Abstract: A method is used in validating association of client devices with sessions. Information of a client device executing a user agent is gathered by a server for creating a device identifier for the client device upon receiving a request from the user agent for establishing a session between the user agent and the server. The device identifier includes information identifying the client device. The device identifier is associated with the session. The client device is validated by the server upon receiving subsequent requests from the client device during the session. Validating the client device includes gathering information of the client device sending each subsequent request for creating a device identifier for the client device and comparing the device identifier created from the information gathered during each subsequent request with the device identifier associated with the session.

Abstract: One or more requests are received from a first system. The requests are queued in a queue. A serialization group is determined for a request and the request is associated with the determined serialization group. At least a subset of the requests from the queue is transmitted to a second system if the second system is available, including transmitting requests in a respective serialization group to the second system serially in accordance with an ordering of the requests within the respective serialization group.

Abstract: An apparatus and method for providing a virtual private network (VPN) service based on mutual authentication are provided, the apparatus including a storage unit configured to store a first public key and a second public key; an authentication unit configured to authenticate a VPN server with the first public key and to authenticate a user device with the second public key; and a tunnel management unit configured to generate a first VPN tunnel and a second VPN tunnel to relay data between the user device and the VPN server based on the authentication of the VPN server and the user device by the authentication unit.

Abstract: Inspection of encrypted network traffic where multiple network connections are monitored that carry encrypted data, but only a subset of the network connections are decrypted and inspected. Typically, only network connections that are associated with designated target users whose encrypted data is to be inspected are decrypted. A Network Monitor Center (NMC) dynamically establishes a list of rules for selection of encrypted data connections. The rules are provided to a Secure data Inspection Appliance (SIA) that accepts some or all of the network user encrypted traffic and checks it against a rule table. When detecting an encrypted connection that matches the rule table, the SIA decrypts the connection and provides a copy of the connection plain data to the NMC. The NMC then inspects the plain data for security threats. Once a security threat is found in a connection, the NMC applies predefined consequent actions to this connection.

Abstract: A system and method are provided for securely establishing Layer-3 SVCs or SPVCs across an ATM network. An originating multiservice switch that generates the connection setup message for the Layer-3 connection includes security information within the setup message, such as a Closed User Group Interlock Code. When the destination multiservice switch receives the setup message, it extracts the embedded security information and compares it with stored security information corresponding to the connection. The correspondence may be determined from the destination user. If the embedded security information matches the stored security information, the destination multiservice switch allows the connection to be established.

Abstract: A method includes controlling security in a communication system that involves a node capable of routing traffic according to one or more security algorithms with respective security levels. The node is adapted to estimate at least one safety degree relating to the node, to select at least one security algorithm of the one or more security algorithms, depending on the estimated safety degree; and to activate the at least one security algorithm.

Abstract: A method of providing transparent encryption for a web resource includes a key manager receiving an encryption key policy; receiving user identifiers and resource locators; defining an access control list based the user identifiers; generating an encryption key and a key identifier for a first resource locator; and establishing a secure communication channel between first and second watchdog modules. The method also includes the watchdog sending encryption information using the secure communication channel. The method also includes a transparent encryption module storing the encryption key and the access control list in protected memory; receiving an input comprising a request to access the first resource stored in the web resource; determining that the user identifier is included in the access control list; encrypting data using the encryption key; and decrypting data using the encryption key.

Abstract: A method, system and computer-usable medium are disclosed for managing identity authorizations to access information processing system resources. An application thread requiring access to target resources is initiated and associated with an authenticated client identity and a server identity. The resource authorization attribute of a resource required for execution of the application thread designates the use of a client identity, a server identity, or a client identity and server identity when attempting authorized access of the resource. The client identity, the server identity, or the client identity and server identity is then respectively used to access the target resource and the application thread is executed.

Abstract: A system and method is provided which allows multicast communications encrypted using IPSec protocol to be received by receivers in a network. In order to allow the receivers to receive the encrypted multicast communication, the address information of the received multicast communication is modified to appear as a unicast communication being transmitted directly to the address of the receiver, such that the receiver may then decrypt the received multicast communication using IPSec decryption capabilities or may, alternatively, forward the received multicast communication in its encrypted state to other devices. The system and method further provide IPSec encryption key delivery to the receiver using an encrypted markup language file. Multiple keys may also be generated for a given IP address of a receiver with each key being generated for a particular multicasting hierarchical classification.

Abstract: A network system includes a security device and a network access device. The network access device is to receive a packet from a source node destined to a destination node, and to examine a data structure maintained by the network access device to determine whether the data structure stores a data member having a predetermined value, the data member indicating whether the packet should undergo security processing. If the data member matches the predetermined value, the packet is transmitted to a security device associated with the network access device to allow the security device to perform content inspection, and in response to a response received from the security device, the packet is routed to the destination node dependent upon the response. The packet is routed to the destination node without forwarding the packet to the security device.

Abstract: A server receives identifying information of a user of a client device and data encrypted with a public key of a group, where the encrypted data includes an encrypted session key for secure content. The server determines whether the user is a member of the group using the identifying information of the user. If the user is a member of the group, the server decrypts the encrypted session key using a private key of the group, and causes the client device to obtain a session key to access the secure content.

Abstract: Provided is an identifying device for identifying request content from an encrypted request to a server, the identifying device including: a target acquiring unit for acquiring the data size of an encrypted response returned from the server for the encrypted request to the server to be identified; a candidate acquiring unit for acquiring the data size of each of a plurality of encrypted response candidates returned by the server in response to a plurality of encrypted request candidates to be identified sent to the server corresponding to a plurality of known request content candidates; and an identifying unit for identifying the request content to be identified from the plurality of request candidates on the basis of results obtained by comparing the data size of an encrypted response for an encrypted request to be identified to the data sizes of a plurality of encrypted response candidates.

Abstract: An information management apparatus includes a first control information setting unit that sets first control information for permitting use of information within a destination terminal to the information; a second control information setting unit that sets second control information for permitting the destination terminal to forward the information to the information; a displaying permitting unit that controls, when information set with the first control information is received from a source terminal, to permit the information to be used locally within an apparatus; and a forwarding permitting unit that controls, when information set with the second control information is received from a source terminal, to permit the information to be forwarded.

Abstract: A system and a computer-implemented methods for email management are disclosed. The method includes storing messages for electronic mail accounts provided by remote electronic mail server systems. The method further includes determining that the remote electronic mail server systems each have a different hostname than the others of the remote electronic mail server systems. The method further includes displaying messages from a first one of the electronic mail accounts and displaying a hostname of a first remote electronic mail server system providing the first one of the electronic mail accounts. The method further includes receiving a request to view messages from a second one of the electronic mail accounts. The method further includes displaying messages from the second one of the electronic mail accounts and displaying a hostname of a second remote electronic mail server system providing the second one of the electronic mail accounts.

Abstract: An elliptic curve random number generator avoids escrow keys by choosing a point Q on the elliptic curve as verifiably random. An arbitrary string is chosen and a hash of that string computed. The hash is then converted to a field element of the desired field, the field element regarded as the x-coordinate of a point Q on the elliptic curve and the x-coordinate is tested for validity on the desired elliptic curve. If valid, the x-coordinate is decompressed to the point Q, wherein the choice of which is the two points is also derived from the hash value. Intentional use of escrow keys can provide for back up functionality. The relationship between P and Q is used as an escrow key and stored by for a security domain. The administrator logs the output of the generator to reconstruct the random number with the escrow key.

Abstract: The present invention relates to a system and method for issuing an authentication key for authenticating a user in a CPNS environment. The system comprises a user terminal, a gateway and a CPNS device. The user terminal is equipped with a short-range wireless communication function, requests the gateway to register terminal information including an ID and password, encrypts the terminal information including the ID and password using the password, transmits an authentication request signal including the encrypted terminal information to the gateway, and receives an authentication key generated by a CPNS device. The CPNS device stores the terminal information, performs user authentication by decrypting the encrypted terminal information in response to the authentication request, generates an authentication key for the CPNS when a user is authenticated, encrypts the generated authentication key using the password, and transmits the encrypted authentication key to the user terminal through the gateway.

Abstract: An authentication system receives encrypted terminal identification information and terminal identification information, from a transmission terminal, and determines whether decrypted identification information decrypted using a terminal public key obtained by the authentication system matches the terminal identification information received from the transmission terminal.

Abstract: A method for enabling a scalable public-key infrastructure (PKI) comprises invoking a process of receiving a message for a device, identifying an association ID for the device, retrieving encrypted association keys stored on the server for communicating with the device, the encrypted association keys encrypted using a wrapping key stored on a Hardware Security Module (HSM). The method further comprises sending the message and the encrypted association keys to the HSM, unwrapping, by the HSM, the encrypted association keys to create unwrapped association keys, cryptographically processing the message to generate a processed message, deleting the unwrapped association keys, sending the processed message to the device, and invoking, concurrently and by a second application, the process.

Abstract: A method for the secure exchange of data over an ad-hoc network implementing an Xcast broadcasting service and an associated node are disclosed. The method includes providing a security graph for the network and a communication graph for the network, routing a data item between the sender node sending the data and each receiver node receiving the data along a secure route on the security graph. The method also includes generating, between one relay node and a subsequent relay node of the secure route, an appropriate message, containing the data protected in accordance with a security association shared between the relay node and the subsequent relay node. The method further includes routing the message from the relay node to the subsequent relay node along a communication route on the communication graph.

Abstract: A method and a system are provided for generating information that relates to services being utilized by a user, by which: at a user device, retrieving usage information that relates to services consumed by the user of the user device; forwarding by the user device the retrieved usage information towards a central processing unit; at the central processing unit, determining based on the received usage information and based on at least one pre-determined criterion associated with the services being consumed by the user, whether a message should be sent to that user; and if in the affirmative, sending a message to the user that relates to the received usage information, without logging any information that relates to the message being sent to the user, at the central processing unit.

Abstract: A method of detecting and responding to an email address harvest attack at an Internet Service Provider (ISP) email system includes counting a number of failed email address look-ups during a single Simple Mail Transfer Protocol (SMTP) session associated with an originating Internet Protocol (IP) address and responding to the originating IP address with a positive acknowledgement that an otherwise invalid email address exists when the count of the number of failed email address look-ups exceeds a threshold.

Abstract: A device for manipulating a computer file or program includes a processor. The device includes a network interface which receives commands. The device includes a receiver which receives the commands from the network interface and provides the commands to the processor. The device includes storage having a computer file or program in a memory. Wherein the processor, based on the commands, makes changes to the computer file or program in the memory and suspends and reestablishes user intervention to the computer file or program. A device for manipulating a computer file or program.

Abstract: A system and method for a distributed multi-processing security gateway establishes a host side session, selects a proxy network address for a server, uses the proxy network address to establish a server side session, receives a data packet, assigns a central processing unit core from a plurality of central processing unit cores in a multi-core processor of the security gateway to process the data packet, processes the data packet according to security policies, and sends the processed data packet. The proxy network address is selected such that a same central processing unit core is assigned to process data packets from the server side session and the host side session. By assigning central processing unit cores in this manner, higher capable security gateways are provided.

Abstract: Disclosed are an apparatus and method for managing a digital copyright on electronic publication (EPUB)-based content and an apparatus and method for providing EPUB-based content according to a user's right. An encryption unit of the apparatus for managing digital copyright generates encrypted unit files by encrypting a plurality of unit files included in content in the form of a compressed archive including the plurality of unit files with different encryption keys, stores the encrypted unit files in a content database, generates mapping data by mapping the encryption keys to pieces of identification information of the encrypted unit files, and stores the mapping data in an encryption key database.

Abstract: A computer-implemented method for providing secure mobile email communications is described. At least one application programming interface (API) of a native email client is hooked in order to transmit data securely via email. The native email client is native to an operating system of the mobile device. An email originating from a registered application is detected, via the hooked API. The email includes the data to transmit securely. The registered application is registered in a registry according to a mobile application authentication procedure. The registry includes a plurality of registered applications authenticated according to the mobile application authentication procedure.

Abstract: Techniques for secure message offloading are presented. An intermediary is transparently situated between a user's local messaging client and an external and remote messaging client. The user authenticates to the local client for access and the intermediary authenticates the user for access to the remote client using different credentials unknown to the user. Messages sent from the local client are transparently encrypted by the intermediary before being passed to the remote client and messages received from the remote client are transparently decrypted before being delivered to the local client.

Abstract: A security virtual machine is provided in a network including a resource shared among two or more virtual machines. All data traffic from each virtual machine to or from the shared resource is transmitted over an encrypted channel to the security virtual machine. Each connection between a virtual machine and the security virtual machine is maintained as a separate encrypted channel, preventing one virtual machine from accessing data sent to or from another virtual machine, even though the virtual machines are all sharing the same resource.

Abstract: Secure management of electronic transactions is provided by a system server that is communicatively coupled to terminals configured as thin client devices (TCD) and to one or more application servers. A TCD completes a secure communications link with the system server, and transfers information concerning the identity of a user and account information from a secure transaction card (STC). Upon authentication, the system server drives the display of available applications at the TCD, allowing the user to select and engage in a desired transaction with the application server hosting the selected application. During the transaction, the system server brokers communications according to the different security schemes used by the TCD and the application server and, ultimately, stores a transaction ticket that memorializes the transaction. The transaction ticket can later be retrieved by presenting appropriate authentication information.

Abstract: Disclosed are a method and a system for synchronizing and providing data requiring digital rights protection, to a portable device, wherein a contents providing server is connected with a contents synchronization server to which the portable device is connected.

Abstract: Methods and systems for a flexible, scalable hardware and software platform that allows a managed security service provider to easily provide security services to multiple customers are provided. According to one embodiment, a method is provided for delivering customized network services to subscribers of a service provider. Multiple virtual routers (VRs) are provided within each of multiple service processing switches of a service provider. Each VR is supported by an object group and each object of the object group supports a network service. One or more VRs are assigned to a subscriber of multiple subscribers of the service provider. Customized network services are provided to the subscriber by the one or more VRs assigned to the subscriber.

Abstract: An auditable cryptographic protected communication system for connecting an enterprise server to a plurality of industrial devices using messaging protocols for each industrial device enabling the industrial devices to receive commands and transmit status and measurement data using the individual device messaging protocols over a network.

Abstract: Systems, methods and computer program products for enabling enforcement of an administrative policy on one or more mobile devices are described herein. In an embodiment, an administrator uses a policy server to create and provide an enforcement policy to a mobile device. An enforcement policy may include information on mobile device resources which may be controlled by an administrator. An enforcement policy also includes information on how mobile device features will be set, configured or disabled. An enforcement device driver and an enforcement monitor on a mobile device use the enforcement policy to control access to resources associated with the mobile device regardless of whether the mobile device is “online” and connected to a network or “offline” and disconnected from a network.

Abstract: There is provided a method to enable mobile devices to rendezvous on a shared communication service. The method includes steps for creating, via a device, a shared username and a shared password for a private channel in a communication network, determining a unique channel identification (ID) for the private channel based on the shared username and the shared password, and configuring the device with the shared username and the shared password. The method further includes steps for subscribing the device to the private channel using the unique channel ID, transmitting, in response to a discovery request, a self-identification discovery response over the private channel, and broadcasting data between the device and each additional device connected to the private channel.

Abstract: An apparatus and method for providing a security service for UI applications in a network system. In a network supporting a user interface, encryption-unneeded data is distinguished from data in which security identifier is specified, that indicates a need for security between a server and a communication device, and the distinguished data is transmitted over a security channel and a general channel separately.

Abstract: A method and apparatus that secures a dynamic virtualized network is described. In an exemplary embodiment, a device learns a current network policy of the dynamic virtualized network, where the dynamic virtualized network is a virtualized layer 2 network that is overlaid on a layer 3 physical network. In addition, the current network policy includes multiple network policy elements, where each of the multiple network policy elements identifies an authorized endpoint in the dynamic virtualized network. Furthermore, the layer 3 physical network includes multiple network access devices. The device further determines a network security policy for the dynamic virtualized network from the current network policy. The network security policy includes one or more second network policy elements that are a different network policy element than one of the multiple network policy elements of the current network policy.

Abstract: A distributing device for generating private information correctly even if shared information is destroyed or tampered with. A shared information distributing device for use in a system for managing private information by a secret sharing method, including: segmenting unit that segments private information into a first through an nth pieces of shared information; first distribution unit that distributes the n pieces of shared information to n holding devices on a one-to-one basis; and second distribution unit that distributes the n pieces of shared information to the n holding devices so that each holding device holds an ith piece of shared information distributed by the first distribution unit, as well as a pieces of shared information being different from the ith piece of shared information in ordinal position among n pieces of shared information, “i” being an integer in a range from 1 to n.

Abstract: Various techniques, including a method, system and computer program product for restoring encrypted files are disclosed. The method includes accessing a file table record for an encrypted file. The file table record includes an encrypted file stream and extent information identifying a location of one or more portions of the encrypted file in a virtual machine image. In response to accessing the file table record a consecutive data stream is stored. Storing the consecutive data stream includes encapsulating the encrypted file stream and the one or more portions of the encrypted file.

Abstract: A method and apparatus that secures a dynamic virtualized network is described. In an exemplary embodiment, a device learns a current network policy of the dynamic virtualized network, where the dynamic virtualized network is a virtualized layer 2 network that is overlaid on a layer 3 physical network. In addition, the current network policy includes multiple network policy elements, where each of the multiple network policy elements identifies an authorized endpoint in the dynamic virtualized network. Furthermore, the layer 3 physical network includes multiple network access devices. The device further determines a network security policy for the dynamic virtualized network from the current network policy. The network security policy includes one or more second network policy elements that are a different network policy element than one of the multiple network policy elements of the current network policy.

Abstract: There is provided a method for optimizing a download of requested data to an electronic data processing unit that is currently receiving unrequested multicast data through a router included in a network. The unrequested multicast data corresponds to at least one multicast data group. Internet Group Management Protocol (IGMP) V2 Leave Messages are sent to the router for the at least one multicast data group. IGMP Membership Queries issued by the router for the at least one multicast data group are ignored, so as to cause the router to terminate a transmission of the unrequested multicast data to free up available bandwidth for the download of the requested data.

Abstract: Communications can be processed with multiple countermeasures to identify attacks. Each countermeasure can compute a probability of a communication containing an attack and an accompanying confidence score indicating confidence in the probability. Combining the probabilities can produce a composite probability and associated confidence of the communication containing an attack. The composite probability and confidence scores can be produced from a weighted combination of the individual countermeasure probabilities and confidence scores. Weighting factors can be generated or obtained from a database that stores profiles of confirmed attacks.

Abstract: A method of encrypting and transferring data between a sender and a receiver in a secure manner is disclosed. The method includes steps of a server receiving from the sender an identifier of the receiver; establishing a transfer specific encryption key specific to the transfer; encrypting the data using the transfer specific encryption key; the server accessing receiver specific information according to the received identifier of the receiver and encrypting, with the receiver specific information, said transfer specific encryption key; transferring the encrypted data and the encrypted transfer specific encryption key over the network for receipt by the receiver; the server receiving from the receiver the encrypted transfer specific encryption key; the server accessing the receiver specific information to decrypt the encrypted transfer specific encryption key; and decrypting the encrypted data using the decrypted transfer specific encryption key.

Abstract: An information processing device and method include storing encrypted content, storing a key for decrypting the encrypted content stored, decrypting the encrypted content stored using the key, storing a deletion table storing information indicating whether or not the key stored is to be deleted when a transition from an operating state to one of other states is made, the information corresponding to the other states, and checking the information in the deletion table corresponding to the one of the other states and deleting the key when the information indicates that the key is to be deleted.

Abstract: A computerized system and method for processing network content in accordance with at least one content processing rule. In accordance with the inventive method, the network content is received at a first interface. The inventive system identifies a transmission protocol information of the received network content and uses the identified transmission protocol information to intercept at least a portion of the received network content formatted in accordance with a transmission protocol. The intercepted portion of the network content is redirected to a proxy, which buffers the redirected portion of network content. The buffered network content is scanned in accordance with a scanning criterion and processed in accordance with the at least one content processing rule based on the result of the scanning. The processed portion of network content may be forwarded using the second interface.

Abstract: A method for encrypting print jobs that includes receiving output data, encrypting the output data with a randomly-generated symmetric session key, generating a session key header by encrypting the randomly-generated symmetric session key using an asymmetric user public key, and encrypting the session key header using a server public key.

Abstract: An apparatus for generating a key for access control of content in a distributed environment network is provided. The apparatus includes a first key distributor configured to generate first encrypted keys by encrypting a first key corresponding to a key for write authorization using each public key of members having write authorization among members included in an access control list including information of at least one user and distribute the access control list and information about access authorization and the first encrypted keys to the members having write authorization, and a second key distributor configured to generate second encrypted keys by encrypting a second key corresponding to a key for read authorization using the first key using each public key of members having read authorization among members included in the access control list and distribute the access control list and second encrypted keys to the members having read authorization.

Abstract: A network node for communicating data packets secured with a security protocol over a communications network includes a host information handling system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about data packets, and the external offload security device provides stateless secure data encapsulation and decapsulation of packets using a security protocol. An external network interface controller or internal network interface controller communicates encapsulated data packets over the communications network to a final destination. Encapsulation and decapsulation of packets by the external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot-swapping of external security offload devices without information loss.

Abstract: The present invention provides an information processing device, an information processing system, and a program capable of improving security and convenience. An information processing system (1) includes an IC card (30) which stores an encryption key and a registered password and allows the encryption key to be read when the IC card (30) has authenticated the user as an authorized user based on the registered password, and an information processing device (10) which stores folder information in which the folder name, path, and hash value of the encryption key are associated, when a request to save data in the folder has been issued from the user, decides whether or not an encryption key corresponding to the folder is included in the encryption key read from the IC card (30) based on the folder information, encrypts the request target data using the corresponding encryption key when the information processing device (10) has decided “YES”, and stores the encrypted data.

Abstract: An apparatus is disclosed including one or more security structures. The one or more security structures includes: a weldable frame; a plurality of composite panels, each panel securable to the weldable frame, each composite panel configured to form at least one joint with at least one adjoining composite panel; and a respective security element embedded within each of the composite panels. The security element is configured to detect a breach in the composite panel.

Abstract: A system and method for a distributed multi-processing security gateway establishes a host side session, selects a proxy network address for a server, uses the proxy network address to establish a server side session, receives a data packet, assigns a central processing unit core from a plurality of central processing unit cores in a multi-core processor of the security gateway to process the data packet, processes the data packet according to security policies, and sends the processed data packet. The proxy network address is selected such that a same central processing unit core is assigned to process data packets from the server side session and the host side session. By assigning central processing unit cores in this manner, higher capable security gateways are provided.

Abstract: Exemplary embodiments of the present invention disclose a method and system for securing a message published to a topic by a publisher in a publish-subscriber messaging system with a topic policy for the topic. In a step, an exemplary embodiment establishes a topic policy for a topic. In another step, an exemplary embodiment associates a message published to the topic with a topic policy. In another step, an exemplary embodiment signs a message published to the topic by a publisher with a private key of the publisher if the topic policy directs. In another step, an exemplary embodiment provides a public key of a subscriber if the topic policy directs that the subscriber receive a message in encrypted form. In another step, an exemplary embodiment encrypts a message for a subscriber specified in a topic policy to receive the message encrypted with a public key of the subscriber.