Abstract: Methods for providing for secure communications across data networks, including untrusted networks. In one embodiment, the method comprises establishing security associations between devices on the network using a digital certificate and key exchange protocol. In one variant, the digital certificate comprises a public encryption key; the recipient of the certificate authenticates the sender using at least the signature, and then generates a cryptographic element (e.g., key), and initialization vector. The key is encrypted and sent back to the originator, where it is decrypted and used to encrypt datagrams sent between the devices. The initialization vector may be used to initialize the encryption algorithm on the receiving device.

Abstract: A process for centrally managing a large number of computers from a central location when technical expertise is not available at each end point nor can other remote management techniques be employed such as remote desktop or direct connection to an agent. This process consists of the generation of processing instructions at a central point which can then be distributed to any number of endpoints in an asynchronous manner where they will be automatically applied and, if requested, response returned to the central management point asynchronously. The communication mechanisms are secure, verifiable, and require no special expertise at the endpoint to employ. Asynchronous refers to the ability for processing instructions and responses to be transferred by a variety of methods but not solely dependent on direct communications, such as via a store-and-forward mechanism, and can also include server-side push directly to the endpoint and client-side pull from a predetermined rendezvous point.

Abstract: An encryption key module in a content providing server receives a request to stream electronic media data to the user device. The encryption key module identifies a predefined shared secret key corresponding to a key in a subscriber identity module (SIM) in the user device. The predefined shared secret key is used for encryption of data. The encryption key module encrypts the requested electronic media data based on the shared secret key and provides the encrypted electronic media data to the user device over a wireless network.

Abstract: Active learning-based fraud detection techniques are provided in adaptive authentication systems. An authentication request from an authentication requestor is processed by receiving the authentication request from the authentication requester; comparing current data for the user associated with the user identifier with historical data for the user; generating an adaptive authentication result based on the comparison indicating a likelihood current user data is associated with a fraudulent user; and performing one or more additional authentication operations to improve learning if the request satisfies one or more predefined non-risk based criteria. The predefined non-risk based criteria comprises, for example, (i) the request receiving a riskiness score below a threshold based on current data and wherein the request was expected to have a risk score above a threshold, or (ii) the request being in a bucket having a number of tagged events below a threshold.

Abstract: A system for transferring secured data has an authentication facilitator that transmits data indicative of a graphical key pad to a remote display device of a user computing device and, in response, receives from the user computing device icon location data indicative of locations of icons selected by a user. Additionally, the authentication facilitator recovers a personal identifier (PI) from the icon location data, translates the recovered PI to obtain a translated PI, and transmits the translated PI. The system further has a partner computing apparatus that receives the translated PI and allows the user access to a secured area based upon the translated PI.

Abstract: Disclosed is a method including allowing an application server to request setup of a session on behalf of a user terminal, and using mechanisms of a generic peer authentication procedure for procedure for enabling authentication of the application server to an interrogating server, the interrogating server being a network element that is configured to process said request to setup a session on behalf of a user terminal. Also disclosed are related devices, systems and computer programs.

Abstract: A first node sends a sequence of packets to another node to which it is connected over a communication network. A second node monitors network traffic in the communication network and intercepts the sequence of packets in the network traffic sent by the first node. The second node decodes a message in the sequence of packets intended for the second node, wherein the message is encoded using lengths of the packets in the sequence of packets.

Abstract: Provided is an incremental MAC tag generation device that enables incremental tag calculations that can support the editing of all block units, without losing the efficiency of normal tag calculations. A padding unit (11) carries out padding on a final block of a plaintext (M) that has been divided into a plurality of blocks. A cache reference parallel encryption unit (12) inputs blocks of the plaintext (M) other than the final block, a cached plaintext (M?), and an intermediate variable (S?) obtained by encrypting the plaintext (M?), and calculates an intermediate variable (S). A scrambled hash unit (13) carries out scrambling processing and calculates a hash value V. A tag generation unit (14) encrypts the hash value V and calculates a tag.

Abstract: Monitoring for potential misuses of identity information is disclosed. A profile comprising a user's identity information is received. An indication from a third party website that at least a portion of the identity information in the user's profile is being or has been provided to register at the third party website, alter user information stored by the third party website, or both is received. Whether the indicated use of the identity information is a potential misuse is evaluated.

Abstract: Method enabling a user to verify the operation of a personal cryptographic device, comprising the following steps: a) a user (2) enters an access request in a terminal (3) (100), d) a personal cryptographic device (1) of the user (2) calculates and displays a response (105), g) the user (2) verifies the operation of the personal cryptographic device (1) by requesting the terminal (3) to display the expected response to the challenge (110), i) the terminal (3) displays the expected response to the challenge (113), j) the user (2) compares the response displayed by the personal cryptographic device with the response displayed by the terminal.

Abstract: The present invention provides a method for keys generation, member authentication and communication security in a dynamic group, which comprises steps: assigning each member an identification vector containing common group identification vector elements and an individual identification vector element, and generating an authentication vector and an access control vector for each member according to the identification vector; using the identification vector elements to generate public key elements and establish an authentication public key and an access control public key; and using a polynomial and the identification vector to generate a private key. The present invention uses these public keys and private keys, which are generated from the identification vectors, to implement serverless member authentication and data access control, whereby is protected privacy of members and promoted security of communication.

Abstract: A method includes generating a randomized base point and causing the randomized base point and a private key to be loaded into a signature engine device. The method also includes signing a message using the randomized base point and the private key as a base point as well as the private key in an elliptic curve cryptographic (ECC) signature.

Abstract: Consistent one-time password (OTP) functionality is provided from a presentation server to secure various on-line resources. A seed file can be provided to or created by a service provider for execution as part of a hosted page displayed at a client to a user. A presentation server receives a call from the seed file. A user interface widget can be initialized at the presentation server in response to the call from the seed file. The widget can be displayed as part of the remotely hosted Web page so that the user perceives the UI widget to be embedded in the page as viewed on the client computer system. Security for the interaction between the servers can be provided through use of security assertion markup language (SAML).

Abstract: According to an embodiment, a data management device includes a receiver; a first calculator; a second calculator; and a transmitter. The receiver is configured to receive at least one piece of encrypted data obtained by encrypting a piece of data and at least one message authentication code for the piece of encrypted data. The first calculator is configured to aggregate pieces of encrypted data received to calculate aggregated encrypted data corresponding to a sum of the pieces of data encrypted. The second calculator is configured to sum up message authentication codes received to calculate a total value of the message authentication codes for the aggregated encrypted data. The transmitter is configured to transmit the aggregated encrypted data and the total value of the message authentication codes.

Abstract: A security module and method within an information handling system are disclosed. In a particular form, a processing module can include a local processor configurable to initiate access to resources of a host processing system. The processing module can also include a security module configured to enable use of the resources of the host processing system using a security metric. According to an aspect, the security module can be further configured to detect the security metric, and enable access to a resource of the host processing system in response to the security metric. The security module can further be configured to disable access to another resource of the host processing system in response to the security metric.

Abstract: Apparatus and methods are described for searching and replacing user credentials in a multiple disparate credential store environment. Upon authentication of a user to change credentials, credential information of multiple disparate credential stores is searched. Upon population of search results, users indicate which of the credentials they desire to change and results are committed upon affirmative execution in a user interface dialog. In this manner, users locate their credential information, from whatever store, and change it in quantity or singularly from a single point of control. They can also fully understand how many passwords, secrets, keys, etc., they have over the many disparate stores available to them and affirmatively control their relationship to other credential information. Reversion of credential information to an earlier time is still another feature as is retrofitting existing SSO services. Computer program products and computing network interaction are also disclosed.

Abstract: Provided are techniques for providing security in a computing system with identity mediation policies that are enterprise service bus (EBS) independent. A mediator component performs service-level operation such as message brokering, identity mediation, and transformation to enhance interoperability among service consumers and service providers. A mediator component may also delegate identity related operations to a token service of handler. Identity mediation may include such operations as identity determination, or “identification,” authentication, authorization, identity transformation and security audit.

Abstract: Communication abuse prevention techniques are described. In an implementation, a reputation level for a communication is determined based on relation information for a sender and an intended recipient of the communication. A challenge is invoked that is to be completed by the sender before the communication is sent. The challenge is selected based on the reputation level for the communication. The communication is caused to be available for access based on successful completion of the challenge. Access to the communication is inhibited in response to a subsequent determination of the reputation level that indicates that the reputation level for the communication has changed to a new reputation level prior to the communication being accessed by the intended recipient. The subsequent determination is based on additional information associated with the sender of the communication.

Abstract: A device for generating a session key which is known to a first communication partner and a second communication partner, for the first communication partner, from secret information which may be determined by the first and second communication partners, includes a first module operable to calculate the session key using a concatenation of at least a part of a random number and a part of the secret information. The device also includes a second module operable to use the session key for communication with the second communication partner.

Abstract: Two-party, role-based email verification can be used by an administrator to control the sending of emails by an authorized user. Various administrator notification/approval options may be provided. Two-party, role-based verification may also be applied to e-commerce transactions and other transactions where two-party, role-based verification is desirable.

Abstract: The present invention concerns a method of generation of a secret key, shared between a first terminal and a second terminal. The key is generated from the impulse response of the transmission channel separating the two terminals. A first message representative of the impulse response estimated by the first terminal is transmitted to the second terminal. This message is encoded using a channel encoding and punctured at a rate which prevents any decoding if additional information is missing. The second terminal combines this first message with at least a part of a second message representative of the impulse response estimated by the second terminal in order to attempt to decode the first message. If the decoding is successful the secret key is generated by the second terminal from the first message thus decoded.

Abstract: A biometric-information processing apparatus and method including storing sample biometric information of a user each time biometric authentication processing for verifying sample biometric information of a user against enrolled biometric information registered in a first storage unit succeeds, where the user's sample biometric information is stored in a second storage unit, and selecting an update-candidate biometric information for updating the user's enrolled biometric information from the user's sample biometric information stored in the second storage unit, based on a result of verification of multiple pieces of the user's sample biometric information stored in the second storage unit against enrolled biometric information of other users.

Abstract: The present disclosure is directed towards systems and methods for performing multi-level tagging of encrypted items for additional security and efficient encrypted item determination. A device intercepts a message from a server to a client, parses the message and identifies a cookie. The device processes and encrypts the cookie. The device adds a flag to the cookie indicating the device encrypted the cookie. The device re-inserts the modified cookie into the message and transmits the message. The device intercepts a message from a client and determines whether the cookie in the message was encrypted by the device. If the message was not encrypted by the device, the device transmits the message to its destination. If the message was encrypted by the device, the device removes the flag, decrypts the cookie, removes the tag from the cookie, re-inserts the cookie into the message and transmits the message to its final destination.

Abstract: Systems and methods are described herein for authenticating a user device that uses a wireless local area network. The user device may generate an encrypted authentication block and/or digitally signed block that includes a variety of information associated with the user device. The user device may attach the encrypted authentication block to periodic messages that are being monitored by the network. The messages may include an unencrypted portion in addition to the encrypted authentication block. A network server may extract the authentication block and decrypt the user device information to verify the identity or the digital signature of the user device. If the network server verifies the identity of the user device, the network server may continue to communicate and provide services with the user device. If the user device identity is not verified, the network server may cease communicating with or providing the user device.

Abstract: A sensor module for detecting at least one physical variable. The sensor module is configured to relay measured values, which characterize the at least one physical variable, to an external unit. The sensor module is configured to form a message authentication code and relay it to the external unit. The message authentication code allows the authenticity and integrity of at least one measured value to be checked.

Abstract: The present invention relates to a method and system to securely authenticate an operation request using a secure device. Automatic rejections are initiated on the basis of detection of mismatch of information by the secure device received from a server computer and an insecure terminal. The system and method further enables the user to manually confirm/reject operation requests by providing user inputs on an insecure terminal.

Abstract: A communication method on a communication link between an aircraft and a ground station, the communication capable of being configured according to a plurality of safety levels in which, when the aircraft sends a request to a ground station to modify the safety level of the communication from a previous safety level to a new safety level and the aircraft does not receive an acknowledgement of the request by the ground station, the aircraft still accepts messages from the ground station according to the new security level.

Abstract: Described are various implementations of location-targeted online services. When a user accesses the Internet from a supported location, he'll be able to use premium or exclusive online services (premium content, member-only discounts etc.) for free and without going through an elaborate subscription process. The location owner may promote these services before the user enters the location. Example: in addition to mentioning “free Internet”, the hotel owner can attract new customers by mentioning “free Netflix movies” or “free access to premium content, from Zagat reviews to stock reports”. It allows the location owner to utilize a network (WIFI) service provider as a means of increasing its core business and not just as a source of incremental advertisement income.

Abstract: A method for joining a user domain based on digital right management (DRM), a method for exchanging information between a user device and a domain enforcement agent, and a method for exchanging information between user devices belonging to the same user domain include sharing a domain session key between the user device and the domain enforcement agent or between the user devices belonging to the same user domain. Information is exchanged through a secure session set up between the user device and domain enforcement agent or between the user devices, and information exchange occurs through encryption/decryption using the domain session key.

Abstract: Systems and methods for providing authentication using an arrangement of dynamic graphical images. The graphical images can be arranged as a grid or matrix for presentation on a device display for authentication of a user. The kinds of graphical images can be derived from a designated authentication category and non-authenticating categories. A series of password elements corresponding to the graphical images can be displayed with the graphical images. The user may enter the series of one or more password elements corresponding to graphical images from the authentication category which combine to form a password entry. An authentication server can compare the password entry to an authentication password corresponding to the particular arrangement of dynamic graphical images. The selection of graphical images, their arrangement and their corresponding password elements, may dynamically change in between authentication processes.

Abstract: A computing device and method for managing security of a memory or storage device without the need for administer privileges. To access the secure memory, a host provides a data block containing a control command and authentication data to the memory device. The memory device includes a controller for controlling access to a secure memory in the memory device. The memory device identifies the control command in the data block, authenticates the control command bused on the authentication data, and executes the control command to allow the host device to access the secure memory.

Abstract: Principles of the invention provide one or more secure key management protocols for use in communication environments such as a media plane of a multimedia communication system. For example, a method for performing an authenticated key agreement protocol, in accordance with a multimedia communication system, between a first party and a second party comprises, at the first party, the following steps. Note that encryption/decryption is performed in accordance with an identity based encryption operation. At least one private key for the first party is obtained from a key service. A first message comprising an encrypted first random key component is sent from the first party to the second party, the first random key component having been computed at the first party, and the first message having been encrypted using a public key of the second party.

Abstract: A host organization system for a host organization of a physical site, receives a request, by a visitor with an identifier of a visitor organization for a visitor access medium, for access to the physical site controlled by a physical access control system requiring presentation of the visitor access medium for access to the physical site, wherein there is an electronic trust relationship between the host organization system and a visitor organization system for the visitor organization via a network, wherein the visitor organization system maintains an electronic identity profile for the visitor. Responsive to the host organization system receiving an authenticated identifier for the visitor from the visitor organization system and validating the authenticated identifier from the visitor organization system, issuing a visitor access medium to the visitor for controlling access to the physical site.

Abstract: In one embodiment, an object in a database schema may be verified as having a valid digital signature associated with a trusted entity. An application may be permitted access to the object of the database schema only when the object of the database schema is verified to have a valid digital signature associated with the trusted entity. In another embodiment, an object in a database schema may be verified as having a digital signature associated with at least one trusted entity. An application may be permitted access to the object of the database schema only when the digital signature for the object is verified to be associated with the at least one trusted entity.

Abstract: A method is described for negotiating the use of multi-link ciphering and for the generation of unique keys for each of the links using a single 4-way handshake protocol exchange.

Abstract: A network component comprising at least one processor coupled to a memory and configured to exchange security information using a plurality of attributes in a management entity (ME) in an optical network unit (ONU) via an ONU management control interface (OMCI) channel, wherein the attributes provide security features for the ONU and an optical line terminal (OLT). Also included is an apparatus comprising an ONU configured to couple to an OLT and comprising an OMCI ME, wherein the OMCI ME comprises a plurality of attributes that support a plurality of security features for transmissions between the ONU and the OLT, and wherein the attributes are communicated via an OMCI channel between the ONU and the OLT and provide the security features for the ONU and the OLT.

Abstract: The present invention provides a new method for user centered privacy which works across all 3rd party sites where users post content, or even for encryption of emails. Users have an identity with a Hyde-It Identity provider (HIP) which authenticates the user to a Hyde-It Service (HITS) which performs key distribution. The functionality can be invoked through a user toolbar, built into the browser or be downloaded on demand via a bookmarklet.

Abstract: Embodiments of a method and apparatus for reducing or eliminating unauthorized access to secured files are generally described herein. In some embodiments, the method includes establishing a connection between a communication portion of the secured file and an authentication agent. The method may include requesting a decryption key from the authentication agent for accessing the secured file on a first computing device. The decryption key may be based on device information retrieved from devices in an authenticated environment of devices. The authenticated environment may be an environment in which the secured the was encrypted. The method may include destroying the secured file subsequent to receiving a message indicating that the requesting has failed.

Abstract: Described are a system and method for presenting security information about a current site or communications session. Briefly stated, a browsing software is configured to receive a certificate during a negotiation of a secure session between a local device and a remote device. The certificate includes security information about a site maintained at the remote device. The security information is displayed to a user of the browsing software in a meaningful fashion to allow the user to make a trust determination about the site. Displaying the security information may include presenting a certificate summary that includes the most relevant information about the certificate, such as the name of the owner of the site and the name of the certificating authority of the certificate.

Abstract: A method of distributing media content over networks where content is shared includes coupling downloading metadata, which is accessed to start downloading media contents from the network, with semantic metadata representative of the semantic information associated with at least one of the content, and with source metadata indicative of the source of the media content. At least one of the semantic and the source metadata may be made accessible without downloading, even partially, the media content. A digital signature may also be applied to the metadata to enable the verification that, at reception, the metadata is intact and has not been subjected to malicious tampering.

Abstract: A method for coupling protected digital data object, for example an application program, and a specified computer, which allows for, if desired, individual components of the computer to be modified. A cryptographic key is generated on the basis of current components of a computer in order to decrypt an encrypted, computer-specific authorization code for executing a protected digital data object on the computer. The computer-specific authorization code is encrypted with a key based on original components of the computer. The key can be determined from the current components of the computer even if they are different from the original components of the computer.

Abstract: A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser may split or share a data set into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting an original data set into portions of data that may be communicated using one or more communications paths. Secure workgroup communication is supported through the secure distribution and management of a workgroup key for use with the secure data parser.

Abstract: A local proxy system includes a storage device having a local proxy and a physical port connection. The local proxy is part of a split proxy configuration having a local proxy and a remote proxy. The physical port connection is operative to receive commands from a host via an internet application protocol; and to transmit commands to the host via a modem control protocol, to thereby function as a gateway for conveying these commands to a remote proxy, via the host. Also provided is a method of optimizing communication over a network; and a local proxy system that includes a storage device having a local proxy. The storage device is in connection with a host via a physical port connection complying with a standard storage device interface.

Abstract: Techniques are disclosed for managing one or more public keys used for verification of one or more messages transferred over a communication network associated with a public warning system. In one example, a method comprises the following steps. A computing device of a communication network obtains key material for at least one source of a message generated for a public warning system. The computing device also obtains an identity of the source. A public key is computed by the computing device from the key material and the identity of the source. The public key is thus useable by the computing device to verify a message received from the source that is digitally signed using a corresponding private key of the source. In one example, the computing device comprises user equipment.

Abstract: A computer-implemented method for controlling access to digital media involves receiving a URL at a computer server system, decoding the URL, extracting a user ID of a user who submitted the URL and an image ID of an image that is accessible by the server system, using the user ID to determine whether the user who submitted the URL is authorized to access the image, and controlling access to the image by the user based on the determination of whether the user who submitted the URL is authorized to access the image.

Abstract: This document describes tools capable of securely distributing entertainment content among and using distributed hardware. These tools may do so robustly by rebinding entertainment content between distributed hardware units. The tools, for example, may distribute content protection in hardware between a policy unit, a transcryption unit, a graphics processing unit, and a playback unit. By so doing the tools enable, among other things, users to select from many graphics cards rather than rely on the graphics capabilities of an integrated (e.g., SOC) hardware solution.

Abstract: In a downloadable conditional access system (DCAS), preferably all DCAS-specific code is implemented in a configurable secure (CS) processor that is in communication with the host processor. Preferably, no DCAS-specific code is executed in the host processor. The host processor delivers commands to the CS processor, which the CS processor performs to configure itself in accordance with the particular DCAS encryption scheme used by the DCAS. Once configured, the CS processor executes a DCAS software module that has been downloaded to the CS processor, which looks for the corresponding EMMs and ECMs, processes them to obtain the CW, and then uses the CW to decrypt the content stream.

Abstract: Methods, systems, and apparatus are disclosed for generating one or more device identifiers based on a public key associated with a respective device. Various embodiments include condensing and/or hashing a device public key to generate the corresponding device identifier. By using the relationship between a device public key and its device identifier, public key exchanges are implemented to verify this relationship and facilitate device enrollment into one or more networks. The embodiments further describe enrolling one or more devices into networks and/or authorizing devices to enroll one more devices into networks based on public key exchanges and verification that the one or more device identifiers match the respective public keys. Embodiments for authorizing other devices describe a first device enrolling a second device in a first network and authorizing a third device to enroll the second device in a second network using an exchange of public keys and/or messages.

Abstract: A data security system includes providing a unique identification from a first system to a second system; copying the unique identification in the second system by the first system; and unlocking a memory in the first system or the second system only when the unique identifications in the first system and the second system are the same.

Abstract: A digital signature generation apparatus includes memory to store finite field Fq and section D(ux(s, t), uy(s, t), s, t) as secret key, section being one of surfaces of three-dimensional manifold A(x, y, s, t) which is expressed by x-coordinate, y-coordinate, parameter s, and parameter t and is defined on finite field Fq, x-coordinate and y-coordinate of section being expressed by functions of parameter s and parameter t, calculates hash value of message m, generates hash value polynomial by embedding hash value in 1-variable polynomial h(t) defined on finite field Fq, and generates digital signature Ds(Ux(t), Uy(t), t) which is curve on section, the x-coordinate and y-coordinate of curve being expressed by functions of parameter t, by substituting hash value polynomial in parameter s of section.