Abstract: A certificate enrollment assistant module may be provided to inject a challenge password into a certificate signing request to be sent, to a Certificate Authority, from a computing device. The certificate enrollment assistant module, thereby, acts as a trusted proxy to assist the computing device in building a valid certificate signing request without the computing device having access to the challenge password.

Abstract: A cryptosystem prevents replay attacks within existing authentication protocols, susceptible to such attacks but containing a random component, without requiring modification to said protocols. The entity charged with authentication maintains a list of previously used bit patterns, extracted from a portion of the authentication message connected to the random component. If the bit pattern has been seen before, the message is rejected; if the bit pattern has not been seen before, the bit pattern is added to the stored list and the message is accepted.

Abstract: Disclosed is a system and method for modifying the presentation of content and/or graphical elements and behavior of a digital presentation (e.g., a webpage) by identifying an information event and dynamically overlaying a fully functional complementary presentation of the digital presentation, without accessing the underlying source code of the digital presentation, employing a special software or equipment (e.g., a special web browser), or requiring that original or user submitted content associated with the digital presentation be transmitted to a remote or otherwise uncontrolled server.

Abstract: Secure execution of workflow tasks are executed according to a given execution pattern in a decentralized workflow system with a central workflow engine and multiple task execution agents. The method starts at an i'th execution agent which is selected by at least one preceding execution agent in accord with the execution pattern to perform an i'th task of the workflow. The method includes receiving, from the at least one preceding execution agent via a secure channel, a task-based private key generated by the at least one preceding execution agent, signing workflow information of the workflow for at least one subsequent execution agent with a workflow signature, selecting at least one appropriate subsequent execution agent, computing a task-based private key for the at least one subsequent execution agent, and forwarding to the at least one subsequent execution agent the workflow information with its associated workflow signature.

Abstract: A system and method for associating message addresses with certificates, in which one or more secondary message addresses are identified and associated with a user-selected certificate that does not contain any e-mail addresses. In certain situations, a message may be encrypted using a certificate that does not contain an e-mail address that matches the e-mail address of the individual to which the message is to be sent, so long as the address to which the message is to be sent matches any of the message addresses associated with the certificate. The message addresses are saved in a data structure that resides in a secure data store on a computing device, such as a mobile device.

Abstract: A method for secure communication and printing, comprising: user entering user and destination information to host; authentication server producing, saving encryption key for the job, user, and destination information into database, and sending to host; host encrypting the job using encryption key and sending job to destination; user entering user and destination information to device; authentication server retrieving encryption key from database, and sending to device; and device decrypting the job using encryption key and releasing job. Authentication at both host and MFP sides disables unauthorized, malicious attack to a user's mailbox, and results in jobs to a mailbox having different dynamic encryption keys, and no password or mailbox PIN trafficking on network. Furthermore, host and MFP can be at different domains. Methods also include secrecy encrypting encryption key; hashing key generator using SHA1, MD5, etc.

Abstract: Systems and methods for generating and verifying an electronic document with embedded digital signatures. When an electronic document is generated, signature blocks are included that are used to store corresponding digital signatures. When each digital signature is generated, some of the attributes of the signature blocks are filled such that the digital signature references these attributes, such as a timestamp. Each signature block also includes a reconstruct attribute that is used when the electronic document and/or the digital signature is validated through reconstruction. Other signature blocks do not require a reconstruct attribute. During reconstruction, some data is removed from the electronic document such that the data is identical to a previous state. The reconstructed document is hashed and the hash result is compared with the decrypted digital signature. The electronic document and/or the digital signature is validated or verified if the hash result matches the decrypted digital signature.

Abstract: A mechanism is provided for security screening image analysis simplification through object pattern identification. Popular consumer electronics and other items are scanned in a control system, which creates an electronic signature for each known object. The system may reduce the signature to a hash value and place each signature for each known object in a “known good” storage set. For example, popular mobile phones, laptop computers, digital cameras, and the like may be scanned for the known good signature database. At the time of scan, such as at an airport, objects in a bag may be rotated to a common axis alignment and transformed to the same signature or hash value to match against the known good signature database. If an item matches, the scanning system marks it as a known safe object.

Abstract: A mechanism and method for managing credentials on an electronic device and providing encryption and decryption services for the electronic device comprising a mobile communication device, smart phone or other computing device. According to an embodiment the device is configured with an iOS based operating system. The device is configured with a data encryption service application and an associated secure data repository. According to an embodiment, the electronic device is configured to download and/or cache credentials from a credential management system operatively coupled to the device, comprising public-private key pairs in a PKI system. According to an embodiment, the electronic device is configured with or stores a digital verification signature. The data encryption service application is configured to encrypt/decrypt data (e.g. files, documents) and optionally digitally sign the encrypted file.

Abstract: To verify a pair of correspondents in an. electronic transaction, each of the correspondents utilises respective parts of first and second signature schemes. The first signature scheme is computationally more difficult in signing than verifying and the second signature scheme is computationally more difficult in verifying than signing. The first correspondent signs information according to the first signature scheme, the second correspondent verifies the first signature received from the first correspondent, using the first signature scheme. The second correspondent then signs information according to the second signature scheme and the first correspondent verifies the second signature received from the second correspondent, according to the second signature algorithm. The method thereby allows one of the correspondents in participate with relatively little computing power while maintaining security of the transaction.

Abstract: A system and method of mobile content sharing and delivery in an integrated network environment, comprising; a first mobile terminal serving as information provider, a home server, and a second mobile terminal serving as information receiver. The information of said first mobile terminal is transmitted to said second mobile terminal through said home server, and that information can be stored in said home server for direct downloading of file by said second mobile terminal in an asynchronous transmission manner; when said first mobile terminal moves and switches to another network environment, said second mobile terminal still can request and download said information through said home server. A double key protection scheme is further provided in safeguarding secure transaction of information.

Abstract: A system, method, and computer readable medium for managing secure content by CDN service providers are provided. A network storage provider stores one or more resources on behalf of a content provider. A CDN service provider obtains client computing device requests for secure content. Based on processing first signature information, the CDN service provider determines whether the secure content is available to the client computing device. If the CDN service provider does not maintain the requested content, the CDN service provider transmits a request to the network storage provider. Based on second signature information and an identifier associated with the CDN service provider, the network storage provider processes the request based policy information associated with the identifier.

Abstract: A file may contain an unencrypted and an encrypted portion. The unencrypted portion may contain a layout section that may point to a published license, metadata, and a contents section, where the contents section is in the encrypted portion. The encrypted portion may contain the contents section which may act as a directory for one or more included files that may be compressed and stored in the encrypted portion. When the file is opened by a receiver, the receiver may read the published license and communicate with a security server to establish access rights and receive at least one key for decrypting at least a portion of the encrypted portion of the file. The receiver may then gain access to the included files.

Abstract: A computer-implemented method and system for embedding ancillary information into the header of a digitally signed executable are disclosed. The method and system include identifying a digital signature block and a digital signature size block in a digitally signed file header, modifying a digital signature size value in the digital signature size block, the modified value corresponding to the size of the digital signature block plus the length of an ancillary data block plus a pre-determined pad, storing the modified digital signature size in the digital signature size block, and appending the ancillary data block to the end of the digital signature block.

Abstract: An information processing apparatus inputs image data and calculates a relative magnitude between coefficient or pixel values of the input image data. The image processing apparatus generates verification data of the image data using the calculated relative magnitude.

Abstract: A method, system, and computer program product for threading documents using body text analysis. The method comprises: computing a fingerprint for each of a plurality of documents by analyzing text in a body of each document; comparing the computed fingerprints to determine a set of documents from the plurality of documents whose fingerprints are sufficiently similar; and ordering the set of documents to create at least one parent-child relationship.

Abstract: A system, devices and methods for verifying an administrator computing device to a guest computing device, verifying the guest device to the administrator device and outputting a list of the guest device capabilities for the administrator device such that the guest device is capable of verifying the administrator device, for example to ensure it does not divulge its capabilities to imposters, and the administrator device is capable of identifying whether the list of device capabilities is authentic. Verification can be achieved through cryptographic hashes of private certificates, digital signatures or expected output from verified modules. The list of device capabilities may be restricted based on the authorization granted to the administrator computer and may be altered or watermarked for verification. A failure to verify the administrator device may restrict execution of instructions on the guest device to prevent unauthorized access to the guest device's capabilities.

Abstract: A system and method for dynamically and automatically updating the appropriate fields on the message application screen of an electronic message to show which of the appropriate service book, security encoding or security properties are acceptable or allowed for the message being composed. This updating occurs automatically based on the contents of the fields that are modified during composition of the message, such as, for example, modifications to classification of the message, recipients, keywords, or the like. Thus, the properties in place for a given message is reflected in a dynamic options list provided to the user based on the contents of various fields of the electronic message and the system policies resident on the system. The dynamic updating may provide an updated list of options to the user, or may optionally automatically apply minimum level settings based on security policy and contents of the message.

Abstract: A method (200) and program (100) for inhibiting attack upon a computer (120) is provided. The address (104) of a process (106) is produced (612), and encrypted (616) to produce an encrypted address (518), which is then stored in memory (128). When needed, the encrypted address (518) is retrieved (702) from memory (128) and decrypted (704) to reproduce the original process address (104). The reproduced process address (104) is then verified (708). If the process address (104) is determined (708) to be valid, i.e., there was no attack, then the process address (104) is placed (712) in the program counter (318), and a valid process (106) is executed. If the process address (104) is determined (708) to be invalid, i.e., there was an attack, then the address (108) of a crash and terminate process (110) is placed (716) in the program counter (318) and the computer (120) crashes. A nonce value (512) may be generated (602) and encrypted (616) and decrypted (704) in conjunction with the process address (104).

Abstract: A method of extending an integrity measurement in a trusted device operating in an embedded trusted platform by using a set of policy commands to extend a list of Platform Configuration Registers (PCRs) for the device and the current values of the listed PCRs and an integrity value identifying the integrity measurement into a policy register, verify a signature over the integrity value extended into the policy register, and, if verification succeeds, extend a verification key of the trusted platform, plus an indication that it is a verification key, into the policy register, compare the integrity value extended into the policy register with a value stored in the trusted platform, and, if they are the same: extend the stored value, plus an indication that it is a stored value, into the policy register, and extend the integrity measurement in the trusted device if the value in the policy register matches a value stored with the integrity measurement.

Abstract: Stateless application notifications are described that enable third parties to provide messages to client applications. A communication channel can be established between a notification service and an application. Upon request, the notification service can generate obfuscated routing data for the channel, which can be in the form of a channel handle or token. The routing data can be encrypted and digitally signed to obscure the content and format of the routing data from third parties. An application service possessing the obfuscated routing data can package a notification with the data and send the package to the notification service for delivery. The application service does so without knowing the channel particulars encoded by the obfuscated routing data. The notification service that produces the obfuscated routing data can decrypt and interpret the data, and deliver the notification on the channel to an appropriate endpoint application on behalf of the application service.

Abstract: The document identification method comprises: a step of marking the document with an anti-copy mark that is identical for a plurality of documents, a step of reading an anti-copy mark, a step of generating an identification mark that can vary from one document to another and according to the reading of the anti-copy mark and a step of marking said document to form said identification mark on said document. In embodiments the method comprises, in addition, a step of printing a uniform area and the step of marking the document to form the identification mark comprises a step of emitting light with a laser in the uniform area. In embodiments the method comprises, in addition, a step of invisibly marking the identification mark on said document.

Abstract: Apparatus and method are disclosed for digital authentication and verification. In one embodiment, authentication involves storing a cryptographic key and a look up table (LUT), generating an access code using the cryptographic key; generating multiple parallel BPSK symbols based upon the access code; converting the BPSK symbols into multiple tones encoded with the access code using the LUT; and outputting the multiple tones encoded with the access code for authentication. In another embodiment, verification involves receiving multiple tones encoded with an access code; generating multiple parallel BPSK symbols from the multiple tones; converting the BPSK symbols into an encoded interleaved bit stream of the access code; de-interleaving the encoded interleaved bit stream; and recovering the access code from the encoded de-interleaved bit stream.

Abstract: Various embodiments of a system and method for a single request—single response protocol with mutual replay attack protection are described. Embodiments may include a system that receives multiple single request messages, each of which may include a respective nonce, timestamp, and digital signature. The system may create a record of previously received nonces that, at any given time, may include multiple message nonces received within a valid period of time prior to that given time. To validate a given single request message the system may verify the digital signature of the that message, determine that the timestamp of that message indicates a time within the valid period of time prior to the current time, and determine the nonce of the that message is not present within the record of previously received nonces. The system may send a single response message that includes the same nonce as the validated message.

Abstract: A data encryption and decryption system securely geoencrypts data using location-dependent navigation signals. To increase the entropy of the cryptographic key to guard against a brute-force attack, geoencryption is made to depend on largely time-independent characteristics of the navigation signals that are not easily spoofed, including the time difference of arrival, the envelope-to-cycle difference, the differential signal-to-noise, the signal envelope shape, and the directions of arrival of the navigation signal set.

Abstract: An initiator shares y_ir with a responder, calculates HASH_I on the basis of y_ir, and sends HASH_I to an IKE proxy server. The initiator receives a digital signature SIG_S generated for HASH_I and the address of the initiator from the IKE proxy server and sends the digital signature SIG_S to the responder.

Abstract: A method, system, computer program product and/or a computer readable medium of instructions for detecting one or more entities which are able to reinfect a processing system with malicious software. The method includes: monitoring, in the processing system, activity indicative of the malicious software reinfecting the processing system; in response to detecting the activity, storing a record of the activity and one or more entities associated with the activity; determining if the malicious software has reinfected the processing system; and in response to determining that the malicious software has reinfected the processing system, analysing the record to detect the one or more entities which were associated with the activity that caused and/or assisted in reinfecting the processing system with the malicious software. There is also disclosed a method, system, computer program product and/or a computer readable medium of instructions for detecting a variant of malicious software in a processing system.

Abstract: A method for protection of data includes maintaining a control parameter indicative of a current version of the data. The data is partitioned into multiple segments. Respective signatures of the segments are computed, responsively to the control parameter, the segments and respective signatures forming respective signed input segments, which are stored in a memory. After the signed input segments are stored, a signed output segment is fetched from the memory. The signature of the signed output segment is verified responsively to the control parameter, and the data in the signed output segment is processed responsively to verifying the signature.

Abstract: A computer readable medium for activating a software application for execution on a designated computer, where the computer readable medium has stored thereon computer executable instructions for performing the following steps: computing an installation identifier reflective of the software application and the designated computer; receiving an activation code generated in accordance with the installation identifier and a blinding factor value; computing a first verification code as a function of the installation identifier; computing a trial blinding factor value; computing a decryption key as a function of the trial blinding factor value and the activation code; using the decryption key to decrypt a second verification code; verifying that the first verification code matches the second verification code; and, activating the software application for execution on the designated computer.

Abstract: A system, method and computer program product are provided for securely generating signatures. Initially received is a request to generate a signature at a secure server. Then, the signature is automatically generated at the secure server utilizing a private key stored at the secure server. The signature is then transmitted from the secure server. Such signature is capable of being used to verify an authenticity of an update (i.e. data and/or software) for a computer utilizing a public key.

Abstract: A method and apparatus for preventing data leakage facilitated by steganography is provided. In one embodiment, the method for preventing data leakage caused by steganography without perceptual quality degradation comprises processing content being transmitted from a computer, wherein the content comprises steganographic data; and before the transmission, modifying the steganographic data to corrupt hidden information within the content without perceptual quality degradation.

Abstract: Apparatus, methods, computer readable media and processors may provide a secure architecture within which a client application on a wireless device may, in some aspects, exchange information securely with resident device resources, and in other aspects, with a remote server over a wireless network.

Abstract: Systems and methods in accordance with embodiments of the invention enhance the security of content distribution using individualized playlists. In many embodiments, a playlist is individually composed for a client device so that the selection of content included in the playlist encodes information. One embodiment includes generating a watermark sequence, where each watermark sequence is a unique identifier, selecting between alternative chunks of encoded content based upon the watermark sequence, where each of the alternative chunks of encoded content includes the same perceptual content and differs in the way it is watermarked, and listing the selected chunks in a playlist, where content assembled using the playlist includes a unique watermark sequence.

Abstract: The terminal device 600 comprises: a read unit configured to read encrypted content and a content signature from a regular region of a recording medium device 700, and to read a converted title key from an authorized region of the recording medium device 700, the converted title key having been converted from a title key with use of a content signature generated by an authorized signature device 500; a title key reconstruction unit configured to generate a reconstructed title key by reversely converting the converted title key with use of the content signature read by the read unit; and a playback unit configured to decrypt the encrypted content with use of the reconstructed title key to obtain decrypted content, and to play back the decrypted content.

Abstract: The present invention relates to file system authentication and, in particular, authentication of users for accessing files stored on a serverless distributed or peer-to-peer file system. Its objective is to preserve the anonymity of the users and to provide secure and private storage of data for users on a serverless distributed file system. It provides a method of authenticating access to a distributed file system comprising the steps of; receiving a user identifier; retrieving an encrypted validation record identified by the user identifier; decrypting the encrypted validation record so as to provide decrypted information; and authenticating access to data in the distributed file system using the decrypted information.

Abstract: This discloses, in the computer data security field, a cryptographic hash function process embodied in a computer system and which may be keyless, but is highly secure. The process is based on the type of randomness exhibited by a heap or stack of physical objects such as a heap of pieces of fruit and involves modeling the behavior of such a heap when pieces are removed from the heap. Computation of the hash value (digest) is thereby the result of executing a heap model algorithm using the message as an input to initialize the heap, then executing the heap model algorithm which logically models the process of serially removing objects (pieces of fruit) from the heap at various locations in the modeled heap.

Abstract: Methods and systems for creating and managing certificates for gaming machines in a gaming network using a portable memory device are described. A gaming machine creates a certificate signing request which is stored on a portable memory device at the machine by an operator. The memory device is handed over to a certificate authority (CA) security officer at the casino and is coupled with an appropriate CA server. A certificate batch utility program on the server downloads and processes the CSRs. A certificate services program on the server issues gaming machine certificates according to the CSRs. In one embodiment, the certificates are uploaded onto the memory device, along with copies of certificate authority server certificates, including a root CA certificate. The CA security officer hands the memory device to the casino floor operator. At the machine, the operator inserts or couples the device and software on the machine identifies and downloads its certificate based on the certificate file name.

Abstract: The invention provides a method, system, device and computer program product for setting up a secure session among three or more devices or parties of a communication group, including authenticating a key agreement between the devices or parties of the communication group, wherein the devices of the group start, preferably after a key is computed or agreed, a protocol, preferably a multi-party data integrity protocol, for authenticating the key agreement.

Abstract: A method and apparatus is provided for securing a region in a memory of a computer. According to one embodiment, the method comprises halting of all but one of a plurality of processors in a computer. The halted processors entering into a special halted state. Content is loaded into the region only after the halting of all but the one of the plurality of processors and the region is protected from access by the halted processors. The method further comprises placing the non-halted processor into a known privileged state, and causing the halted processors to exit the halted state after the non-halted processor has been placed into the known privileged state.

Abstract: A mobile communication device operates in a wireless communication network with use of a communication service provided by a service provider (e.g. a wireless carrier for voice telephony, or data service provider for data synchronization). An application server receives, via the wireless network, a message from the mobile device. The message has a field for inclusion of a token having a digital signature corresponding to the service provider. The application server performs token validation of the message, which includes a verification step for verifying the digital signature of the token with a public key corresponding to the service provider. The application server then grants or denies access to an application service depending on the outcome of the token validation. In one embodiment, the application service is an e-commerce transaction service, wherein a proof-of-work (POW) test (e.g. a Captcha test) otherwise utilized for the service is bypassed or excluded.

Abstract: A method provided herein includes the following steps: storing seal data of an electronic seal, a digital certificate, electronic signature program and a private key of a sealer in an external portable apparatus; performing a Hash conversion to a file to be sealed and the seal data of the electronic seal to generate a data digest, wherein the file to be sealed is a layout file; sealing, in the portable apparatus, the data digest using the private key of the sealer and the electronic signature program to generate an electronic signature result; and combining the file to be sealed, the seal data of the electronic seal, the digital certificate and the electronic signature result to generate a seal combination file.

Abstract: An embodiment of the invention relates to an integrated circuit such as an FPGA wherein a stable unique identifier is produced by reading an intrinsic characteristic of the IC such as a physically unclonable function, and a related method. In one embodiment, a first unique identifier is generated using the intrinsic characteristic and is subdivided into a plurality of first subsets. A second unique identifier is received and subdivided into a plurality of second subsets. The first and second subsets are compared to identify matching subsets to generate the stable unique identifier. Each of the one or more matching subsets includes a particular one of the plurality of first subsets that matches a corresponding one of the plurality of second subsets. The stable unique identifier can be integrated into logic of the IC. Prior to comparing the subsets, the first and second subsets can be transformed with one-way functions.

Abstract: The present invention includes a computer-implemented method and an Enterprise Resource Planning System (ERP). The method and system allows a user to enable an electronic signature approval process for modification of data in a transaction. The method includes accessing a table that corresponds with the transaction and adding a signature field having a property sheet to the table. The method also includes defining a select property in the property sheet with a select parameter. The select property configured to provide approval of modified data in the transaction upon entry of a valid electronic signature.

Abstract: A non-keyboard computer peripheral device represents itself to a host computer as having a keyboard function in addition to representing its actual function. Keyboard status signals are generated by the host computer in response to a user pressing different keys on an actual keyboard. The peripheral device uses the keyboard status signals to identify different peripheral device operations selected by the user. In one example, a radio receiving device represents itself to the host computer as including the keyboard function. Pressing a button on the receiving device causes the receiving device to send a sequence of keystroke commands to the host computer that cause the host computer to initiate software applications and to display operating instructions to a user. A series of further binding operations are then executed in accordance with the displayed operating instructions.

Abstract: A digital signature management system for distributed software applications includes a communication network and a digital signature module coupled to the communication network. The system also includes one or more software applications coupled to the communication network that each include an identification code and a signature application that intercepts a digitally signed message received from a sending application and provides it to the digital signature module. The digital signature module can be configured to verify the digital signature of messages it receives from the one more software applications.

Abstract: There is described an electronic data communication system in which encrypted mail messages for a recipient are sent in two parts: message data encrypted by a symmetric encryption algorithm using a session key and session key data encrypted by an asymmetric encryption algorithm using a public key associated with the recipient. If the recipient uses a webmail service to access the encrypted electronic mail message, the encrypted session key data is sent to a trusted third party server which has access to the private key of the user. The trusted third party server decrypts the encrypted session key using the private key of the user, and then sends the decrypted session key to a remote network device for decryption of the encrypted message.

Abstract: A method begins by a dispersed storage (DS) processing module receiving a certificate signing request (CSR) from a user device. The method continues with the DS processing module generating a set of hidden passwords based on the CSR and accessing a set of authenticating units to obtain a set of passkeys. The method continues with the DS processing module retrieving a set of encrypted shares and decrypting the set of encrypted shares to produce a set of encoded shares. The method continues with the DS processing module decoding the set of encoded shares to recapture a private key and generating a user signed certificate based on the private key. The method continues with the DS processing module discarding the private key to substantially protect the private key from the user device and outputting the user signed certificate to the user device.

Abstract: Systems and methods are described that relate to authentication and/or binding of multiple devices with varying security profiles. In one aspect, a first device with a higher security profile may vouch for the authenticity of a second device with a lower security profile when the second device requests access for content from a content provider. The vouching process may be implemented by allowing the first device to overlay its digital signature on a registration request that has been signed and transmitted by the second device. The second device with the lower security profile may access content from the content provider or source for a predetermined time period, even when the second device does not access content through the first device.

Abstract: A system, method and computer-readable storage medium with instructions for operating a digital signature server and a portable security device to cooperate to provide digital signature services using a private key stored on the portable security device by delegating to a user's smart card the actual task of digitally signing documents. Other systems and methods are disclosed.

Abstract: Methods and systems for robust watermark insertion and extraction for digital set-top boxes are disclosed and may include descrambling, detecting watermarking messages in a received video signal utilizing a watermark message parser, and immediately watermarking the descrambled video signal utilizing an embedded CPU. The embedded CPU may utilize code that may be signed by an authorized key, encrypted externally to the chip, decrypted, and stored in memory in a region off-limits to other processors. The video signal may be watermarked in a decompressed domain. The enabling of the watermarking may be verified utilizing a watchdog timer. The descriptors corresponding to the watermarking may be stored in memory that may be inaccessible by the main CPU. The watermark may comprise unique identifier data specific to the chip and a time stamp, and may be encrypted utilizing an on-chip combinatorial function.