СПОСОБ, СЕРВЕР И СИСТЕМА ДЛЯ ИДЕНТИФИКАЦИИ ЧЕЛОВЕКА

Изобретение относится к области информационной безопасности в телекоммуникациях. Технический результат заключается в надежной идентификации владельца телекоммуникационного оборудования. Способ, в котором сервер получает запрос на идентификацию от терминала, отправляет идентификационный код терминалу посредством первой сети передачи данных; терминал передает идентификационный код телекоммуникационному оборудованию; сервер получает от телекоммуникационного оборудования идентификационный код вместе с уникальным идентификатором, генерирует одноразовый идентификационный маркер и отправляет его телекоммуникационному оборудованию посредством второй сети передачи данных; телекоммуникационное оборудование возвращает одноразовый идентификационный маркер серверу посредством второй сети передачи данных; одновременно терминал принимает личный код доступа, вводимый человеком; сервер получает личный код доступа от терминала посредством первой сети передачи данных; идентификация человека реализуется сервером ...

СПОСОБ И СИСТЕМА РАСПРЕДЕЛЕННОЙ РАЗРАБОТКИ ПРОГРАММЫ ДЛЯ ПРОГРАММИРУЕМОГО ПОРТАТИВНОГО НОСИТЕЛЯ ИНФОРМАЦИИ

Изобретение относится к защищенной от несанкционированного доступа разработке исполняемого программного кода для портативных программируемых носителей информации. Техническим результатом является повышение защищенности данных. Способ заключается в следующем: исходный текст программы составляют на компьютере пользователя, передают на компьютер эмитента носителя информации, где осуществляют компиляцию и компоновку исходного текста программы с получением исполняемого программного кода, который зашифровывают и преобразовывают в транспортный код, который загружают в носитель информации через компьютер пользователя, при этом на стадии предварительного комплектования носитель информации снабжают инструментальными программными средствами, позволяющими восстанавливать из представленного в переходном формате транспортного кода исполняемый программный код. Также раскрыта система для распределенной разработки исполняемой программы для портативного носителя информации и носитель информации. 5 н. и 15 ...

СПОСОБ И УСТРОЙСТВО ДЛЯ ШИФРОВАНИЯ/ДЕШИФРОВАНИЯ ДАННЫХ В ЗАПОМИНАЮЩЕМ УСТРОЙСТВЕ БОЛЬШОЙ ЕМКОСТИ

Изобретение касается способа и устройства, осуществляющих шифрование/дешифрование данных при записи или считывании из запоминающего устройства. Сущность изобретения состоит в обеспечении множества различных алгоритмов шифрования/дешифрования со взаимодействующими ключами, причем выбирают и используют один из множества различных алгоритмов шифрования/дешифрования со взаимодействующими ключами в элементе данных, подлежащих перенесению в адрес на носителе памяти или из него, причем при выборе алгоритма и взаимодействующего ключа используют, по меньшей мере, два физических адреса, определяющих верхний и нижний предел адресов адресуемой области, включающий адрес элемента данных на носителе. Технический результат, достигаемый при осуществлении изобретения, состоит в повышении защиты запоминающего устройства путем шифрования/дешифрования данных, хранящихся на адресуемых участках носителя памяти большой емкости, с помощью различных алгоритмов и ключей шифрования/дешифрования. 2 н. и 34 з.п. ф-лы ...

ИЗОЛИРОВАННОЕ ВЫЧИСЛИТЕЛЬНОЕ ОКРУЖЕНИЕ, ПРИВЯЗАННОЕ К ЦЕНТРАЛЬНОМУ ПРОЦЕССОРУ И МАТЕРИНСКОЙ ПЛАТЕ

... 1. Компьютер, выполненный с возможностью исполнения программного кода в изолированном вычислительном окружении, содержащийизолированное вычислительное окружение для исполнения программного кода, защищенную память, доступную только упомянутому программному коду и недоступную второму программному коду, исполняемому другим окружением исполнения;логическую схему для предписания процессору осуществлять исполнение из защищенной памяти; итаймер для хронирования событий, который присоединен к логической схеме, при этом упомянутый программный код активируется в качестве реакции на сигнал от таймера.2. Компьютер по п.1, в котором упомянутое другое окружение исполнения содержит одно из операционной системы, базовой системы ввода/вывода (BIOS) и ядра.3. Компьютер по п.1, в котором упомянутый программный код выполняет мониторинг состояния компьютера.4. Компьютер по п.3, дополнительно содержащий процессор, и состояние компьютера является одним из состояния ресурса, используемого операционной системой ...

МОДУЛЬ ОБЕСПЕЧЕНИЯ БЕЗОПАСНОСТИ, ВКЛЮЧАЮЩИЙ ВТОРИЧНЫЙ АГЕНТ, ВЗАИМОДЕЙСТВУЮЩИЙ С ГЛАВНЫМ АГЕНТОМ

... 1. Система для удаленного мониторинга устройства, включающая, по крайней мере, одну сеть, по крайней мере, один сетевой интерфейс устройства, связанный, с этой, по крайней мере, одной сетью, главный агент, приспособленный для работы под управлением операционной системы базового устройства, установленной на устройстве, при этом главный агент имеет доступ к, по крайней мере, одной сети через, по крайней мере, один сетевой интерфейс, центр мониторинга, подключенный к, по крайней мере, одной сети, и настроенный таким образом, чтобы иметь возможность связываться с главным агентом и (или) с вторичным агентом через, по крайней мере, один сетевой интерфейс, и вторичный агент, установленный на устройстве, при этом вторичный агент имеет доступ к, по крайней мере, одной сети, через, по крайней мере, один сетевой интерфейс независимо от операционной системы базового устройства, при этом вторичный агент и главный агент приспособлены для того, чтобы передавать в центр мониторинга сведения об атрибутах ...

КРИСТАЛЛ ИНТЕГРАЛЬНОЙ СХЕМЫ, УСТРОЙСТВО ДЛЯ ОБРАБОТКИ ИНФОРМАЦИИ, СПОСОБ УПРАВЛЕНИЯ ПРОГРАММНЫМИ МОДУЛЯМИ, СИСТЕМА И СПОСОБ ОБРАБОТКИ ИНФОРМАЦИИ

... 1. Кристалл интегральной схемы (IC chip), содержащий: ! секцию памяти, конфигурированную для хранения информации о карте распределения нескольких программных модулей для обработки информации, которой схема обменивается в соответствии с различными принципами бесконтактной связи; ! секцию управления, конфигурированную для управления работой программных модулей на основе информации о карте распределения; и ! дополнительный программный модуль, конфигурированный для отображения информации о карте распределения, чтобы разрешить или запретить работу указанных нескольких программных модулей. ! 2. Кристалл интегральной схемы по п.1, отличающийся тем, что, если указанные программные модули, работа которых запрещена, начинают работать, секция управления осуществляет аппаратный сброс. ! 3. Кристалл интегральной схемы по п.2, отличающийся тем, что дополнительный программный модуль осуществляет отображение состояний, в которых разрешено работать только одному из программных модулей. ! 4. Кристалл интегральной ...

СПОСОБ, СЕРВЕР И СИСТЕМА ДЛЯ ИДЕНТИФИКАЦИИ ЧЕЛОВЕКА

... 1. Способ для идентификации человека, при котором серверу идентификации заранее известно, что человек является владельцем телекоммуникационного оборудования, имеющего уникальный идентификатор, и известно, что человек имеет личный код доступа, при этом способ содержит:- получение (51) сервером запроса на идентификацию от терминала посредством первой сети передачи данных;- отправку (53) сервером идентификационного кода терминалу посредством первой сети передачи данных;- передачу (57) идентификационного кода от терминала телекоммуникационному оборудованию;- получение (59) сервером от телекоммуникационного оборудования посредством второй сети передачи данных идентификационного кода вместе с уникальным идентификатором;- генерацию (61) сервером одноразового идентификационного маркера и отправку (63) его телекоммуникационному оборудованию посредством второй сети передачи данных; и возврат (64) одноразового идентификационного маркера серверу телекоммуникационным оборудованием посредством второй ...

VERFAHREN UND SYSTEME ZUR TRANSAKTIONSAUFZEICHNUNGSÜBERTRAGUNG UNTER ANWENDUNG VON SCHWELLEN UND EINEM MEHRSTUFIGEN PROTOKOLL

Verfahren und Vorrichtung zur Autorisierung in Datenübertragungssystemen

Verfahren und Vorrichtung zur Überprüfung einer Datei

The invention relates to a method and a device for verifying the authenticity and integrity of a file which has been received, or is to be transmitted from a computer (14) and which is furnished with a digital signature. For the verification process, said method accesses signals which are available at an interface (18) of the computer that is linked to an output device (16) for outputting the file furnished with the digital signature. A device (20) for carrying out the method comprises a circuit and a programme which are used to perform the verification in the device (20), in a manner which is logically separate from the central calculation unit of the computer (14). The device (20) is coupled to an interface (18) of the computer (14) that is linked to an output device (16), in such a way that it detects the signals used for the verification, in order to output the file furnished with the digital signature.

SYSTEM UND VERFAHREN FÜR EINE MEHRZWECKCHIPKARTE DIE EINE NACHTRÄGLICHE SPEICHERUNG EINER ANWENDUNG AUF DIESER KARTE ERMÖGLICHT

Eingebauter Prozessor mit direkter Verbindung von Sicherheitsvorrichtungen für verbesserte Sicherheit

Integrierte Schaltung (212), umfassend: eine Schnittstellen-Logikschaltung (216) eines ersten Busses zur Verbindung mit einem ersten externen Bus (215); eine Mikrosteuerung (320), welche geeignet konfiguriert ist, um ein Eingangssignal von einer Sicherheitsvorrichtung (720) über eine direkte Eingangsleitung (710), welche von dem ersten externen Bus (215) verschieden ist, zu empfangen, wobei die Mikrosteuerung (320) ferner geeignet konfiguriert ist, um eine Anforderung zu empfangen und die Sicherheitsvorrichtung (720) über die direkte Eingangsleitung (710) zu befragen.

Apparatus and method for storing log files on a once only recordable medium

An apparatus 30 for storing log data of an user in a communications network comprises a control means 31, a data transmission means and a once only recording medium 34,35. In use the control means 31 creates log data and transmits it via the data transmission means to the recording means 34,35 . Preferably the control means 31 operates a switching mechanism 33 to select the recording medium according to available capacity. Preferably the recording medium is a CD-R or DVD-R. A method of recording log files is also proposed. A log file is created on a storage device S30 and set as an old log file S45 . Log data pertaining to an accessing user is recorded in the storage device S50 and the resultant file set as a new log file S55. If the content of the two files differs then the data is recorded into an additional log file S130 and written to the recording medium S140, preferably in either real time or at a predetermined interval.

Portable storage device with Firewire connection

System and method of tamper-resistant control

Protection and controlled distribution of digital content

A system that employs a licensing scheme for distributed digital content. The licensing scheme requires the authentication of a physical key device 1 (e.g. a smart card) and an application extension 9 and may provide content 4 and licenses 5 which are encrypted in a fashion that is unique to the physical key device. The licensing scheme and authentication mechanisms used minimise the possibility of commercial copying. The licensing scheme and authentication mechanisms also allow the consumption of content without the physical key device being present, but still under the conditions defined by the licence. Independent claims relate to various aspects including:

Operating system data management

A method of computer operating system data management comprising the steps of: (a) associating data management information with data input to a process (300); and (b) regulating operating system operations involving the data according to the data management information is provided (310). A computing platform (1) for operating system data management is also provided. Furthermore, a computer program including instructions configured to enable operating system data management, an operating system, and an operating system data management method and apparatus arranged to identify data having data management information associated therewith when that data is read into a memory space are provided.

USB autorun devices

Systems and methods for controlling internet access

Trusted computing environment

System security process method and properties of human authorization mechanism

PROTECTED BACKWARD CHANNEL OF THE DIGITAL RIGHT ADMINISTERING DONGLE

MULTI-GATE MEMORY UTILIZATION INTELLIGENT ONE DATA BUS INTERFACE

CONTROL UNIT

PROCEDURE FOR AUTHENTIFIKATION OF APPLICATIONS

PROCEDURE AND CIRCUIT FOR IDENTIFYING AND/OR VERIFYING HARDWARE AND/OR SOFTWARE OF EQUIPMENT AND A WITH THE EQUIPMENT OF WORKING DATA MEDIUM

EQUIPMENT TO AUTHENTIFIZIERUNG THE MESSAGE

PROTECTION OF AN ELECTRONIC FILE USING THE LOCATION

SYSTEM AND PROCEDURE FOR THE PROTECTION OF KEYS FOR MASTER CODING

PROCEDURE FOR THE PROTECTION OF DATA

OPTICAL DATA MEDIUM, PLAYER FOR OPTICAL DATA MEDIA AND PROCEDURE FOR PLAYING AN OPTICAL DATA MEDIUM AS WELL AS A AUTHENTIFIKATION OF DOWNLOADED CONTENTS

PROCEDURE AND SYSTEM FOR THE SWITCHING OF PLATFORM-INDEPENDENT REMOTE EXPENSIVE DEVICE AND FOR THE MONITORING OF THE FACILITY ACCESS SUPERVISION

PROCEDURE, SYSTEM AND SAFETY DEVICE FOR DATA ARCHIVING WITH AUTOMATIC CODING AND DECODING BY FRAGMENTING OF KEYS

RELIABLE COMPUTERS PLATFORM

PROCEDURE AND SYSTEM FOR THE DISTRIBUTED PRODUCTION OF A PROGRAM FOR A PROGRAMMABLE ONE, PORTABLE DATA MEDIUM

PROCEDURE FOR THE EXAMINATION OF A SIGNATURE OF A MESSAGE

PROCEDURE FOR THE MONITORING OF THE PROGRAM SEQUENCE

Single chip microprocessor, math co-processor, random number generator, real-time clock and ram having a one-wire interface

Self-managed network access using localized access management

SYSTEM AND METHOD FOR AUDIO TICKETS

Device and method for digital rights management

Intelligent data bus interface using multi-port memory

Method and apparatus for software authentication

Device, system and method for data access control

Trusted path subsystem for workstations

Access control/crypto system

Hand-drawing capture via interface surface

Using a high level programming language with a microcontroller

METHOD FOR SECURED ACCESS TO DATA IN A NETWORK

The invention relates to a method which ensures respect for data protection rights, especially as regards personal data which are available in a network with distributed memories. According to said method access rights to the data available in the network are distributed to owners, with the possibility of revocation, and the data are stored in the network only after authorization has been given by the owner holding the rights to the data. When certain data are requested only the references of those data records for which the requestor holds the access rights can be given. Data which are available but for which there are no access rights cannot be recognized. Should someone wish to access data the access rights can again be verified before access to said data is authorized.

METHOD AND APPARATUS FOR ACQUIRING AND REMOVING INFORMATION REGARDING DIGITAL RIGHTS OBJECTS

A method and apparatus for acquiring and removing information regarding a digital rights object are provided. The method for acquiring removing information regarding a digital rights object includes receiving a request for data on a rights object from a device, processing the data on the rights object in response to the request, and providing the processed data to the device. The method of removing a digital rights object includes selecting information regarding a rights object to be removed, encrypting the selected information regarding the rights object using a common encryption key, embedding the encrypted information regarding the rights object into a signal to be transmitted to a portable storage device, and transmitting the signal to the portable storage device. A device requests information regarding a rights object from a portable storage device, receives the information regarding the rights object from the portable storage device, and removes an unnecessary rights object.

INDEPENDENT COMPUTER MODULE SYSTEM

A portable secure computer architecture, apparatus, and method for protecting information and at least one program for controlling that information is disclos ed comprising: a computer protected inside of a single sealed cartridge, the comput er having a CPU, Memory, and a communications means for communicating with a host computer outside of the cartridge. All internal information and external communications a re exclusively controlled by the internal program. Provision is also made for runni ng a second program inside the architecture, while protecting secure information from that s econd program. Secure information is placed in a bank switched subdivision of memory. The subdivision is switched off by the information controlling program before the se cond program is permitted to run. Reactivating the protected subdivision causes a sim ultaneous non-maskable interrupt halting the second program and transferring control back to the first program.

SYSTEM AND METHOD OF OWNER CONTROL OF ELECTRONIC DEVICES

A system and method of owner control of an electronic device are provided. Owner identification information, such as data integrity and source authentication information, is stored on the electronic device. Received owner control information is stored on the electronic device where the integrity of the received owner control information is verified and/or the source is authenticated using the owner identification information. In one embodiment, owner identification information comprises an owner signature private key.

METHOD AND APPARATUS FOR PROGRAMMING ELECTRONIC SECURITY TOKEN

A method of programming a second security token (720) using data stored on a first security token (710), wherein a privilege to be assigned to the second security token (720) is selected by a user of the first security token (710). The user selects from privileges derived from a first set of privileges assigned the first security token (710). A file containing a definition of the privilege to be assigned to the second security token is transferred from an apparatus for programming security tokens (500) to the second security token (720).

METHOD AND APPARATUS FOR SOFTWARE AUTHENTICATION

A system for authenticating software is disclosed. In one embodiment, the invention is utilized in conjunction with a gaming machine to authenticate the software utilized by the gaming machine or loaded onto the gaming machine. To achieve authentication, one exemplary mode of operation is used to authenticate the contents of a removable media (224), the removable media being used to per form any desired operation on the gaming machine. Use of a removable media (224) provides means to store large amounts of software on a single media to thereby access and perform numerous tasks including software install, software update, diagnosis, authentication, or configure.

DYNAMIC SUBSTITUTION OF USB DATA FOR ON-THE-FLY ENCRYPTION/DECRYPTION

A security module and method implements data requests from a USB or other similar device, in which a secure component can communicate securely with a device without modifying the underlying USB bus protocol, or the device, even where the software controlling the bus is untrusted. A security module (physically separate or integrated into a device or hub) intercepts data being sent from device to secure component in response to a data request. A "not acknowledged" signal is sent to the secure component, and the data is encrypted. The next data request is intercepted, and the encrypted data sent in response. The acknowledgement from the secure component to the device is allowed to reach the device. In order to handle a setup request, an allow command is sent to the security module, which includes the encrypted and unencrypted setup command. If an encryption check is successful, a setup command sent to the device (via the security module) is allowed to reach the device.

WIRELESS PERSONAL AREA NETWORK HAVING AUTHENTICATION AND ASSOCIATED METHODS

A wireless personal area network (WPAN) system includes a plurality of WPAN devices using encrypted wireless communication therebetween when in an enabled state and not wirelessly communicating when in a disabled state. At least one of the WPAN devices includes a WPAN identity reader for reading at least one identifying parameter of a user, for confirming that the user is an authorized user based upon reading the at least one identifying parameter, and for wirelessly communicating with at least one other WPAN device to switch the at least one other WPAN device from the disabled state to the enabled state based upon confirming the user is an authorized user.

MOBILE UNIT PARENTAL CONTROL

Parents can desire to limit content viewable upon a mobile device and a u niversal integrated circuit card can be programmed to limit viewing upon the mobile device. A user completes a service request form that includes an all owable view threshold for content upon the mobile device. The request can tr ansfer to a service provider, sometimes via a base station. A subscription m anager can forward the threshold back to the mobile device and the mobile de vice can program the threshold upon secure storage. When content is received , it can be compared against the threshold and a determination can be made o n if the content is allowable to view in light of the threshold.

SECURE KVM SYSTEM HAVING REMOTE CONTROLLER-INDICATOR

As KVMs (Keyboard Video Mouse) may be abused by attackers to bridge or leak between isolated networks, Secure KVM typically used having isolated circuitry for each computer channel to reduce its vulnerability to leakages between channels. To enable remote installation of a KVM with isolated computers a remote Controller-Indicator is needed in order to present to the user the KVM front panel indications and to enable certain control functions. The current invention provides a KVM switch capable of providing secure remote extension of KVM control and indication functions. Another object of the present invention is to provide a KVM switch having secure remote extension of the complete user console with support of: remote keyboard, mouse, one or more displays, smart-card reader, audio devices, KVM control and KVM monitoring.

ORIENTATION DETERMINATION FOR A MOBILE DEVICE

A system determines an orientation of a user of a mobile device has a head-mounted accessory device including a first digital compass for providing a first orientation signal and a short-range wireless transmitter for transmitting the first orientation signal to the mobile device. The mobile device includes a short-range wireless receiver for receiving the first orientation signal from the head-mounted accessory device. A processor in the mobile device determines the orientation based on the first orientation signal. The mobile device may include a second digital compass. The system with two compasses provides greater accuracy. By comparing the two orientation signals, the device can infer whether the user is viewing the mobile device. Tilt sensors in the accessory device and mobile device can also be used with the orientation signals to infer whether the user is viewing the mobile device and thus to control content delivered by the mobile device.

CRYPTOGRAPHIC FILE SECURITY FOR SINGLE DOMAIN NETWORKS

SYSTEM AND METHOD FOR ALERTING AND TRACKING WITH IMPROVED CONFIDENTIALITY

An alarm system comprising at least one first signal source (110a -110j) communicating with a central unit (100) configured for providing a logically true alerting signal (120) when predetermined conditions are met. The signal sources 110 may include transponders, such as RFID chips, for example, and a confidential list containing the relation between an RFID chip and the name of the person identified may be stored in a computer 160. A verification unit (200) is connected to independent signal sources (210a - 210j) and is configured for providing a logically true verification signal (220) when predetermined conditions are met. The signal sources (210) may also comprise means for measuring bio-functions, e.g. heart rate, respiration, or eye movements, and the verification unit (200) may be carried by a safety manager. In such a case, the safety manager will also be able to confirm or reject an alerting alarm from the central unit (100) manually. An alarm signal (320) is activated if and ...

APPARATUS AND METHOD FOR SECURE DISTRIBUTION OF DATA

The present invention overcomes the disadvantages and limitations of the related art by providing an apparatus and method for secure distribution of software, software updates, and configuration data. Cryptography is used to protect software or data updates sent to computer products or peripherals using non-secure distribution channels. In the preferred embodiment, the contents of the data cannot be read by anyone who obtains the data, and the data will not be accepted unless it is unmodified and originated with the valid source for such data.

INFORMATION PROVIDING SYSTEM

A content provider (1) adds a dealing policy to a ciphered content and transmits the content with the dealing policy to a service provider (3). The service provider (3) calculates and adds to them the charge from the dealing policy and transmits them to a user home network (5). The user home network (5) creates charging information according to the use of the content, and transmits the information with the dealing policy to an EMD service center (1). The EMD service center (1) detects fraudulence from the charging information, dealing policy, and the charge.

PORTABLE INFORMATION STORAGE DEVICE FOR STORING AND PROCESSING INFORMATION.

Electronic security key for controlling use of computer software

A terminal (2) connects to the serial port of the computer, and a circuit attaches to this serial port. The circuit includes a single chip (5) which has three types of memory built in - PROM, RAM and EEPROM (6,7,8). - A logic unit (9) controls all the operations of the chip, and a serial management unit (10), which may be of RS-232 and RS-485 type, offers programmable baud rates and parity with the possibility of introducing block errors according to programmable rules. Also within the external circuit is a unit (11) for managing communication protocols and a unit (12) for decoding input routines. A further unit (13) processes inputs and units (14 & 15) analyse and manage random events.

Method for the secure processing of data in a computer, uses a mass memory device connected to a computer and processes data without leaving any trace of files and operations carried out

The processing method involves requesting one or more passwords, checking the presence of a persistence folder in the primary volume and if not present creating a folder, assembly of the second volume, formatting of the second volume and modifying the second volume into a visible and encrypted volume linked to a primary password and creating the encrypted persistence folder and file on the second volume. Independent claims are included for a processor computer program;#a mass memory device connected to a computer; and#an electronic data processing unit.

Method and apparatus for establishing usage rights for digital content to be created in the future

Usage rights for a digital work are established prior to creation of the corresponding content. The rights can be associated with the content after the content is created. A content creation, such as a video recorder or a still camera, device can store labels of the rights and can associate usage rights with content in real time as the content is created.

Apparatus management system

PROCEEDED OF SECURITY AND Access control HAS INFORMATION STARTING FROM a DATA-PROCESSING PLATFORM EQUIPEE Of a MICROCOMPUTER

Procédé de sécurisation et de contrôle d'accès à des informations à partir d'une plate-forme informatique équipée d'un micro-ordinateur, caractérisé en ce qu'il consiste: - à produire au moins un support d'enregistrement non réinscriptible sur lequel sont stockées des informations telles que des données et/ou applications selon un format logique prédéterminé, ainsi qu'un logiciel d'exploitation de ces informations, - à configurer ou transformer la plate-forme informatique d'un utilisateur autorisé en un poste de travail sécurisé pour interdire toute intrusion matérielle et/ou logicielle visant à accéder indûment aux informations ou à en faire usage en lieu et place d'un utilisateur autorisé et sans son accord, et - à charger le logiciel d'exploitation à partir du support d'enregistrement qui est lu par un dispositif de lecture approprié de la plate-forme informatique.

DVD PLAYER HAS THE SESSION PAYABLE

SECURITY OF READING Of INSTRUCTIONS IN a SYSTEM OF TREATMENT DEDONNEES

Access control OF SUBJECTS HAS OBJECTS IN PARTICULAR IN a CHART AMICROCONTROLEUR

PROCEDE ET DISPOSITIF DE SAUVEGARDE QUALITATIVE DE DONNEES NUMERISEES

L'INVENTION CONCERNE UN PROCEDE ET UN DISPOSITIF DE SAUVEGARDE QUALITATIVE DE DONNEES NUMERISEES. UNE SIGNATURE CHIFFREE S REPRESENTATIVE DES INFORMATIONS ET DE L'IDENTITE DU DETENTEUR DE CELLES-CI EST ETABLIE AU MOYEN D'UN ALGORITHME DE CALCUL DE CHIFFREMENT ET DE COMPRESSION DES INFORMATIONS A SAUVEGARDER. LA SIGNATURE S EST ENREGISTREE SUR LE SUPPORT DES INFORMATIONS CONSTITUANT LE MESSAGE M. LES PARAMETRES DE CALCUL DE LA SIGNATURE S, UNE OU PLUSIEURS CLEFS SECRETES, SONT ENREGISTRES SUR AU MOINS UN SUPPORT INVIOLABLE. APPLICATION A LA SAUVEGARDE QUALITATIVE ET A LA PROTECTION DES DONNEES EN LIGNE OU NON DE BASES DE DONNEES.

PROCESS AND SURVEILLANCE DEVICE OF the COURSE Of a PROGRAM, DEVICE PROGRAMS ALLOWING the MONITORING OF ITS PROGRAM

DEVICE Of INTERFACE BETWEEN a PARALLEL PORT Of a COMPUTER AND AT LEAST UNPERIPHERIQUE COMPRISING an INTERFACE FOR SMART CARD

PROCEEDED OF DETECTION OF MICROPROCESSOR CARDS NONAUTHENTIC, MICROPROCESSOR CARD, FINAL CARD READER AND CORRESPONDING PROGRAMS

L'invention concerne un procédé de détection de cartes à microprocesseur non authentiques, appelées clones. Selon l'invention, ledit procédé comprend les étapes suivantes : - modification d'un programme de contrôle d'au moins un terminal lecteur de cartes, de façon que ledit programme comprenne un appel d'au moins une commande dite secrète d'un jeu d'au moins une commande secrète, préalablement inséré dans chaque carte authentique, et distinct d'un jeu de commandes standard et public ; - détection de l'authenticité de ladite carte, si ladite commande secrète est reconnue et/ou traitée de façon correcte, ou de la présence d'un clone, si ladite commande secrète n'est pas reconnue et/ou traitée de façon erronée.

MICROPROCESSOR PROTECTS FROM A OVERFLOW FROM PILE

L'invention concerne un microprocesseur comprenant une unité centrale (CPU), au moins une pile d'exécution (STCK), un pointeur de pile (SP), un bus d'adresse (B1) et un bus de données (B2). Le microprocesseur comprend également un moniteur hardware (MT) configuré pour fournir des codes témoins (C1, C2), insérer les codes témoins dans la pile ou laisser l'unité centrale les insérer, puis générer un signal d'erreur (ER) en réponse à une tentative de modification d'un code témoin présent dans la pile.

A method of authenticating a user in a managed industrial line

DEVICE Of INTERFACE BETWEEN a PARALLEL PORT Of a COMPUTER AND AT LEAST a PERIPHERAL COMPRISING an INTERFACE FOR SMART CARD

La présente invention concerne un dispositif (1) d'interfaçage entre un port parallèle (2) d'un ordinateur et au moins un périphérique. Selon l'invention, le dispositif (1) comporte en outre : - une interface (4) pour cartes à puce (5) apte à conditionner l'autorisation d'accès à au moins une partie des applications informatiques ¡ - au moins une interface (6, 9) de périphérique pour la liaison avec chaque périphérique (7, 8); - une interface de gestion (3) connectée au port parallèle (2) de l'ordinateur et apte à gérer le flux de données entre l'ordinateur, l'interface (4) pour carte à puce et les interfaces périphériques (6, 9). Application à la sécurisation de systèmes informatiques par une autorisation donnée par carte à puce.

Ｍ2Ｍ 통신을 인에이블하는 방법 및 장치

... 보안 M2M 프로비져닝 및 통신을 수행하기 위한 방법 및 장치가 개시된다. 특히, M2ME를 고유하게 식별하기 위한 임시 비공개 식별자, 또는 임시 접속 식별정보(PCID)도 또한 개시된다. 또한, M2ME를 확인하고 인증하고 프로비져닝하는데 사용하기 위한 방법 및 장치가 또한 개시된다. 개시된 확인 절차는 자율, 반자율, 및 원격 확인을 포함한다. 프로비져닝 절차는 M2ME를 재프로비져닝하기 위한 방법을 포함한다. 소프트웨어를 업데이트하고, M2ME에 대한 조작을 검출하는 절차도 또한 개시된다.

SYSTEM FOR PROVIDING LIMITED-ACCESS HOMEPAGE

IC TAG SYSTEM

CARD READ/WRITE CONTROLLER OF PERSONAL COMPUTER WITH USE PREVENTIVE FUNCTION BY CHIP-IN CARD

PURPOSE: A card read/write controller of a personal computer with use preventive function by a chip-in card, is provided to fundamentally cut off use without permission by mounting a card read/write unit on the personal computer and controlling a data input of an input circuit by an attachment and detachment of the ching-in card. CONSTITUTION: A card read/write control circuit(26) detects attachment or detachment with a detection switch switched in reply to an operation of attachment or detachment of a chip-in card, has a display lamp showing the attachment or detachment, generates an interrupt signal by a detection signal generated from the card read/write unit for an electrical connection to a card, and controls a read/write of information with the card read/write unit.A host control circuit receives an input circuit more than one at least to input command or information and the interrupt signal from the card read/write control circuit, controls the input of the command and information ...

METHOD FOR CONFIRMING DIVERSION OF MOBILE WIRELESS STATION

PURPOSE: A method for confirming diversion of a mobile wireless station is provided to prevent surreptitious use or use of an unacceptable person by forcedly performing confirmation procedure of appropriateness or secret number of a SIM card. CONSTITUTION: If a user provides power to a mobile wireless station or inserts a SIM card into an IC card part, a CPU starts on confirmation procedure of SIM(Subscriber Identity Module)-lock(4a). The CPU checks the contents of 'SIM-lock confirmation mode' storage address within an EEPROM of a memory part(4b). It is judged whether the mode is a 'force confirmation mode'(4c). The CPU unconditionally performs SIM-lock confirmation procedure(4d). The CPU reads an identification code of the EEPROM for comparing the identification code of the SIM card inserted into the IC card part(4f). The CPU confirms the result of comparison and terminates the confirmation procedure if the identification codes are coincided(4g). If the identification codes are coincided ...

MOBILE UNIT PARENTAL CONTROL

USING HIGH LEVEL PROGRAMMING LANGUAGE WITH MICROCONTROLLER

PURPOSE: An integrated circuit card including a memory that stores an interpreter and an application that has a high level programming language format is provided so that the processor of the card is configured to use the interpreter to interpret the application for execution and to use a communicator of the card to communicate with the terminal. CONSTITUTION: An integrated circuit card includes a communicator that is configured to communicate with the terminal, a memory and a processor. The memory stores applications, and each application has a high level programming language format. The memory also stores an interpreter. The processor is coupled to the memory and is configured to use the interpreter to interpret the applications for execution, to use the interpreter to create a firewall to isolate the applications from each other, and to use the communicator to communicate with the terminal. COPYRIGHT 2000 KIPO ...

CONTENT DELIVERY SYSTEM

Code of a software product is delivered by embodying, on a computer-readable storage medium, installation code for installing the software product code on a computer and DRM code for permitting the installation only if a predetermined condition is satisfied. If the condition is violated, the installation code is erased and that part of the storage medium then is available for general use. © KIPO & WIPO 2008 ...

INFORMATION PROCESSING DEVICE, METHOD OF CONTROLLING INFORMATION PROCESSING DEVICE, INFORMATION PROCESSING DEVICE CONTROL PROGRAM AND COMPUTER READABLE RECORDING MEDIUM WITH INFORMATION PROCESSING DEVICE CONTROL PROGRAM RECORDED THEREON

Nfc communications device for setting up encrypted email communication

KEY FOB WITH PROTECTED BIOMETRIC SENSOR

A key fob includes a biometric sensor including a fingerprint area sensor having a surface for receiving a finger, and a controller includes at least one processor configured to authenticate a user of the key fob based on biometric information obtained with the biometric sensor and stored biometric information for an individual. The key fob includes a RF transmitter for communicating stored transaction information to a reader upon authentication of the user and a housing. The housing includes a base for supporting the biometric sensor and a cover sleeve slidably engaged with the base to allow for extension from and retraction into the sleeve by the base, thereby permitting selective exposure of the fingerprint area sensor under user actuation.

CONTENT DELIVERY SYSTEM

Code of a software product is delivered by embodying, on a computer-readable storage medium, installation code for installing the software product code on a computer and DRM code for permitting the installation only if a predetermined condition is satisfied. If the condition is violated, the installation code is erased and that part of the storage medium then is available for general use.

MESSAGE HANDLING AT A MOBILE DEVICE

A method for sending a message from a mobile device via a first application running on the mobile device is proposed. The method comprises a challenge step for supplying the first application with a challenge, a response step for receiving a response to the challenge, an equality check step for determining whether the received response corresponds to an expected response, a signature step for providing a signature for the message, using a cryptographic key and the result of the equality check step, and a send step for sending the signed message via the first application from the mobile device to a backend system.

OPERATING SYSTEM INDEPENDENT DATA MANAGEMENT

Apparatuses and methods provide operating system independent digital rights management. A request can be made for data, which can be monitored by a security module. The security module is independent of a host operating system and manages digital rights for the requested data. Thus, digital rights management occurs outside the context of a host operating system. The security module may classify the data and determine a security policy based on the data classification. Policy may be stored locally or remotely, and may be associated with the data subject to the policy.

USB MEMORY ENCRYPTION DEVICE

The invention is the USB memory encryption device (501) providing encryption capability against the problem of accessibility to the content of portable memories (USB flash memory (502) and USB external discs (505)) that are increasingly used in the IT sector, in the event of losing or robbery.

ELECTRONIC SIGNATURE METHOD AND ELECTRONIC SIGNATURE TOOL

An electronic signature method and an electronic signature tool are disclosed. At first, outputting the verification promoting information; receiving the verification confirming information inputted by user; validating whether the verification confirming information and the verification promoting information are matched or not, if they are matched, performing the predetermined electronic signature operation. With the electronic signature method and electronic signature tool, it can prevent from attacking of other users on the network and implement transaction in security simply and convenience, and convenient for popularizing.

KEY DEVICE AND METHOD BASED ON CAMERA AND BAR CODE IDENTIFICATION TECHNOLOGY

The present invention relates to a key device and method based on camera and bar code identification technology, which belongs to the network information security certification domain. The Key device includes a CPU processing module, a camera module connecting the CPU processing module, a display module and a keystroke module, and a power management module, wherein the camera module is used for photographing a bar code image, and transmitting the taken bar code image to the CPU processing module, the CPU processing module analyzes the bar code image, transmits a transaction information data to the display module, and performs the corresponding process according to the response of the keystroke, and computes digital signature for the transaction information data, and generates a bar code image to display on the display screen, etc. The device and method in the present invention can improve the universality of the Key, thus the Key can be used on the PC, and on the mobile intelligent device ...

COMMUNICATION DEVICE AND COMMUNICATION SYSTEM

A communication device enabling a user to perform authentication by simple action with the use of physical information and to perform communication via user’s body. An authentication device (10) has a communication section (30) for communicating via user’s body, a communication terminal (31) for communications, a sensor section (26) for sensing physical information, an authentication section (20) for authenticating the physical information and user information, and a storage section (22) for storing the physical information. The sensor section (26) is placed so that a communication contact portion (62b) is in contact with the communication terminal (31) when the sensor section (62a) senses physical information. By this the user can perform, by simpler action, both authentication using physical information and communications via the user’s body.

METHOD AND SYSTEM FOR ESTABLISHING A TRUST FRAMEWORK BASED ON SMART KEY DEVICES

A mechanism is provided for securing cryptographic functionality within a host system such that it may only be used when a system administrator physically allows it via a hardware security token. In addition, a hardware security unit is integrated into a data processing system, and the hardware security unit acts as a hardware certificate authority. The hardware security unit may be viewed as supporting a trust hierarchy or trust framework within a distributed data processing system. The hardware security unit can sign software that is installed on the machine that contains the hardware security unit. Server processes that use the signed software that is run on the machine can establish mutual trust relationships with the hardware security unit and amongst the other server processes based on their common trust of the hardware security unit.

METHOD AND SYSTEM FOR THE DISTRIBUTED CREATION OF A PROGRAM FOR A PROGRAMMABLE PORTABLE DATA CARRIER

The invention relates to a method for the distributed creation of a program for a programmable portable data carrier (10), for example, a chip card. To this end, program source text (Q) is created on a user computer (20), compiled and linked to executable program code (C) on a spatially separate compiler server (30), and the executable program code (C) is loaded into the data carrier (10) once again via the user computer (20). A secure end-to-end link is established for conducting an exchange of data between the data carrier (10) and the compiler server (30). To this end, the data carrier (10) is provided, in a pre-completion step, with software tools for final processing, which permit a transport code (U, Cssl, UCSM) provided in a transition format to be converted into executable program code (C). The transport code (U, Cssl, UCSM) is secured by encoding mechanisms. The transmission of the executable program code (C), which is generated by the compiler server (30), ensues in the transition ...

COVER FOR SELLING ELECTRONIC INFORMATION

A cover for selling electronic information represents the ownership of electronic information by use of address, identifier and password. The address field for electronic information identification is a very new idea, which identifies the server system of the electronic information in the communications network. This simplifies routing of access request to the server where the electronic information is stored and enables use of distributed system of small computers eliminating the need of a large-scale centralized system. This small amount of information consisting of address, identifier and password can be written on any record medium as access tool. This type of record medium is a typical example of the cover of the present invention, and the new business model of off-line commerce of on-line information is also part of the present invention. Access control database system and terminal equipment to use this type of identification are part of the present invention.

System and method for performing a management operation

There is provided a system and method of performing a management operation. An exemplary method comprises receiving a command that comprises information derived from a private key in response to a request to generate the command for an electronic device. The exemplary method also comprises verifying a source of the command using the information derived from the private key and a corresponding public key stored in an immutable memory of the electronic device. The exemplary method additionally comprises performing a management operation corresponding to the command if the verifying of the source of the command determines that the command is from an authorized source.

Data integrity protecting and verifying methods, apparatuses and systems

The disclosure provides data integrity protecting and verifying methods, apparatuses and systems. A data integrity protecting method include: calculating a Hash value of each of the data blocks by using a first Hash function, to obtain a plurality of block Hash values which form a first series of Hash values; calculating a second series of Hash values based on the first series of Hash values, the second series of Hash values comprising a plurality of chain Hash values, each of which being associated with a corresponding block Hash value in the first series of Hash values and being associated with a neighbor chain Hash value in the second series of Hash values, wherein the first series of Hash values and the second series of Hash values used as integrity information of the data; and generating verification information of the data by using a last chain Hash value.

Random-id function for smartcards

A method for low-level security based on the UID. In particular it enhances an RFID system by adding the ability to dynamically modify the UID of the smartcard or to randomly generate a new UID for the smartcard.

Method and system for subscription digital rights management

A system and method for managing use of items having usage rights associated therewith. The system includes an activation device adapted to issue a software package having a public and private key pair, the public key being associated with a user, a license device adapted to issue a license, a usage device adapted to receive the software package, receive the license and allow the user to access the item in accordance with the license, and a subscription managing device adapted to maintain a subscription list including the public key associated with the user. License's is issued by the license device upon verifying presence of the public key in the subscription list corresponding to requested content.

Removable devices

Methods and removable devices are provided. Some such removable devices may include a secure partition and a public partition. The secure partition is not accessible by an operating system of a host for some embodiments. The secure partition is configured to store information so that formatting/reformatting does not alter the stored information for other embodiments.

Program execution device

A program execution device capable of protecting a program against unauthorized analysis and alteration is provided. The program execution device includes an execution unit, a first protection unit, and a second protection unit. The execution unit executes a first program and a second program, and is connected with an external device that is capable of controlling the execution. The first protection unit disconnects the execution unit from the external device while the execution unit is executing the first program. The second protection unit protects the first program while the execution unit is executing the second program.

Method for the authentication of applications

Authentication method of at least one application using resources stored in a security module associated to an equipment connected to a control server via a network. The control server receives via the network, analyses and verifies identification data comprising at least an identifier of the equipment and an identifier of the security module, generates a cryptogram comprising a digest of the application, the identification data and instructions intended for the security module and transmits the cryptogram, via the network and the equipment, to the security module. The latter verifies the application by comparing the digest extracted from the cryptogram with a calculated digest, wherein, during at least one of initialization and activation of the application, the security module executes the instructions extracted from the cryptogram and either releases or blocks access to certain resources of said security module according to a result of the verification of the application.

NFC Communications Device for Setting Up Encrypted Email Communication

NFC communication is utilized to provide methods, apparatus and systems for increasing the security of cryptographic keys and cryptographic processes. For the encryption and decryption of a message, public key cryptography requires the use of a pair of keys, i.e., the public key and the private key. Various embodiments of the present invention provide storage of information needed for one or more aspects of encrypting and/or decrypting messages, wherein that information is made available through an NFC communications interface. An NFC-enabled device is brought into physical proximity with a computational platform that is executing, or otherwise providing access to, an email client. Once the NFC-enabled device and the computational platform are within NFC communication range of each other, transfer of information needed to set up an encryption and/or decryption process takes place. Since the encryption/decryption keys and/or related cryptographic process parameters are not stored on the computational platform the security of this information is improved. In some embodiments the encrypted communication is encrypted email, or PUP encrypted email.

Systems and Methods For Digital Forensic Triage

In one embodiment, a method for forensic triage may include coupling, communicatively, a computer and a mobile device. The computer can be booted with machine readable instructions stored on the one or more mobile memory modules of the mobile device. A search data set can be received with one or more mobile processors of the mobile device. One or more processors of the computer, the one or more mobile processors, or both, can execute, automatically, the machine readable instructions stored on the one or more mobile memory modules of the mobile device to search one or memory modules of the computer in a read only mode for triage data that corresponds to the search data set. The triage data can be transmitted via one or more communication modules of the mobile device.

Bios flash attack protection and notification

A system and method for BIOS flash attack protection and notification. A processor initialization module, including initialization firmware verification module may be configured to execute first in response to a power on and/or reset and to verify initialization firmware stored in non-volatile memory in a processor package. The initialization firmware is configured to verify the BIOS. If the verification of the initialization firmware and/or the BIOS fails, the system is configured to select at least one of a plurality of responses including, but not limited to, preventing the BIOS from executing, initiating recovery, reporting the verification failure, halting, shutting down and/or allowing the BIOS to execute and an operating system (OS) to boot in a limited functionality mode.

Security token for securely executing an application on a host computer

The invention relates to a security token comprising a communication interface adapted to communicate with a host computer; a security module, comprising encryption based security features; a non volatile memory storing at least an application to be uploaded and executed in a host computer. The application makes use of the security features when executed in a host computer in communication with the communication interface. The security token is adapted to modify the content of the application as uploaded or its execution parameters at successive connexions of the security token to a host computer.

Method for the Cryptographic Protection of an Application

A method is provided for cryptographic protection of an application associated with an application owner and executed in an external data processing center having a security module that stores private cryptographic material of the application owner. A first secure channel between the security module and application owner and a second secure channel between the application owner and the application are used for transmitting a cryptographic key. The cryptographic key is automatically made available to the secure module and the application via the secure channels, without the data processing center service operator being able to access said key. The application can authenticate itself using the key so that the cryptographic material can be transmitted to the application via a channel protected by the cryptographic key. The application data can be encrypted using the cryptographic material such that the application data cannot be accessed by the data processing center service operator.

Apparatus and method of binding a removable module to an access terminal

The described apparatus and methods may include a processor, a memory in communication with the processor, a removable module in communication with the processor and operable to store data, an initialization component executable by the processor and configured to initialize the removable module, and an authentication component executable by the processor and configured to: receive a command from the removable module to perform an authentication operation, wherein the command is a standard message having a command qualifier value or code that represents an authentication challenge; obtain a random value from the removable module in response to the command; calculate a response based on the random value and a terminal key stored in the memory; and transmit the response to the removable module.

Methods and Systems for Securing Data by Providing Continuous User-System Binding Authentication

Devices, methods, and computer programs are presented for managing data security. One example method includes receiving user identification information from a screen of a device that is connectable to a database of secure information. The method proceeds to authenticating of the user identification information. The authenticating includes capturing image data of a user associated with the user identification information. The method further includes providing access to the database of secure information upon authenticating the user identification information, such that while the access is provided the capturing of the image data of the user is maintained. The method includes recording data of user interactive input and viewed images displayed on the screen while the access provided. The method binds the captured image data of the user to the recorded data to produce audit data for the user when accessing the database of secure information. The method is executed by a processor.

Managing network identities

Techniques for managing network identities include generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes; assigning a unique identifier to each node; identifying each node of the plurality of nodes as being a protected node or an unprotected node; and transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

Methods and apparatus for device applet management on smart cards

Methods and apparatus for device applet management on smart cards. A method includes detecting access to a smart card; reading a directory structure from the smart card that identifies one or more platform types, and for each platform type identifies corresponding device applets; determining from the directory structure one or more device applets associated with a selected platform type; and providing access to the one or more device applets. The apparatus comprises means for detecting access to a smart card, means for reading a directory structure from the smart card that identifies one or more platform types, and for each platform type identifies corresponding device applets, means for determining from the directory structure one or more device applets associated with a selected platform type, and means for providing access to the one or more device applets.

System Utilizing A Secure Element

A device includes a receiver configured to receive a request to perform a function. A secure element connected with the receiver, the secure element to verify the request to perform the function, where the secure element is configured to operate in either a report mode or a silent mode. Details about a status of the performance of the function are displayed when the device operates in the report mode, and no details about the status of the performance of the function are displayed when the device operates in the silent mode.

System, method and apparatus for electronically protecting data and digital content

A system, method and apparatus for protecting sensitive data in a file that has been replaced with pointer(s) for each sensitive data. The sensitive data items are protected by restricting subsequent access to and use of the sensitive data items via the pointers by: receiving a first request for data stored in a file on the data storage, determining whether the requested data includes at least one of the pointers, providing the requested data whenever the requested data does not include any of the pointers, and performing the following steps whenever the requested data includes at least one of the pointers: sending a second request containing the pointer(s) included in the requested data to the server that authenticates the second request, denying the first request whenever the authentication fails, and receiving and providing the extracted data item(s) corresponding to the pointer(s) included in the requested data whenever the authentication succeeds.

Method of Securing data in Storage Device and Storage Device thereof

After a file is stored in a storage device, the file is segmented into a first segment and a second segment, the latter of which is relocated to a removable security device only when the removable security device is connected to the storage device. After the removable security device is removed from the storage device, as long as the removable security device is kept by the owner of the file, the file cannot be accessible for someone other than the owner even if said someone takes the storage device. Security of the file is thus assured.

User Authentication of Applications on Third-Party Devices Via User Devices

In one embodiment, a first computing device receives an access token from a second computing device, the access token being generated by the second computing device for a specific software application executing on a specific computing device; stores the access token; receives a request for the access token from a software application executing on a third computing device; verifies whether the software application is the same as the specific software application and the third computing device is the same as the specific computing device for which the access token is generated; and sends the access token to the third computing device only when the software application is the same as the specific software application and the third computing device is the same as the specific computing device for which the access token is generated.

System and Method for Controlled Decentralized Authorization and Access for Electronic Records

A system and computer-implemented method for providing decentralized access to records. The method is performed on at least one computer system including at least one processor. The method includes the steps of: generating at least one reference for at least one record stored on a source system, the at least one reference comprising authorization information and a pointer to the at least one record; receiving, at the source system from a client system, a request to retrieve the at least one record from the source system, the request initiated using the at least one reference and including at least a portion of the at least one reference; authenticating or authorizing at least one of the client system and a user of the client system; and transmitting the at least one record from the source system to the client system.

ASSURED COMPUTER ARCHITECTURE -VOLATILE MEMORY DESIGN AND OPERATION

A method and apparatus providing computer system cryptographic protection including a processor, a trusted platform module, trusted bus devices, a first secure memory and a second secure memory, wherein the first and second memory each have a first and second shadow copy, an external bus controller, and a system bus. The system bus contains trusted data and connects with the processor, the trusted platform module, trusted bus devices, the first and second secure memory and the external bus controller. The first and second secure memory separating code and data via physically distinct memory components. The contents of the distinct memory components being replicated into two shadow copies for each component, wherein during a write operation, simultaneously updating the shadow copies with the contents of the distinct components, and during a read operation, sending the two shadow copies and the memory component to a majority function. 1. An apparatus providing computer system cryptographic protection comprising:a processor;a trusted platform module;trusted bus devices;a first secure memory and a second secure memory, wherein the first and second memory each have a first and second shadow copy;an external bus controller; anda system bus.2. The apparatus as recited in wherein the system bus contains trusted data and connects with the processor claim 1 , the trusted platform module claim 1 , trusted bus devices claim 1 , the first and second secure memory and the external bus controller.3. The apparatus as recited in wherein the external bus controller is connected between the system bus and untrusted external devices.4. The apparatus as recited in wherein data is encrypted when not in use.5. The apparatus as recited in further comprising trust boundaries claim 1 , wherein encrypted data can be unencrypted within the trust boundary.6. The apparatus as recited in wherein the trusted platform module includes secure key generation claim 1 , secure key storage and certified ...

Security Device, Methods, and Systems for Continuous Authentication

Methods, systems, and computer programs are presented for securing a computing device. One security device includes a processor, memory and a connector. The memory includes a computer program that, when executed by the processor, performs a method. The method includes operations for detecting that the connector is coupled to a second computing device, and for determining a user associated with the security computing device. In addition, the method includes operations for receiving periodic images from an image capture device coupled to the second computing device, and for performing continuous authentication operations to validate an identification of the user based on the periodic images. The user is disabled from using the second computing device after an authentication operation fails. 1. A method for monitoring security of a computing device interfaced with a security computing device , the method comprising:authenticating a user prior to providing access to content via the computing device;receiving images of the user captured periodically by an image capture device and images rendered on a display screen of the computing device, the images of the user and of the display screen captured while the user is interacting with the computing device;tracking user inputs provided at the computing device while the user is accessing the content;analyzing the user inputs to identify user activities included therein, the analysis used to assign descriptive tags to the identified user activities,wherein the user activities and the descriptive tags, the images of the user and the images of the display screen are stored in a user activity log for the user to provide an audit trail, the user activity log is searchable using the descriptive tags; andgenerating an alert upon detecting a deviation in the user activities from activities allowed for the user, the deviation used to disable access to the content using the computing device.2. The method of claim 1 , wherein operations ...

HOST FOR CONTROLLING NON-VOLATILE MEMORY CARD, SYSTEM INCLUDING THE SAME, AND METHODS OPERATING THE HOST AND THE SYSTEM

A host for controlling a non-volatile memory card, a system including the same, and methods of operating the host and the system are provided. The method of operating the host connected with the non-volatile memory card through a clock bus, a command bus, and one or more data buses includes transmitting a first command to the non-volatile memory card through the command bus, transmitting first data corresponding to the first command to the non-volatile memory card through the one or more data buses or receiving the first data from the non-volatile memory card through the data buses, and transmitting a second command to the non-volatile memory card at least once through the command bus during or before transfer of the first data. 1transmitting a first command from the host to the non-volatile memory card through a command bus, the first command indicating first data; transmitting the first data from the host to the non-volatile memory card through one or more data buses, and', 'receiving, at the host, the first data from the non-volatile memory card through the one or more data buses; and, 'transferring the first data by performing at least one of,'}transmitting a second command to the non-volatile memory card through the command bus during or before the transfer of the first data.. A method of operating a host connected to a non-volatile memory card: This application is a continuation of and claims priority under 35 U.S.C. §§ 120/121 to U.S. patent application Ser. No. 15/191,749, filed on Jun. 24, 2016, which is a continuation of and claims priority under 35 U.S.C. §§ 120/121 to U.S. patent application Ser. No. 14/025,334, filed on Sep. 12, 2013, which claims priority under 35 U.S.C. § 119(a) from Korean Patent Application No. 10-2012-0102484 filed on Sep. 14, 2012, the disclosures of each of which are hereby incorporated by reference in their entirety.Example embodiments of the inventive concepts relate to a host for controlling a non-volatile memory card, and ...

Encryption device with configurable security functionality using network authorization code

A device and method for file encryption and decryption with a cryptographic processor reconstituting a file encryption key from a version of the key which has been shrouded with a network authorization code. This meets a need for restricted communication and data containment by limiting access to a pre-defined community-of-interest, so that no one outside of that community can decrypt encrypted content.

SYSTEM AND METHOD FOR HIGH PERFORMANCE SECURE ACCESS TO A TRUSTED PLATFORM MODULE ON A HARDWARE VIRTUALIZATION PLATFORM

A system and method for high performance secure access to a trusted platform module on a hardware virtualization platform. The virtualization platform including Virtual Machine Monitor (VMM) managed components coupled to the VMM. One of the VMM managed components is a TPM (Trusted Platform Module). The virtualization platform also includes a plurality of Virtual Machines (VMs). Each of the virtual machines includes a guest Operating System (OS), a TPM device driver (TDD), and at least one security application. The VMM creates an intra-partition in memory for each TDD such that other code and information at a same or higher privilege level in the VM cannot access the memory contents of the TDD. The VMM also maps access only from the TDD to a TPM register space specifically designated for the VM requesting access. Contents of the TPM requested by the TDD are stored in an exclusively VMM-managed protected page table that provides hardware-based memory isolation for the TDD. 1Virtual Machine Monitor (VMM) managed components coupled to a VMM, wherein one of the VMM managed components comprises a Trusted Platform Module (TPM); anda plurality of Virtual Machines (VMs), each of the virtual machines including a guest operating system (OS), a TPM device driver (TDD), and at least one security application,wherein the VMM to create an intra-partition in memory for the TDD such that other code and information at a same or higher privilege level within the VM cannot access the memory contents of the TDD and to map accesses from only the TDD to a TPM register space specifically designated for the VM requesting access.. A virtual platform comprising: This application is a continuation of U.S. application Ser. No. 14/510,534, entitled “System and Method for High Performance Secure Access to a Trusted Platform Module on a Hardware Virtualization Platform,” which was filed on Oct. 9, 2014, and which is a divisional application of U.S. application Ser. No. 13/305,902, entitled “System ...

USB DEVICE

A portable, application-specific USB autorun device, following connection to a computer terminal, automatically initialises or presents itself as a known type of device and then automatically sends to the terminal a sequence of data complying with a standard protocol, that sequence of data automatically causing content to be accessed or a task to be initiated. The device (i) includes a standardised USB module that includes a USB microcontroller, the standardised module being designed to be attached to or embedded in multiple types of different, application specific packages but (ii) excludes mass memory storage for applications or end-user data. 1. A portable universal serial bus (USB) device , the device including a package , wherein the device , following connection to a computer terminal , presents itself to the computer terminal as a human interface device (HID);wherein the portable USB device includes a USB module that includes a USB microcontroller, the USB module being attached to or embedded in the package, wherein the portable USB device is applicable to secure on-line access, wherein the portable USB device is operable to generate a one-time-only passcode and to use the one-time-only passcode so that the portable USB device can be authenticated by a server via the computer terminal.2. The portable USB device of claim 1 , wherein the device includes a one-time-only passcode generator.3. The portable USB device of claim 2 , wherein the one-time-only passcode generator includes a computer program embodied on a non-transitory storage medium of the portable USB device claim 2 , wherein the computer program is executable on the portable USB device to generate one-time-only passcodes.4. The portable USB device of claim 1 , wherein the HID device is a HID keyboard device.5. The portable USB device of claim 4 , wherein the portable USB device sends to the computer terminal a sequence of data claim 4 , the data complying with the HID keyboard standard protocol.6. ...

PROGRAM EXECUTION DEVICE

A program execution device capable of protecting a program against unauthorized analysis and alteration is provided. The program execution device includes an execution unit, a first protection unit, and a second protection unit. The execution unit executes a first program and a second program, and is connected with an external device that is capable of controlling the execution. The first protection unit disconnects the execution unit from the external device while the execution unit is executing the first program. The second protection unit protects the first program while the execution unit is executing the second program. 1. A method for operating a portable terminal having a hardware processor and a non-transitory memory , the method comprising:processing, using a hardware processor, a first component including at least a first program for tamper detection and a second component including at least a second program for executing a task; andloading, in a non-transitory memory, at least the second component from the non-transitory memory,wherein, the first program of the first component judges whether or not at least part of the second program of the second component is tampered with, by using a tamper detection value in a secure environment,the tamper detection value is a first hash value, andthe secure environment cannot be accessed outside of the secure environment.2. The method according to claim 1 ,wherein the first hash value is calculated for the second component prior to the loading.3. The method according to claim 1 ,wherein the first program of the first component judges whether or not at least part of the second program of the second component is tampered with, by comparing the first hash value and a second hash value which is calculated after the calculation of the first hash value.4. The method according to claim 1 ,wherein the secure environment is a higher security level than a normal environment in which the second program is executed.5. The method ...

ENCRYPTION ON COMPUTING DEVICE

A first component of a cryptographic key is received from a user via a user interface of a user computing device. A second component of the cryptographic key is received via a short-range communication interface that communicatively couples the user computing device to a physically separate storage device. The cryptographic key is generated based at least on the first component and the second component. The cryptographic key is then used to encrypt and/or decrypt data. 1. A method for generating cryptographic keys for encrypting and decrypting data , the method comprising:receiving, by one or more processors, a first component of a cryptographic key from a user via a user interface of a user computing device;receiving, by the one or more processors, a second component of the cryptographic key via a short-range communication interface that communicatively couples the user computing device to a physically separate storage device;generating, by the one or more processors, the cryptographic key based at least on the first component and the second component; andusing the cryptographic key to encrypt and/or decrypt data, by the one or more processors.2. The method of claim 1 , wherein using the cryptographic key to encrypt and/or decrypt the data includes:storing the generated cryptographic key in a volatile memory of the user computing device during an active session,automatically encrypting and/or decrypting data accessed by the user during the active session, by the one or more processors, anddeleting the cryptographic key from the volatile memory when the active session completes.3. The method of claim 2 , further comprising:verifying the cryptographic key using control data stored on the storage device, wherein the generated cryptographic key is stored in the volatile memory only in response to the cryptographic key having been successfully verified.4. The method of claim 3 , wherein the control data includes first control data and second control data claim 3 , and ...

Method and system for subscription digital rights management

A system and method for managing use of items having usage rights associated therewith. The system includes an activation device adapted to issue a software package having a public and private key pair, the public key being associated with a user, a license device adapted to issue a license, a usage device adapted to receive the software package, receive the license and allow the user to access the item in accordance with the license, and a subscription managing device adapted to maintain a subscription list including the public key associated with the user. License's is issued by the license device upon verifying presence of the public key in the subscription list corresponding to requested content.

Usb autorun device

A portable, application-specific USB autorun device, following connection to a computer terminal, automatically initialises or presents itself as a known type of device and then automatically sends to the terminal a sequence of data complying with a standard protocol, that sequence of data automatically causing content to be accessed or a task to be initiated. The device (i) includes a standardised USB module that includes a USB microcontroller, the standardised module being designed to be attached to or embedded in multiple types of different, application specific packages but (ii) excludes mass memory storage for applications or end-user data.

FACILITATING SEQUENTIAL READS IN MEMORY SUB-SYSTEMS

An example memory subsystem includes a memory component and a processing device, operatively coupled to the memory component. The processing device is configured to receive a plurality of logical-to-physical (LP) records, wherein an LP record of the plurality of LP records maps a logical block address to a physical address of a memory block on the memory component; determine a sequential assist value specifying a number of logical block addresses that are mapped to consecutive physical addresses sequentially following the physical address specified by the LP record; generate a security token encoding the sequential assist value; and associate the security token with the LP record. 1. A system comprising:a memory component; and{'claim-text': ['identifying an L2P record mapping a logical block address to a physical address of a memory block on the memory component;', 'determining a sequential assist value specifying a number of logical block addresses that are mapped to consecutive physical addresses sequentially following the physical address specified by the L2P record;', 'generating a token encoding the sequential assist value and a sub-region update count;', 'associating the token with the L2P record.'], '#text': 'a processing device, operatively coupled to the memory component, the processing device to perform operations comprising:'}2. The system of claim 1 , wherein the operations further comprise:responsive to receiving a request from a host system, transmitting the L2P record to the host system.3. The system of claim 1 , wherein the token further comprises:an encoding of a power-on reset count.4. The system of claim 1 , wherein generating the token further comprises:concatenating a power-on reset count, the sub-region update count, and the sequential assist value.5. The system of claim 1 , wherein the operations further comprise:receiving, from a host system, a read command specifying the logical block address and the sequential assist value; andreading, from ...

System, method and apparatus for using a virtual bucket to transfer electronic data

A system that enables a mobile communication device to transfer data to or from a computer system using communication data read from an NFC tag. The first device transfers the data and is temporarily held until the second device removes the data. Once the data is removed, the location where the data was temporarily held is emptied.

Methods and systems for managing data

Computationally implemented methods and systems include receiving data regarding one or more properties of a device, said data not particularly identifying the device, identifying one or more services configured to be provided to a user of the device, said one or more services requiring access to particular data controlled by the device, wherein access to the particular data controlled by the device is managed by the device, and requesting access to the particular data controlled by the device, in exchange for providing one or more of the identified one or more services. In addition to the foregoing, other aspects are described in the claims, drawings, and text.

ADD-ON MODEM FOR WIRELESS DEVICES AND METHODS USEFUL IN CONJUNCTION THEREWITH

System for ex post facto upgrading of at least one Legacy personal communication device including a legacy modem and lacking at least one desired wireless communication feature, the system comprising an upgraded communication device including an auxiliary modem physically connected via an ex post facto physical connection to a Legacy personal communication device having at least one legacy wireless output channel which has been neutralized or disabled. 1. A system for ex post facto upgrading of at least one Legacy personal communication device including a legacy modem and lacking at least one desired wireless communication feature , the system comprising:an upgraded communication device including an auxiliary modem physically connected via an ex post facto physical connection to a Legacy personal communication device having at least one legacy wireless output channel which has been neutralized.2. A system according to wherein the Legacy personal communication device has a USB port and wherein said auxiliary modem's ex post facto physical connection to the Legacy personal communication device is via the USB port.3. A system according to or any of the preceding claims wherein said at least one desired cellular communication feature comprises at least one cellular communication security feature lacking in said legacy device and wherein said upgraded communication device also includes a security module claim 1 , disposed intermediate said ex post facto physical connection and said auxiliary modem claim 1 , which provides said at least one desired cellular communication security feature.4. A system according to or any of the preceding claims wherein said desired cellular communication security feature lacking in said legacy device comprises cryptographic protection for data wirelessly exiting the Legacy personal communication device claim 3 , wherein said cryptographic protection is provided by providing encrypting functionality in said security module.5. A system ...

Method and apparatus for encrypting short data in a wireless communication system

A method and apparatus is capable of encrypting short data in a wireless communication system When a terminal generates a short data burst in idle mode, the apparatus generates a Traffic Encryption Key (TEK) using a Cipher-based Message Authentication Code (CMAC)-TEK prekey derived from an Authorization Key (AK) related to Security Association (SA) between the terminal and a Base Station (BS). A nonce is constructed with a Packet Number (PN) identical to an uplink CMAC PN (CMAC-PN_U) transmitted together with a Ranging Request (RNG-REQ) message carrying the short data burst The short data burst is encrypted using the TEK and the nonce. A Medium Access Control (MAC) Protocol Data Unit (PDU) is generated by attaching a MAC header and a CMAC digest for integrity protection to the RNG-REQ message carrying the encrypted short data burst. The MAC PDU is transmitted to the BS.

METHOD, SYSTEM AND DEVICE FOR MANAGING AN EXECUTION OF A PROGRAM RELATING TO PART OR ALL OF A FIRST APPLICATION

A method for managing a first application program comprises: executing, by a first processor, a first control flow; executing, by a second processor, in synchronization with the first control flow execution, a second application, comprising a variable and an expected value that the variable has to have or a condition that the variable has to satisfy to authorize an execution of the correct first control flow; verifying, by the second processor, by executing each of the at least one second application, whether the variable has the expected value or the variable satisfies the condition; and inferring, by the second processor, if, for the second application, the variable has (not) the expected value or does (not) satisfy the condition, that the first processor is (not) executing the correct first control flow.

SECURITY MEASUREMENT METHOD AND SECURITY MEASUREMENT DEVICE FOR STARTUP OF SERVER SYSTEM, AND SERVER

The present disclosure provides a security measurement method and security measurement device for startup of a server system, and a server. The security measurement method for startup of a server system is applied to a trusted platform control module of the server system, and the method includes: starting the trusted platform control module after the server system is powered on; measuring subsequent startup operations of the server system by the started trusted platform control module to identify and record safety of the startup operations. By adopting the trusted platform control module, the present disclosure effectively improves the safety of startup of the server system.

METHODS AND SYSTEMS IMPLEMENTED IN A NETWORK ARCHITECTURE WITH NODES CAPABLE OF PERFORMING MESSAGE-BASED TRANSACTIONS

A method for establishing connection weights between network nodes is implemented by communicating data processing units, a public key and a private key being associated with each node, a given node being able to communicate its public key to another node, thus forming a so-called real connection (“IRL-connected”) between two nodes, and each node also being able to communicate to another node a public key received from yet another node, thus forming a so-called indirect connection between the other node and the yet another node. Each node can have a specific connection weight in relation to another node with which it has a real or indirect connection. In order to determine the connection weight of a second node in relation to a first node, the method comprises calculating a set combination of weighting factors (influence, proximity) of third nodes that are IRL-connected to the second node. 1. A method for establishing connection weights between network nodes , implemented by communicating data processing units , a public key and a private key being associated with each node , a given node being able to communicate its public key to another node , thus forming a so-called real connection (“IRL-connected”) between the two nodes , and each node also being able to communicate to another node a public key received from yet another node , thus forming a so-called indirect connection between the other node and the yet another node , a node being able to have a specific connection weight in relation to another node with which it has a real or indirect connection , the method comprising , in order to determine the connection weight of a second node in relation to a first node , calculating a set combination of weighting factors (influence , proximity) of third nodes that are IRL-connected to the second node.2. The method according to claim 1 , wherein the connection weight of the second node influences the weighting factors of the third nodes claim 1 , and comprising ...

Systems and methods for generating and managing user authentication rules of a computing device

Aspects of the present disclosure include systems and methods for generating and managing user authentication rules of a computing device. In an example, a computing device may include a memory storing instructions and a processor communicatively coupled with the memory and configured to execute the instructions. The processor may determine a state of the computing device, wherein the state of the computing device is one of a locked state or an unlocked state. The processor may determine a user authentication rule corresponding to the state of the computing device. The processor may also identify whether a combination of signals associated with the user authentication rule of the computing device are received by the computing device. The processor may also change or maintain the state of the computing device based on the combination of signals being received.

Data storage system with information security protection

A data storage system with information security protection includes an SSD and at least one activation device selectively connected to the SSD. The SSD has a device identifier, and includes a data storage unit and a controlling and processing unit. The controlling and processing unit is in information connection with the data storage unit, and is written with at least one set of firmware data that is triggered and activated by an activation key to execute a predetermined task on the data storage unit. The activation device includes a data processing unit which is written with the activation key in advance, and has a pairing mode and an enabling mode. In the pairing mode, the data processing unit accesses and stores the device identifier. In the enabling mode, the data processing unit compares the stored device identifier to output the activation key to the controlling and processing unit.

Method and apparatus for supporting multiple broadcasters independently using a single conditional access system

A method and apparatus for brokering the enablement of the communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers is disclosed. The system makes use of a pairing key for each provided service, which is differently encrypted by a pairing server and by the broadcaster providing the service. The encrypted versions of the pairing key are decrypted in a first receiver module using information known to the pairing service but not the broadcaster and in a second receiver module using information known to the broadcaster. The pairing key is used to cryptographically bind the first and second receiver modules.

METHOD FOR STRONGLY ENCRYPTING .ZIP FILES

The present invention provides a method of integrating existing strong encryption methods into the processing of a .ZIP file to provide a highly secure data container which provides flexibility in the use of symmetric and asymmetric encryption technology. The present invention adapts the well-established .ZIP file format to support higher levels of security and multiple methods of data encryption and key management, thereby producing a highly secure and flexible digital container for electronically storing and transferring confidential data. 124-. (canceled)25. A method of constructing a modified .ZIP file format data container on a computer , said method including:receiving a first data file at an application on a computer, wherein said first data file has been retrieved from an electronic computer data storage by said application;encrypting said first data file to form a first encrypted data file, wherein said encrypting uses symmetric encryption employing a first encryption method using a first symmetric key received from a user,wherein said first encryption method is selected from a plurality of available encryption methods selectable by a user,wherein said symmetric encryption uses one of a plurality of bit lengths selectable by a user;asymmetrically encrypting said first symmetric key using a public key to form asymmetric key data,wherein said public key is received by said application from a memory including a public key storage location on said computer; andconstructing a modified .ZIP file format data container based on the .ZIP file format,wherein said modified .ZIP file format data container includes a central directory,wherein said central directory has been modified from the .ZIP file format to include an asymmetric key data storage location receiving and storing said asymmetric key data,wherein said modified .ZIP file format data container includes an encrypted data file storage location receiving and storing said encrypted data file,wherein said ...

Method and Apparatus For Enabling Machine To Machine Communication

A method and apparatus for performing secure Machine-to-Machine (M2M) provisioning and communication is disclosed. In particular a temporary private identifier, or provisional connectivity identification (PCID), for uniquely identifying machine-to-machine equipment (M2ME) is also disclosed. Additionally, methods and apparatus for use in validating, authenticating and provisioning a M2ME is also disclosed. The validation procedures disclosed include an autonomous, semi-autonomous, and remote validation are disclosed. The provisioning procedures include methods for re-provisioning the M2ME. Procedures for updating software, and detecting tampering with the M2ME are also disclosed.

Device, and card type device

The present invention enables a code to be recognized by a smart phone or other electronic devices even when the code is successively changed. The apparatus is equipped with an incoming amount detection unit for detecting the incoming amount per unit time of external energy incoming from the exterior, an information acquisition circuit for acquiring input information in a predetermined format based on a change in the said incoming amount per unit time, a working surface arranged with one or more elements in which a physical quantity change detectable from a counter surface occurs, one or more physical quantity control units which generate the said physical quantity change in each of the said one or more elements, and an information output unit in the said one or more physical quantity control units which outputs output information in a predetermined format in accordance with the said physical quantity change by the said one or more elements.

Dynamic switching between pointer authentication regimes

Embodiments described herein enable the interoperability between processes configured for pointer authentication and processes that are not configured for pointer authentication. Enabling the interoperability between such processes enables essential libraries, such as system libraries, to be compiled with pointer authentication, while enabling those libraries to still be used by processes that have not yet been compiled or configured to use pointer authentication.

SYSTEM AND METHOD FOR SHARING OF DATA SECURELY BETWEEN ELECTRONIC DEVICES

A system for securely sharing data and conducting transactions in an electronic environment. The system may include a personal information device having a processor, memory and biometric sensor. Personal data is stored in the memory of the personal information device. The personal information device may be registered with a centralized system. Data stored on the personal information device may be uploaded to an access device upon verification of a user's identity using a biometric recognition technique. 1. A device for use in securely transferring data in an electronic environment , said device comprising:a processor;a memory accessible to the processor, the memory having personal data and a biometric template of a user stored therein;the memory further having an application stored therein which, when activated, causes the processor to perform the steps of:receive a request from an access device to access data stored in the memory,receive a biometric sample from a user,compare the biometric sample from the user to the biometric template,upload the requested data to the access device if the biometric sample and biometric template match.2. The device of claim 1 , further comprising a biometric sensor in communication with the processor.3. The device of claim 2 , further comprising a housing for containing the processor and the memory claim 2 , the housing having a front housing member and a back housing member claim 2 , the front housing member having a cutout for accommodating a biometric sensor.4. The device of claim 3 , wherein the housing is approximately 0.125 inches thick by 2.125 inches wide by 3.375 inches long.5. The device of claim 3 , wherein the housing is approximately a shape of a credit card.6. The device of claim 1 , wherein the memory further includes a unique identification number stored therein.7. The device of claim 6 , wherein the application further comprises instructions to cause the processor to perform the steps of: uploading the unique ...

SYSTEM AND METHOD FOR SPECIFYING AND PROCESSING LEGALITY EXPRESSIONS

A system and method are provided for specifying a legality expression for use in a system for processing the legality expression. The system and method include providing a legality expression language, including at least one of a duty element specifying an obligation that a principal must perform an act, a ban element specifying a prohibition that a principal must not perform an act, an intent element specifying an intention that a principal wants to perform an act, and a claim element specifying an assertion that a principal does perform an act. The system and method further include interpreting by the system a legality expression specified using the legality expression language. 1. A computer-implemented method executed by one or more computing devices for specifying a legality expression for use in a system for processing the legality expression , the method comprising: a duty element specifying an obligation that a principal must perform an act,', 'and a claim element specifying an assertion that a principal does perform an act;, 'selecting, by at least one of the one or more computing devices, at least one digital data element from a legality expression language, including at least one of,'}determining, by at least one of the one or more computing devices, at least one attribute value for the at least one data element;transforming, by at least one of the one or more computing devices, the at least one digital data element and the at least one attribute to create a legality expression; andrecording, by at least one of the one or more computing devices, the legality expression in a form that can be enforced by a computing device.2. The method of claim 1 , further comprising enforcing the legality expression.3. The method of claim 1 , further comprising:providing in the legality expression language a grant element specifying a permission that a principal may perform an act; andenforcing the legality expression.4. The method of claim 1 , further comprising ...

Method and apparatus for providing a cryptographic security function for the operation of a device

Provided is a method and apparatus for providing a cryptographic security function for the operation of a device, and to an associated computer program (product). The method for providing a cryptographic security function for the operation of a device carries out the following steps: receiving a request to provide such a security function, providing an interface to a point providing such a security function, said point being called a trust anchor, wherein said interface determines context information in accordance with the application initialing the request, providing the requested security function for the application initiating the request, wherein the determined context information influences the provision of said security function.

Secure communication between a contact lens and an accessory device

Described herein are systems and methods that allow for secure wireless communication between a contact lens system and an accessory device to protect sensitive data and prevent unauthorized access to confidential information. In certain embodiments, tampering attempts by potential attackers are thwarted by using a Physically Unclonable Functions (PUF) circuit that is immune to reverse engineering. In addition, sensors monitor a to-be-protected electronic device to detect tampering attempts and physical attacks to ensure the physical integrity of the communication system.

System and method for sharing of data securely between electronic devices

A system for securely sharing data and conducting transactions in an electronic environment. The system may include a personal information device having a processor, memory and biometric sensor. Personal data is stored in the memory of the personal information device. The personal information device may be registered with a centralized system. Data stored on the personal information device may be uploaded to an access device upon verification of a user's identity using a biometric recognition technique.

Method and system for preventing unauthorized processor mode switches

A system comprising a processor adapted to activate multiple security levels for the system and a monitoring device coupled to the processor and employing security rules pertaining to the multiple security levels. The monitoring device restricts usage of the system if the processor activates the security levels in a sequence contrary to the security rules.

CONTROLLING ACCESS TO AN INTERFACE WITH A DONGLE

A dongle () for controlling access to an interface () is provided. The dongle () includes a dongle memory () configured to communicatively couple to the interface (), the dongle memory () comprising a program code () that includes authorized menus (), wherein the program code () is configured to authorize access to one or more menus on the C interface (). 1100200100. A dongle () for controlling access to an interface () , the dongle () comprising:{'b': 120', '200', '120', '122', '122, 'i': 'a', 'a dongle memory () configured to communicatively couple to the interface (), the dongle memory () comprising a program code () that includes authorized menus ();'}{'b': 122', '200, 'wherein the program code () is configured to authorize access to one or more menus on the interface ().'}2100100110120110200. The dongle () of claim 1 , wherein the dongle () further comprises a connector () communicatively coupled to the dongle memory () claim 1 , wherein the connector () is configured to communicatively couple to the interface ().3100122122120124122124122100bb. The dongle () of claim 1 , wherein the program code () further comprises a reference value () and the dongle memory () further comprises a dongle identifier () and wherein the reference value () can be compared with the dongle identifier () to determine if the program code () is associated with the dongle ().4100122200122a. The dongle () of claim 1 , wherein the program code () is configured to at least one of authorize access and terminate authorization to the one or more menus on the interface () based on the authorized menus ().5100122200100200200. The dongle () of claim 1 , wherein the program code () is executed by the interface () when the dongle () is at least one of communicatively coupled to the interface () and communicatively decoupled from the interface ().61002005. The dongle () of claim 1 , wherein the interface () is an interface for industrial equipment ().71020010010. A system () for controlling access ...

System and methods for secure firmware validation

An electronic device, such as a dynamic transaction card having an EMV chip, that acts as a TPM having a memory, an applet, and a cryptographic coprocessor performs secure firmware and/or software updates, and performs firmware and/or software validation for firmware and/or software that is stored on the electronic device. Validation may compare a calculated checksum with a checksum stored in EMV chip memory. If a checksum calculated for firmware and/or a software application matches a checksum stored in EMV chip memory of the transaction card, the transaction card may operate normally. If a checksum calculated for firmware and/or a software application does not match a checksum stored in EMV chip memory of the transaction card, the transaction card may freeze all capabilities, erase the memory of the transaction card, display data indicative of a fraudulent or inactive transaction card, and/or the like.

Out-of-band tokens for rights access

Access to content may be administered by storing content, the content comprising one or more selections, accessing a passive optical out-of-band token associated with the content, determining an access right for the content based on the passive optical out-of-band token, and enabling access to the content in accordance with the access right.

Security Device, Methods, and Systems for Continuous Authentication

Methods, systems, and computer programs are presented for securing a computing device. One security device includes a processor, memory and a connector. The memory includes a computer program that, when executed by the processor, performs a method. The method includes operations for detecting that the connector is coupled to a second computing device, and for determining a user associated with the security computing device. In addition, the method includes operations for receiving periodic images from an image capture device coupled to the second computing device, and for performing continuous authentication operations to validate an identification of the user based on the periodic images. The user is disabled from using the second computing device after an authentication operation fails. 1. A security computing device comprising:a processor;a memory; and authenticate the user for accessing content via the second computing device;', 'receive the images rendered on the display screen and the periodic images of the user;', 'provide, after the user is authenticated from the second computing device, user inputs to the second computing device, the user inputs being provided while accessing the content, the images and the user inputs used to monitor digital and physical activities of the user and to establish a link between the digital and physical activities of the user;', 'transmit the user inputs with the received periodic images to a security server using an out of band channel to create audit data of the digital and physical activities of the user while accessing the second computing device; and', 'send a message from the security computing device to the second computing device to disable the user from using the second computing device if said authentication of the user fails during use of the second computer., 'a connector for enabling communication between the security computing device and a second computing device, wherein the second computing device is configured ...

Systems and methods for implementing application control security

Systems and methods for implementing application control security are disclosed. In one embodiment, a system includes a first device, a decrypted white-list, and an executable program. The first device may be in electrical communication with a memory containing an encrypted white-list. The encrypted white-list may be decrypted using an identifier of a second device. The executable program may be referenced in the decrypted white-list.

Electronic device and method of starting the same

A method of starting an electronic device includes: receiving a first wireless signal carrying a first identification data by a wireless receiver before the electronic device enters a normal operating state; comparing the first identification data with a valid data; obtaining an account name and a password according to the first identification data if the first identification data matches the valid data and logging in to an operating system with the account name and the password so as to allow the electronic device to enter the normal operating state; and not logging in to the operating system if the first identification data does not match the valid data.

METHODS AND SYSTEMS FOR GENERATING HISTORY DATA OF SYSTEM USE AND REPLAY MODE FOR IDENTIFYING SECURITY EVENTS SHOWING DATA AND USER BINDINGS

Devices and methods are presented for managing data security. One example method includes receiving user identification information from a screen of a device that is connectable to a database of secure information. The method includes authenticating the user identification information, the authenticating includes capturing image data of a user associated with the user identification information. The method provides access to the database of secure information upon authenticating the user identification information. The method records data of user interactive input and viewed images displayed on the screen while the access provided. The method stores audit data for the user when accessing the database of secure information, the audit data being associated with a history of use by the user. The audit data including a plurality of events associated with the use. The method enables replay of the audit data for at least one of the plurality of events associated with the use. 1. A method for managing data security , comprising ,receiving user identification information from a user via a mobile device, the mobile device includes a screen and is connectable to a database of secure information;receiving image data captured of the user associated with the user identification information, the image data of the user operating the mobile device captured by a camera of the mobile device;authenticating the user based on the user identification information and the image data of the user;providing access to the database of secure information upon authenticating the user;receiving interactive input provided by the user on the mobile device and content displayed on the screen of the mobile device while the access to the database is provided via the mobile device, the image data of the user mapped to the interactive input and the content to define audit data; andproviding access to the audit data to enable replay of the audit data for an event of a plurality of events, the replaying of ...

Systems and Methods for Temporary Digital Content Sharing

Systems and methods are provided herein for temporary digital content sharing. The systems and methods may involve receiving, from a first device, a selection of a first element associated with a first URL. The systems and methods may also involve determining first content associated with the first URL. The systems and methods may also involve receiving, from the first device, a selection of a second device at which to display the first content associated with the first URL. The systems and methods may also involve providing the first URL to the second device, wherein the URL allows access to the content by the second device. 1. A system comprising:a processor; anda memory storing computer-executable instructions, that when executed by the processor, cause the processor to:receive, from a first device, a selection of a first element associated with a first URL;determine first content associated with the first URL;receive, from the first device, a selection of a second device at which to display the first content associated with the first URL; andprovide the first URL to the second device, wherein the first URL allows access to the content by the second device.2. The system of claim 1 , wherein the computer-readable instructions are further operable to:receive, from a first device, a selection of a second element associated with a second URL;determine second content associated with the second URL;receive, from the first device, a selection of a second device at which to display the second content associated with the second URL; andprovide the second URL to the second device, wherein the second URL allows access to the content by the second device.3. The system of claim 1 , wherein the first content is stored on a remote server or the first device claim 1 , and a window is provided to access the first content on the remote server or the first device through the second device.4. The system of claim 1 , wherein the computer-readable instructions are further operable to: ...

CHAINED SECURITY SYSTEMS

A tiered credentialing approach provides assurance to customers having virtual machines running in a remote environment that the virtual images for these machines are in a pristine state and running in a trusted execution environment. The environment can be divided into multiple subsystems, each having its own cryptographic boundary, secure storage, and trusted computing capabilities. A trusted, limited subsystem can handle the administrative tasks for virtual machines running on the main system of a host computing device. The limited system can receive a certificate from a certificate authority, and can act as a certificate authority to provide credentials to the main system. Upon an attestation request, the subsystems can provide attestation information using the respective credentials as well as the certificate chain. An entity having the appropriate credentials can determine the state of the system from the response and verify the state is as expected. 1. (canceled)2. A computer-implemented method , comprising:receiving an attestation request at a computing device, the computing device operating a virtual machine;sending a request to a first subsystem, the first subsystem configured to perform administrative tasks for the virtual machine;receiving, at the first subsystem, a first certificate from a certificate authority;generating, at the first subsystem, first credentials using the first certificate, a first measurement, and a second certificate for authenticating the second subsystem;receiving, at the second subsystem, the second certificate from the first subsystem;generating, at the second subsystem, second credentials using the second certificate, and a second measurement including state information for the virtual machine; andsending an attestation response in response to the attestation request, the attestation response including the first measurement with the first credentials and the second measurement with the second credentials.3. The computer- ...

Computer program product containing instructions for providing a processor the capability of executing an application derived from a compiled form

An integrated circuit card is used with a terminal. The integrated circuit card includes a memory that stores an interpreter and an application that has a high level programming language format. A processor of the card is configured to use the interpreter to interpret the application for execution and to use a communicator of the card to communicate with the terminal.

PROGRAM EXECUTION DEVICE

A program execution device capable of protecting a program against unauthorized analysis and alteration is provided. The program execution device includes an execution unit, a first protection unit, and a second protection unit. The execution unit executes a first program and a second program, and is connected with an external device that is capable of controlling the execution. The first protection unit disconnects the execution unit from the external device while the execution unit is executing the first program. The second protection unit protects the first program while the execution unit is executing the second program. 1. An information processing device comprising:a processor configured to execute a first program for tamper detection, and execute a second program for executing a task; anda hardware memory for loading at least part of the second program,wherein the first program judges whether or not at least part of the second program is tampered with, by using a tamper detection value in a secure environment, and the secure environment cannot be accessed outside of the secure environment.2. The information processing device according to claim 1 , wherein the tamper detection value is a first hash value.3. The information processing device according to claim 2 , wherein the first hash value is calculated for the second program prior to the loading.4. The information processing device according to claim 3 , wherein the first program judges whether or not at least part of the second program is tampered with claim 3 , by comparing the first hash value and a second hash value which is calculated after the calculation of the first hash value.5. The information processing device according to claim 1 , wherein the processor is configured to execute the first program in a secure environment claim 1 , and execute the second program in the normal environment.6. The information processing device according to claim 1 , wherein the secure environment is a higher security ...

SYSTEM AND METHOD FOR HIGH PERFORMANCE SECURE ACCESS TO A TRUSTED PLATFORM MODULE ON A HARDWARE VIRTUALIZATION PLATFORM

A system and method for high performance secure access to a trusted platform module on a hardware virtualization platform. Example instructions partition resources of the host system to allocate (a) first resources of the host system for a first virtual machine and (b) second resources of the host system for a second virtual machine, wherein the resources of the host system include memory resources and a trusted platform module, the first virtual machine to run a first guest operating system and the second virtual machine to run a second guest operating system, wherein the first guest operating system is to run in a first isolated environment, the second guest operating system is to run in a second isolated environment; implement a virtual trusted platform module to support encryption for the first virtual machine; and protect the first resources and the second resources from unauthorized access. 1. At least one storage device comprising instructions that when executed by one or more processors cause the one or more processors of a host system to at least: partition resources of the host system to allocate (a) first resources of the host system for a first virtual machine and (b) second resources of the host system for a second virtual machine, wherein the resources of the host system include memory resources and a trusted platform module, the first virtual machine to run a first guest operating system and the second virtual machine to run a second guest operating system, wherein the first guest operating system is to run in a first isolated environment, the second guest operating system is to run in a second isolated environment, the first isolated environment to be isolated from the second isolated environment;', 'implement a virtual trusted platform module to support encryption for the first virtual machine; and', 'protect the first resources and the second resources from unauthorized access., 'execute a hypervisor to2. The at least one storage device of claim 1 ...

INPUT PERIPHERAL DEVICE SECURITY

An input peripheral agent intercepts input commands on a host machine and enforces policy conditions and whitelist conditions before deciding whether to permit the commands to be processed by an operating system of the host or whether to ignore the commands on the host machine. In an embodiment, the policy conditions and whitelist conditions can be dynamically changed by a remote network manager without changing, stopping, and/or restarting the input peripheral agent and/or the host machine. 1. A method , comprising:intercepting an input command generated from an input peripheral of a host machine; anddetermining whether to block the input command from being processed by an Operating System (OS) of the host machine or whether to pass the input command to the OS for processing.2. The method of claim 1 , wherein intercepting further includes identifying the input command as a keyboard connected to the host machine through a peripheral port of the host machine.3. The method of claim 2 , wherein identifying further includes recognizing the input command as a sequence of keys activated on the keyboard.4. The method of claim 1 , wherein determining further includes attempting to match the input command in a whitelist command file for the input peripheral and when matched passing the input command to the OS for processing and when unmatched ignoring the input command and blocking the input command from being processed by the OS.5. The method of claim 1 , wherein determining further includes identifying a resource that initiated the input command from the input peripheral and making the determination based on security rights assigned to the resource with respect to the input command.6. The method of claim 5 , wherein identifying further includes dynamically obtaining the security rights for the resource from a remote network service over a network connection accessible from the host machine.7. The method of claim 6 , wherein dynamically obtaining further terminating the ...

METHOD AND APPARATUS FOR FIELD FIRMWARE UPDATES IN DATA STORAGE SYSTEMS

Data storage devices and methods for updating firmware are disclosed. For example, one such data storage device includes a device firmware and a controller, where the controller operates in accordance with the device firmware. The controller determines whether or not the device firmware can be updated with new firmware at least partially based on whether or not the new firmware meets a criterion related to a configuration profile of the device firmware. 1. An apparatus comprising:a memory device including device firmware; anda controller coupled to the memory device, the controller configured to determine whether the device firmware can be updated with new firmware based on a difference between a minor version of the new firmware and a minor version of the device firmware,wherein the device firmware is not updated with the new firmware when the difference between the minor version of the new firmware and the minor version of the device firmware exceeds an incremental value, andwherein the device firmware is updated with the new firmware when the difference between the minor version of the new firmware and the minor version of device firmware does not exceed the incremental value.2. The apparatus of claim 1 , wherein access to the memory device is provided to a host responsive to authenticating the host.3. The apparatus of claim 1 , wherein access to the memory device is provided to a host responsive to providing cryptographic capabilities to the host.4. The apparatus of claim 1 , wherein the controller is further configured to determine whether the device firmware can be updated with the new firmware based on the minor version of the new firmware and the minor version of the device firmware claim 1 ,wherein the device firmware is not updated with the new firmware when the minor version of the new firmware is less than the minor version of the device firmware, andwherein the device firmware is updated with the new firmware when the minor version of the new firmware ...

PROGRAM EXECUTION DEVICE

A program execution device capable of protecting a program against unauthorized analysis and alteration is provided. The program execution device includes an execution unit, a first protection unit, and a second protection unit. The execution unit executes a first program and a second program, and is connected with an external device that is capable of controlling the execution. The first protection unit disconnects the execution unit from the external device while the execution unit is executing the first program. The second protection unit protects the first program while the execution unit is executing the second program. 1. An information processing device comprising: a hardware memory configured to load at least a program to be protected; and a controller operable to judge whether or not the program to be protected is tampered with , by executing a tamper detection program in a secure processing mode , wherein , in the secure processing mode , the controller is operable to prohibit an external device from accessing data in the hardware memory.2. The information processing device according to claim 1 , wherein the tamper detection program is a program for detecting a tampering by using a digital signature.3. The information processing device according to claim 1 , wherein the controller is operable to execute the program to be protected claim 1 , when it is judged that the program to be protected has not been tampered with.4. The information processing device according to claim 2 , wherein the controller is operable to execute the program to be protected claim 2 , when it is judged that the program to be protected has not been tampered with.5. The information processing device according to claim 1 , wherein the external device is a debugger.6. The information processing device according to claim 1 , wherein the program includes program instructions.7. The information processing device according to claim 6 , wherein the controller is operable to judge whether or ...

Secure storage and transmission of medical information

Disclosed are various embodiments for securely storing and transmitting medical- or health-related information. According to various embodiments described herein, a computing device may enroll or register a client device or a peripheral device associated with the client device in response to the client device or the peripheral device complying with at least one compliance rule. Health information received from the client device or the peripheral device is accessed in response a request received from a requesting service for the health information, wherein the health information as received is encrypted according to a cryptographic key. A determination is made whether consent to send the health information to the requesting service has been provided by a user of the client device. If consent has been provided, the health information received from the client device or the peripheral device is sent to the requesting service.

HARDWARE MONITOR OF A PROCESSING UNIT STACK STRUCTURE

A hardware monitor circuit includes an electronic control circuit coupled to a processing unit. The electronic control circuit generates multi-bit protection codes and directs operations of the hardware monitor circuit. A bus interface is coupled to an address bus of the processing unit, and the bus interface passes signals associated with a stack structure of the processing unit. The stack structure is arranged to store the multi-bit protection codes in at least one internal memory coupled to the processing unit. A plurality of comparators in the hardware monitor circuit are arranged to accept values from the at least one internal memory and gating logic coupled to the plurality of comparators is arranged to generate an error signal when it detects that an address on the address bus read via the bus interface is equal to an address stored in the at least one internal memory. Upon generating the error signal, the processing unit is placed in a secure mode. 1. A hardware monitor circuit , comprising:an electronic control circuit coupled to a processing unit, the electronic control circuit configured to generate multi-bit protection codes and further configured to direct operations of the hardware monitor circuit;a bus interface coupled to an address bus of the processing unit, the bus interface configured to pass signals associated with a stack structure of the processing unit, the stack structure arranged to store the multi-bit protection codes in at least one internal memory coupled to the processing unit;a plurality of comparators arranged to accept values from the at least one internal memory; andgating logic coupled to the plurality of comparators, the gating logic arranged to generate an error signal upon detection of an address on the address bus read via the bus interface being equal to an address stored in the at least one internal memory, wherein upon generating the error signal, the processing unit is placed in a secure mode.2. The hardware monitor circuit ...

Apparatus and method for secure over the air programming of a communication device

A system that incorporates the subject disclosure may perform, for example, receiving an over-the-air programming message that is utilizing a hypertext transfer protocol where the over-the-air programming message including programming data for use by the mobile communication device, converting the over-the-air programming message to a short message service transport protocol to generate an adjusted message that includes the programming data, and providing the adjusted message to a universal integrated circuit card of the mobile communication device via a baseband proxy operating in a device processor of the mobile communication device. Other embodiments are disclosed.

Edge device and method for operating an edge device

The invention relates to an edge device ( 10 ) and to a method for operating an edge device ( 10 ), wherein the edge device ( 10 ) is supplemented by a unikernel manager ( 52 ) and a base unikernel ( 54 ), wherein the unikernel manager ( 52 ) acts as a means at least for starting and stopping a unikernel ( 40 - 46 ) installed on the edge device ( 10 ), and wherein the base unikernel ( 54 ), in the form of a standalone unikernel, comprises the base functionality of the edge device ( 10 ).

Identity deep freeze

System and methods perform identity freezing. A user input requesting halting of operations related to a plurality of accounts or profiles of the user at different local systems is received. In response, a token mapping database is accessed to identify a personally identifiable information (PII) token for the user. A freeze message with the PII token is transmitted to the different local systems to halt operations associated with the plurality of accounts or profiles of the user. Thereafter, at the different local systems, the operations associated with the plurality of accounts or profiles of the user are halted to freeze an identity of the user. More efficient communication and operations to freeze the user accounts and profiles thereby result.

Hardware-Assisted Log Protection Devices And Systems

A hardware-assisted technique may protect a system log from attackers, regardless of an attacker's acquired privileges at the host system. In some embodiments, the technique may employ specialized hardware, e.g., in the form of an add-on peripheral card. The hardware may be connected to a commodity server through a standard bus. Said hardware may stores log files from a host system while permitting only read and append operations from the host system. Thus, even if the attacker obtains root privileges at the host system, removal through the host system of logs may be prevented because the asymmetric interface does not support such commands from the host system. In some embodiments, an existing log file storage path at the host system may be maintained, reducing the required change to implement the disclosed techniques within existing server setups. Further, any performance degradation due to the techniques may be small to negligible. 1. A device for protecting log messages , the device comprising:a memory configured to store log messages;a controller operationally coupled to the memory, the controller comprising a file system for accessing the memory;a first interface for operationally coupling a first computer to the controller, the first interface configured to transmit log messages and file commands between the first computer and the controller; anda second interface for operationally coupling a second computer to the controller, the second interface configured to transmit log messages and file commands between the second computer and the controller; andthe controller configured to perform file operations based on file commands received through the first interface and second interface, wherein the controller permits only non-destructive file operations based on commands transmitted through the first interface but permits non-destructive and destructive file operations based on commands transmitted through the second interface.29.-. (canceled)10. The device of ...

Method for managing external portable storage device and related machine readable medium

A method for managing an external portable storage device includes at least the following steps: when the external portable storage device having at least a non-encrypted partition is electrically connected to an electronic device, searching the external portable storage device for a default image file which is an encrypted partition; and when the default image file is found in the external portable storage device, mounting the default image file to an operating system of the electronic device, such that the encrypted partition and the non-encrypted partition are both available to the operating system for data access.

ADD-ON MODEM FOR WIRELESS DEVICES AND METHODS USEFUL IN CONJUNCTION THEREWITH

System for ex post facto upgrading of at least one Legacy personal communication device including a legacy modem and lacking at least one desired wireless communication feature, the system comprising an up-graded communication device including an auxiliary modem physically connected via an ex post facto physical connection to a Legacy personal communication device having at least one legacy wireless output channel which has been neutralized or disabled. 112-. (canceled)13. A system for ex post facto upgrading of at least one Legacy personal communication device including a legacy modem and lacking at least one desired wireless communication feature , the system comprising:an upgraded communication device including an auxiliary modem physically connected via an ex post facto physical connection to a Legacy personal communication device having at least one legacy wireless output channel which has been neutralized.14. A system according to wherein the Legacy personal communication device has a USB port and wherein said auxiliary modem's ex post facto physical connection to the Legacy personal communication device is via the USB port.15. A system according to wherein said at least one desired cellular communication feature comprises at least one cellular communication security feature lacking in said legacy device and wherein said upgraded communication device also includes a security module claim 13 , disposed intermediate said ex post facto physical connection and said auxiliary modem claim 13 , which provides said at least one desired cellular communication security feature.16. A system according to wherein said desired cellular communication security feature lacking in said legacy device comprises cryptographic protection for data wirelessly exiting the Legacy personal communication device claim 15 , wherein said cryptographic protection is provided by providing encrypting functionality in said security module.17. A system according to wherein said desired cellular ...

SYSTEM AND METHODS FOR SECURE FIRMWARE VALIDATION

An electronic device, such as a dynamic transaction card having an EMV chip, that acts as a TPM having a memory, an applet, and a cryptographic coprocessor performs secure firmware and/or software updates, and performs firmware and/or software validation for firmware and/or software that is stored on the electronic device. Validation may compare a calculated checksum with a checksum stored in EMV chip memory. If a checksum calculated for firmware and/or a software application matches a checksum stored in EMV chip memory of the transaction card, the transaction card may operate normally. If a checksum calculated for firmware and/or a software application does not match a checksum stored in EMV chip memory of the transaction card, the transaction card may freeze all capabilities, erase the memory of the transaction card, display data indicative of a fraudulent or inactive transaction card, and/or the like. 1. A dynamic transaction card comprising:A EuroPay-MasterCard-Visa (EMV) processor storing existing firmware and version data associated with the existing firmware;an EMV plate connectively coupled to the EMV processor;a bootloader; andan input/output interface that receives an updated firmware program from a firmware provider system;wherein the EMV processor receives, via contacts on the EMV plate, an update component associated with the updated firmware program transmitted from the firmware provider system during a secure communication with the firmware provider system via a secure terminal, wherein the update component is used to validate the received updated firmware program;wherein, in response to the validation of the updated firmware program, the bootloader loads the updated firmware on the dynamic transaction card, executes the updated firmware program, which overwrites the existing firmware; andwherein, in response to the bootloader loading and executing the updated firmware program, the EMV processor stores and uses the updated firmware program.2. The ...

CONTROL UNIT SYSTEM

A control unit system includes a control unit on which a rights management system is set up, access permission information being retrievably stored by the rights management system, functions in executable form being stored on further control units of the control unit system, at least one of the further control units being configured as a query control unit set up to execute these functions, or not, based on access permission information stored in the rights management system, characterized in that the control unit also includes a device management system that is configured to establish a connection with a server via a communication interface and to provide the rights management system with an update of the access permissions received from the server via this interface. 18-. (canceled)9. A control unit system comprising:a control unit on which a rights management system is set up and that includes a device management system that is configured to establish a connection with a server via a communication interface, wherein access permission information is retrievably stored by the rights management system and the device management system is configured to provide the rights management system with an update of access permissions received from the server via the interface; andcontrol units storing executable functions and at least one of which is a query control unit that is configured to execute the functions depending on access permission information stored in the rights management system.10. The control unit system of claim 9 , wherein the query control unit is configured to inquire regarding the access permission information prior to receipt of the access permission information by the rights management system.11. The control unit system of claim 9 , wherein the rights management system is configured to update a list of stored access permissions according to the received update.12. The control unit system of claim 9 , wherein the device management system is configured ...

FACILITATING SEQUENTIAL READS IN MEMORY SUB-SYSTEMS

An example memory subsystem includes a memory component and a processing device, operatively coupled to the memory component. The processing device is configured to receive a plurality of logical-to-physical (L2P) records, wherein an L2P record of the plurality of L2P records maps a logical block address to a physical address of a memory block on the memory component; determine a sequential assist value specifying a number of logical block addresses that are mapped to consecutive physical addresses sequentially following the physical address specified by the L2P record; generate a security token encoding the sequential assist value; and associate the security token with the L2P record. 1. A system comprising:a memory component; and receiving a plurality of logical-to-physical (L2P) records, wherein an L2P record of the plurality of L2P records maps a logical block address to a physical address of a memory block on the memory component;', 'determining a sequential assist value specifying a number of logical block addresses that are mapped to consecutive physical addresses sequentially following the physical address specified by the L2P record;', 'generating a security token encoding the sequential assist value; and', 'associating the security token with the L2P record., 'a processing device, operatively coupled to the memory component, the processing device to perform operations comprising2. The system of claim 1 , wherein the operations further comprise:responsive to receiving a request from a host system, transmitting at least a subset of the plurality of L2P records to the host system, wherein the subset includes the L2P record.3. The system of claim 1 , wherein the security token further comprises:an encoding of a power-on reset count.4. The system of claim 1 , wherein the security token further comprises:an encoding of a sub-region update count.5. The system of claim 1 , wherein the operations further comprise:receiving, from a host system, a read command ...

AUTHENTICATION TECHNIQUES IN RESPONSE TO ATTEMPTS TO ACCESS SENSITIVE INFORMATION

The present disclosure describes techniques for changing a required authentication type based on a request for a particular type of information. For example, consider a situation where a user has asked a virtual assistant “who owns this device?” By default, the device may allow biometric authentication to unlock. In response to identification of the owner by the virtual assistant, however, the device may require one or more other types of authentication (e.g., manual entry of a passcode) to unlock the device. In various embodiments, the disclosed techniques may increase the security of the device by making it more difficult for malicious entities to obtain the sensitive information or to access device functionality once the sensitive information has been disclosed. In various embodiments, this may prevent or reduce unauthorized access to the device. 1. A mobile device , comprising:interface circuitry configured to receive a removable storage element; andone or more processing elements configured to select a set of authentication operations to be performed prior to authorizing an action associated with the mobile device;wherein the mobile device is configured to select the set of authentication operations differently based on whether the removable storage element has been removed from the interface circuitry.2. The mobile device of claim 1 , wherein the interface circuitry is configured to receive a removable subscriber identity module (SIM) card.3. The mobile device of claim 1 , wherein the mobile device is configured to require manual entry of a passcode in response to determining that the removable storage element has been removed from the interface circuitry.4. The mobile device of claim 3 , wherein the mobile device is configured to authorize the action based on a biometric authentication operation if the removable storage element has not been removed.5. The mobile device of claim 1 , wherein the action is unlocking the mobile device.6. The mobile device of ...

PROGRAM EXECUTION DEVICE

A program execution device capable of protecting a program against unauthorized analysis and alteration is provided. The program execution device includes an execution unit, a first protection unit, and a second protection unit. The execution unit executes a first program and a second program, and is connected with an external device that is capable of controlling the execution. The first protection unit disconnects the execution unit from the external device while the execution unit is executing the first program. The second protection unit protects the first program while the execution unit is executing the second program. 1. An information processing device comprising:a processor configured to 1) execute a first program component for operating in a secure processing mode and performing tamper detection, and 2) execute a second program component for operating in a normal processing mode and performing a task; anda hardware memory configured to store at least the second program component,wherein the processor is configured to execute the first program component for determining whether at least part of the second program component is tampered with, by using a tamper detection value and while operating in the secure processing mode, andthe first program component operated in the secure processing mode cannot be accessed from the second program component operated in the normal processing mode.2. The information processing device regarding to the claim 1 ,wherein the tamper detection value is a first hash value.3. The information processing device regarding to the claim 2 ,wherein the first hash value is calculated prior to executing the second program component.4. The information processing device regarding to the claim 2 ,wherein the processor is configured to execute the first program component for determining whether at least part of the second program component is tampered with, by comparing the first hash value and a second hash value which is calculated after ...

TEMPORARY PARTIAL AUTHENTICATION VALUE PROVISIONING FOR OFFLINE AUTHENTICATION

Methods, apparatus, and processor-readable storage media for temporary partial authentication value provisioning for offline authentication are provided herein. An example computer-implemented method includes generating, in response to a request from an access device, an intermediary set of cryptographic information from an initial set of cryptographic information; modifying the intermediary set of cryptographic information based at least in part on data pertaining to the access device and one or more security parameters, wherein modifying the intermediary set of cryptographic information comprises removing one or more items of the cryptographic information from the intermediary set; and transmitting, over a network connection, the modified intermediary set of cryptographic information to the access device for use in a subsequent offline authentication request. 1. A computer-implemented method comprising:generating, in response to a request from an access device, an intermediary set of cryptographic information from an initial set of cryptographic information, wherein the intermediary set of cryptographic information comprises a portion of the initial set of cryptographic information and is temporally-limited in accordance with at least one predetermined unit of time;modifying the intermediary set of cryptographic information based at least in part on data pertaining to the access device and one or more security parameters, wherein modifying the intermediary set of cryptographic information comprises removing one or more items of the cryptographic information from the intermediary set; andtransmitting, over a network connection, the modified intermediary set of cryptographic information to the access device for use in a subsequent offline authentication request;wherein the method is performed by at least one processing device comprising a processor coupled to a memory.2. The computer-implemented method of claim 1 , wherein the access device comprises a hardware ...

Data protection system and method

An authentication system to authorize access to data to be protected, including a token having a memory that stores: an array containing alphanumeric information and random data; and a seal scheme vector containing information to enable access to each of the information items in their respective positions in the array. The authentication system is configured to: subject access to the token to the insertion of a password; decrypt the seal scheme vector; acquire the arrangement information and the size information of each random data from the seal scheme vector; check correspondence between the acquired arrangement information and the effective arrangement of the information in the array, and between the acquired size information and the effective size of the random data; authorize or deny access to the data to be protected on the basis of a result of the previous check.

PROGRAM EXECUTION DEVICE

A program execution device capable of protecting a program against unauthorized analysis and alteration is provided. The program execution device includes an execution unit, a first protection unit, and a second protection unit. The execution unit executes a first program and a second program, and is connected with an external device that is capable of controlling the execution. The first protection unit disconnects the execution unit from the external device while the execution unit is executing the first program. The second protection unit protects the first program while the execution unit is executing the second program. 1. An information processing device comprising:a first component including at least a first program for tamper detection;a second component including at least a second program for executing a task; andhardware memory for loading at least the second component,wherein the first program of the first component judges in a secure environment whether or not at least part of the second program of the second component is tampered with, by using a tamper detection value,the tamper detection value is a first value generated by using a first key, anda third program executed outside of the secure environment that cannot access the first program for tamper detection in the secure environment.2. The information processing device according to claim 1 ,wherein the first value is a hash value.3. The information processing device according to claim 1 ,wherein the first value is a signature.4. The information processing device according to claim 1 ,wherein the third program is an application configured to be executed in an external device.5. The information processing device according to claim 2 ,wherein the external device is a debugger device.6. The information processing device according to claim 1 ,wherein the first program of the first component judges whether or not at least part of the second program of the second component is tampered with, by comparing ...

METHOD FOR STRONGLY ENCRYPTING .ZIP FILES

The present invention provides a method of integrating existing strong encryption methods into the processing of a .ZIP file to provide a highly secure data container which provides flexibility in the use of symmetric and asymmetric encryption technology. The present invention adapts the well-established .ZIP file format to support higher levels of security and multiple methods of data encryption and key management, thereby producing a highly secure and flexible digital container for electronically storing and transferring confidential data. 124-. (canceled)25. A method of constructing a modified .ZIP file format data container on a computer , said method including:receiving a first data file at an application on a computer, wherein said first data file has been retrieved from an electronic computer data storage by said application;receiving a first symmetric user key data at said application on said computer, wherein said first symmetric user key data has been received from a user;receiving a first symmetric random key data at said application on said computer,encrypting said first data file to form a first encrypted data file, wherein said encrypting uses symmetric encryption employing a first encryption method using said first symmetric random key data,wherein said first encryption method is selected from a plurality of available encryption methods selectable by said user,wherein said symmetric encryption uses one of a plurality of bit lengths selectable by said user;wherein said first symmetric random key data is symmetrically encrypted using said first encryption method and said one of a plurality of bit lengths selectable by said user to form a first encrypted symmetric key data,wherein said first symmetric user key data is used as an encryption key in said symmetric encryption; andconstructing, on said computer, a modified .ZIP file format data container based on the .ZIP file format,wherein said modified .ZIP file format has been modified from the .ZIP file ...

TECHNIQUES FOR AUTHENTICATION VIA A MOBILE DEVICE

Techniques for authentication via a mobile device are provided. A mobile device is pre-registered for website authentication services. A user encounters a website displaying an embedded code as an image alongside a normal login process for that website. The image is identified by the mobile device, encrypted and signed by the mobile device and sent to a proxy. The proxy authenticates the code and associates it with the website. Credentials for the user are provided to the website to automatically authenticate the user for access to the website bypassing the normal login process associated with the website. 1. (canceled)2. A method , comprising:generating an encrypted code;injecting the encrypted code into a web page of an existing login interface that controls access to a resource;obtaining from a device a decrypted version of the encrypted code;authenticating the decrypted version of the encrypted code for access to the resource associated with the existing login interface; andlogging a principal associated with the device into an authenticated session with the resource for access through the existing login interface based on the authenticating, wherein the existing login interface is incapable of authenticating the decrypted version of the encrypted code for access to the resource.3. The method of claim 2 , wherein generating further includes generating the encrypted code as one of: a bar code and a Quick Response (QR) code.4. The method of claim 2 , wherein injecting further includes injecting the encrypted code on the web page that represents a login page to a access the resource for the existing login interface.5. The method of claim 4 , wherein injecting further includes presenting the encrypted code as a login option on the login page to an existing login option presented on the login page.6. The method of claim 2 , wherein generating further includes generating the encrypted code as an encrypted random number.7. The method of claim 2 , wherein obtaining ...

METHOD AND SYSTEM FOR INFORMATION AUTHENTICATION

A system and a method for performing an authentication are provided. The method includes: capturing, by using a front-facing camera of a mobile communication device, a first image of a face of a user; capturing, by using a rear-facing camera of the mobile communication device, a second image of an identification card that includes a photograph of the face of the user; comparing the first image with the second image; verifying that the first image matches the second image; obtaining user-specific information included in the second image; receiving a request to authenticate a transaction that relates to the user; receiving an input from the user that is usable for authenticating the transaction; and using the first image, the second image, the obtained user-specific information, and the received input to authenticate the transaction. 1. A method for performing an authentication , the method being implemented by at least one processor of a mobile communication device , the method comprising:capturing, by the at least one processor via a front-facing camera of the mobile communication device, a first image of a face of a user;capturing, by the at least one processor via a rear-facing camera of the mobile communication device, a second image of an identification card that includes a photograph of the face of the user;comparing, by the at least one processor, the first image with the second image;verifying, by the at least one processor, that the first image matches the second image based on a result of the comparing;obtaining, by the at least one processor, user-specific information included in the second image;receiving a request to authenticate a transaction that relates to the user;receiving an input from the user that is usable for authenticating the transaction; andusing the first image, the second image, the obtained user-specific information, and the received input to authenticate the transaction.2. The method of claim 1 , wherein the verifying comprises using a ...

Method, secure device, system and computer program product for securely managing user access to a file system

“A method, a secure device, a system and a computer program product for securely managing user access to a file system. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server through a telecommunication network establishing a connection between the secure device and the server, receiving at the secure device, through the established connection, data pertaining to a file system identifying files which are at least partly stored outside the secure device, exposing at the secure device the file system to a user, based on the data received from the server, the file system navigable by the user.”

SYSTEM ON CHIP TO PERFORM A SECURE BOOT, AN IMAGE FORMING APPARATUS USING THE SAME, AND METHOD THEREOF

A system on chip is provided. The system on chip includes a first memory to store a plurality of encryption keys, a second memory, a third memory to store an encryption key setting value, and a CPU to decrypt encrypted data which is stored in an external non-volatile memory using an encryption key corresponding to the encryption key setting value from among the plurality of encryption keys, to store the decrypted data in the second memory, and to perform a boot using data stored in the second memory. Accordingly, security of a boot operation can be improved. 1. An image forming apparatus comprising:a consumable unit in which a Customer Replaceable Unit Monitoring (CRUM) chip is mounted; anda controller to perform an image forming job using the consumable unit and to update data recorded on the CRUM chip according to the image forming job, 'a non-volatile memory to record encrypted data; and', 'wherein the controller comprisesa system on chip to perform a secure boot operation using the encrypted data when the image forming apparatus is turned on, and to control the image forming apparatus according to a user command when the secure boot operation is completed.2. The image forming apparatus as claimed in claim 1 , wherein the system on chip comprises:a first memory to store a plurality of decryption keys;a second memory;a third memory to store an encryption key setting value is stored; anda CPU to decrypt data which is stored in the non-volatile memory using an decryption key corresponding to the encryption key setting value from among the plurality of decryption keys, to store the decrypted data in the second memory, and to perform a boot operation using data stored in the second memory.3. The image forming apparatus as claimed in claim 2 , wherein initialization data is stored in the first memory separately from the plurality of decryption keys claim 2 ,wherein the CPU performs initialization using the initialization data and then decrypts the encrypted data.4. The ...

Systems and Methods For Digital Forensic Triage

In one embodiment, a method for forensic triage may include coupling, communicatively, a computer and a mobile device. The computer can be booted with machine readable instructions stored on the one or more mobile memory modules of the mobile device. A search data set can be received with one or more mobile processors of the mobile device. One or more processors of the computer, the one or more mobile processors, or both, can execute, automatically, the machine readable instructions stored on the one or more mobile memory modules of the mobile device to search one or memory modules of the computer in a read only mode for triage data that corresponds to the search data set. The triage data can be transmitted via one or more communication modules of the mobile device.

SECURELY PROVISIONING A TARGET DEVICE

The embodiments described herein describe technologies for Module management, including Module creation and Module deployment to a target device in an operation phase of a manufacturing lifecycle of the target device in a cryptographic manager (CM) environment. One implementation includes a Root Authority (RA) device that receives a first command to create a Module and executes a Module Template to generate the Module in response to the first command. The RA device receives a second command to create a deployment authorization message. The Module and the deployment authorization message are deployed to an Appliance device. A set of instructions of the Module, when permitted by the deployment authorization message and executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision a data asset to the target device. 1. (canceled)2. A method comprising:executing, by a tester device, a first application comprising a client cryptographic manager (CM) client library, the tester device being operatively coupled to a target device that is located at a first facility during an operation phase of a manufacturing lifecycle of the target device, wherein the tester device is an untrusted device;invoking, by the tester device, a script to generate a request comprising an argument from the client library to securely provision a data asset to the target device;sending, by the tester device, the request to an Appliance device at the first facility, the request causing the Appliance device to execute a Module at the Appliance device, wherein the Module is a second application that, when executed by the Appliance device, securely provisions the data asset to the target device by generating a Module sequence and sending the Module sequence to the tester device;receiving, by the tester device, the Module sequence from the Appliance device; andsending, by the tester device, the Module sequence to a cryptographic circuit that is ...

Two-step hardware authentication

Methods and systems are provided for two-step hardware authentication for machine monitoring systems. In one embodiment, a machine monitoring system can include a first hardware lock having a locked-state and an unlocked-state. The monitoring system can also include a second hardware lock including a sensor to detect first identification indicia of a user. The machine monitoring system can further include a data port configured to operatively couple to a computing device of the user. The data port can have an enable state and a disable state. The monitoring machine can include a processor operatively coupled to the first hardware lock, the second hardware lock, and the data port. The processor can be configured to receive data characterizing the activation of the first hardware lock and the first identification indicia of the user, and activate the data port to the computing device of the user.

Digital rights management of content when content is a future live event

A method and system for managing use of items having usage rights associated therewith including a point of capture system adapted to generate content of a future event when the event occurs, a content distributor adapted to generate a rights label having usage rights associated with content of the future event before the content is created, the rights label having a distribution key for encrypting the content as the content is generated, the distribution key being encrypted with a public key. The system also includes a license server adapted to generate a license associate with the content from the rights label before the content is generated, the license including the distribution key encrypted with the public key, and a content distributor adapted to distribute the license before the content is generated.

Managing the Customizing of Appliances

Disclosed is a method of customizing an appliance. The method includes steps of pre-storing a public key in the appliance; connecting the appliance to an external storage device; and booting up the appliance to automatically proceed with the following customization process: obtaining a customization file from the external storage device; authenticating the customization file with the public key; and executing customization with the customization file if the authentication succeeds. 1. A method of customizing an appliance , comprising steps of:pre-storing a public key and verification reference information in the appliance;connecting the appliance to an external storage device; andbooting up the appliance to automatically proceed with the following customization process:obtaining a customization file from the external storage device;authenticating the customization file with the public key;verifying a content of the customization file according to the verification reference information; andresponsive to a successful authentication of the customization file, executing customization with the customization file, wherein the appliance is customized according to the customization file after the content of the customization file is successfully verified.2. The method as claimed in claim 1 , wherein the step of booting up the appliance to proceed with the customization process comprises:booting up the appliance with a pre-stored firmware,and wherein the step of executing customization with the customization file further includes:modifying settings in the pre-stored firmware.3. The method as claimed in claim 1 , wherein the step of booting up the appliance to proceed with the customization process comprises:booting up the appliance with a pre-stored firmware,and wherein the step of executing customization with the customization file further includes:updating the pre-stored firmware.4. The method as claimed in claim 1 , wherein the step of executing customization with the ...

WORKING METHOD FOR MULTI-SEED ONE-TIME PASSWORD

Disclosed is a working method for a multi-seed one-time password, which falls within the field of information security. The method comprises: powering and initialising a one-time password, opening a total interrupt, initialising the state of a system, and then entering a sleep mode; when the one-time password detects the interrupt, awakening the one-time password from the sleep mode, and entering an interrupt processing flow; after the interrupt processing flow is ended, checking each awakening flag; and executing a processing flow corresponding to the set awakening flag. According to the present invention, a user can burn seed data into the one-time password by operating the one-time password, and can update the seed data in the one-time password. In addition, according to the present invention, the one-time password is capable of storing and managing a plurality of seeds. In a process of using the one-time password, a one-time command can be generated using the corresponding seed data according to the selection from the user, which is convenient for the user to use. In addition, the reliability and security of the seed data are guaranteed by means of binding between a unique identifier of the one-time password and the seed data. 1. A working method of multi-seeded dynamic token , wherein said method comprises:{'b': '1', 'Step S, powering on and initializing a dynamic token, turning on a general interrupt, setting a system state as a first preset state, making the dynamic token enter into a sleep mode, and the dynamic token waiting for being waken;'}{'b': 2', '3, 'Step S, waking up the dynamic token when an interrupt is detected, making the dynamic token enter into an interrupt process flow, and executing Step S after the interrupt process flow is finished; in which the interrupt process flow includes: determining, by the dynamic token, whether a key-interrupt flag is set, if yes, setting a key-waken flag and resetting the key-interrupt flag, and ending the ...

MODULES TO SECURELY PROVISION AN ASSET TO A TARGET DEVICE

The embodiments described herein describe technologies for Module management, including Module creation and Module deployment to a target device in an operation phase of a manufacturing lifecycle of the target device in a cryptographic manager (CM) environment. One implementation includes a Root Authority (RA) device that receives a first command to create a Module and executes a Module Template to generate the Module in response to the first command The RA device receives a second command to create a deployment authorization message. The Module and the deployment authorization message are deployed to an Appliance device. A set of instructions of the Module, when permitted by the deployment authorization message and executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision a data asset to the target device. 1. A method comprising:receiving, at a Root Authority (RA) device located at a first facility, a first command to create a Module, wherein the Module is a first application that, when executed by an Appliance device at a second facility, different from the first facility, in which a target device is manufactured, securely provisions a data asset to the target device in an operation phase of a manufacturing lifecycle of the target device, wherein the target device is a monolithic integrated circuit that is separate from the Appliance device;in response to the first command, executing a Module Template by the RA device to generate the Module, wherein the Module Template is a second application that defines a set of instructions for the Module and the data asset;receiving, at the RA device, a second command to create a first deployment authorization message, wherein the first deployment authorization message ties the Module to a first Appliance cluster comprising at least the Appliance device and delivers a module key that is used to encrypt the data asset in the Module; anddeploying the Module and the first ...

AUTHENTICATION METHOD, AUTHENTICATION SYSTEM AND AUTHENTICATION APPARATUS

An authentication method for authenticating an electronic ticket stored in a portable information device by an authentication apparatus, including a step of acquiring, by the portable information device, shared information that is sharable with the authentication apparatus when authentication of the electronic ticket is performed, a step of generating, by the portable information device, a bar code based on the acquired shared information and the electronic ticket, a step of displaying the bar code by the portable information device, a step of reading, by the authentication apparatus, the electronic ticket and the shared information from the bar code displayed on the portable information device, and a step of performing, by the authentication apparatus, the authentication of the electronic ticket by making a comparison between contents of the shared information read from the bar code together with the electronic ticket and shared information in the authentication apparatus. 1. An authentication method for authenticating an electronic ticket stored in a portable information device by an authentication apparatus , comprisinga step of acquiring, by the portable information device, shared information that is sharable with the authentication apparatus when authentication of the electronic ticket is performed;a step of generating, by the portable information device, a bar code based on the acquired shared information and the electronic ticket;a step of displaying the bar code by the portable information device;a step of reading, by the authentication apparatus, the electronic ticket and the shared information from the bar code displayed on the portable information device; anda step of performing, by the authentication apparatus, the authentication of the electronic ticket by making a comparison between contents of the shared information read from the bar code together with the electronic ticket and shared information in the authentication apparatus.2. The authentication ...

Rock of Randomness

A system that efficiently packs indefinitely large quantities of random data in sufficiently identical physical entities (“Random Rocks”, “Rocks”) so that all holders of a matching Rock will extract from it the same data, in response to the same data request, (“query”); the packed random data is inherently analog, not digital, in form; the Rock always responds with the same data to the same data request, which must be presented one request at a time. 1. A system that efficiently packs indefinitely large quantities of random data in sufficiently identical physical entities (“Random Rocks” , “Rocks”) so that all holders of a matching Rock will extract from it the same data , in response to the same data request , (“query”); the packed random data is inherently analog , not digital , in form; the Rock always responds with the same data to the same data request , which must be presented one request at a time.2. A method for manufacturing a pre-determined number of duplicate physical entities (“Random Rocks” , “Rocks”) that serve as containers for indefinitely large amount of random data , such that when the manufacturing instructions are erased , it is infeasible to manufacture additional duplicates; and where the data in the Rocks can be extracted one small data element at a time , resisting attempts to extract more data at a time.31. A system claimed as in () where the Rocks are comprised of materials of varying electrical conductivity , partially mixed according to random data , such that the electrical resistance measured between any two arbitrary selected points on the surface of the rock depends on the individual conductivity of each of the comprising materials , and on the manner of distribution of all those materials within the rock.42. A method claimed as in () where the Rocks are manufactured in a three-dimensional printing process where the printing is carried out with materials of varying degrees of electrical conductivity , which are mixed according to ...

METHOD AND SYSTEM FOR PREVENTING UNAUTHORIZED PROCESSOR MODE SWITCHES

Disclosed embodiments relate to a system having a processor adapted to activate multiple security levels for the system and a monitoring device coupled to the processor and employing security rules pertaining to the multiple security levels. The monitoring device restricts usage of the system if the processor activates the security levels in a sequence contrary to the security rules. 1. A system comprising:a processor operable in one of a plurality of modes, the plurality of modes including a secure mode, a non-secure mode, and an intermediate mode between the secure mode and the non-secure mode;a register comprising a security bit, wherein a value of the security bit determines whether the processor is operating in the secure mode or in the non-secure mode; andmonitoring logic operable to cause the system to perform a protective action in response to determining an occurrence of a security violation, the security violation being a determination that the processor attempts to switch from operating in the non-secure mode to operating the secure mode without first switching to the intermediate mode or a determination that the processor attempts to switch from operating in the secure mode to the non-secure mode without first switching to the intermediate mode.2. The system of claim 1 , wherein:the secure mode is a first secure mode and the plurality of modes also includes a second secure mode, wherein the first secure mode and the second secure mode are assigned different privilege levels; andthe non-secure mode is a first non-secure mode and the plurality of modes also includes a second non-secure mode, wherein the first non-secure mode and the non-second secure mode are assigned different privilege levels.3. The system of claim 2 , wherein:the different privilege levels include a privileged mode and a user mode;the first secure mode and the first non-secure mode are each assigned the privileged mode; andthe second secure mode and the second non-secure mode are each ...

Data protection system and method

An authentication system to authorize access to data to be protected, including a token having a memory that stores: an array containing alphanumeric information and random data; and a seal scheme vector containing information to enable access to each of the information items in their respective positions in the array. The authentication system is configured to: subject access to the token to the insertion of a password; decrypt the seal scheme vector; acquire the arrangement information and the size information of each random data from the seal scheme vector; check correspondence between the acquired arrangement information and the effective arrangement of the information in the array, and between the acquired size information and the effective size of the random data; authorize or deny access to the data to be protected on the basis of a result of the previous check.

Integrated second factor authentication

Techniques and apparatuses are described that enable integrated second factor authentication. These techniques and apparatuses enable the improved security of something you have without the accompanying inconvenience or chance of loss. To do so, a secure physical entity is integrated within a computing device. While this provides the something you have without a need to carry a separate object with you, the something you have also must not be able to be accessed remotely. To prevent remote access physical wires are connected from the secure physical entity to physical structures on the computing device. In this way, a hacker or cyber thief cannot convince an authentication system that the cyber attacker does indeed have the something you have because to do so the attacker must be in physical possession of the computing device.