Abstract: A method and apparatus for securing hypertext transfer protocol sessions authenticates a user's credentials before creating a session. The present invention then associates the session with the credentials. Subsequent requests are submitted with the session ID and the user credentials to be associated with the session. Therefore, an unauthorized user that has obtained a session ID cannot gain access to sensitive content associated with the session without possessing the valid credentials.

Abstract: A retailer facilitates issuance of a digital license from a licensor to a customer for a corresponding piece of digital content. The retailer receives payment for the license from the customer, where the payment is to be shared with the licensor in a pre-determined manner. The retailer also receives customer-based information from the customer. The retailer then composes an actual license request including the obtained customer-based information, and including retailer-based information identifying the retailer to the licensor and acknowledging to the licensor that the retailer owes a portion of the received payment to the licensor. Thereafter, the retailer forwards the actual license request to the licensor. The licensor notes based on the retailer-based information in the actual license request that the retailer identified thereby owes the licensor at least a portion of the forwarded payment.

Abstract: The present invention relates to electronic purse systems, and in particular it relates to the improved management of multiple money flows in such systems. According to the basic principles of the present invention it is proposed that the secure access modules (SAMs) of a purse provider support multiple user groups or environments in the system while still requiring only one system key. The user groups or environments are identified by a so-called float ID tag which is advantageously added to each set of data involved in a load or purchase process performed by the user of the electronic purse system.

Abstract: A method, system and device for determining fees for access to digital works including associating a usage right with a digital work and which specifies a manner of use of the digital work and (i) a fee specification including a maximum price and a best price specification indicating a best price to be charged to a consumer upon exercising the manner or (ii) a price to be charged and a markup specification indicating a markup percentage to the price to be charged to a consumer upon exercising the manner of use; determining when the consumer is entitled to the best price or the markup specification and if so, returning a difference between the maximum price and the best price to the consumer or adding the markup percentage to the price to be charged to the consumer upon exercising the manner of use, respectively.

Abstract: An intranet platform system that automatically configures and provides access to virtual intranet networks using intranet access cards. The intranet platform system comprises a processing system coupled to an interface system. The processing system is configured to process a request message for intranet access to determine if an intranet configuration exists, and if the intranet configuration exists, process the request message to connect a user who receives an intranet access card to the intranet configuration. If the intranet configuration does not exist, the processing system processes the request message to automatically create the intranet configuration and connect the user to the intranet configuration. The interface system is configured to receive the request message for the processing system.

Abstract: The process consists of carrying out the first phase of generating the transaction signature (9), with prior authentication by the cardholder, in the issuing centre (3) through its authentication server (5), a second phase of decimalising (10) the signature (9) to obtain a valid permutation number and a third phase of permuting (11) the intermediary positions or digits of the card, the processor fixing a BIN and maintaining the check digit. In this way, the digits forming the expiry date are permuted. The card and expiry date are sent in the data flow (12) of the transaction to the acquiring server (7), from where they are sent back to the issuing centre (3), to its processing centre (6) to be specific, where three other operative phases are carried out: the new generation of the signature (13), its decimalisation (14) and lastly the inverse process (15) to reestablish the card's real data and expiry date.

Abstract: A collection/distribution server divides processing task accepted from a customer terminal into a plurality of processing units, and transmits the units to at least one or more user terminals. The collection/distribution server receives processing results of execution on the user terminals, and integrates the processing results to send back to the customer terminal. The user terminal registers with an application server in advance for receiving a task commission from the collection/distribution server, and receives a license application from the application server. When the license application receives a processing unit from the collection/distribution server, the license application executes the processing on the user terminal. The license application sends back a result of the processing to the collection/distribution server via a network. The user terminal receives a specified service as good value for executing the processing task substituting for a contractor.

Abstract: A cargo management system is described in which a host computer system determines rejected freight shipment items and non-rejected freight shipment items based on one or more configurable parameters. A user interface module executing on a network interface computer of the cargo management system presents a user interface that includes a user-selectable debug option. During normal operation, i.e., when the debug option is not activated, the user interface module displays only the non-rejected freight shipment items. When the debug option is activated, however, the user interface module displays the rejected freight shipment items in addition to the non-rejected freight shipment items.

Abstract: A method and system is disclosed for maintaining a database of configurations of mechanical equipment. A functional configuration database is established to store functional information about an end item and internal components of the end item. A logical configuration database is established that corresponds to the functional configuration database. A physical configuration database is established to store physical information about the end item. An operational configuration database is established to store operational information about the end item. The database of configurations of mechanical equipment is maintained in accordance with the functional configuration database, the logical configuration database, the physical configuration database and the operational configuration database.

Abstract: To provide a contactless IC tag for storing secret information for each of multiple stages of a life cycle from manufacture to disposal, and an access device for reading/writing information in secrecy from/to the contactless IC tag for each stage. A memory unit has stage storage areas as many as the stages. Each stage storage area is identified by a secret stage identifier. A controlling unit receives an access identifier from the access device in secrecy, via an antenna unit, a demodulating unit, and an instruction decoding unit. Upon judging that the access identifier properly identifies one of the stage storage areas, the controlling unit receives access information from the access device, and an inputting/outputting unit accesses the stage storage area based on the access information.

Abstract: A scheduling system and method. Schedules, created by an administrator, are made available to users through a global computer network, such as the Internet. Authorized users gain access to an administrator's web site and, upon entry of an appropriate access code, obtain access to the schedule. The user may select a time slot which has not been selected or which has not been frozen. The system provides an automatic e-mail reminder of the appointment to the student to the e-mail address entered by the user, who may, for example, be a student making an appointment to sit for a portrait. The administrator can alter certain aspects of the schedule such as moving up the starting date, moving back the closing date, selecting the number of appointments per day and/or the length and starting and ending time of appointments. Each user may change an appointment prior to the scheduled date. The administrator may prevent users from selecting more that one appointment for the same purpose.

Abstract: An enforceable property right and a system for controlling the manner of use of an item in accordance with usage rights. The enforceable property right includes an item ticket having a security mechanism incorporated therein and specifying an item for which the item ticket can be redeemed and a license associated with the item ticket. The license includes usage rights specifying a manner of use for redeeming the item ticket and a mechanism for unlocking said security mechanism.

Abstract: A hybrid optical recording disc having copy protection for use in a computer, including a read-only area having preformed information including at least one program and disc identifier data; a recordable area; and the disc identifier data being adapted to authenticate a transferred program in the computer to permit the program to be operated by the computer.

Abstract: In a data multiplexing device which multiplexes and transmits the transport stream packets of program data consisting of a plurality of data elements constructed in the form of transport stream packets, a program distribution system, a program transmission system, a pay broadcast system, a program transmission method, a conditional access system, and a data reception device according to the present invention, by generating a scramble key Ks corresponding to one or more data elements among the plurality of data elements constituting a program and by scrambling each data element, an audience can subscribe for each data element.

Abstract: A computer program product is provided as a system and associated method for use with a web browser and an Internet, to improve the access security to a secure web site and to protect the user from undesirable hacking. The system presents a novel, secure, implicit log-off procedure in addition to the conventional express log-off and cookie termination. The implicit log-off procedure reduces the risks resulting from transiting to an insecure site while remaining logged onto a secure site. The system is comprised of a secured transaction protection module implemented on a business server that includes a security/identification module and a local database; and a notification module which is implemented on the user's browser. The system tracks the user's access state to the server, and issues a termination command shortly as soon as the notification module detects migration to another site or to an insecure page on the same site.

Abstract: In an apparatus for authenticating a digital signature, a signature generating part encrypts a digital document by using a private key defined by a signer and digest information for checking whether the digital document has been tampered with, and generates a digital signature. A signature synthesizing part creates image information by synthesizing the digital signature and a predetermined mark. And an image embedding part embeds the image information created by said signature synthesizing part into an indicated position in the digital document.

Abstract: The invention provides techniques for issuing electronic seals of certification to online entities, such as online merchants, in a manner that prevents non-certified parties from easily stealing or otherwise misusing the seals. A central seal issuer verifies the credentials, policies or business practices of each merchant and issues a corresponding seal of certification. For each merchant, the seal issuer generates a unique media object representing an electronic seal. The media object includes an encrypted watermark containing an expiration date. The media objects are stored on a seal server such that the merchants can dynamically retrieve and display the electronic seals when accessed by a user. The seal issuer can easily revoke or update the centrally stored seals.

Abstract: Consumer authentication information is associated with an information account stored in a central database, such that access to the information account by the consumer is conditioned upon receipt and verification of the consumer authentication information. A temporary authorization may also be associated with the information account. The temporary authorization has consumer-defined attributes that define access privileges to be granted to a person who presents the temporary authorization along with a request for further access to the information account. The temporary authorization may be transmitted to the consumer for presentation to a third-party of the consumer's choice. Alternately, the temporary authorization may be transmitted to a designated third-party or device on behalf of the consumer.

Abstract: A method for enabling privacy and trust in electronic communities is disclosed. A major impediment to using recommendation systems and collective knowledge for electronic commerce is the reluctance of individuals to reveal preferences in order to find groups of people that share them. An equally important barrier to fluid electronic commerce is the lack of agreed upon trusted third parties. We propose new non-third party mechanisms to overcome these barriers. Our solutions facilitate finding shared preferences, discovering communities with shared values, removing disincentives posed by liabilities, and negotiating on behalf of a group. We adapt known techniques from the cryptographic literature to enable these new capabilities.

Abstract: In one embodiment an apparatus includes a housing; a user authenticator, supported by the housing, that authenticates an identity of a user; at least one memory, supported by the housing, that stores transaction information for at least first and second media; and at least one output, supported by the housing, that releases at least a portion of the transaction information to a point-of-sale (POS) terminal after the user authenticator has authenticated the identity of the user. In another embodiment, a method involves steps of: storing transaction information for at least first and second media in a memory of a device; receiving as input a user's selection of one of the at least first and second media; displaying a visual indication to the user regarding which of the at least first and second media has been selected; and transferring at least a portion of the transaction information from the device to a point-of-sale (POS) terminal.

Abstract: Methods and systems for associating watermark enabled objects with machine behaviors. Machine behaviors refer to actions by devices or systems in response to a triggering event. Examples of these behaviors include fetching a web page, opening an email client to send an email to a specific person, initiating a phone or video conference call, etc. A registration system enables users to associate machine behaviors with objects through a watermark embedded in the objects. The decoding of the watermark initiates a process for triggering the machine behaviors associated with the watermarked object. While the disclosure describes an implementation for stickers as a class of watermark enabled objects, the system and related methods apply to other forms of watermark enabled objects, including both electronic and physical objects.

Abstract: An electronic order confirmation for a made-to-order or out-of-stock item in an electronic transaction is provided to a public electronic environment (e.g., a browser on a global computer network) from a private electronic environment (e.g., an ERP application on a private computer network) by electronically receiving a sales order in a private electronic environment from a purchaser in a public electronic environment; obtaining an electronic including an entitled price and an estimated date of delivery for the item, within the private electronic environment while the purchaser waits; and automatically returning an electronic order confirmation, including the entitled price and the estimated date of delivery, from the private electronic environment to the public electronic environment for providing to the purchaser.

Abstract: The present invention contemplates a system whereby a service provider can service a large number of customers (millions) and connect them to their rented PC from millions of locations around the world. Many customers (10 to 100 thousand) can be connected simultaneously. The service provider is responsible for maintaining the latest PC Hardware and Software configurations available on the market instead of the customer. The rented PC operates in essentially the same manner as if one purchased and maintained their PC at home or office. Access to the individuals rented PC can be obtained from any existing PC, office network computer, a Web TV computer or other customer interface computer which has been authorized by the service provider. The current invention will greatly improve existing Client/Server systems being used to service large global offices.

Abstract: A multiple party system for distributing content. In one embodiment, four parties are involved in the system: a consumer, a service provider, an authenticator, and a content provider. The distribution of content from the content provider to the consumer is carried out using a predefined protocol, mutating IDs, and licenses. The authenticator controls the distribution of mutating IDs and verifies the identity of one or more participating parties.

Abstract: In order to verify the authenticity of manufactured goods, a smart tag is attached to the goods containing encrypted authentication information, such as a serial number, a description of the good's physical appearance or chemical decomposition, its color, or digital images of the good etc. The encryption procedure comprises public/private key encryption with zero-knowledge protocols. Zero knowledge protocols allow a smart tag to be authenticatable and yet be duplication resistant by allowing the verifying agent to convince him/herself that the smart tag is authentic without revealing its authentication information. The verification procedure can be done using a reader at a point of sale (POS) machine equipped with the appropriate public key and zero-knowledge protocols to decrypt the authentication information. A printed version of the serial number or other authentication information may be placed on the goods in human readable form to quickly verify the information electronically read from the smart tag.

Abstract: A method for purchasing items over a non-secure communication channel uses a secure communication device. The secure communication device includes a host processor, a secure memory that includes a laser-scribed encryption key, and a non-secure memory for storing encrypted data. A user's sensitive data is encrypted within the secure memory using the laser-scribed encryption key and stored as encrypted data in the non-secure memory. An encrypted credit card number and an encrypted secret key is retrieved from the non-secure memory, the encrypted credit card and secret key are decrypted with the laser-scribed encryption key, the credit card number is encrypted with a session key, and the encrypted credit card number is transferred over the network to a destination such as an internet vendor.

Abstract: In a computing platform, a trusted hardware device (24) is added to the motherboard (20). The trusted hardware device (24) is configured to acquire an integrity metric, for example a hash of the BIOS memory (29), of the computing platform. The trusted hardware device (24) is tamper-resistant, difficult to forge and inaccessible to other functions of the platform. The hash can be used to convince users that that the operation of the platform (hardware or software) has not been subverted in some way, and is safe to interact with in local or remote applications. In more detail, the main processing unit (21) of the computing platform is directed to address the trusted hardware device (24), in advance of the BIOS memory, after release from ‘reset’.

Abstract: A computer-implemented method for mapping between part numbers that are based on different part numbering schemes includes receiving a first part number associated with an item, the first part number associated with the item being defined according to a first part numbering scheme. A database is searched for one or more second part numbers that are associated with the item and also cross-referenced to the first part number associated with the item, the one or more second part numbers associated with the item being defined according to one or more corresponding second part numbering schemes.

Abstract: The present invention features a system and method for establishing a secure communication channel between a client and an application server. In one embodiment, a ticket service generates a ticket having an identifier and a session key. A communications device obtains the ticket from the ticket service and transmits the ticket to a client over a secure communication channel. The client transmits the identifier of the ticket to an application server over an application communication channel. The application server then obtains a copy of the session key of the ticket from the ticket service. Communications exchanged between the client and the application server over the application communication channel are then encrypted using the session key to establish the application communication channel as a secure communication channel.

Abstract: A method of assuring integrity of a personal information in a data base containing personal information provided by multiple users uses in various embodiments physiological identifiers associated with each of the users. Related systems are also provided.

Abstract: An iterative search technique is used to quickly and accurately locate information in a database, such as one storing information about digital versatile discs (DVDs). First, a presumably unique search key is generated for an unidentified DVD and compared with corresponding keys in a database. If no match is found progressively less specific information is used to generate a series of search keys that are similarly compared with corresponding keys in the database. If at least one possibly matching record is found, it is determined whether the best matching record can be considered a match, otherwise, less specific information is used to search for a match until predefined least specific information is used.

Abstract: An optical medium uses a single structure or format (such as identical materials, layers and the like) for both a region for holding mastered data and a writeable area. In one aspect, a writeable region of a medium with mastered content is used in connection with paying, collecting or accounting for usage or royalties for proprietary intellectual property embodied in or associated with the content. In one embodiment, the (preferably write-once) writeable area can be used for storing later-written information such as annotations, highlighting, reordering, remixing, modifications, supplements, collections, additions, bookmarks, cross references, hypertext or hyperlinks and the like. Preferably, annotations and similar materials can be associated, by the user, with particular portions or content of the mastered data.

Abstract: A TV music broadcasting program is distributed from a distribution apparatus through a ground station and a satellite, and a musical-piece program is also distributed through a plurality of audio channels. A subscriber looks for the desired musical piece from a musical-piece list displayed on the screen of a TV receiver and downloads it into a storage device. A pay-per-view method is employed in which accounting is performed in units of musical pieces. At downloading, a purchase record is stored in an IC card placed in a receiving apparatus and it is periodically sent to a customer management center. The customer management center calculates the viewing fee and issues a bill to the subscriber. A copyright management apparatus in the distribution apparatus obtains the purchase record of a musical piece from the customer management center to calculate a copyright fee to be paid to the copyright holder.

Abstract: In a method and apparatus for protecting a device against operation with unallowed consumables whose authenticity is checked in a remote data center, at least one code word is generated, an allocation to a specific consumable is stored in the form of a dataset with a reference code word, the consumable is aggregated with the generated code word, which has a predetermined relationship to the reference code word or to a group of reference code words that are stored in the data center. An operation for the replacement of a consumable in a device remote from the data center is detected and a communication connection is set up between the device and the remote data center and the code word aggregated with the consumable is communicated to the data center. The communicated code word is received in the data center and the authenticity of the consumable on the basis of a stored reference code word is checked at the data center, which transmits a message to the device after checking the code.

Abstract: The present invention relates to a digital contents selling system for selling digital contents. Identification information of digital contents selected by a customer is received. Personal digital contents are generated by setting identification information for identifying the customer in the selected digital contents as status information for permitting the customer to replay the selected digital contents. The generated digital contents are sold. Thereby, a technique is provided for preventing the illegal use of the sold digital contents.

Abstract: A conditional access system and method are disclosed allowing the use of a standard smart card. A computing resource configured to run the conditional access protocol has a smart card interface and a software wrapper configured to run on the computing resource coupling the smart card interface to the conditional access protocol.

Abstract: The present invention is directed to methods and apparatus that partially encrypt an information data file. An exemplary method includes dividing the information file into a first file and a second file, wherein the second file includes content from the information file to preclude reconstruction of the information file using only the first file, and encrypting the second file. Additionally, the method provides for transmitting the first file and the encrypted second file from a first device to a second device.

Abstract: An automated banking machine (12) is operative to conduct transactions in response to HTML documents and TCP/IP messages exchanged with a local computer system (14) through an intranet (16), as well as in response to messages exchanged with foreign servers (20, 22, 24, 26, 28, 96) in a wide area network (18). The banking machine includes a computer (34) having an HTML document handling portion (76, 80, 82). The HTML document handling portion is operative to communicate through a proxy server (88), with a home HTTP server (90) in the intranet or the foreign servers in the wide area network. The computer further includes a device application portion (84) which interfaces with the HTML document handling portion and dispatches messages to operate devices (36) in the automated banking machine. The devices include a sheet dispenser mechanism (42) which dispenses currency as well as other transaction devices.

Abstract: In a method for authenticating a user, when authentication request information including a content identification of a content provided is received from the content provider through a terminal of the user, the user is authenticated based on the authentication request information. Then, authentication result information is sent to the content provider through the terminal.

Abstract: A navigation information updating system G updates navigation information for use in a navigation process executed by navigation apparatus S that navigate respective vehicles. The navigation information updating system G comprises: the navigation apparatus transmitting an identifier Sid associated therewith to an updating center UC; the updating center UC that outputs updated navigation information which is generated on the basis of the transmitted identifier Sid for each associated navigation apparatus S, to a shop SP; and the shop SP that delivers the outputted updated navigation information to the associated navigation apparatus S.

Abstract: A rendering system adapted for use in a system for managing use of content and operative to rendering content in accordance with usage rights associated with the content. The system includes a rendering device configured to render the content and a repository coupled to the rendering device and operative to enforce usage rights associated with the content and permit the rendering device to render the content in accordance with a manner of use specified by the usage rights.

Abstract: A method for providing limited printing of a digital work having one or more rights associated therewith within a system having at least one repository configured to enforce use of the digital work in accordance with the rights. A limited printing right, or other rights, can be associated with a digital work. The limited printing right specifies a type of printer and type of ticket required for exercising the limited printing right of the digital work for a limited printing fee. A copy of the digital work is distributed along with the ticket to a consumer. The limited printing fee is reported as a transaction in response to the consumer exercising the limited printing right.

Abstract: The invention pertains to a method, online service, and system, for creating partnerships based on trust relationships over a public network, authenticating trade partners, infrastructure providers and collaborators to each other, and providing users with an environment suitable for conducting transactions requiring a high level of trust. A service according to the invention is a persistent authentication and mediation service (PAMS) which is provided as an on-line service. One embodiment is a method for conducting authenticated business transactions involving microprocessor equipped devices over the Internet comprising: A. providing an on-line authentication service available on the distributed network; B. authenticating a plurality of users to said on-line authentication service using a closed authentication system to produce a plurality of authenticated users; and C.

Abstract: A player-centric content creation, distribution and consumption method is disclosed. A computer implemented-content authoring tool (CI-CAT) is distributed to a content creator. The CI-CAT includes an identification function for embedding control information, such as a content owner identifier, in a content created using the CI-CAT, to facilitate compensation of a developer of the CI-CAT. A computer implemented-content player (CI-CP) is provided to a consumer. The CI-CP includes a recovery function for recovering the control information from the content when the content is rendered by the player, and a reporting function for reporting rendering of the content using the recovered control information. During operation, the content is received by the consumer, and rendered using the CI-CP. The control information is recovered, and rendering of the content, using the recovered control information, is reported by the CI-CP, to facilitate compensating the developer(s) of the CI-CAT.

Abstract: A trusted system having at least one repository for controlling use of digital works in accordance with usage rights associated with the digital works. A request to use a digital work in accordance with usage rights associated with the digital work is received. The usage rights specify a manner of use and an access specification indicating a security class. A security level of a repository controlling the requested use is determined. The request is granted and the user is permitted to exercise the manner of use specified in the usage rights associated with the digital work if the security level of the repository corresponds to the security class of the access specification specified in the usage rights associated with the digital work.

Abstract: A system for increasing transaction security across existing infrastructure is provided. A user bio-metric sensor device is integrated into a credit or debit card. A display unit provides a key, preferably encrypted, upon successful utilization of the sensor device. Included in the key generation mechanism is an indicator of the transaction number or other sequential count indicative of card use. An authorization service decrypts the key in a manner at least partially dependent upon a second sequential count maintained in sync with the first count to determine whether the use is authorized. In one embodiment, a separate credit card reader may be configured to read conventional credit cards, smart cards, and credit cards incorporating such bio-metric sensor devices.

Abstract: An enforceable property right and a system for controlling the manner of use of an item in accordance with usage rights. The enforceable property right includes an item ticket having a security mechanism incorporated therein and specifying an item for which the item ticket can be redeemed and a license associated with the item ticket. The license includes usage rights specifying a manner of use for redeeming the item ticket and a mechanism for unlocking said security mechanism.

Abstract: Disclosed are network management procedures that apply measurements of traffic load to achieve greater efficiency in the operation of the network. In a method for deciding whether to route an incoming call on a selected potential service route, the potential service route is treated preferentially if each of its links has available capacity that is more than sufficient by a specified margin. In a method for computing billing revenues, the non-compliance of the network service provider with contracted requirements for carried load causes a revenue penalty to be exacted for lost bandwidth.

Abstract: A system and method are shown for work management for facility maintenance. The system includes a central management server configured to receive a first set of information including tasks to be performed at a first facility and to generate a first work schedule for a first user selected to perform the first work schedule at the first facility. The system further includes a first client device at the first facility, where the first client device is configured to receive the first work schedule from the central management server and display the first work schedule to the first user via an electronic management interface. The electronic interface is further configured to receive task completion data from the first user and send the data to the central management server. When the central management server receives the task completion data, the central management server is configured to update a status of the work schedule based upon the task completion data received from the first user.

Abstract: A method for distribution, recognition and accountability for Intellectual and Copy written Properties in digital media's by associating a Transaction Code Identifier or Designator and further bundled information which distinguishes digital files as Intellectual or Copy written Property, and therefore unique and bound to restrictions with regard to transfer, ownership, proliferation and electronic commerce. The employment of said transaction code identifier further promotes novel distribution scenarios for electronic commerce. Further delineated is the role of network providers and servers in promoting the interests of owners of Intellectual and Copy written Property in accordance with the present invention.