Abstract: Particular embodiments provide a method for orchestrating an order fulfillment business process that includes a sub-process. In one embodiment, abstraction of business processes from an underlying information technology (IT) infrastructure is provided. An orchestration process can be designed using sub-processes such that the sub-process is assembled at run-time into an executable process. The sub-process may be defined in an interface as a single step. A plurality of services as then assembled as steps in the executable process at run-time.

Abstract: A wagering game system and its operations are described herein. In embodiments, the operations can include managing multiple instances of gaming applications associated with a wagering game client device and determining event data from the multiple instances of gaming applications. The operations can further include aggregating the event data into an event repository and determining that a requesting application requests some portion of the event data. The operations can further include opening a communication channel between the event data repository and the requesting application, formatting the requested portion of the event data in a format understandable to the requesting application, and communicating the requested portion of the event data to the requesting application via the communication channel.

Abstract: This invention relates to provide a communication network system, a gateway, and a data communication method, in which the gateway has an advanced functionality. A person who issues an access request can retrieve a desired access destination easily by the following configuration: functions of routing information providing and authentication processing are added to a gateway that performs protocol conversion between two different communication networks; when an access request is issued from a public communication network such as Internet to a terminal in a local (private) communication network connected to the gateway, a request terminal is authenticated to enable prevention of unauthorized data writing and reading; and an access request user who succeeded in the authentication is provided with an active terminal list comprising accessible terminal information, or with a user condition table.

Abstract: Systems and methods for providing efficient reputation management schemes resilient to malicious attacks. Methods for providing a reputation management scheme can comprise representing sets of service providers, raters, and ratings of service providers as a factor graph, wherein a factor node is associated with a function representing the probability distributions of the arguments of the function given the trustworthiness value and the ratings associated with a rater; and calculating the probability distributions of each variable in the reputation values of the set of providers using a belief propagation algorithm. In some embodiments, the computational complexity of the method is linear in the number of service providers and raters. In some embodiments, the method can identify malicious behavior and accordingly adjust the trustworthiness value for raters associated with malicious behavior.

Abstract: A flexible product distribution and payment system for computer network based electronic commerce is disclosed. Primary content data is made available to customers through a detachable local storage medium, such as a DVD or CD-ROM disc, or over a network connection. The primary content is capable of being accessed and played back through a computer or game console at the customer site. The primary content distribution may comprise a superset of content that is intended to be used by the customer. The customer is allowed to view and access the encoded primary content, and is charged only for the primary content that is used. Content that is encoded on the medium but that is not used by the customer remains on the medium but is not charged. A content database and customer database maintained at the primary customer site maintain records of products ordered and used by the customer, as well as identification and use patterns associated with the user.

Abstract: In some applications, it may be more convenient to the user to be able to log in the memory system using one application, and then be able to use different applications to access protected content without having to log in again. In such event, all of the content that the user wishes to access in this manner may be associated with a first account, so that all such content can be accessed via different applications (e.g. music player, email, cellular communication etc.) without having to log in multiple times. Then a different set of authentication information may then be used for logging in to access protected content that is in an account different from the first account, even where the different accounts are for the same user or entity.

Abstract: An asset management apparatus includes a processor for conducting arithmetic operation processing and a storage device, and executes an asset management program to detect unfairness. The asset management program includes a common asset management part common to the asset management apparatus and other devices, and a device specific asset management part specific to the asset management apparatus. The asset management apparatus acquires the device specific asset management part and device specific part setting information. When executing the asset management program, the asset management apparatus refers to the device specific part setting information, links the device specific asset management part to the asset management program, and executes the linked asset management program.

Abstract: An application program or an extended application program is installed that extends the functionality of this application program. If the application program is installed, a license file used in this application program is stored in a storage unit. If the extended application is installed, then control is executed so as to install the extended application using the license file stored in the storage unit and used in installing the application program corresponding to the extended application program.

Abstract: A system and method are provided for synchronizing playback of media content on multiple playback devices utilizing Digital Rights Management (DRM) encoding. In general, multiple playback devices or users of those playback devices are associated to form a virtual group. A virtual group (VG) control function operates to synchronize advertisement (ad) slots within media content provided to the playback devices in the virtual group utilizing DRM encoding.

Abstract: A product distribution and payment system for limited use or otherwise restricted digital software products. Digital content data comprising a software product to be rented is made available to customers through a detachable local storage medium, such as a DVD or CD-ROM disc, or over a network connection. The product digital content is capable of being accessed and played back through a computer or game console at the customer site. The software product may comprise a limited use product that is restricted in the number of plays or duration of use. The customer is allowed to download and purchase the product using his computer or playback console. The product purchase information is encoded and transmitted to the content distributor. When the preset time or number of plays has elapsed the software program is frozen and access to the program is not allowed.

Abstract: Technologies are disclosed to transfer responsibility and control over security from player makers to content authors by enabling integration of security logic and content. An exemplary optical disc carries an encrypted digital video title combined with data processing operations that implement the title's security policies and decryption processes. Player devices include a processing environment (e.g., a real-time virtual machine), which plays content by interpreting its processing operations. Players also provide procedure calls to enable content code to load data from media, perform network communications, determine playback environment configurations, access secure nonvolatile storage, submit data to CODECs for output, and/or perform cryptographic operations. Content can insert forensic watermarks in decoded output for tracing pirate copies.

Abstract: An embodiment defines access control allowing the expression of access control rules using ontology based semantics and references an ontology subset using XPath as the ontological expression. The access control rules or access criteria are defined by an access control statement and may be expressed using classification criteria and ontology classes. The access control statement comprises a structural description that is used to define an asset and a logical expression that may be used to express the classification criteria. The access control statement defines access policy for various assets.

Abstract: In a personal Internet communication device, a security key is stored on the master boot record. Any bootable device attempting to write operating system files or software files must have an authorized signature key in order to be eligible to install files on the personal Internet communication device.

Abstract: In a content delivery system, delivery of content and charging the fee of the content are performed and managed in a highly secure and effective fashion. If a content-purchasing request is transmitted from a user device to a shop server, a charging process is performed. A user device authentication server, which manages content delivery, converts an encrypted content key KpDAS(Kc) encrypted using a public key of the user device authentication server (DAS) into an encrypted content key KpDEV(Kc) encrypted using a public key KpDEV of the user device. If the charging process is successfully completed, the shop server transmits, to the user device, the encrypted content key KpDEV(Kc).

Abstract: The present invention includes a virtual customer database system for delivering personalized services to a consumer operating a communication device. The virtual customer database system includes an administrator and a distributed database. The distributed database may be selectively loaded by the administrator with customer related information extracted from participating businesses. The distributed database includes secure databases associated with each participating business and a public participant database. The administrator may process push and pull service requests by selectively querying the distributed database. Sensitive customer specific information may remain with each corresponding participating business while responses to the requests may include personalized customer specific information provided via a common interface standard.

Abstract: An online reward exchange system and method of operation, which includes an exchange computer that interoperates via a computer network with user computers, reward point issuer computers, and merchant computers. The merchants' products may be purchased by a user by requesting an issuer(s) to redeem reward points in exchange for payment to the merchant for the product. The exchange computer is the gateway to the system and manages various transactions such as providing online product catalogs to users that list the merchants products, as well as displaying to the user the reward points he has available in his reward programs with the issuers. Once a user selects a desired product the exchange computer can mediate or manage the purchase transaction in which reward points are redeemed by the selected issuer and consideration is conveyed to the merchant in exchange for the merchant providing the product to the user.

Abstract: A licensing system is disclosed for performing synchronous encryption with a client over an IP-compliant network. In disclosed embodiments, the system includes a licensing agent configured to pass a data structure unencrypted in an initial communication between the licensing agent/client pair and pass a first key to said client responsive to an initial communication. The licensing agent then receives the data structure from the client having designated fields encrypted according to the first key. The licensing agent then sends a second key to the client for use in subsequent communications.

Abstract: A method and system for authenticating applications. The system includes a plurality of portable electronic devices, at least one process organizer, at least one module developer, at least one task performer and a workflow server. The process organizer generates an application. The process organizer can request modules from module developers that are incorporated into the application. Alternatively, the process organizer makes an agreement with a task performer to perform tasks to complete the application. The application is transmitted to the workflow server, which includes an online marketplace for displaying and selling the applications. A user purchases the application through the store. A routing module generates a signature and compares the signature to application, module or document metadata and a secret to determine consistency of the data before the application, module or document is routed.

Abstract: Selling intangible property rights may include receiving content from a seller and determining one or more potential purchasers for the content's intangible property rights. The potential purchasers may be determined according to the subject of the content, the audience for the content, and the intangible property rights being sold. An offer to sell the intangible property rights may then be transmitted to one or more potential purchasers, along with a portion of the content. Upon receiving the one or more purchaser's acceptance of the offer, a complete copy of the content may be transmitted to the purchaser.

Abstract: A determination is made regarding whether a user is allowed to access a content item. The content item is associated with a website. An offer associated with the website is identified. The offer includes a set of use-time rules specifying time periods during which the offer can be used to access content. A use-time rule is associated with a user class. A class of the user with respect to the offer is determined. The user's class indicates whether the user has accepted the offer or whether the user has registered with the website. A determination is made regarding whether the user is allowed to access the content item based on the offer, the user's class, and a current timestamp.

Abstract: A method and system for secure distribution of digital content, using a disintegration tool under control of a distributor of the digital content to divide the digital content into protected and unprotected segments, delivering the unprotected segments to the customer along with installation software and identification information. The segments to be protected are modified using the identification information on the distribution medium and hardware information unique to a particular customer device. Upon communication of this information from the customer device, the modified segments are sent to the customer device for integration with the unprotected segments to generate a modified digital content operable only on the particular customer device.

Abstract: Systems and methods enable members of a secure transaction network to readily identify the appropriate trusted service manager (TSM) to support a particular transaction. A global directory of TSM providers is provided that a secure service provider can use for determining which TSM provider is the authorized manager of a security domain for the particular transaction. In aspect the directory of TSM providers may be stored within a mobile device secure element. In another aspect, the directory of TSM providers may be stored in a central TSM repository. In a further aspect, the directory of TSM providers may be distributed among a number of secondary TSM repositories. The appropriate TSM may be identified based upon a secure element identifier and an application identifier provided by a secure element as part of the transaction. Communication of the identifiers from mobile devices may be via cellular or near field communication links.

Abstract: Mechanisms that provide a sealed storage in a data processing device are provided. Processors of the data processing device may operate in a hardware isolation mode which allows a process to execute in an isolated environment on a processor and associated memory thereby being protected from access by other elements of the data processing device. In addition, a hardware controlled authentication and decryption mechanism is provided that is based on a hardware core key. These two features are tied together such that authentication occurs every time the isolation mode is entered. Based on the core key, which is only accessible from the hardware when in isolation mode, a chain of trust is generated by providing authentication keys for authenticating a next piece of software in the chain, in each piece of software that must be loaded, starting with the core key.

Abstract: Techniques are provided for controlling the activation of computer games. In one embodiment, the technique may involve receiving a combination of a game identifier for the game and a device identifier for the device. The technique may further involve accessing a database of known game identifiers, each known game identifier being associated with a device count corresponding to a total number of known devices on which a known game was previously played or activated, and obtaining a usage policy for the game.

Abstract: An IP server sends e-mail to a mobile device MS. This e-mail includes an application specifier that specifies startup of a Java application stored in mobile device MS and a data specifier that includes data used in operations executed by mobile device MS in accordance with a Java application. On the other hand, the ADF for the Java application stored in mobile device MS includes trusted source data containing a plurality of e-mail addresses that indicate trusted origins. Mobile device MS compares the e-mail transmission origin address with the trusted source data. Mobile device MS, only in the case where the transmission origin address of the received e-mail is included in the trusted source data, starts up a Java application based on an application specifier included in said e-mail, and uses data included in said data specifier in operations executed by that Java application.

Abstract: The present invention proposes a safe and quick individual certification method using a portable terminal. When a portable terminal 30 sends a request for certification to a certification server 10, the certification server 10 transmits query code for certification to the portable terminal 30. The portable terminal 30 transmits said query code to the certification server 10 via a reader 21 or the like and also via a sales management server 23 to be certified. The certification server 10 verifies the query code to that generated in the past, and returns a result of verification and personal data required by the sales management server 23 to the sales management server 23.

Abstract: There is provided a character training and development system for a virtual environment and related method. A character can be purchased by a user and then registered on a communication network via a unique code. Once registered, a set of attributes can be assigned to the character based on the type and class of the character. Attribute values can be assigned to the attributes by default or by user preferences. The characters can be manipulated within the virtual environment. In particular, the characters can be trained in order to improve their skills, to add new skills, and to increase their overall value and worth in the virtual environment. In addition, the characters can be traded among users for a price based on their skills. Fees can be charged for each trade. Traded characters are given a new code to transfer all control of the character to the new owner.

Abstract: Described are methods and apparatuses, including computer program products, for inserting personalized information into digital content. A request for digital video content is received by a computing device. The request includes authentication data associated with a user of a client device. Personalized data to be inserted into the requested video content is generated by the computing device. The personalized data and the requested video content are combined by the computing device. The combining includes replacing one or more frames of the requested video content with the personalized data to generate personalized video content.

Abstract: An equipment managing system includes an intermediating apparatus and an equipment managing apparatus. The intermediating apparatus is connected to a license management apparatus and a program management apparatus via a network. The equipment managing apparatus is connected to an electronic equipment via a network. The intermediating apparatus stores a program acquired from the program management apparatus and a license file acquired from the license management apparatus to an external storage medium. The equipment managing apparatus sends the program and the license file recorded in the external storage medium to the electronic equipment.

Abstract: Computer systems and environments implemented herein permit a local machine increased participation in authorizing access to protected content. An operating system attests to a computing environment at a corresponding computer system. If the computing environment is one permitted to access protected content, the operating system is permitted to regulate further (e.g., application) access to protected content in accordance with a procreation policy. As such, authorization decisions are partially distributed, easing the resource burden on a content protection server. Accordingly, this computing environment can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Abstract: Service delivery systems and methods are described. In one aspect, a service delivery system includes a set of tokens, a database, multiple terminals, and a service manager. Each of the tokens includes a respective token identifier. The database stores personal user profiles each of which is associated with a respective token identifier. The terminals are distributed about a selected locale. Each terminal has a reader that is operable to read token identifiers from tokens and a controller that is operable to transmit read token identifiers and context data identifying one or more conditions under which a token identifier is read through a network connection each time a token identifier is read. The service manager is connected to each of the terminals through a respective network connection and to the database.

Abstract: A method distributes personalized circuits to one or more parties. The method distributes a generic circuit to each party, encrypts a unique personalization value using a secret encryption key, and transmits each encrypted personalization value to the corresponding party. Each party then stores the encrypted personalization value in their circuit. The stored encrypted personalization value allows a piece of software to be properly executed by the circuit. A semiconductor integrated circuit is arranged to execute a piece of software that inputs a personalization value as an input parameter. The circuit comprises a personalization memory arranged to store an encrypted personalization value; a key memory for storing a decryption key; a control unit comprising a cryptographic circuit arranged to decrypt the encrypted personalization value using the decryption key; and a processor arranged to receive the decrypted personalization value and execute the software using the decrypted personalization value.

Abstract: Unauthorized access to modules, especially modules in automation systems, is prevented by controlling access between modules and a central processing unit. At least one first device transmits an identifier to at least one of the central processing unit and a second device which evaluate(s) the identifier by comparison with at least one comparative identifier stored in the at least one of the central processing unit and the second device. Operation of the first device on the system is denied by the at least one of the central processing unit and the second device if the received identifier does not correspond to the comparative identifier.

Abstract: Described herein are processes and devices that integrate social contact identifiers into wagering games. One of the devices described is a social contact identifier integrator. The social contact identifier integrator can display one or more elements of a wagering game, such as graphics that are part of, or connected to, the wagering game. A player of the wagering game can have a social network account that has one or more related social network accounts, such as friends or acquaintances. The social contact identifier integrator selects a social contact identifier from one of the related social network accounts and integrates the social contact identifier into the wagering game. The social contact identifier integrator can also determine and assign rewards to the player or to the related social network account whose social contact identifier appeared in the wagering game.

Abstract: A method for casino operators and/or players to instantly “create” new games without requiring recertification by a gaming laboratory. New games are created on the fly by making combinations of game attributes including but not limited to theme, denomination, volatility, RTP. Game attributes are associated to pre-certified software components that are then dynamically linked to instantly offer a new game. Having players dynamically create games according to their preference totally removes the game operator's risk to compose menus of available games that players will not play.

Abstract: In electronic commerce (e-commerce) sites that are executed on a single e-commerce application, a user's session is only associated with a single user identity for e-commerce site domain. Acting under a single identity across the site may not be desired. There may be requirements to associate an individual user with one or more separate identities within parts of the site. Aspects of the invention provide a method, system and computer program product for managing multiple user identities for a user of an electronic commerce (e-commerce) site.

Abstract: A software conditional access system (CAS) for media services provided to a Media Distribution Device, such as a set top box (STB), is disclosed. The STB may be connected to a Media Delivery Service Provider via a broadband connection. Over the broadband connection, a CAS application may be downloaded to the STB, maintained and dynamically updated. Because the CAS is implemented by software on the STB, it is inexpensive to install, maintain and update. When a user desires to purchase media services through the STB, a request, with identifying information, is sent to the Media Delivery Service Provider via the broadband connection. The service provider cross-references the identifying information with a user's account to determine whether to allow the user to view the media service requested. If the service provider determines to allow the user to view the media service, the user's account (typically maintained by the service provider) is charged and a key is downloaded via the broadband connection to the STB.

Abstract: Methods and systems for controlling the distribution of digital content are provided. A license holder acquires protected content and an original digital license to the protected content from a content provider system. The license holder in turn delegates all or part of the grants in that original license to other qualified devices or clients. The content remains in its original, protected or encrypted form while it is delivered from the license holder to the client along with a digital sublicense that the client receives from the original license holder, whereupon the content can then be rendered. The original digital license defines or governs the conditions under which such delegation occurs, and includes terms under which such delegation is permitted to continue in order to enforce the intent of the content provider.

Abstract: An apparatus and a method for generating serial numbers is described. In one embodiment, a block cipher encrypter encrypts an application identifier and a sequence of random numbers to generate a signature. The block cipher encrypter is associated with a serial number key. The application identifier, the sequence of random numbers, and the signature are concatenated to generate a serial number. An encoder encodes the serial number into a string.

Abstract: A method and system for reselling an object in a client-server environment is disclosed. The method and system also enables a user using a client device can order an object, order a customized object, order a composite object, and order a customized composite object. The system includes an object order form handler, an object order handler, a view objects handler, a reseller form handler, a reseller handler, a reseller permission handler, an add object handler and a server database.

Abstract: Manufacturer registration of consumer electronic devices includes a registration server receiving purchaser-specific information from a user computer over a network, such as the Internet. This received purchaser-specific information may then be associated with a temporary short code, which is in turn provided back to the user computer over the network. The purchaser is then free to input the provided temporary short code into the consumer electronic device to be registered, after which both the short code and certain additional device-specific identification information may be provided directly by the consumer electronic device to the registration server over a network connection. The provided short code may then be matched to the previously-provided purchaser-specific information, and the manufacturer registration process completed using both the purchaser-specific information and the device-specific identification information.

Abstract: Systems and methods of theft prevention of communication devices are provided. In one embodiment, the method may include, for example, one or more of the following: registering a communication device being used at a home, where the device is connected to a communication network; entering validation information relating to the communication device; and analyzing the validation information to determine whether the communication device is authorized for use in the communication network.

Abstract: A system, method, and apparatus are arranged to enable loading of an application, such as a game application, prior to a formal release date of the application. An end-user is provided components of the application either over a network, CD, DVD, or the like. At least one component of the application is encrypted. The end-user may register with an application provider. At a pre-defined time, such as a release date for the application, a decryption key is made available to the end-user. The decryption key may be employed to decrypt the encrypted component(s) of the application, such that the application may be readied for execution. In addition, bug fixes, additions, or the like, may also be pre-loaded to release of the application, thereby ensuring that the end-user has the most current application configuration.

Abstract: A dynamic network policies system based on device classification is provided. The system comprises a computer system, a configuration database, and a dynamic network policies application based on device classification that receives a message from a virtual local area network access component containing a device identity certificate. The application parses the device identity certificate to discover a device classification, references the configuration database to determine a network policy associated with the device classification, and associates the network policy with a virtual local area network definition. The application also sends a reply containing the virtual local area network definition to the virtual local area network access component in response to the request, wherein access to network services is made available by association with a virtual local area network, and wherein association with a virtual local network is specific to the device classification and the network policy.

Abstract: Embodiments of the present disclosure describe methods, apparatus, and system configurations for device management in a wireless communication network. A method includes determining, by a server of a communication network, that one or more updates are designated for a mobile station, initiating a re-authentication of the mobile station based on the determining to trigger the mobile station to establish communication with the server of the communication network to receive the one or more updates, and sending the one or more updates to the mobile station. Other embodiments may be described and/or claimed.

Abstract: The Gaming System With End User Feedback enables a reverse path feedback architecture wherein the forward path multicasted gaming content transmitted by a gaming site can be dynamically modified as a result of end user interaction or feedback, wherein each end user has a private bidirectional link to the gaming site to enter their moves, optionally receive private data from the gaming site to enable the end user's device to display private data that is hidden from the other players, and to communicate privately with another member or members of a sub-group.

Abstract: A method and system that enables cross-border compliance with export restrictions of particular computer technology, including software loaded on a computing device. The computing device is loaded with software, and has a country location device, such as a low-end GPS device. The country location device (country locator) stores the present geographic location of the device in a location register. When the computing device is turned on or the software is activated for operation on the computing device, a security utility of the software compares the value in the register against a list of pre-established locations that are export-restricted. When the value matches (or falls within a range) of one of pre-established locations, the features of the software that are export restricted are automatically disabled.

Abstract: A method and system to enhance the protection of the data in an user equipment and secure real time streaming of the data in the user equipment is disclosed. The method and system includes sending request by at least one user to access at least one application server. The user is provisioned to download a appropriate CMSC and a mapper into the user equipment from the application server. The method and system further comprises user sending request via an IMS network to download a data to the user equipment. The data is encrypted in the application server and is downloaded into the user equipment. The mapper identifies the appropriate CMSC, which may decrypt the data. Further, the data undergoes double decryption in real time within the user equipment before being presented in user interface. The double decryption is provisioned using the valid CMSC downloaded in the user equipment.

Abstract: This document discusses, among other things, systems and methods for managing security for network-based gaming. A method and system download and install an image of wagering game content on a wagering game machine, wherein the wagering game machine is capable of receiving a wager input from a player. The image is validated and may be transformed to a virtual storage device, such that it appears to be a physical storage device. The files may be accessed and validated in a similar manner as if they were stored on a physical storage device. In some cases, the same image format for content in an image is the same as if the content was stored on a physical storage device.

Abstract: A smart card and an access method thereof for use with a smart card management system are provided. The smart card management system comprises a smart card access apparatus and a card server. The smart card access apparatus is electrically connected to the smart card. The smart card is configured to store a plurality of application data and management information corresponding to the application data. The smart card access apparatus may transmit a modification signal of a user to the smart card. The smart card may modify the management information according to the modification signal to generate modified management information when the smart card access apparatus is disconnected from the card serve. Therefore, the contents of the smart card may be managed when the smart card access apparatus is disconnected from the card server.