Abstract: In general, the invention features methods by which more than one client program connected to a network stores the same data item on a storage device of a data repository connected to the network. In one aspect, the method comprises encrypting the data item using a key derived from the content of the data item, determining a digital fingerprint of the data item, and storing the data item on the storage device at a location or locations associated with the digital fingerprint. In a second aspect, the method comprises determining a digital fingerprint of the data item, testing for whether the data item is already stored in the repository by comparing the digital fingerprint of the data item to the digital fingerprints of data items already in storage in the repository, and challenging a client that is attempting to deposit a data item already stored in the repository, to ascertain that the client has the full data item.

Abstract: A system for distributing digital content over a computer network (e.g., the Internet) uses certificates to establish a trust relationship between a content provider and a display device. The certificates identify the display device and the content provider as well as unique characteristics of the distribution. For example, the content provider may be a book publisher and the display device may be a printer/binder.

Abstract: A system and method for searching and retrieving certificates, which may be used in the processing of encoded messages. In one embodiment, a certificate synchronization application is programmed to perform certificate searches by querying one or more certificate servers for all certificate authority (CA) certificates and cross-certificates on the certificate servers. In another embodiment, all certificates related to an identified certificate are retrieved from the certificate servers automatically by the certificate synchronization application, where the related certificates comprise at least one of one or more CA certificates and one or more cross-certificates. Embodiments of the invention facilitate at least partial automation of the downloading and establishment of certificate chains, thereby minimizing the need for users to manually search for individual certificates.

Abstract: Provided is digital rights management (DRM) provision technology, and more particularly, are an apparatus, system, and method which can easily provide content using one or more DRM systems. A DRM provision apparatus includes a content download unit which downloads encrypted real content and dummy content from a download server and which manages the downloaded real content and dummy content; a license management unit which manages a license issued by a license server; and a processing unit which manages the downloaded real content and dummy content and the issued license.

Abstract: The present invention concerns application of digital rights management to industrial automation devices including programmable logic controllers (PLCs), I/O devices, and communication adapters. Digital rights management involves a set of technologies for controlling and managing access to device objects and/or programs such as ladder logic programs. Access to automation device objects and/or programs can be managed by downloading rules of use that define user privileges with respect to automation devices and utilizing digital certificates, among other things, to verify the identity of a user desiring to interact with device programs, for example. Furthermore, the present invention provides for secure transmission of messages to and amongst automation devices utilizing public key cryptography associated with digital certificates.

Abstract: The present invention provides safe and secure application distribution and execution by providing systems and methods that test an application to ensure that it satisfies predetermined criteria associated with the environment in which it will execute. Furthermore, by using rules and permission lists, application removal, and a modification detection technique, such as digital signatures, the present invention provides mechanisms to safely distribute and execute tested, or untested, applications by determining whether the application has been modified, determining if it has permission to execute in a given wireless device environment, and removing the application should it be desirable to do so.

Abstract: An information processing apparatus has an authentication/key exchange unit, a round trip time measuring unit, a common key transmitter, a contents key transmitter and a contents transmitter. The round trip time measuring unit sends a round trip time measuring request generated to the communication apparatus through the first communication connection to measure the round trip time, and check whether the measured round trip time is within a predetermined time and whether a transmitting source of the round trip request response is the communication apparatus sharing the first key. The common key transmitter encrypts a second key used for contents transmission by using the first key and transmits the encrypted second key through the first communication connection when the round trip time measuring unit succeeds in the checking.

Abstract: Methods and apparatuses are provided for use with optical data storage media and related devices.

Abstract: The present invention enforces digital rights within the confines of a content license by validating an entity certificate. Cryptographic information within a entity certificate is utilized to unlock protected content and authenticate the entity certificate. The entity certificate includes personal credentials, which have information that the entity is unwilling or uncomfortable to share publicly. For example, the personal credentials may include private information, or information associated with a personal object that cannot consume the protected content, or both.

Abstract: A method for securing a communication between a peer node and an intermediary peer node in a peer-to-peer network comprises the peer node generating a secured communication request to the intermediary peer node. The intermediary peer node authenticates the peer node in response to the secured communication request. The intermediary peer node issues a signed certificate of authority upon successful authentication.

Abstract: A system is provided for upgrading a legacy security system having a legacy control panel and a legacy card reader, without interfering with legacy system operation. A new control panel is installed between the legacy card reader and the legacy control panel. Also, a new token reader is installed next to the legacy card reader and connected to the new control panel. The new control panel passes credentials it receives from the legacy card reader to the legacy control panel, avoiding interference with legacy system operation. When the new control panel receives credentials from the new token reader, it evaluates them against an access rights list administered independently of the legacy access rights list. When the new control panel determines that an access request should be granted, it sends a memorized legacy credential associated with full access rights to the legacy control panel, causing it to open the door.

Abstract: Systems and methods for automated exchange of encryption certificates for transmitting and receiving encrypted email messages are disclosed. In one embodiment, a method of communicating an encrypted email message includes providing a recipient identifier, creating an unencrypted email message, automatically querying a recipient email domain for a recipient encryption key corresponding to the recipient identifier, automatically receiving the recipient encryption key from the recipient email domain, automatically encrypting the unencrypted email message using the recipient encryption key, and transmitting the encrypted email message to the recipient identifier.

Abstract: A method and apparatus for authenticating a client to a content server. A ticket authority generates a ticket associated with the client. The ticket comprises a first ticket and a second ticket. The ticket authority transmits the first ticket to the client and the client uses the first ticket to establish a communication session with an content server proxy. The ticket authority then transmits a second ticket to the content server proxy and the content server proxy uses the second ticket to establish a communication session with the content server.

Abstract: Methods and apparatus, including computer systems and program products, related to techniques for creating a chain of transfer for a digital document in which every transferor and transferee participates in the transfer. A first entity, e.g., an offeror with current control of the document, generates an offeror certificate associated with the digital document, and encrypts the offeror certificate with the offeror's private key. The offeror transmits the encrypted offeror certificate to a second entity, e.g., an offeree that will be the subsequent controller of the document. The offeree generates an offeree certificate from the offeror certificate, encrypts the offeree certificate with the offeree's private key, and transmits the encrypted offeree certificate to the offeror. When the offeror receives the offeree certificate, the offeror adds the offeree to a chain of transfer for the document and generates a transfer certificate for the offeree.

Abstract: A grantor issues a trustable electronic document for the benefit of a requestor. The requestor may be able to get the benefits specified by the electronic document through access controls located at the service or information origin. A request digitally signed by a requestor is received. The digitally signed request contains the electronic document digitally signed by the grantor. The electronic document also contains a grantor certified reference, a requestor certified reference, and access control rules for the requestor. The request is validated using the requestor certified reference and the access control rules for the requestor.

Abstract: A system and method for determining file system data integrity. In one embodiment, the system includes a storage device configured to store data and a file system configured to manage access to the storage device, to store plurality of files, to store a respective signature of each of the plurality of files, and to compare a respective signature of a given file against a corresponding validation signature. In one specific implementation, the system further includes a validation signature inventory including a plurality of validation signatures, and the file system is further configured to validate a particular file by retrieving a corresponding particular validation signature from the validation signature inventory and comparing the corresponding particular validation signature against the respective signature of the particular file. In another specific implementation, the file system is further configured to store the corresponding validation signature of the given file in a write-once storage attribute.

Abstract: The disclosure relates to the management of PKI digital certificates, including certificate discovery, installation, verification and replacement for endpoints over an insecure network. A database of certificates may be maintained through discovery, replacement and other activities. Certificate discovery identifies certificates and associated information including network locations, methods of access, applications of use and non-use, and may produce logs and reports. Automated requests to certificate authorities for new certificates, renewals or certificate signing requests may precede the installation of issued certificates to servers using installation scripts directed to a particular application or product, which may provide notification or require approval or intervention. An administrator may be notified of expiring certificates, using a database or scanning or server agents.

Abstract: The disclosure relates to the management of PKI digital certificates, including certificate discovery, installation, verification and replacement for endpoints over an insecure network. A database of certificates may be maintained through discovery, replacement and other activities. Certificate discovery identifies certificates and associated information including network locations, methods of access, applications of use and non-use, and may produce logs and reports. Automated requests to certificate authorities for new certificates, renewals or certificate signing requests may precede the installation of issued certificates to servers using installation scripts directed to a particular application or product, which may provide notification or require approval or intervention. An administrator may be notified of expiring certificates, using a database or scanning or server agents.

Abstract: A method and apparatus to establish a trustworthy local time based on trusted computing methods are described. The concepts are scaling because they may be graded by the frequency and accuracy with which a reliable external time source is available for correction and/or reset, and how trustworthy this external source is in a commercial scenario. The techniques also take into account that the number of different paths and number of hops between the device and the trusted external time source may vary. A local clock related value which is protected by a TPM securely bound to an external clock. A system of Accuracy Statements (AS) is added to introduce time references to the audit data provided by other maybe cheaper sources than the time source providing the initial time.

Abstract: An apparatus for communicating, including a communicating unit that enables the apparatus to communicate with a communications counterparty via the communicating unit. The communicating unit includes a unit for providing an individual certificate that is a digital certificate being provided with information identifying the apparatus for communicating in order to receive an authentication by the communications counterparty when communicating, and a unit for communicating when having been authenticated with the individual certificate by the communications counterparty. The apparatus further includes at least one storage area for storing the individual certificate and a common certificate that is a digital certificate not being provided with apparatus identifying information, in a replacement component as a minimum unit enabled for replacement.

Abstract: A security device of this invention includes a nonvolatile storage unit 22 for storing a validity check unit including a counter updated every time signature function means 30 is called up, a volatile storage unit 24 for reading and storing a counter array out of an external nonvolatile storage unit storing the counter array, in which the counter array is obtained by coupling a hash value generated for each signature key with a signature number counter for counting the number of signatures performed by use of the signature key, and a hash function unit 28 for reading the counter array out of the volatile storage unit 24, generating the hash value, and transferring the hash value to the validity check unit for a validity check.

Abstract: A method for processing a file having an existing filename. A private key associated with a digital certificate and a certificate address from which the digital certificate may be accessed are received from a certification authority (CA) who issued the digital certificate. A digital signature is generated based on the file and the received private key. The digital certificate includes a public key associated with the private key such that the generated digital signature can be verified through use of the public key. The file is signed with the generated digital signature The received certificate address is encoded to generate an encoded address. The existing filename and the encoded address are merged to generate a new filename. The file is renamed with the new filename. The renamed file may be authenticated by verifying the digital signature via execution of an authentication algorithm in conjunction with the public key.

Abstract: A Method and system for ensuring security-compliant creation and signing of endorsement keys of manufactured trusted platform modules. The endorsement keys are generated for the trusted platform module (TPM). The TPM vendor selects an N-byte secret and stores the N-type secret in the trusted platform module along with the endorsement keys. The secret number cannot be read outside of the trusted platform module. The secret number is also provided to the credential server of the original equipment manufacturer. During the endorsement key (EK) credential process, the trusted platform module generates an endorsement key, which comprises both the public key and a hash of the secret and the public key. The credential server matches the hash within the endorsement key withy a second hash of the received public key (from the endorsement key) and the vendor provided secret. The EK certificate is generated and inserted into the trusted platform module only when a match is confirmed.

Abstract: A key escrow service is described. In embodiment(s), the key escrow service maintains an escrow license that includes an escrow content key that is associated with protected media content which is distributed from a content distributor to a media device. A content key that is associated with the protected media content can be received from the content distributor, and the content key can then be encrypted with a public escrow key to generate the escrow content key. The escrow license can be generated to include the escrow content key, and the escrow content key can then be communicated back to the content distributor that provides a digital rights management (DRM) license to the media device. The DRM license can include both the escrow content key and the content key encrypted with a public key that corresponds to the media device.

Abstract: A system and method for searching and retrieving certificates, which may be used in the processing of encoded messages. In one broad aspect, a method is provided in which a certificate search request is received, a search of one or more certificate servers for certificates satisfying the request is performed, located certificates are retrieved and processed at a first computing device to determine data that uniquely identifies each located certificate, and search result data comprising the determined data is communicated to a second device (e.g. a mobile device) for use in determining whether each located certificate is already stored on the second device.

Abstract: A portable device for use in establishing trust including a communications module for communicating with a host machine; embedded trusted data; a virtual machine module for instantiating a virtual machine on the host machine; and a security module for including a secure application in the virtual machine to perform an attestation process using the embedded trust data to authenticate the host machine.

Abstract: A method and system for secure communication and control in a fueling environment. In one aspect, the fueling environment with secure communication comprises a fuel dispenser and at least one node communicable coupled with the fuel dispenser. The fuel dispenser is operable to generate a first public key and a first private key associated with the fuel dispenser and publish the first public key within the fueling environment. The fuel dispenser is further operable to authenticate a particular one of the nodes using, at least in part, a second public key associated with the particular node and the first public and the first private keys. The fuel dispenser may then dynamically generate a run-time symmetric key using, at least in part, the first private key and the second public key and communicate data associated with the fueling environment to the authenticated node, with the data encrypted using the symmetric key.

Abstract: A security module is provided in a data recording medium, data to be written to the data recording medium is encrypted with an content key different from one data to another, and the content key is safely stored in the security module. Also, the security module makes a mutual authentication using the public-key encryption technology with a drive unit to check that the counterpart is an authorized (licensed) unit, and then gives the content key to the counterpart, thereby preventing data from being leaked to any illegal (unlicensed) unit. Thus, it is possible to prevent copyrighted data such as movie, music, etc. from being copied illegally (against the wish of the copyrighter of the data).

Abstract: The present invention relates electronic receipts. There is provided a method for generating an electronic receipt in a communication system providing a public key infrastructure, the method comprising the steps of receiving by a second party a request message from a first party, the request message comprising a transaction request and a first public key based on a secret owned by the first party and wherein the secret is associated with at least the secret of a further public key of the first party, electronically signing at least part of the request message with a second public key assigned to the second party to issue the electronic receipt, and providing the electronic receipt to the first party.

Abstract: The invention relates to methods and apparatuses for acquiring a physical measurement, and for creating a cryptographic certification of that measurement, such that its value and time can be verified by a party that was not necessarily present at the measurement. The certified measurement may also include corroborative information for associating the actual physical measurement process with the certified measurement. Such corroborative information may reflect the internal or external state of the measurement certification device, as well as witness identifiers of any persons that may have been present at the measurement acquisition and certification. The certification may include a signal receiver to receive timing signals from a satellite or other external source. The external timing signals may be used to generate the time included in the certified measurement, or could be used to determine the location of the measurement certification device for inclusion in the certified measurement.

Abstract: A first data processing system, which includes a first cryptographic device, is communicatively coupled with a second data processing system, which includes a second cryptographic device. The cryptographic devices then mutually authenticate themselves. The first cryptographic device stores a private key of a first asymmetric cryptographic key pair and a public key of a second asymmetric cryptographic key pair that is associated with the second data processing system. The second cryptographic device stores a private key of the second asymmetric cryptographic key pair and a public key of the first asymmetric cryptographic key pair that is associated with the first data processing system.

Abstract: In a communications system supporting the exchange of messages, a method for authenticating messages, comprising: having a message sender send a message to be authenticated to a signature generator entity in the communications system; having the signature generator entity generate a signature with respect to the received message, the signature being dependent on the message sender; having the signature generator entity send back to the message sender an authenticated message, the authenticated message including the generated signature; having the message sender forward the authenticated message to a message recipient; having the message recipient send the received message to a signature verifier entity in the communications system; having the signature verifier entity verify the validity of the signature, and notifying the message recipient of an outcome of the validity verification.

Abstract: An event-ordering certification system 100 includes a certification apparatus 1, a plurality of user apparatuses 2i (i=a, b, . . . , n), an audit apparatus 3 for performing an audit of an event-ordering receipt published by the certification apparatus 1 and a network 4 for connecting these elements with each other. In response to an event-ordering request from one user apparatus 2i, the certification apparatus 1 publishes the event-ordering receipt and sends it to the user apparatus 2i. If a mistrust is produced in the event-ordering receipt, the user apparatus 2i verifies the event-ordering receipt with the use of data published by the certification apparatus 1 and an audit result by the audit apparatus 3.

Abstract: The invention provides a method and system for secure data transfer and dynamic definition of trustworthiness of various entities by multiple parties in a hierarchy tree or graph structure. The invention uses digital certificates. Each party in the business hierarchy can control and define various trust information including trustworthiness and delegation authority for the entities it deals with. The ability of a party to redefine or add trust information is controlled by the parties with which it has a relationship that are above it in the hierarchy. Trust vectors and delegation vectors are used to store this information. Each party can add trusted third parties to a security object without compromising the integrity of security objects already issued. A sequence of security objects including digital certificates can be modified without compromising the original digital certificates in those security objects.

Abstract: A system and method for searching and retrieving certificates, which may be used in the processing of encoded messages. In one embodiment, a certificate synchronization application is programmed to perform certificate searches by querying one or more certificate servers for all certificate authority (CA) certificates and cross-certificates on the certificate servers. In another embodiment, all certificates related to an identified certificate are retrieved from the certificate servers automatically by the certificate synchronization application, where the related certificates comprise at least one of one or more CA certificates and one or more cross-certificates. Embodiments of the invention facilitate at least partial automation of the downloading and establishment of certificate chains, thereby minimizing the need for users to manually search for individual certificates.

Abstract: An arrangement is provided for performing MD5 digesting. The arrangement includes apparatuses and methods that pipeline the MD5 digesting process to produce a 128 bit digest for an input message of any arbitrary length.

Abstract: A software system and method for executing secure commercial transactions online is disclosed. A user's password is received to initiate secure socket layer (SSL) communications with a transaction site on a server. A web session associated with the SSL communications is encrypted by associating a domain name of the transaction site with its SSL public key. Then, the user's password is added to a hypertext markup language (HTML) header of a message within the web session. When added, the password is invisible to a hypothetical man-in-the-middle (MITM) attacker, who cannot read the encrypted message nor mimic the user. The MITM is thus unable to compromise the user's account as the MITM is unable to provide the correct password into any fraudulent message.

Abstract: A method for establishing proof of existence and possession of source digital content, the method comprising the steps of generating a content certificate by calculating a content hash derived from the source digital content; creating code incorporating the content hash and content details, and a certifying body time-stamping and digitally signing the content hash and the content details to create a content certificate; transmitting the content certificate via a secure channel so that the recipient can verify that the certificate came from the certifying body; transmitting a digitally signed file representing the content certificate content details. A tamper-proof audit trail of certification is generated by: calculating a proving hash of a concatenated file of data relating to a plurality of content certificates; publishing the proving hash, and publishing the concatenated file.

Abstract: A method and system for securely processing a credential substrate using a credentials production system and secured consumable supply. The consumable supply is selectively in one of a plurality of states including a production disabled state and a production enabled state. The state of the consumable supply is changed from the production disabled state to the production enabled state. The state in the consumable supply is verified as being in the production enabled state prior to processing the credential substrate using the consumable supply.

Abstract: A method of registering network devices in a digital rights management system (DRMS) includes receiving a digital certificate transmitted by the network device requesting registration and verifying the validity of the certificate. The DRMS may then send cryptographic information to the applying network device. The network device may be authorized for registration via a user interface to the DRMS. The DRMS may conduct a proximity test to determine of the network device is proximate to the DRMS. If the certificate is validated, authorization is received, and the proximity test indicates that the network device is proximate to the DRMS, the network device may be registered. A registered network device is then authorized to play protected digital content.

Abstract: A download processor for secure downloading of a digital product file when ordered by a user. The order includes a file identifier related to the file and an order identifier related to the order. The download processor performs security checks related to the file, the order, and the user. The file identifier and order identifier are verified based upon information related to the file and the order, and information related to the user is also verified. Based upon the verifications, the download processor selectively permits or denies download of the file to a user machine.

Abstract: A mobile station is provided. The mobile station includes one or more radio transceiver module and a processor. The processor generates an Authorization Key (AK) context including at least one secret key shared with a base station, transmits at least one association negotiation message via the radio transceiver module to the base station to obtain an association of a service flow established by the base station, and generates at least one TEK according to the secret key and an identifier associated with the association. The service flow is established for traffic data transmission with the base station and the TEK is a secret key shared with the base station for encrypting and decrypting the traffic data.

Abstract: Protection systems and methods provide for protecting one or more personal computers (“PCs”) and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java™ applets, ActiveX™ controls, JavaScript™ scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other “Downloadables” or “mobile code” in whole or part. A protection engine embodiment provides, within a server, firewall or other suitable “re-communicator,” for monitoring information received by the communicator, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information, more suitably by forming a protection agent including the MPC, protection policies and a detected-Downloadable.

Abstract: A validation authority for certificates searches for and verifies paths and certificate revocation lists periodically, and classifies the paths into valid paths and invalid paths in accordance with the results of the validations, so as to register the paths in databases beforehand. Besides, in a case where a request for authenticating the validity of a certificate has been received from an end entity, the validation authority judges the validity of the public key certificate by checking in which of the valid-path database and the invalid-path database a path corresponding to the request is registered. On the other hand, in a case where the path corresponding to the validity authentication request is not registered in either of the databases, the validity of the public key certificate is authenticated by performing path search and validation anew.

Abstract: Techniques are provided for improving security in a single-sign-on context by providing, to a user's client system, two linked authentication credentials in separate logical communication sessions and requiring that both credentials be presented to a host system. Only after presentation of both credentials is the user authenticated and permitted to access applications on the host system.

Abstract: A method and system for displaying the trusted status of a website by displaying a trust symbol that is displayed as part of the website so that they trust symbol does not scroll when the website is scrolled, preventing the trust symbol from ever being hidden from the user. Specifically, displaying the trust symbol in the comer or bottom of the web page works well. The trust symbol can include information about the website that may be displayed when the computer user interacts with the trust symbol. Both the trust symbol and the information displayed about the website can be generated dynamically by the third party validator for display on website. However the location of the display of the trust symbol remains under the control of the website operator so as not to interfere with the aesthetics of the site.

Abstract: A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser may split or share a data set into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting an original data set into portions of data that may be communicated using one or more communications paths. Secure workgroup communication is supported through the secure distribution and management of a workgroup key for use with the secure data parser.

Abstract: A first vehicle obtains from a certification authority a certification that an authentic vehicle is associated with a cryptographic key. The certification certifies that the cryptographic key is bound to information identifying the authentic vehicle, and may be implemented. The first vehicle utilizes the cryptographic key obtained from the certification authority in cryptographic communication with a second vehicle, and determines whether the second vehicle is the authentic vehicle based on whether the cryptographic key is successfully utilized in the cryptographic communication. Upon determining the second vehicle is the authentic vehicle, the first vehicle may communicate further with the second vehicle.

Abstract: Techniques for registering certificates after the issuance of the certificates are provided. A service provider securely registers a client's identity and its certificate without depending on or using an existing basis of trust, such as that provided by domain-joined clients or a security directory (e.g., MICROSOFT's ACTIVE DIRECTORY). The service provider provides services, such as, by way of example and not a limitation, email services, web application services, application services, etc., based on identifiers (e.g., service IDs) issued to registered clients. The service provider subsequently uses the issued identifier to authenticate a client requesting a service or services, and to authorize the client to receive the requested service or services.

Abstract: Methods and systems for establishing a secure network channel between two or more devices in a communication network are disclosed. In exemplary implementations the network may be a UPnP network. A first device passes authentication information to at least a second device to permit the second device to authenticate the first device. Optionally, the first device may request to authenticate the second device, in which authentication information associated with the second device is passed to the first device. The first device uses this information to authenticate the second device. At least one of the first and second device may store authentication information in an data store associated with the device.