Abstract: When a packet arrives from a communication terminal apparatus, i.e., a communicating terminal with which the IPsec communication is performed, a source IP address is recognized from an IP header of the packet and a security policy is registered in an SPD. At the same time, an encoding parameter for the encoded communication with the communicating terminal is registered in an SAD. When an SA entry is deleted from the SAD, the security policy for the communicating terminal is deleted from the SPD, as long as there is no other entry that is referring to the security policy corresponding to the deleted SA entry.

Abstract: The security of data is enhanced by the use of cyclic redundancy checks. Data is encoded with one or more cyclic redundancy checks and then transmitted by a transmitter to a receiver. The receiver receives the encoded data and decodes it in order to use the one or more cyclic redundancy checks to determine whether the data was sent by an authorized user.

Abstract: A method includes receiving an authentication request from a mobile station (401) and determining whether to forward the request to an authentication agent. When it is determined to forward the request, the request is forwarded to the authentication agent (107). A random number and a random seed are received from the authentication agent (107). The random number and the random seed are forwarded to the mobile station (401). A response to the random number and the random seed from the mobile station (401) is received and forwarded to the authentication agent (107). The authentication agent (107) compares the response with an expected response. When the authentication agent (107) authenticates the mobile station (401), a derived cipher key is received from the authentication agent (107).

Abstract: Disclosed herein is a data transmission system permitting secure and more reliable transmission of data from a data transmitter to a data receiver or receivers. The system comprises: a data transmitter for encrypting data and transmitting the encrypted data; data receivers for receiving the encrypted data from the data transmitter; satellite links used for data transmission from the data transmitter to the data receivers; and bidirectional communication channels which are also used for transmitting data from the data receivers to the data transmitter and which have a smaller capacity of data transmission than the satellite links. The satellite links are used to transmit encrypted data from the data transmitter to the data receivers. At least the bidirectional communication channels are used to communicate restrictive data transmission control information between the data transmitter and the data receivers.

Abstract: A method and apparatus for digital content access control comprises determining the occurrence of a synchronization event that triggers synchronization of information used by one or more content provisioners to create an authenticated digital content request that is based at least in part on a digital content request comprising a request for digital content with information used by one or more content repositories to validate the authenticated digital content request and to return the digital content based at least in part on the validation. The method also comprises determining the information in response to the sychronization event and sending the information to at least one of the group comprising the one or more content provisioners and the one or more content repositories.

Abstract: In an image processing system according to the present invention, a first device encrypts image data generated by reading an image in a document, stores a decryption key for decrypting the image data, and transmits the image data to a data storing device. A second device receives the image data from the data storing device, sends a request for the decryption key to the first device and receives the decryption key, decrypts the image data with the decryption key, and performs print processing on the image data. Thus, users can easily perform print processing without the need to remember authentication and printer information.

Abstract: A method for controlling a flow of a RADIUS (Remote Authentication Dial-In User Service) protocol, where the method allows a plurality of RADIUS servers to share a load in a RADIUS system in which a RADIUS client of the RADIUS system can swiftly receive a response message from a RADIUS server being responsive to a request message from the RADIUS client. The method includes the steps of allowing a RADIUS server to transmit a notification message to a RADIUS client on the basis of a packet format in the RADIUS protocol, the notification message having information relating to an available or unavailable state of the RADIUS server, and allowing the RADIUS client to check the available or unavailable state of the RADIUS server from the notification message received from the RADIUS server.

Abstract: An embodiment of the invention includes a secure server. A user at a terminal, communicatively coupled to the secure server by a secure link, can obtain web pages from web sites in a network, in encrypted form, via the secure link. Addresses associated with the web pages are altered to make it appear as if the web pages come from the secure server rather than from the web sites. Spoofing units may be used as alternative access points to the secure server, with the secure server sending the requested web pages directly to the terminal. In general, address rewriting and other manipulation can be performed on the requested web pages, such that the true sources of the web pages are disguised and such that subsequent communications from the terminal are directed to the secure server and/or spoofing unit, rather than to the true source of the web pages. Components of the user's privacy may be sold, or advertisements may be provided, in exchange for protection of the user's identity.

Abstract: There are provided a method, a system and an initiator server for a secure execution of workflow tasks of a workflow to be executed according to a given execution pattern in a distributed workflow management system within a decentralized network system with a plurality of servers (b0, b1, . . . , bn) including at least an initiator server and at least a number of groups of servers of the plurality of servers. Each group satisfies a policy (poli) of a vertex, and thus, knows a corresponding policy key pair including a policy private key (SKpoli) and a policy public key (PKpoli), respectively. Each vertex denotes a set of workflow tasks to be executed in accord with the execution pattern and is assigned a vertex key pair including a vertex private key and a vertex public key.

Abstract: Disclosed is a method for providing secure access to multiple secure networks from a single workstation. The architecture can use multiple layers of protection to isolate applications running at different security levels. The first means of isolation is a virtual machine monitor that isolates multiple operating systems running within separate virtual machines on the host operating system. The second layer is the use of multiple user security contexts on the host operating system to isolate each virtual machine. The third level of protection is a highly secured and restricted host operating system where all unnecessary services are removed and user actions are restricted to just the virtual machine monitor using software restriction policies. Finally, the operating system and virtual machine monitor can be run from read-only media to prevent any changes by an attacker from persisting.

Abstract: Techniques for assigning a network address to a host are based on authentication for a connection between the host and an intermediate device. One approach involves receiving first data at the intermediate device from an authentication and authorization server in response to a request for authentication for the connection. The first data indicates at least some of authentication and authorization information. A configuration request message from the host is also received at the intermediate device. A second message is generated based on the configuration request message and the first data and is sent to a configuration server that provides the logical network address for the host. The configuration server provides the logical network address based on authorization and authentication information. The logical network address is thus based on the user, e.g., to limit access by the user to the Internet and other services.

Abstract: An address list management apparatus stores, for each user of an MFP (Multi Function Peripheral), a different address list that lists address information pieces for transmission of image data by the MFP. Upon being instructed by a logged-in user to transmit image data, the MFP transmits, to the address list management apparatus, a request for the address list that specifies the user. Upon receiving the request, the address list management apparatus transmits, to the MFP, a sending list pertaining to the user. The sending list is created by deleting secret information from address information pieces in the address list, and modifying such address information pieces so that image data is transmitted to the address list management apparatus. The address list management apparatus refers to the address list, and transfers the image data to the specified address.

Abstract: A method for providing quality of service (QoS) aware, wireless point to multi-point telecommunications in a telecommunications system. The telecommunications system includes: a wireless base station coupled to a first data network; one or more host workstations coupled to the first data network; one or more subscriber customer premise equipment (CPE) stations in wireless communications with the wireless base station over a shared bandwidth using a packet-centric protocol; one or more subscriber workstations coupled to each of the subscriber CPE stations over a second network. The method includes allocating shared bandwidth among the subscriber CPE stations in a manner to optimize end-user QoS. The method includes analyzing and scheduling IP flows over the shared wireless bandwidth. This includes identifying the IP flows; characterizing the IP flows; classifying the IP flows; and prioritizing the IP flows.

Abstract: Methods and apparatus are described which provide secure interactive communication of text and image information between a central server computer and one or more client computers located at remote sites for the purpose of storing and retrieving files describing and identifying unique products, services, or individuals. Textual information and image data from one or more of the remote sites are stored separately at the location of the central server computer, with the image data being in compressed form, and with the textual information being included in a relational database with identifiers associated with any related image data. Means are provided at the central computer for management of all textural information and image data received to ensure that all information may be independently retrieved. Requests are entered from remote terminals specifying particular subject matter, and the system is capable of responding to multiple simultaneous requests.

Abstract: Preparing a document for transmission over a network in a manner that increases the security of URLs included in the document. A server accesses a document that contains a number of URLs. For one or more of those URLs, the server calculates a digital signature that is unique to the intended recipient client, or unique to the user of the client. The server then modifies each of those URLs by including the digital signature in the URL. The document with the modified URLs in then transmitted over the network to the client. Thus, even if a sensitive URL is discovered, that modified URL is unique to the client only or to the user of the client only. Therefore, the damage that may be caused by an unauthorized user is limited to just that client or user.

Abstract: Techniques for seeding data among client machines, also referred to as boxes herein, are disclosed. To prevent the data distributed among the boxes from being illegitimately accessed or possessed, according to one aspect of the present invention, each box is configured to perform what is referred to herein as a transcription process. In other words, when encrypted data is received, the data is decrypted and then re-encrypted with a key agreeable with a next box configured to receive the data.

Abstract: Conventional SSL termination devices support secure connections only to a predetermined destination address. An SSL termination device accepts a plaintext connection and associate it to a secure connection to an arbitrary destination endpoint by intercepting a connection request from the local subnetwork, identifying the intended destination of the connection, and establishing a secure connection to the destination, bridges the local connection and the secure connection to provide a connection through the gateway device. The SSL termination device identifies an outgoing secure connection request from a client, and intercepts the connection request to identify the recipient destination. The SSL termination device establishes a secure connection using the identified destination, and associates the connections by mapping the intercepted connection to the recipient.

Abstract: A Personal Computer Memory Card International Association (PCMCIA) card may establish, via a non-secure network, a secure communications channel between a computer and a secure network. The non-secure network may define a first address space. The secure network may define a second address space. The PCMCIA card may include a cryptography module, a network adapter, and/or a processor. The cryptography module may provide Type 1 cryptography of data communicated between the computer and the secure network. The network adapter may be in communication with the non-secure network and may be associated with a first network address from the first address space. The processor may be in communication with the secure network via the cryptography module and the network adapter. The processor may identify a second network address for the computer from the second address space and may communicate the second network address to the computer, for example via dynamic host control protocol (DHCP).

Abstract: An endpoint uses Interactive Connectivity Establishment (ICE) to enable multimedia communications to traverse Network Address Translators (NATs). A security policy enables security devices and asymmetric security devices to forward ICE messages. A management device stores information about an initial message. Later, a security device receives an ICE message and sends and authorization request to the management device. The management device compares information in the authorization request to information in memory. According to the comparison, the management device authorizes the security device to forward the ICE message.

Abstract: Under the present invention, when an event is received on a server, it is stored and then categorized. In being categorized, an event group pertaining to the event is identified. Based on the group of events, a set (e.g., one or more) of destinations to which the event should be routed can be determined. The group of events is then associated with an access control list (ACL) that contains entries identifying users (or groups of users) and their permissions to interact with events in that group. Once the association is made, the event and optionally the ACL is routed to the appropriate destinations. Based on the permissions contained in the ACL, the destinations will interact with the event accordingly.

Abstract: A host requests a public key certificate from a gateway, and the gateway requests a public key certificate from a Certification Authority (CA). The CA generates a public key certificate, which is sent to the host through the gateway. The host sets an IPv6 address based on information from the gateway. The host requests and receives a new public key certificate whenever necessary, and sends a public key certificate including the IPv6 address to the communication counterpart.

Abstract: The present invention provides a method and program product for randomly relaying a protected web request from a client, through a set of peers, to a privacy proxy. Once received, the web request is proxied to a web services provider. When a provider reply is received by the privacy proxy, it is protected and relayed back through a set of peers to the client.

Abstract: A system and method to verify a user's identity in an Internet-related transaction. One system and method use a personal computer having identification information, a card reader, and a personal identification card having access information, to verify a user's identity using the access information and the identification information. Another system and method use a personal computer, a card reader, and a personal identification card having access information, wherein the card reader is included as part of a mouse coupled to the personal computer and wherein a user's identity is verified using the access information. Another system and method use a personal computer, a fingerprint reader, a card reader, and a personal identification card having access information to verify a user's identity using the access information and the data of the fingerprint reader.

Abstract: A method of multi-domain authorization/authentication on a computer network comprises: a user making a request to a policy enforcement point of a computer for access to information on the computer; providing a location address for a user's authorization and/or authentication information, a policy decision point of the service on the computer network then verifying the authorization/authentication information; and the user being given access by the PEP to the information or the service requested, if the request is accepted, wherein the user's authorization/authentication and/or further information is located on a meta policy decision point (MPDP).

Abstract: A system, method and apparatus for securing communications between a trusted network and an untrusted network are disclosed. A perimeter client is deployed within the trusted network and communicates over a session multiplexing enabled protocol with a perimeter server deployed within a demilitarized zone network. The perimeter client presents requests to make available and communication initiation requests to the perimeter server which presents corresponding sockets to the untrustred network. The session multiplexing capabilities of the protocol used between the perimeter server and perimeter client permit a single communication session therebetween to support a plurality of communication sessions between the perimeter server and untrusted network. In the event data flows across the communication sessions are encrypted, decryption of the data flows is left to the components at the end points of the communication session, thereby restricting exposure of privileged information to areas within trusted networks.

Abstract: A secure pointer. The secure pointer can include an encrypted pointer to a resource disposed in a communicatively coupled computing device. The secure pointer also can include a network address of a server computing device able to locate the resource based upon a decrypted form of the encrypted pointer. Finally, the secure pointer can include an encrypted wrapper about the encrypted pointer and the network address. Notably, the encrypted pointer can be encrypted and decrypted according to a local encryption/decryption key known to the server computing device. Yet, the encrypted wrapper can be encrypted according to a public encryption key while the encrypted wrapper can be decrypted according to a private encryption key corresponding to the public encryption key.

Abstract: Systems and methods for providing autonomous security are configured to modify an original header associated with an original data packet wherein key information is added; encrypt original data associated with the original data packet in response to the key information; and form an encrypted data packet including the modified header and the encrypted data, wherein the encrypted data packet is a same size as the original data packet.

Abstract: An approach for establishing secure multicast communication among multiple members that participate in a multicast group is disclosed. In one feature, multiple multicast proxy service nodes (MPSNs) are defined and control when members join or leave the multicast group. The MPSNs are logically represented by a first binary tree in which each node of the first binary tree is associated with a domain of a directory service and one or more of the MPSNs. A second binary tree is created that has leaf nodes representing each member. The second binary tree is stored in a domain of the directory service with a root node that represents one or more of the MPSNs. The members can each establish multicast communication and serve as a key distribution center. When a member joins the multicast group, a new group session key is determined by replicating a branch of the second binary tree.

Abstract: A method and device performing encryption/decryption of data on a mass storage media. A plurality of different encryption/decryption algorithms with associated keys can be utilised on different storage areas of the media, such as blocks/sectors on a hard disk drive, thereby increasing the security of the data significantly. In addition, combining the keys with random numbers for a further increase of the security of the data. The block/sector number is used to select an algorithm with associated key and random number. The device and method encrypts/decrypts emails, networking traffic etc. and other types of electronic data. In addition, the device provides an authentication session when booting a computer from a hard disk drive, and even be used to select a certain operating system and/or environment associated with a certain key carrier by changing the Master Boot Record of the disk system.

Abstract: A mail delivery system and method utilize unique delivery addresses, each for a corresponding addressee, and addressee-controlled delivery codes. Each delivery code is embedded in a message address but is distinct from the unique root delivery address for the addressee. Mail that bears an address that includes an embedded valid delivery code is delivered and optionally sorted according to the code. Mail that lacks an embedded delivery code is segregated as lacking a valid code. Addressees of the system may define any number of delivery codes and may invalidate delivery codes as desired.

Abstract: A method includes receiving an authentication request from a mobile station (401) and determining whether to forward the request to an authentication agent. When it is determined to forward the request, the request is forwarded to the authentication agent (107). A random number and a random seed are received from the authentication agent (107). The random number and the random seed are forwarded to the mobile station (401). A response to the random number and the random seed from the mobile station (401) is received and forwarded to the authentication agent (107). The authentication agent (107) compares the response with an expected response. When the authentication agent (107) authenticates the mobile station (401), a derived cipher key is received from the authentication agent (107).

Abstract: Systems and/or methods of secure communication of information between multi-domain virtual private networks (VPNs) are presented. A dynamic group VPN (DGVPN) can reside in one domain and a disparate DGVPN can reside in a disparate domain. An administrative security authority (ASA) can be employed in each domain. Each ASA can generate and exchange respective keying material and crypto-policy information to be used for inter-domain communications when routing data from a member in one DGVPN to a member(s) in the disparate DGVPN, such that an ASA in one domain can facilitate encryption of data in accordance with the policy of the other domain before the data is sent to the other domain. Each ASA can establish a key server to generate the keying material and crypto-policy information associated with its local DGVPN, and such material and information can be propagated to intra-domain members.

Abstract: A data delivery system providing multipoint delivery of encrypted digital data to specific destinations. A plurality of pieces of key information are generated on the basis of an encryption key specific to each digital data item to be delivered. The multiple pieces of key information are delivered over routes which differ from the routes used to deliver the digital data and which further differ from each other. Physically different media or transmission over a network at different times are used to separately transmit different sets of key information.

Abstract: To encrypt a digital object, a key ID is selected for the digital object, and a function ƒ( ) having an input and an output is selected. The selected key ID is then employed as the input to the function ƒ( ), and the output of such function ƒ( ) is employed as the key (KD) for the digital object: ƒ(key ID)key (KD). The digital object is then according to such key (KD), and the encrypted digital object is distributed.

Abstract: Disclosed is an authentication mechanism that provides much of the security of heavyweight authentication mechanisms, but with lower administrative and communicative overhead while at the same time not being limited to a 64-bit limit on the length of a cryptographic hash value. Removal of this limitation is achieved by increasing the cost of both address generation and brute-force attacks by the same parameterized factor while keeping the cost of address use and verification constant. The address owner computes two hash values using its public key and other parameters. The first hash value is used by the owner to derive its network address. The purpose of the second hash is to artificially increase that computational complexity of generating new addresses and, consequently, the cost of brute-force attacks. As another measure against brute-force attacks, the routing prefix (i.e., the non-node selectable portion) of the address is included in the first hash input.

Abstract: A device and method for scrambling data by means of address lines is disclosed, which includes a seed generator, a first parameter generator, a data scrambler and a de-scrambler. The seed generator is connected to an address bus for generating a seed in accordance with a specific address on the address bus. The first parameter generator is connected to the seed generator for generating a first parameter based on the seed. The data scrambler is connected to a data bus for scrambling data based on the first parameter when a CPU core is to write the data to the specific address. The de-scrambler is connected to the data bus for de-scrambling the data based on the first parameter when the core is to read the data from the specific address.

Abstract: The present invention relates to a method and apparatus for providing configuration information to terminals and network components within a network. In particular, a specialist is no longer necessary in order to exchange a terminal or a component for the network. The network user simply exchanges the terminal or the network component and places a configuration storage adapter in a serial interface of the replaced terminal or component, whereby the newly inserted terminal or network component is automatically provided with stored configuration information and the network can then be started.

Abstract: A method, apparatus, and computer instructions for managing access to a set of applications associated with a universal resource locator in a data processing system. A request is received, wherein the request includes the universal resource locator and a user identification. The request is directed to a selected application within the set of applications using the universal resource locator and the user identification.

Abstract: Communication using IPv6 is carried out, and conversion is given to a prefix of an IPv6 address in a firewall. A security channel for mutual authentication with an out-of-home apparatus or the like is carried out by the firewall, and only identification of an in-home apparatus is carried out on an in-home network by the firewall. A PC is connected to a PC in-home network different from the in-home network, and communication between the PC and the in-home apparatus is always carried out via the firewall.

Abstract: A system is provided that uses identity-based encryption to support secure communications. Messages from a sender to a receiver may be encrypted using the receiver's identity and public parameters that have been generated by a private key generator associated with the receiver. The private key generator associated with the receiver generates a private key for the receiver. The encrypted message may be decrypted by the receiver using the receiver's private key. The system may have multiple private key generators, each with a separate set of public parameters. Directory services may be used to provide a sender that is associated with one private key generator with appropriate public parameters to use when encrypting messages for a receiver that is associated with a different private key generator. A certification authority may be used to sign directory entries for the directory service. A clearinghouse may be used to avoid duplicative directory entries.

Abstract: A method and system are disclosed that provide a significant improvement for securely selecting a subset of available cryptographic functionality in a system. This is implemented by using the highest level of cryptography available in a system to encrypt the system initialization data used to select, enable, disable, or configure cryptographic features in a crypto chip. The system decrypts the encrypted data by momentarily fully enabling the crypto chip during the boot process, and using a known, system-unique, and fixed seed to generate the private key to use for decryption. The seed used is the system's MAC address (L2 LAN address—medium access control). Alternatively, the system could include a one-time use decryption-only algorithm in the boot strap code itself.

Abstract: A method of transmitting contents, which are to be received at a reception side where a portion of the contents is previewed while the contents are not accessible for playing other than for a preview purpose, includes the steps of encrypting the contents by a first encryption key, generating information indicative of an elapsed time of the contents that indicates a relationship between positions on a time axis of the contents representing an amount of time that passes as the contents are played and a time count that accrues as a preview time when the contents are previewed, encrypting the first encryption key and the information indicative of an elapsed time of the contents by a second encryption key, thereby generating first encrypted information, encrypting the second encryption key and content-usage control information by a third encryption key, thereby generating second encrypted information, the content-usage control information indicating usage of the contents on the reception side, and transmitting the

Abstract: Network registration for a device is achieved by providing the device with an RFID chip bearing a MAC address, cryptographic capabilities and keys, and then disposing the device near a registration server (such as a home network server/server TV) to cause the information on the RFID chip to be automatically transferred to the server and thus execute registration of the device on the network automatically, relieving a person from having to enter long strings of numbers.

Abstract: A method and system for authenticating a message is described, in which the message contains a network address, at least a portion of which is a digital fingerprint. Embedded in the message is data, such as a code, that indicates the size of the digital fingerprint. A device receiving the message uses the size data and, for example, the public key of the sender to attempt to reproduce the digital fingerprint. If successful, the device receiving the message verifies the identity of the sender.

Abstract: A Security Association (SA) lookup table is maintained at a network interface. The SA data is stored in a memory external to the network interface, for example, in the memory of a host electronic system in which the network interface provides network access. The lookup table stores sufficient information for the network interface, or another system component, to access the SA data. When a cryptography operation is to be performed, the SA data is retrieved from the external memory and delivered to the processor performing the cryptographic operations. In one embodiment, destination Internet Protocol (IP) address and the IPSec protocol are checked after the SA data is retrieved from the external memory. In one embodiment, the lookup table entries contain only an offset value from a base address value to locate the SA data.

Abstract: An improved network architecture employs a super authority having an identity catalog to direct login authentication tasks to appropriate authorities. Authentication tasks may be performed by authorities across namespace boundaries if so directed by the super authority, such that a principal account may be moved without alteration of the account ID. In an embodiment of the invention, the identity catalog comprises a listing associating account IDs with appropriate authenticating authorities.

Abstract: The present invention provides a data processing apparatus and method for managing processor configuration data. The data processing apparatus comprises a processor operable in a plurality of modes and a plurality of domains, said plurality of domains comprising a secure domain and a non-secure domain, said plurality of modes including at least one non-secure mode being a mode in the non-secure domain, at least one secure mode being a mode in the secure domain, and a monitor mode. The processor is operable such that when executing a program in a secure mode the program has access to secure data which is not accessible when said processor is operating in a non-secure mode.

Abstract: Systems, methods, and a storage medium for storing and securely transmitting digital media data in a networked system are provided. The method includes determining an amount of memory for storing the digital media data. The method further includes querying a plurality of network computers to determine an amount of available memory in a plurality of memory storage devices associated with the plurality of network computers. The method further includes receiving the digital media data and partitioning the digital media data into a plurality of digital media data sets. The method further includes encrypting the plurality of digital media data sets into a plurality of encrypted digital media data sets using at least one encryption key value. The method further includes storing the plurality of encrypted digital media data sets in at least two of the plurality of memory storage devices associated with the plurality of network computers.

Abstract: A printer controller is provided having an integrated circuit incorporating a processor and memory. The memory stores a set of data representing program code and/or an operating value for printer control. Each bit of the data is stored as a bit/inverse-bit pair in corresponding pairs of physically adjacent bit cells in the memory.

Abstract: A system, device, and method for controlling access in a multicast communication network uses a centralized host authentication scheme to prevent unauthorized hosts from joining a shared multicast distribution tree. Each authorized host is allocated a unique authentication key, which is used by the designated router to encode the PIM join message and by the rendezvous point router to authenticate the PIM join message. If the PIM join message is authentic, then each PIM router from the rendezvous point router to the designated router establishes appropriate multicast routes to route multicast packets to the host. If the PIM join message is not authentic, then multicast packets are prevented from reaching the host.