby reducing processing latency in the security appliance.

Abstract: The present invention constructs a compound type combined public key system on the basis of a combined public key CPK system. The combined key is combined by an identity key and a randomly defined key. The randomly defined key can be defined by a center, called a system key; and can be self-defined, called updating key. Combination of the identity key and the system key generates a first-order combined key. The first-order combined key is then combined with the updating key to generate a second-order combined key. The first-order combined key can be used for centralized digital signature and key exchange. The second-order combined key can be used for distributed digital signature, to provide individual with convenient key exchange and absolute privacy. A combining matrix, as a trust root, provides proof of integrity of identity and key, with no need of third party proof.

Abstract: An image forming apparatus of the invention includes a key generating unit to change an encryption key and to generate an encryption key different from the previous encryption key at each time of change, an encryption unit to encrypt image data using the encryption key generated by the key generating unit, a first storage unit to store the encrypted image data, a second storage unit to store the encryption key and a table to correlate the image data encrypted by the encryption key with the encryption key, and a decryption unit to decrypt the data stored in the first storage unit by using the encryption key correlated in the table. According to the image forming apparatus of the invention, the read data can be stored with high security into a storage apparatus such as an HDD, while an operation burden is not imposed on a user.

Abstract: An electronic circuit includes a more-secure processor having hardware based security for storing data. A less-secure processor eventually utilizes the data. By a data transfer request-response arrangement between the more-secure processor and the less-secure processor, the more-secure processor confers greater security of the data on the less-secure processor. A manufacturing process makes a handheld device having a storage space, a less-secure processor for executing modem software and a more-secure processor having a protected application and a secure storage. A manufacturing process involves generating a per-device private key and public key pair, storing the private key in a secure storage where it can be accessed by the protected application, combining the public key with the modem software to produce a combined software, signing the combined software; and storing the signed combined software into the storage space.

Abstract: A system is described for reducing leakage of meaningful information from cryptographic operations. The system uses a pairwise independent hash function to generate a modified secret key SK? having individual components. The system forms a modified secret key collection that includes SK? and its individual components. The system then uses the modified secret key collection to decrypt a message. The decryption involves providing multiple partial operation results in separate respective steps. Leakage of meaningful information is reduced due to difficulty in piecing together meaningful information from information leaked by the separate partial operations. In one example, the hash function has the form HK(r)=ar+b, where a, b, and r are selected values, such as random numbers. In another example, the hash function has the form HK(r)=Ar*B, where A, B, and r are selected values.

Abstract: A method and system are disclosed. The system includes a trusted loader. The method includes downloading an IP core from a vendor to a target device. The IP core is received in an encrypted form at the target device, which can be, for example, a programmable logic device.

Abstract: A method, system and program are disclosed for efficiently processing host data which comprises encrypted and non-encrypted data and is to be written to a storage medium. The encrypted data is written to the storage medium in encrypted form. The non-encrypted data is encrypted by a storage device using a well known encryption key and written to the storage medium. In this way, the data that is processed by the storage device to and from the storage medium can always be processed through a single encryption engine.

Abstract: An information processing system and method using an encryption key block sets sub-trees classified based on data processing ability of the devices (capability) in a key tree in which respective keys are corresponded to a root, nodes and leaves of a tree in which a plurality of devices are constituted as the leaves, generates a sub-enabling key block which is effective for an entity in a managing subject of each sub-tree (entity), and generates an enabling key block decodable only by the entities having common capability. Also, an information processing system and method using an encryption key block manages a partial tree of a key tree (sub-tree), generates a sub-enabling key block based only on a key set corresponding to nodes or leaves included in the sub-tree, and generates an enabling key block decodable only by selected entities by using the sub-enabling key block.

Abstract: A security information implementation system includes a storage section 120a for storing first encrypted security information EDK (MK) provided by encrypting final security information DK according to internal security information MK and second encrypted security information EMK (CK) provided by encrypting the internal security information MK according to conversion security information CK and an LSI 120b including a seed generation section 131 for storing a first constant value containing address information on which a conversion seed is generated based and a second constant value and a third constant value on which a test conversion seed is generated based and outputting the first constant value and the second constant value or the third constant value as the conversion seed or the test conversion seed in response to a test signal and a mode setup value; a one-way function circuit 32 for converting the conversion seed or the test conversion seed output from the seed generation section 131 according to the f

Abstract: A secure information transmission system includes one or more transmitters and one or more receivers. The transmission waveform employed includes highly randomized, independent stochastic processes, and is secured as a separate entity from the information it carries. The signal, using novel modulation methodology reducing impulse responses, has a paucity of spectral information and may be detected, acquired and demodulated only by communicants generating the necessary receiving algorithm coefficients. The physical area of signal reception is restricted to that of each intended communicant, reception areas following movements of mobile communicants. A unique instant in time is used as basis for communications keys to the securing algorithms dynamically generated on a one-time basis and never exchanged or stored by communicants.

Abstract: A content playback apparatus reduces load concentration on a specific server apparatus that manages content keys of encrypted content, while protecting copyrights of the content. The content apparatus makes playback of content recorded in a recording medium sold possible after the specific server breaks down. A key acquisition control unit (204) reads a playback control information table (211) from a recording medium (102) via a reading unit (201). The key acquisition unit (204) acquires a rights key via a key acquisition intermediation unit (223) from an apparatus specified by an acquisition-destination type and a request-destination type that are stored in the playback control information table (211) and that corresponding to the content to be played. The key acquisition unit (204) generates a content key using the acquired rights key and, when required, a medium key recorded in a medium. A decryption unit (203) decrypts encrypted content using the content key.

Abstract: Aspects of the disclosure provide methods and systems for cross domain discovery. According to the disclosure, an object can include multiple entities defined by an originator. The multiple entities have different scopes corresponding to different access restrictions. Further, the originator defines keywords for each of the multiple entities. A system for cross domain discovery stores the multiple entities in an object service component, and stores the keywords and access restrictions in a search service component. The search service component conducts a search based on the keywords and access restrictions in response to a search request from a user. An entity is provided to the user based on the user's credential and the searching.

Abstract: A method and system provide efficient exception handling of the production process of PIV smartcards. Specifically, an automatic personal identity verification (AutoPIV) system and process manage potential failures in identification for agencies, such as a breakdown in correct identification. The AutoPIV system and process may deny access to individuals falsely claiming to be someone with legitimate access rights. The AutoPIV system and process may also accurately identify those with legitimate access rights.

Abstract: A key generating method is disclosed which includes the steps of: firstly detecting first change information as first change information data; secondly detecting second change information different from the first change information as second change information data; and merging the first change information and the second change information into key information.

Abstract: An apparatus for protecting privacy information of a surveillance image includes a key management unit for generating and managing keys used to unmask a masked input image; an input image processing unit for unmasking the input image using the keys, decoding the unmasked input image to acquire an uncompressed image data, and then applying a second masking on an area containing privacy information of the image data. Further, the apparatus for protecting the privacy information of the surveillance image includes an image recording unit for encoding the image data to which the second masking has been applied to store the encoded image data.

Abstract: The present disclosure provides a method for performing modular exponentiation. The method may include generating a first remainder (xp) based on an encrypted message (X) modulo a first prime number (p) and generating a second remainder (xq) based on the encrypted message (X) modulo a second prime number (q). The method may further include generating a third remainder (v1) based on the first remainder (xp) raised to a first private key number (d1) modulo the first prime number (p) and simultaneously generating a fourth remainder (v2) based on the second remainder (xq) raised to a second private key number (d2) modulo the second prime number (q). The method may also include subtracting the fourth remainder (v2) from the third remainder (v1) to yield a result (v1?v2) and multiplying the result (v1?v2) by a constant (c) to produce a second result.

Abstract: A tree is used to partition stateless receivers in a broadcast content encryption system into subsets. Two different methods of partitioning are disclosed. When a set of revoked receivers is identified, the revoked receivers define a relatively small cover of the non-revoked receivers by disjoint subsets. Subset keys associated with the subsets are then used to encrypt a session key that in turn is used to encrypt the broadcast content. Only non-revoked receivers can decrypt the session key and, hence, the content.

Abstract: A system, business methodology and apparatus for facilitating controlled dissemination of digital works is disclosed. An audio and video organizer, entertainment, and communication unit that plays back audio and video media content received from a central storage server. The unit relies on a smartcard, which has a personalized key that unlocks encrypted content. Using the unit, a user can purchase music or other types of media using a appropriate ordering method. The central storage server then transmits a double-encrypted, compressed audio file to the unit, where it is decrypted based on the smartcard key, and available for listening.

Abstract: Provided is a key migration device which can securely and reliably control the migration of keys. A migration authority (101) fetches a generation level which is the security level of a first electronic terminal (3011) and an output destination level which is the security level of a third electronic terminal (3013), decides whether the relationship between the generation level and the output destination level satisfies a predetermined condition when a request for fetching a collection of keys is received from the third electronic terminal (3013), outputs the key generated by the first electronic terminal (3011) among the collection of keys to the third electronic terminal (3013) if the predetermined condition is fulfilled, and restricts output to the third electronic terminal (3013) of the key generated by the first electronic terminal (3011) among the collection of keys if the predetermined condition is not fulfilled.

Abstract: A communication system comprises a covert channel detector. The covert channel detector can be used in a multi-level security system (MLS) or multiple single levels of security (MSLS). The covert channel detector detects covert channels in a cryptographic system. The cryptographic system can be used in a military radio system.

Abstract: The present invention allows the user (author or creator) of a document to specify that certain portions of a document be selected for encryption while other portions of the document remain displayed as created. In addition, each encrypted section could have multiple encryption keys such that some viewers can review certain parts of the document while other viewers will not have that same access. The user could employ a standard word processing editor technique to highlight (or swipe) portions of a document that the user desires to be encrypted. The highlighted portion would then be ‘tagged’ with a surrounding attribute indicating to the word processor that this highlighted portion of the document is to be encrypted. The highlighted sections would also have encryption keys associated with the highlighted and encrypted section. Any one of the encryption keys for that section would decrypt that section. With proper authorization, any encrypted portion of a document would be displayed as part of the document.

Abstract: A computer-implemented method of generating an elliptic curve cryptosystem (ECC) signature includes the steps of: generating a first random key (k1) having n bits, where n is a natural number; calculating a first ECC point (V) from k1 and a base point; and storing k1 and V securely in a computer-readable medium. To digitally sign electronic data, the method further includes the steps of generating a second random key (k2), where k2 has fewer than n bits; calculating a second ECC point (Q) from V and k2; and digitally signing electronic data using Q.

Abstract: This invention enhances the security strength of wireless communications in the ad-hoc mode. To this end, it is checked if the communication apparatus and a terminal of a communication partner can concurrently use different encryption keys in correspondence with a plurality of communication destinations. When at least one of the communication apparatus and the terminal of the communication partner cannot concurrently use different encryption keys in correspondence with the plurality of communication destinations, an encryption key uniquely set in the wireless network is set as an encryption key for a communication with the terminal of the communication partner.

Abstract: A cryptographic key is virtualized to provide a virtual cryptographic key. To virtualize the key, an operation, such as an exclusive OR operation, is used with the key and a mask. The virtual key is usable by a guest of a virtual environment in cryptographic operations.

Abstract: A method for managing shared passwords on a multi-user computer system is disclosed. A set of shared passwords and an administrator internal key are initially generated. After the receipt of an administrator external key, the administrator internal key is encrypted with the administrator external key. For each user level within the computer system, an internal key is generated by hashing the administrator internal key. For each user level within the computer system, each of the shared passwords encrypted with a respective one of the internal keys. The internal keys and the encrypted shared passwords are then stored in a non-volatile storage device.

Abstract: The presented messaging protocol uses three new public keys in a signed and encrypted message to achieve backward security and recovery in an environment where an attacker now and then obtains the security parameters in exposed, decrypted form. Backward security is understood to mean that an adversary cannot decrypt those captured encrypted messages that the user has decrypted prior the exposure. The recovery of the protocol means that the attacker at some point of time after the exposure cannot any more decrypt messages created after the exposure. The invention can be used e.g. in encrypted email communication. New to the current state of the art is that a message contains history data: a list of recently used public keys and their Diffie-Hellman counterparts.

Abstract: An object of the present invention is to provide an information processing apparatus in which a secure CPU and a non-secure CPU are included, that is capable of reliably detecting falsification of programs. The information processing apparatus according to the present invention includes a secure CPU 1, a non-secure CPU 2, a nonvolatile memory 3, a boot ROM 11, and a RAM 12. The secure CPU 1 verifies the presence or absence of falsification of various programs stored in the nonvolatile memory 3 with reference to a first falsification verification program stored in the boot ROM 11, according to a verification result, and loads a secure CPU target program 31 stored in the nonvolatile memory 3 into the RAM 12, and outputs a non-secure CPU target program stored in the nonvolatile memory 3 to the non-secure CPU 2 with reference to a load program loaded in the RAM 12.

Abstract: To establish credentials, a user network station transmits a first value. An authenticating entity network station generates a first key portion based on the transmitted first value and a second value unknown to the user, splits one of a private key and a public key of a user asymmetric crypto-key into the first key portion and a second key portion, stores the second key portion of the one key so as to be accessible only to the authenticating entity network device, generates a cookie including the second value, transmits the generated cookie to the user network station, and destroys the transmitted first value, the second value, the one key, and the first key portion of the one key. The first value represents a first and the second value included in the transmitted cookie represents a second user credential useable to authenticate the user.

Abstract: A technique for using a key repository to store data encryption keys provides a way to access key records in the key repository using a key identifier constructed from a media identifier associated with a data storage medium on which encrypted data is or will be stored. The media identifier is hashed and added to a counter value to produce the key identifier. In some embodiments, the technique is implemented in an encryption switch that provides data-at-rest encryption for a storage access network, but in other embodiments, the technique may be implemented in other devices, including data storage devices and hosts.

Abstract: In a communication system (100), a method and apparatus provides for message integrity regardless of the operating version of an authentication center (198) or an interface (197) between the authentication center (198) and a mobile switching center (199). The method and apparatus include generating a cellular message encryption algorithm (CMEA) key, and generating a CMEA-key-derived integrity key (CIK) based on the CMEA key for message integrity between a mobile station and a base station. The mobile station transmits a registration message to the base station, and determines an operating version of the authentication center (198) in communication with the base station based on whether the mobile station receives a registration accepted order or some elements of an authentication vector from the base station. The CIK is generated based on the CMEA key, if the mobile station receives a valid registration accepted order from the base station.

Abstract: A system for effectively pre-distributing keys for a distributed sensor network is disclosed, The system includes: a plurality of sensor nodes, each of which has a sensing function, a calculation function, and a wireless communication function; and a base station which is connected to the sensor nodes over a wireless network, receives data from the sensor nodes, acts as a data central station, and distributes keys for inter-sensornode security authentication to the sensor nodes. A key management unit contained in the base station, generates a set of the sensor nodes used for security authentication between the sensor nodes, decomposes the set of the sensor nodes into a plurality of matrices, distributes the matrices to the sensor nodes, and allows the sensor nodes to search for a common private key required for the security authentication using the received matrices. Therefore, the system can always search for a common private key between the sensor nodes.

Abstract: A system and method securely replicates a configuration database of a security appliance. Keys stored on an original configuration database of an original security appliance are organized as a novel key hierarchy. A replica or clone of the original security appliance may be constructed in accordance with a cloning technique of the invention. Construction of the cloned security appliance illustratively involves sharing of data between the appliances, as well as substantially replicating the key hierarchy on a cloned configuration database of the cloned appliance.

Abstract: Systems, methods and media for encrypting and decrypting content files are disclosed. More particularly, hardware and/or software for adding an additional level of indirection to a title key encryption scheme are disclosed. Embodiments may include generating by a cryptographic system a binding key based on binding information. Embodiments may also include encrypting by the cryptographic system a secret key with the binding key and generating a title key associated with at least one content file. Embodiments may also include encrypting by the cryptographic system the title key with the secret key and the at least one content file with the title key. Further embodiments may include receiving an indication that the binding information has changed, generating a new binding key based on the new changed binding information, and re-encrypting the secret key with the new binding key.

Abstract: A mesh station applying for access to a network includes a list of peer stations in messages of an authenticated key establishment protocol. A mesh key distributor derives a key delivery key and generates a top level key, and then delivers the top level key to the mesh station. Following the key establishment protocol, the mesh key distributor also creates pairwise keys for use between the mesh station and the peer stations listed in its peer list. The list of peers permits the identifier for the peer to be bound into the derived key, which helps ensure that the key used between each pair of peers is unique. Once the mesh key distributor finishes creating a key for one of the stations on the peer list, the mesh key distributor sends a message to the peer to initiate a key push.

Abstract: A programmable encryption approach involves the use of a downloadable decryptor. According to an example embodiment of the present invention, an FPGA device includes a microcontroller for configuring logic circuitry on the FPGA device. A memory register is implemented for storing encryption key data and a message authentication code (MAC). When the FPGA device is to be configured using a configuration bitstream, a MAC is calculated for a decryptor and sent to the microcontroller along with an encryption key. The microcontroller stores the encryption key and MAC in a register to which access is limited. When the decryptor is downloaded to the microprocessor, a MAC is calculated on the downloaded decryptor and compared with the stored MAC. If the calculated MAC matches the stored MAC, the decryptor is allowed to access the key.

Abstract: Methods and systems are provided for generating and verifying signatures of digital messages communicated between signers and verifiers. Using bilinear mappings, such as Weil or Tate pairings, these methods and systems enable generation and verification of efficient multisignatures, identity-based ring signatures, hierarchical proxy signatures, and hierarchical online/offline signatures.

Abstract: A system and method for securing data on a mass storage device. A centralized device permission store contains device identifiers for the mass storage devices to be secured along with keys of a symmetric cipher that have been encrypted with public keys or pass phrases of authorized users of the devices. A list of these users also contained in the store. A helper module provides the private key or pass phrase, for imported keys, needed to decrypt the key of the symmetric cipher, which is used to encrypt and decrypt blocks of data stored on the mass storage device. When a read request is made, a protection module intercepts the request, obtains the block from the mass storage device and decrypts the block. When a write request is made, the protection module intercepts the request, encrypts the block and has it stored on the mass storage device.

Abstract: A decryption apparatus (109) comprises a key stream generator (111) generating a local decryption key stream. It furthermore comprises a synchronization value receiver (201) receiving key stream synchronization values. A synchronization processor (203) implements a state machine which may operate in a synchronized state (303) wherein the communication is decrypted using the local key stream, a non-synchronized state (301) wherein the local key stream is not synchronized, or in an uncertain synchronization state (305) wherein the communication is decrypted using the local key stream and wherein the local key stream is synchronized to each new received synchronization value. The synchronization processor (203) furthermore comprises a transition controller (213) operable to transition from the synchronized state to the non-synchronized state in response to a first criterion and to the uncertain synchronization state in response to a second criterion.

Abstract: The invention provides an enciphering apparatus and method, a deciphering apparatus and method and an information processing apparatus and method by which illegal copying can be prevented with certainty. Data enciphered by a 1394 interface of a DVD player is transmitted to a personal computer and a magneto-optical disk apparatus through a 1394 bus. In the magneto-optical disk apparatus with which a change to a function is open to a user, the received data is deciphered by a 1394 interface. In contrast, in the personal computer with which a change to a function is open to a user, the enciphered data is deciphered using a time variable key by a 1394 interface, and a result of the decipherment is further deciphered using a session key by an application section.

Abstract: A method for secure data transmission in wireless sensor network includes that: the network user determines a master key and inputs it into a central node and a device node; after the central node and the device node have authorized each other, the central node generates a new session key and sends it to the device node; while the central node and the device node communicate with each other, the data sending party uses the new session key to encrypt the data for transmission and verify the integrity of the data, and the data receiving party uses the session key to decrypt the data and verify the integrity of the data.

Abstract: To provide a method and a system for creating a mini time key from a time key, a plurality of mini time keys are created within a unit time period. First, a unit time decryption key is prepared immediately after the unit time is created. Then, the last mini time key is created by applying a one-way function to the unit time decryption key. A desired mini time key is created by applying the one-way function to a mini time key following the desired mini time key. In other words, the mini time keys are created as a timed series arranged in a descending order beginning with the last mini time key. In this manner, even when a specific mini time key is externally leaked for a specific reason, a following mini time key in a timed series can not be created by using this mini time key. In addition, even when the mini time keys are sequentially published, the security of the unit time decryption key is maintained.

Abstract: Aspects are applicable to secure encryption such as in the generation of a cryptographic key from location information as may be useful in portable/wireless communication devices. As an example, one embodiment is implemented as a method of generating cryptographic keys from location information derived from a signal received from a publicly-used wireless communication system. The location information is protected from fraudulently generated signals using direction of arrival of the received signal.

Abstract: The present invention is made to provide an information distribution system capable of securely storing digitized personal information in an encrypted state in a storage section and securely transferring/disclosing the stored digitized information only to a particular third person via a network. Communication of the information is securely performed in the encrypted state between information terminals connected to the communication network (between a client and a server or between peer-to-peer client terminals). An information terminal which has created information encrypts the original information by a common key generated upon communication and stores the information in a secure storage of one of the information terminals connected to the communication network while maintaining the encrypted state.

Abstract: Provided is a migration system considering security authentication levels and data protection strength levels of the both security devices between which data is migrated. A first terminal 102 includes a mechanism for protecting data by a private key in the public key method held by TPM, and a second terminal 103 includes a key in the private key method encrypted by the private key in the public key method held by TPM and a mechanism for protecting the data by the key. A Migration Authority 101 holds a security policy table describing a security policy and judges whether data movement from the first terminal 102 to the second terminal 103 is enabled according to the security policy table.

Abstract: A recording device configured to store content data in an encrypted manner, the recording device comprises a memory unit which stores various data, and a controller which controls the memory unit. The controller possesses a controller key and unique identification information, and is configured to generate a controller-unique key unique for each controller in accordance with the controller key and the identification information. The memory unit stores an MKB generated by encrypting a medium key with a device key set that is a collection of a plurality of device keys, an encrypted device key set generated by encrypting the device key set with the controller-unique key, and a device-key-set index which uniquely identifies the device key set.

Abstract: An apparatus, method, and computer-readable media capable of encrypting and unencrypting secure documents with multiple passwords and/or fallback keys. Embodiments allow documents to unencrypt themselves or be able to be unencrypted with multiple passwords. Methods embodiments include the creation of self-encrypted documents that provide for multiple password decryption, and may include the automatic generation of at least one fallback key to facilitate unencryption of documents.

Abstract: A method and system to decrypt data in a particular round of decryption substantially in parallel with the generation of a decryption key associated with the next round of the particular round of decryption. By performing an inverse next key computation, the decryption process can be symmetric to the advanced encryption standard (AES) encryption process in terms of processing time, hardware implementation and storage requirements.

Abstract: The claimed subject matter relates to architectures that can construct a hierarchical set of decryption keys for facilitating user-controlled encrypted data storage with diverse accessibility and hosting of that encrypted data. In particular, a root key can be employed to derive a hierarchical set of decryption keys and a corresponding hierarchical set of encryption keys. Each key derived can conform to a hierarchy associated with encrypted data of the user, and the decryption capabilities of the decryption keys can be configured based upon a location or assignment of the decryption key within the hierarchy. The cryptographic methods can be joined with a policy language that specifies sets of keys for capturing preferences about patterns of sharing. These policies about sharing can themselves require keys for access and the policies can provide additional keys for other aspects of policy and or base-level accesses.

Abstract: An apparatus, method, and computer-readable media capable of encrypting and decrypting secure documents with multiple passwords and/or fallback keys. Embodiments allow documents to decrypt themselves or be able to be decrypted with multiple passwords. Methods embodiments include the creation of self-encrypted documents that provide for multiple password decryption, and may include the automatic generation of at least one fallback key to facilitate decryption of documents.

Abstract: A document access control scheme uses digital “skeleton keys” to distribute access permissions for encrypted documents in a manner that does not require that rights management files (RMFs) be associated with each document. Multiple skeleton keys can be issued for the same document. The skeleton keys themselves can be opened by one or more other skeleton keys for different levels of document access.