МЕЖСЕТЕВОЙ РОУМИНГ И РАЗРЕШЕНИЕ ВЕБ-СЛУЖБ ДЛЯ УСТРОЙСТВ

Изобретение относится к системам и способам автоматизированного определения сетевых адресов и передачи данных между выполняющими роуминг одноранговыми узлами сети. Техническим результатом является обеспечение безопасности и исключение конфликтов адресации внешних и внутренних узлов частной сети. Система включает: процессор реализующий: провайдер разрешения, выполненный с возможностью автоматического определения сетевых адресов; и компонент обнаружения для способствования определению сетевых адресов путем приема первого тестового сообщения от клиентского устройства, причем первое тестовое сообщение включает в себя характеристику, относящуюся к целевой службе; и посылки второго тестового сообщения в сетевое устройство, обеспечивающее целевую службу, имеющую характеристику, причем второе тестовое сообщение содержит информацию, включающую в себя характеристику и адрес клиентского устройства для обеспечения возможности сетевому устройству ответить на первое тестовое сообщение путем посылки ответа ...

АУТЕНТИФИКАЦИЯ ПРИЛОЖЕНИЯ

Изобретение относится к области сетей передачи данных. Технический результат заключается в оптимизации доступа приложений. Сущность изобретения заключается в том, что способ включает выполнение серверным приложением (408) процедур (412) начальной загрузки между этим серверным приложением (408) и функцией (400) сервера начальной загрузки; получение (420, 422) общего ключа на основе, по меньшей мере, ключа, принятого от сервера (400) функции сервера начальной загрузки во время процедур (412) начальной загрузки, и идентификатора функции сетевого приложения; предоставление (414) приложению (406) идентификатора транзакции начальной загрузки, принятого от сервера функции сервера начальной загрузки (400) во время процедур начальной загрузки (412); прием ответа от приложения (406) и аутентификацию (426) приложения путем проверки ответа с использованием общего ключа. 7 н. и 42 з.п. ф-лы, 5 ил.

СПОСОБ АУТЕНТИФИКАЦИИ ПРИ ОДНОСТОРОННЕМ ДОСТУПЕ

Изобретение относится к беспроводной связи, а именно к способу аутентификации при одностороннем доступе. Техническим результатом является повышение расширяемости сети. Технический результат достигается тем, что в соответствии с параметрами системы, установленными третьим объектом, второй объект отправляет первому объекту сообщение группировки распределения запроса аутентификации и ключа. Первый объект осуществляет верификацию достоверности сообщения, отправленного со второго объекта, и, если оно является достоверным, первый объект генерирует сообщение группировки ответа аутентификации и ключа и отправляет его на второй объект, который осуществляет верификацию достоверности сообщения, отправленного с первого объекта и, если оно является достоверным, второй объект генерирует сообщение группировки подтверждения аутентификации и ключа и отправляет это сообщение первому объекту. Первый объект осуществляет верификацию достоверности сообщения группировки подтверждения аутентификации и ключа и, ...

СПОСОБ И УСТРОЙСТВО ДЛЯ ПЕРЕДАЧИ ДАННЫХ СОДЕРЖИМОГО И УСТРОЙСТВО ЗАПИСИ И/ИЛИ ВОСПРОИЗВЕДЕНИЯ

Изобретение относится к области передачи данных. Технический результат заключается в запрете неразрешенного копирования данных. Для этого шифруют, по меньшей мере, данные содержимого входных цифровых данных на основе данных первого ключа, которые шифруют на основе функции, генерированной на основе случайного числа, и данных второго ключа, генерированных с использованием данных специфического ключа устройства и данных общего ключа. При декодировании принимают кодированные данные, состоящие из зашифрованных данных содержимого, зашифрованных данных первого ключа, случайного числа и данных общего ключа, генерируют данные второго ключа на основе данных специфического ключа устройства и данных общего ключа, декодируют зашифрованные данные первого ключа на основе генерированных данных второго ключа и функции, генерированной на основе случайного числа, декодируют зашифрованные данные содержимого на основе декодированных данных первого ключа. 2 н. и 1 з.п. ф-лы, 13 ил.

СПОСОБ И УСТРОЙСТВО ДЛЯ ПЕРЕДАЧИ ДАННЫХ СОДЕРЖИМОГО И УСТРОЙСТВО ЗАПИСИ И/ИЛИ ВОСПРОИЗВЕДЕНИЯ

Изобретение относится к области передачи данных. Технический результат заключается в запрете неразрешенного копирования данных. Для этого декодируют цифровые данные, зашифрованные на основе данных специфического ключа устройства, которое должно быть местом назначения передачи, извлекают из декодированных зашифрованных данных данные, относящиеся к условиям копирования и осуществляют запись декодированных зашифрованных данных в запоминающее устройство на основе извлеченных данных, относящихся к условиям разрешения копирования. 2 н. и 8 з.п. ф-лы, 13 ил.

Способ и система передачи данных на сервер с привлечением удостоверяющего центра

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении анонимности передаваемых данных без потери полноты и репрезентативности информации, необходимых серверу для анализа и построения статистики. Предлагается способ передачи преобразованных данных в клиент-серверной архитектуре, в котором: отправляют клиенту от средства сертификации ключ преобразования; разделяют структуру данных, предназначенную для отправки серверу, на по меньшей мере две подструктуры и осуществляют первичное преобразование подструктур данных на клиенте; отправляют указанные подструктуры данных от клиента к серверу по разным маршрутам; объединяют подструктуры данных на сервере после получения в структуру. 2 н. и 48 з.п. ф-лы, 22 ил., 1 табл.

УСТРОЙСТВО И СПОСОБ ОБЕСПЕЧЕНИЯ ЦЕЛОСТНОСТИ ДАННЫХ ТРАНСПОРТНОГО СРЕДСТВА В РЕАЛЬНОМ МАСШТАБЕ ВРЕМЕНИ И СИСТЕМА ЧЁРНОГО ЯЩИКА ТРАНСПОРТНОГО СРЕДСТВА С ИХ ИСПОЛЬЗОВАНИЕМ

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении целостности данных транспортного средства. Устройство обеспечения целостности данных транспортного средства в реальном масштабе времени содержит модуль объединения данных в блоки, предназначенный для разделения входящих потоков данных об измерительной информации о транспортном средстве в блоки данных заданного размера; модуль генерирования исходных данных аутентификации (ИДА), предназначенный для генерирования ИДА путем подписи исходных блоков данных во входящих потоках данных с помощью ключа подписи; первый модуль хэширования, предназначенный для генерирования первого хэш-значения каждого разделенного блока данных по порядку, первый модуль хэширования генерирует первое хэш-значение текущего блока данных путем конкатенирования и хэширования значения текущего блока данных и первого хэш-значения предыдущего блока данных; и второй модуль хэширования, предназначенный для генерирования второго хэш-значения ...

СПОСОБ И СИСТЕМА ДВУХСТОРОННЕЙ АУТЕНТИФИКАЦИИ СУБЪЕКТОВ

Изобретение относится к секретной связи, а именно к способу и системе для двухсторонней аутентификации субъектов. Техническим результатом является предотвращение проблемы при выполнении аутентификации, обусловленной неспособностью осуществить доступ к сети до успешной аутентификации. Технический результат достигается тем, что способ включает в себя этапы, на которых: первый субъект отправляет первое сообщение; второй субъект отправляет второе сообщение на заслуживающую доверия третью сторону после приема упомянутого первого сообщения; упомянутая заслуживающая доверия третья сторона возвращает третье сообщение после приема второго сообщения; упомянутый второй субъект после приема третьего сообщения и верификации подписи доверенной третьей стороны получает открытый ключ первого субъекта для верификации подписи первого субъекта в первом сообщении и, если верификация подписи пройдена, отправляет четвертое сообщение; упомянутый первый субъект принимает упомянутое четвертое сообщение и верифицирует ...

Система многоуровневой процедуры идентификации и установления личности для проверки подлинности данных при распознавании документов, удостоверяющих личность

Изобретение относится к вычислительной технике. Технический результат заключается в расширении арсенала технических средств для решения задачи реализации многоуровневой процедуры идентификации и установления личности для проверки подлинности данных при распознавании документов, удостоверяющих личность. Технический результат достигается тем, что система содержит модуль оптического сканирования и цифрового описания реквизитов документов, модуль приема цифрового описания реквизитов документов, модуль приема идентификационных данных документов и транзакций из базы данных сервера системы, модуль селекции адресов записей реквизитов документов в базе данных сервера системы, модуль идентификации реквизитов распознаваемых документов, модуль верификации реквизитов распознаваемых документов, регистр адресов записей реквизитов документов в базе данных сервера системы и модуль выдачи транзакций. 5 ил., 3 табл.

ВЗАИМНАЯ МОБИЛЬНАЯ АУТЕНТИФИКАЦИЯ С ИСПОЛЬЗОВАНИЕМ ЦЕНТРА УПРАВЛЕНИЯ КЛЮЧАМИ

... 1. Способ аутентификации, содержащий этапы:отправляют сообщение вызова с мобильного шлюза на потребительское устройство, причем сообщение вызова отправляется в ответ на сообщение запроса связи, при этом потребительское устройство сконфигурировано для использования в качестве платежного устройства;принимают сообщение ответа на вызов от потребительского устройства в мобильном шлюзе в ответ на сообщение вызова; иотправляют сообщение ответа на вызов от мобильного шлюза центру управления ключами, при этом центр управления ключами сконфигурирован с возможностью управления сеансовыми ключами для связи с потребительским устройством, при этом центр управления ключами осуществляет верификацию сообщения ответа на вызов и позволяет осуществить транзакцию связи между первым объектом и потребительским устройством, если сообщение ответа на вызов является достоверным.2. Способ по п.1, в котором центр управления ключами отправляет сеансовый ключ мобильному шлюзу и потребительскому устройству, причем сеансовый ...

Способ передачи конфиденциальных данных

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении отправки критических данных на сервер. Способ отправки критических данных на сервер, в котором разделяют на клиенте структуру данных, предназначенную для отправки серверу, на подструктуру, содержащую критические данные (далее КД), подструктуру, не содержащую КД, подструктуру, содержащую КД, дополнительно разделяют на клиенте по меньшей мере на две подструктуры и отправляют полученные подструктуры последовательно на сервер через узел со средством преобразования, где средством преобразования узла осуществляют преобразование каждой полученной подструктуры данных, отправляют подструктуру, не содержащую КД, на сервер, объединяют на сервере подструктуры, разделенные ранее, в структуру данных. 15 з.п. ф-лы, 19 ил.

АУТЕНТИФИКАЦИЯ ПРИЛОЖЕНИЯ

... 1. Способ аутентификации приложения, включающий: ! выполнение с использованием серверного приложения процедур начальной загрузки между серверным приложением и функцией сервера начальной загрузки; ! получение общего ключа на основе, по меньшей мере, ключа, принятого от сервера функции сервера начальной загрузки во время процедур начальной загрузки, и идентификатора функции сетевого приложения; ! предоставление приложению идентификатора транзакции начальной загрузки, принятого с сервера функции сервера начальной загрузки во время процедур начальной загрузки; !прием ответа от приложения и ! аутентификация приложения путем проверки ответа с использованием общего ключа. ! 2. Способ по п.1, в котором аутентификация приложения содержит ! аутентификацию приложения путем сравнения общего ключа с ответом. ! 3. Способ по п.1, также содержащий ! создание вызова и ! предоставление вызова приложению, ! где шаг аутентификации содержит аутентификацию приложения путем проверки ответа с использованием вызова ...

СПОСОБЫ И УСТРОЙСТВО ДЛЯ РАСПРЕДЕЛЕННОЙ БАЗЫ ДАННЫХ, СОДЕРЖАЩЕЙ АНОНИМНЫЕ ВХОДНЫЕ ДАННЫЕ

СПОСОБ И СИСТЕМА ДВУХСТОРОННЕЙ АУТЕНТИФИКАЦИИ СУБЪЕКТОВ

... 1. Способ для двухсторонней аутентификации субъектов, содержащий этапы, на которых: ! передают, первым субъектом, первое сообщение, несущее меняющийся во времени параметр RA, идентичность IDA субъекта и подпись; ! передают, вторым субъектом, по приему первого сообщения, доверенной третьей стороне второе сообщение, несущее меняющиеся во времени параметры RA и RB, идентичность IDA субъекта первого субъекта и идентичность IDB субъекта второго субъекта; ! возвращают, доверенной третьей стороной, по приему второго сообщения, второму субъекту третье сообщение, несущее подпись доверенной третьей стороны и меняющиеся во времени параметры RA и RB; ! получают, вторым субъектом, по приему третьего сообщения, результат верификации для первого субъекта, если верификация подписи доверенной третьей стороны пройдена, и меняющийся во времени параметр RB совместим с локально хранимым меняющимся во времени параметром RB, и если результат верификации указывает, что первый субъект достоверен, то получают открытый ...

Способ и устройство для ввода информации

Способ и устройство дл передачи данных содержимого и устройство записи и/или воспроизведени

... 1. Устройство передачи данных, содержащее запоминающее устройство для хранения зашифрованных данных; блок аутентификации для аутентификации устройства, которое должно быть местом назначения передачи, и блок повторного шифрования для декодирования данных, считанных из запоминающего устройства, и повторного шифрования декодированных данных, в котором если указанное устройство, которое должно быть местом назначения передачи, аутентифицировано указанным блоком аутентификации, то данные, считанные из указанного запоминающего устройства, декодируются, и декодированные таким образом данные повторно зашифровываются с использованием данных специфического ключа устройства, полученных из указанного устройства, которое должно быть местом назначения передачи, аутентифицированного указанным блоком аутентификации, повторно зашифрованные таким образом данные передаются на указанное устройство, которое должно быть местом назначения передачи. 2. Устройство передачи данных по п.1, отличающееся тем, что если ...

Verteilen geheimer Schlüssel zum Verwalten eines Zugriffs auf ECUs

Ein System und ein Verfahren zum Steuern des Zugriffs auf elektronische Steuereinheiten (ECUs) umfassen: Empfangen, an einem ECU-Zulieferercomputer, eines Zuliefererverschlüsselungsschlüssels, der von einem Master-Verschlüsselungsschlüssel unter Verwendung eines Zuliefereridentifikators, der einen ECU-Zulieferer identifiziert, abgeleitet wird; Ausgeben eines ECU-Identifikators, der eine ECU identifiziert und den Zuliefereridentifikator umfasst; Generieren eines ECU-Freischaltungsautorisierungsschlüssels unter Verwendung des Zuliefererverschlüsselungsschlüssels und des ECU-Identifikators für die ECU; und Speichern des ECU-Freischaltungsautorisierungsschlüssels und des ECU-Identifikators in der ECU.

Verfahren zur Erzeugung und Registrierung von Grundschlüsseln

Datennachweissystem, Servergerät, Clientgerät, Publishing-Server und Datennachweisverfahren

Es ist möglich, Nichtfälschung von Ausgabedaten nachzuweisen, ohne ein Gerät zu verwenden, welches Überprüfungsinformationen als Informationen zum Bestätigen von Nichtfälschung ausgibt. Eine Überprüfungsinformationserzeugungseinheit erzeugt Nachweisinformationen zum Bestätigen von Nichtfälschung von Rohdaten und erzeugt Überprüfungsinformationen einschließlich der Nachweisinformationen und die Zeit der Erzeugung der Nachweisinformationen darstellende Zeitinformationen. Eine Serversendeeinheit sendet die Überprüfungsinformationen an ein Clientgerät. Eine Client-Empfangseinheit empfängt die von einem Servergerät gesendeten Überprüfungsinformationen. Eine Zeitinformationserfassungseinheit erfasst die Zeitinformationen, die die Zeit der Erzeugung der Nachweisinformationen darstellen, aus den Überprüfungsinformationen. Eine Berichtserzeugungseinheit erzeugt Berichtsdaten, wobei Zeitinformationen und einen Publishing-Zielort darstellende Publishing-Zielortinformationen in den Rohdaten einbezogen ...

EINRICHTUNG UND VERFAHREN ZUR ELEKTRONISCHEN ZAHLUNG UND KREDITEINSAMMLUNG ÜBER EIN GESICHERTES NETZWERK

Verriegelungs- und Entriegelungssystem und Schlüsseleinheit

Ein Verriegelungs- und Entriegelungssystem (1) beinhaltet ein mobiles Endgerät (20) und eine in einem Fahrzeug oder einer Einrichtung vorgesehene Schlüsseleinheit (12). Das mobile Endgerät (20) beinhaltet eine Übertragungseinheit, die erste Authentisierungsinformationen und ein erstes Anforderungssignal an die Schlüsseleinheit (12) überträgt. Die Schlüsseleinheit (12) beinhaltet eine Empfangseinheit, die die ersten Authentisierungsinformationen und das erste Anforderungssignal von dem mobilen Endgerät (20) empfängt, eine erste Authentisierungseinheit (1245), die eine Authentisierung des mobilen Endgeräts (20) basierend auf den ersten Authentisierungsinformationen in einem Fall durchführt, in dem die Authentisierungsinformationen empfangen wurden, eine erste Authentisierungseinheit (1245), die die Authentisierung des mobilen Endgeräts (20) in einem Fall, in dem die erste Authentisierungseinheit (1245) die Authentisierung des mobilen Endgeräts (20) einmal basierend auf den ersten Authentisierungsinformationen ...

ÜBERPRÜFBARE, GEHEIME MISCHUNG VON VERSCHLÜSSELTEN DATEN WIE Z. B. ELGAMAL-VERSCHLÜSSELTE DATEN FÜR GESICHERTE MEHRINSTANZWAHLEN

GESTEUERTE AKTIVIERUNG EINER FUNKTION

Datenauthentifizierungsverfahren und Agent basiertes System

Authentication system and method

Setting information distribution apparatus, method, program, and medium, authentication setting transfer apparatus, method, program, and medium, and setting

Method of secure broadcasting of digital data to an authorized third party

Public key infrastructure & method of distribution

Anonymous authentication

Systems and methods for blockchain-based digital lottery ticket generation and distribution

Format-preserving cryptographic systems

Setting information distribution apparatus, method, program, and medium, authentication setting transfer apparatus, method, program, and medium, and setting

Authorized operations in electronic systems

Bootstrapping with common credential data

The invention comprises bootstrapping a device by a bootstrap server wherein the device has common credential data (e.g. a certificate or key) that is provisioned on and common to a group of devices. The method may reduce the administration burden as the devices do not each need to be provisioned with unique credential data. The process comprises receiving at the bootstrap server common credential data from the device including a trust indicator indicating that the common credential data is common for a group of devices; obtaining, at the bootstrap server, resource credential data based on the common credential data, where the resource credential data enables the device to authenticate with a resource; and transmitting the resource credential data from the bootstrap server to the device. Subsequently, the bootstrap server may obtain bootstrap credential data that devices can use to authenticate without the common credential data. The trust indicator indicates that it may have a chain of ...

Validating software code using a trusted third party

Validating software code provided to a user entity (39) by a software provider (38). User entity (39) encrypts first data, provides it to the software provider (38), and receives back an indication that the code is valid only if the software provider (38) has been able to correctly decrypt the encrypted first data, such decryption only being possible using an appropriate decryption key provided by a party (35) with rights in the software code. More particularly, the user entity (39) encrypts the first data using, as encryption parameters, both an encryption key string (EKS) comprising said software code or a representation thereof, and public data of the aforesaid party. A decryption key appropriate for correctly decrypting the encrypted first data is provided to the software provider (38) by the party (35) with rights in the software code, only if the software code provided to the user entity (39) is valid. Generation of this key by the party (35) is effected using both private data related ...

Systems and methods of secure data exchange

Improved capabilities are described for securely viewing, and collaboratively working on, computer data content, such as documents, presentations, spreadsheets, emails, blog entries, texts, and the like, wherein a secure exchange server is controlled by an intermediate business entity, and access to restricted computer data content is granted to a plurality of users comprising a user of a second business entity and an anonymous user. The second business entity may indicate permissions to the secure exchange server for the anonymous user to access the computer data content through an anonymous information rights management (IRM) facility which limits retention of information about the anonymous user. The indication of permission also comprises an anonymous access condition. Other embodiments describe a federated search facility, a data management facility distributed over several data management sites, an encryption management facility, a data chunking facility, an asynchronous upload messaging ...

Data relay authentication

An intermediate relay device 3 arranges for mutual authentication between itself and a remote terminal 4 to allow data to be exchanged between the remote terminal 4 and a server 1 through the relay 3. The server 1 sends first and second key codes CK, RK to the intermediate device (step 105), the key codes both being derived from a shared secret known to the server 1 and remote terminal 4, but not to the intermediate device 3. In response to a challenge (step 107) from the intermediate device 3, the remote terminal 4 uses the shared secret to generate a duplicate CK* of the first key code and transmits the duplicate to the intermediate device 3 (step 109). The intermediate device 3 compares the first key code CK and the duplicate CK* of the first key code received respectively from the server 1 and the remote terminal 4 to verify the authenticity of the remote terminal 4. The intermediate device 3 then transmits the second key code RK to the remote terminal 4 (step 112), to be compared by ...

Optimised host identity protocol authentication

Secure communications

A system, possibly contained within a secured perimeter, comprising: a sensor 405 responsive to an initiation signal 410, possibly containing location information and sent from a proximal third party computing device 425 on a first communications channel, arranged to generate and store 420 first security information, such as a Diffie-Hellman key exchange parameter pair, and a first message 430 including at least part of the first security information is sent to a wireless access point (WAP) 415 on a second channel; the WAP 415 receives and stores the first message 430, and generates 440 second security information, transmitting a second message 450 including at least part of the second security information to the computing device 425 on a third channel; wherein the sensor 405 receives at least the second message only on the first channel 460. The WAP 415 may be partially shielded and communicate over medium range interfaces. Cryptographic keys and authentication code may be generated by ...

Mobile message source authentication

A control circuit 101 receives from a mobile receiver 109 a request for a certificate identifying a source 104 and returns the requested certificate. The certificate, which may be an x.509 certificate or a hashed digital signature which may be a seventy byte hash and may also an elliptical-curve based hash, includes a logo corresponding to a particular source and decryption information. The mobile receiver 109 decrypts an encrypted digital signature to authenticate the source 104 of the mobile message comprising that signature and then displays the entity logo while presenting said message, providing visual confirmation of the source of the message. The mobile receiver 109 can also display the entity logo with additional graphics features representing a confirmed authentication. The control circuit may have a circuit revocation list and the certificate may include one or more of a unique number, a source name, a validity period, a public or private security key.

Distributed management system for internet of things devices and methods thereof

Distributed management of Internet of Things (IoT) devices is achieved using gateway devices. A gateway device connects to a security entity, e.g. a server, to obtain a gateway digital certificate, signed by a root of trust, and permission to perform tasks on the IoT device. The gateway connects to the IoT device and uses the gateway digital certificate to obtain management control of it. The IoT device has a private /public key pair and stores its private key and a certificate from the root of trust. The IoT device is able to check the root of trust of the gateway certificate with its own. The gateway may control multiple IoT devices and may be given permission to modify firmware of the IoT devices. A distributed management system comprises multiple gateways with each gateway managing multiple IoT devices. In another claimed arrangement the gateway receives from a security entity credentials to obtain control of the IoT devices and also an assignment of tasks for the gateway to perform ...

A set of servers for "machine-to-machine" communications using public key infrastructure

Systems and methods for blockchain-based digital lottery ticket generation and distribution

Systems for and methods of generating a digital lottery ticket includes receiving a ticket issuance request from a customer computing device 40. The request includes transaction data including a player entry and a first public key associated with the player entry. A first message is generated by an issuer server 10 including digital ticket information, TKD, relating to the player entry, a source field, such as issuer server public key, and a destination field, such as the public key of the player entry. A digital signature of the first message is generated using a private key of an issuer server 10. The first message and the digital signature is transmitted to a transaction certification authority (TCA) server 20 for storage on a publicly viewable transaction ledger 30, preferably a block chain, maintained by the TCA. A message from the TCA server is received by the issuer server 10 including a digital ticket number and an associated transaction ID. A third message including the transaction ...

Identifier-based signcryption

Encryption and verification method

Terminal determination device and method

Mobile device with secure element

Mobile device with secure element

SAFE DATENTRANSFER

SYSTEM AND PROCEDURE FOR SIGNING A SOFTWARE CODE

SYSTEM AND PROCEDURE FOR SIGNING A SOFTWARE CODE

STEERED ACTIVATION OF A FUNCTION

REMARK PROOF WITH ZUFALLSFUNKTION

PROCEDURE AND MECHANISM FOR THE SETTING UP A CRYPTOGRAPHIC CONNECTION BETWEEN ELEMENTS OF A SYSTEM

Apparatus and method for authenticating the dispatch and contents of documents

Identity authentication

The present invention relates to a method of authenticating the identity of one or more users (101, 102) who are communicating with each other. The users (101, 102) share one or more secrets with each other, and use those secrets to verify their identities at a remote authentication system (103). A server (104) of the system (103) receives a secret from a first user (102) and hashes it with a salt (206), sending a reference code (207) back to the first user (102) in response. The server (104) then receives the secret from a second user (101), along with the reference code (207) and hashes the secret with the same salt (206) used to hash the first secret. The outputs (208, 209) of the hashes are then compared to determine whether the secrets matched, authenticating the identities of each user.

Lifecycle management method and apparatus for trusted certificates and trust chains

A method and apparatus is provided for updating certificates in a trust chain and managing versions of the trust chain. A first electronic processor determines that a first certificate in a first level of the trust chain is to be updated, updating the first certificate and each certificate in a lower level in the trust chain that is lower than the first level, creates a second version of the trust chain including an updated first certificate and an updated certificate at each lower level in the trust chain, and transmits the second version of the trust chain to one or more entities.

Methods and apparatus for a distributed database including anonymous entries

In some embodiments, an apparatus having at least a portion of a first instance of a distributed database at a first compute device is configured to be included within a group of compute devices that implement via a network operatively coupled to the group of compute devices the distributed database. The distributed database enables anonymous transfers of digital assets between compute devices via a transfer protocol such that an identity of a compute device associated with a private key corresponding to a public key logically related to a destination record is concealed among a set of compute devices including the first compute device and at least one second compute device.

Methods and apparatus for a distributed database including anonymous entries

In some embodiments, an apparatus having at least a portion of a first instance of a distributed database at a first compute device is configured to be included within a group of compute devices that implement via a network operatively coupled to the group of compute devices the distributed database. The distributed database enables anonymous transfers of digital assets between compute devices via a transfer protocol such that an identity of a compute device associated with a private key corresponding to a public key logically related to a destination record is concealed among a set of compute devices including the first compute device and at least one second compute device.

PRE-REGISTRATION OF AUTHENTICATION DEVICES

Abstract A system is disclosed for pre-registering authentication devices. A security key provider system may receive a request to pre-register a security key with identified applications from an enterprise. Responsive to receiving the request, the security key provider system instructs the security key to generate a unique authentication code for each of the applications. The security key provider system may generate pre-registration information based on the authentication codes and pre-register the authentication codes of the security key to the applications by providing the pre-registration information to the applications on behalf of the enterprise. The security key provider system may instead provide the pre-registration information to the enterprise to allow the enterprise to pre-register the authentication codes. -1I- Third-Party Application Third-Party 125 Application Third-Party Application Enterprise User User Security Key 115 115 Provider System Security Key Security Key ...

System for protected storage and management in a ttp server

Electronic commerce with cryptographic authentication

Subscriber authentication in a mobile communications system

Controlled security domains

A security domain control method includes defining a sequential series of security domains; designating one of the security domains as a current domain; generating a plurality of security tokens under the current security domain, each security token being configured to enable a party to exchange cryptographically secured messages with another party that is holding any one of: a token generated under the current security domain; a token generated under at least one next security domain in the series; and a token generated under at least one previous security domain in the series; and subsequently designating a next one of the security domains in the series as a current domain.

METHOD AND SYSTEM FOR AUTHENTICATION

Implementation of secure communications in a support system

A support system negotiates secure connections on behalf of multiple guest systems using a set of credentials associated with the guest systems. The operation of the secure connection may be transparent to the guest system such that guest system may send and receive messages that are encrypted or decrypted by the support system, such as a hypervisor. As the support system is in between the guest system and a destination, the support system may act as a local endpoint to the secure connection. Messages may be altered by the support system to indicate to a guest system which communications were secured. The credentials may be managed by the support system such that the guest system does not require access to the credentials.

Secure authentication of user and mobile device

An authentication method is disclosed. To authenticate a user, a mobile device may request identification and verification from the user. Upon receiving a positive identification and verification response from the user, the mobile device may generate a cryptogram using a user identification (ID) associated with the user, a timestamp, a device ID associated with the mobile device, a service provider application ID associated with the service provider application, and a service provider device ID. The mobile device may transmit the generated cryptogram, the user ID, the timestamp, the device ID, the service provider application ID, and the service provider device ID, to a service provider computer associated with the service provider application. The service provider computer may decrypt the cryptogram and compare the decrypted data elements to the received data elements to validate and authenticate the user.

Dual network system and method for online authentication or authorization

System and method for electronic transmission, storage, and retrieval of authenticated electronic original documents

Apparatus and method for preventing disclosure through user-authentication at a printing node

Method and device for the protected storage of data from message traffic

Procedure and system for reliable and safe identification of a contracting party

SYSTEM FOR SECURE ELECTRONIC INFORMATION TRANSMISSION

A method for secure electronic information exchange between a sender and a recipient. The method includes generating a message at a first entity, generating a message encryption key, encrypting the message using the message encryption key, wrapping the message encryption key using a key agreement algorithm, generating a Java archive file including the encrypted message, the wrapped message encryption key and cryptographic algorithm code including decryption algorithm and key agreement algorithm code, encoding the Java archive file, embedding the encoded Java archive file in an HTML file, and sending the HTML file as an e-mail attachment to said recipient.

METHOD FOR IMPROVING THE READABILITY OF COMPOSITE IMAGES

A method for improving the readability of composite images by determining available areas on a document where no text or graphics will be printed in visible ink and printing one or more 2-D bar code with invisible ink at a size pre- determined based on the available areas. The one or more auxiliary 2-D bar codes are printed in luminescent ink, either invisible or lightly colored when viewed under white light.

SYSTEM AND METHOD FOR PROVIDING SECURE COMMUNICATIONS BETWEEN WIRELESS UNITS USING A COMMON KEY

A system and method uses a common key provided to a first wireless unit and a second wireless unit to use in secure communications between the first and second wireless units over at least one wireless communications system. By providing a common key to the first and second wireless units, the common key security system alleviates the at least one wireless communications system from having to perform the security methods used to provide secure communications between the first and second wireless units.

METHOD AND SYSTEM FOR SHARING DATA

A system and method for sharing data is provided. A request is received from a mobile device to transfer a set of data to a recipient. The set of data is stored by a server and controlled by a user of the mobile device. The request is authenticated, and the data is encrypted. The set of data is transmitted to a recipient specified by the user via the mobile device.

METHOD AND SYSTEM FOR MANAGING AUTHENTICATION AND PAYMENT FOR USE OF BROADCAST MATERIAL

SERVER FOR DETECTING A PROXY DEVICE IN A COMMUNICATIONS PATH AND RELATED METHODS

A server for detecting a proxy device in a communications path may include a processor and a memory associated therewith. The processor may obtain an encrypted first portion of an encryption key from the client device. The encryption key may be based upon user-input credentials for a given user. The processor may also communicate an encrypted second portion of the encryption key to the client device based upon determining that the encrypted first portion matches a corresponding first portion of the encryption key indicative of an absence of the proxy device in the communications path. The processor may also detect a loss in connectivity between the server and the client device in response to the client device determining that the decrypted second portion of the encryption key does not match a corresponding second portion of the encryption key indicative of a proxy device in the communications path.

IDENTITY AUTHENTICATION

The present invention relates to a method of authenticating the identity of one or more users (101, 102) who are communicating with each other. The users (101, 102) share one or more secrets with each other, and use those secrets to verify their identities at a remote authentication system (103). A server (104) of the system (103) receives a secret from a first user (102) and hashes it with a salt (206), sending a reference code (207) back to the first user (102) in response. The server (104) then receives the secret from a second user (101), along with the reference code (207) and hashes the secret with the same salt (206) used to hash the first secret. The outputs (208, 209) of the hashes are then compared to determine whether the secrets matched, authenticating the identities of each user.

SYSTEMS AND METHODS FOR USE IN MANAGING DIGITAL IDENTITIES

Systems and methods are provided for managing digital identities associated with users. One exemplary method includes receiving, at a computing device, an encrypted message from a communication device associated with a user where the messaging includes a changed attribute for the user. The method also includes generating a hash of a digital identity for the user with the changed attribute, generating a hash of the digital identity of the user stored in a ledger data structure, and transmitting a request for the user to attest to the changed attribute when the generated hashes do not match. The method then further includes broadcasting a pending status of the digital identity of the user to a relying party for the digital identity, and storing a certification of the changed attribute, received from the relying party in response to the pending status, based on verification of the changed attribute by the relying party.

SUBSCRIPTION CONCEALED IDENTIFIER

A method performed by an authentication server (14) in a home network (3) of a user equipment (1), UE, for obtaining a subscription permanent identifier, SUPI. The method comprises: - receiving a subscription concealed identifier, SUCI, which comprises an encrypted part in which at least a part of the SUPI is encrypted, and a clear-text part which comprises a home network identifier and an encryption scheme identifier that identifies an encryption scheme used by the UE to encrypt the SUPI in the SUCI, - determining a de-concealing server (19) to use to decrypt the encrypted part of the SUCI; - sending the SUCI to the de-concealing server (19), and - receiving the SUPI in response. Methods performed by a UE and a de-concealing server are also disclosed. Furthermore, UEs, de-concealing servers, authentication servers, computer program (133) and a memory circuitry (12) are also disclosed.

INTEGRATED MULTI-LEVEL NETWORK APPLIANCE, PLATFORM AND SYSTEM, AND REMOTE MANAGEMENT METHOD AND SYSTEM THEREFOR

Described are various embodiments of an integrated multi-level network appliance and system, and remote management system and method therefor. In one embodiment, the appliance comprises: two or more hardware-integrated processing engines each operable to implement a corresponding network-related resource associated with a respective network level in accordance with a designated multi-level network architecture; an integrated processor operable to execute the processing engines; one or more integrated data storage resources accessible to the processing engines to implement each corresponding network-related resource; and a trusted single-chip switch having a plurality of hardware ports associated therewith and configured to define in hardware multiple data communication paths embedded therein.

SYSTEM AND METHOD FOR SECURE ACCESS

The present invention provides a method and system for secure access to computer equipment. An embodiment includes a secure access controller connected to a link between a transceiver (such as a modem) and the computer equipment. Public and private keys are used by the secure access controller and a remote user. The keys are provided to the secure access controller by an authentication server. Once the transceiver establishes a communication link with the user, the access controller uses these keys to authenticate packets issued by the user to the computer equipment. If the packet is authenticated, the access controller passes the packet to the computer equipment. Otherwise, the packet is discarded. Another embodiment includes a secure access controller having a plurality of ports for connection to a plurality of different pieces of computer equipment. The secure access controller thus intermediates communications between the modem and the plurality of different pieces of computer equipment ...

METHOD AND SYSTEM FOR SECURE PROCESSING OF AUTHENTICATION KEY MATERIAL IN AN AD HOC WIRELESS NETWORK

A method and system for secure processing of authentication key material in an ad hoc wireless network enables secure distribution of the authentication key material between a mesh authenticator (110) and a mesh key distributor (115), which may be separated by multiple wireless links. The method includes deriving a pairwise transient key for key distribution (PTK-KD) using a mesh key holder security information element (MKHSIE). A mesh authenticator pairwise master key (PMK-MA) is then requested using a first mesh encrypted key information element (MEKIE) that includes data origin information. Using the pairwise transient key for key distribution (PTK-KD), a second mesh encrypted key information element (MEKIE) is then decrypted to obtain the mesh authenticator pairwise master key (PMK-MA).

METHOD AND APPARATUS FOR ESTABLISHING SECURITY ASSOCIATIONS BETWEEN NODES OF AN AD HOC WIRELESS NETWORK

A method and apparatus for establishing security associations between nod es of an ad hoc wireless network includes two authentication steps: an initi al first contact step (authentication, authorization, and accounting (AAA)-b ased authentication), and a "light-weight" step that reuses key material gen erated during first contact. A mesh authenticator within the network provide s two roles. The first role is to implement an 802.1X port access entity (PA E), derive transient keys used for encryption with a supplicant mesh point v ia a four-way handshake and take care of back end communications with a key distributor. The second role is as a key distributor that implements a AAA-c lient and derives keys used to authenticate a mesh point during first contac t or fast security association. The key distributor and the on-line authenti cation server can communicate to one another without these messages being tr ansported over mesh links.

TERMINAL ACTIVATION METHOD

L'invention concerne un procédé d'activation par un opérateur d'un terminal (4), l'activation du terminal permettant des échanges d'informations sécurisés entre le terminal (4) et un serveur sécurisé, caractérisé en ce qu'il comprend les étapes suivantes pour le terminal (4) : - recevoir de l'opérateur (2) une première information d'activation, - recevoir d'un serveur d'habilitation (3) une deuxième information d'activation, - utiliser les première et deuxième informations d'activation pour activer le terminal.

SECURE METHOD FOR LOADING SERVICE ACCESS DATA IN AN NFC CHIPSET

L'invention concerne un procédé de chargement sécurisé de données dans un premier processeur hôte sécurisé (HP3) d'un système NFC (Chipset) comportant un circuit d'interface NFC d'émission et de réception de données, permettant d'accéder à un service, le procédé comprenant des étapes consistant à : générer une donnée secrète (SSK), transmettre la donnée secrète au premier processeur hôte par l'intermédiaire d'une liaison sécurisée, chiffrer des données (APP, DATA) à charger dans le premier processeur hôte en utilisant une clé publique (NPK) du premier processeur hôte, et transmettre les données chiffrées au système à destination du premier processeur hôte qui déchiffre les données à l'aide d'une clé privée (NSK) correspondant à la clé publique.

METHOD FOR MANAGING AUTHORIZATIONS IN AN ARRANGEMENT HAVING MULTIPLE COMPUTING SYSTEMS

The invention relates to a method for managing authorizations on an arrangement having multiple computer systems, wherein a first computer system (105) produces a first data packet, which is used to identify a user, and produces a second data packet, which indicates an authorization of the user, the second data packet being produced on the basis of the first data packet. The two data packets are provided with a signature and transmitted to a user computer system (101). A function on an application system (100), which is different from the user computer system (101), is enabled after the following steps are performed: receipt of the first and second data packets from the user computer system (101), a check to determine whether the user computer system (101) is authorized to use the first data packet, a check to determine whether the first and second data packets are provided with a valid signature, a check to determine whether the first and second data packets are associated, and a check ...

DISTRIBUTED WHITE LIST FOR SECURITY RENEWABILITY

To provide for security and robustness in distribution of high value video content such as UHD video, a white list is provided that does not grant default access to content like a revocation listing does, but rather forces a software update on potentially compromised devices to bring them back into copy protection compliance, eliminating, e.g., the use of certain outputs that have been compromised. Prior to outputting content, a source device determines whether the receiving device is on a white list, whether the output is still valid, whether the version number of the receiving device is still valid, and that the receiving device does not have insecure outputs on which it could re- output content.

SYSTEMS AND METHODS FOR SECURE REMOTE DATA RETRIEVAL FOR KEY DUPLICATION

A system for storing key information for duplicating a key includes a kiosk comprising a key identification module. After identifying key blank and bitting pattern information for one or more master keys associated with a user, the kiosk receives a user request to store the identified key information on a remote device associated with the user. Upon verification of the user's identity, the kiosk may encrypt the identified key information, and transmit it to the remote device for storage. On a future visit, upon verification of the user's identity, a kiosk comprising a key identification module and a key cutting module may receive and decrypt the previously stored key information from the remote device. The kiosk may cut the key for the user via the key cutting module based on the previously stored key information.

TIERED KEY COMMUNICATION SYSTEM AND METHOD IN SUPPORT OF CONTROLLED VENDOR MESSAGE PROCESSING

A computer-implemented system processes secure electronic documents from one or more content providers in accordance with subscriber instructions has a processor and modules operative within the processor. A monitoring module obtains a provider GUID, a subscriber GUID, and a transaction ID from public metadata associated with a transaction received from a particular content provider. A determination module determines any designees of the subscriber and contact information one or more of the subscriber and any designees. A transaction module distributes a transaction addressed to at least one of the subscriber and any designees. Each distributed transaction includes data that is used for management, tracking, and alerting. Also described is a station for constructing transactions for distribution to subscribers through such a system, and management of local-advertising to users of such a system. An end-to-end system and method are described.

METHOD AND APPARATUS FOR SECURING NETWORK COMMUNICATIONS

A verifier (20) for verifying the authenticity of a communication sent via a communications network from a first network component (10) to a second network component (1000) including input means/apparatus arranged for receiving via the communications network an encrypted communication from a said first network component. The verifier has key means/apparatus operable to issue to a said second network component a key associated with the first network component on condition that the verifier has verified the encrypted communication to be decryptable using said key thereby to enable the second network component to decrypt encrypted communications from the first network component sent independently of the verifier apparatus.

SECURE AND EFFICIENT LOGIN AND TRANSACTION AUTHENTICATION USING IPHONESTM AND OTHER SMART MOBILE COMMUNICATION DEVICES

To authenticate a user of a mobile communication device for login or transaction authorization, a first application on the device directs transmission of a request for authentication of the user to a security server. A second application on the device receives the request for authentication from the security server and directs presentation of the received request for authentication to the user by the device. The second application receives a user input to the device indicating that the requested authentication should proceed and in response directs transmission of an indication that the requested authorization should proceed, to the security server. In response to this latter transmission, the second application receives a PIN from the authentication server. The first application directs transmission of the PIN received by the second application to the network site, which validates the transmitted PIN, in order to authenticate the user or the transaction to the network site.

MUTUAL MOBILE AUTHENTICATION USING A KEY MANAGEMENT CENTER

A system, method, and server computer configured to authenticate a consumer device. The consumer device is authenticated via a mobile gateway using challenge-response authentication. If the consumer device is successfully authenticated, a secure channel is established between the consumer device and a first entity. The secure channel allows for secure communication between the consumer device and the first entity.

TERMINAL IDENTITY VERIFICATION AND SERVICE AUTHENTICATION METHOD, SYSTEM AND TERMINAL

Disclosed is a terminal identity verification and service authentication method, comprising: after initiating a service request, a terminal generates a unique user code according to the specific user information in a SIM card, encrypts the name of the specific user information, and transmits the specific user information together with the unique user code to a trusted cloud control center; a service provider generates a unique code according to the specific information thereof, and transmits the name of the encrypted specific information thereof together with the generated unique code to the trusted cloud control center; the trusted cloud control center conducts authentication on the terminal and the service provider according to the unique code, and transmits a communication code to the terminal and the service provider when the terminal and the service provider both pass authentication; and the terminal and the service provider communicate according to the communication code to complete ...

APPARATUS AND METHOD FOR ESTABLISHING A CRYPTOGRAPHIC LINK BETWEEN ELEMENTS OF A SYSTEM

A secure cryptographic network is established among operational units in a system. A public key cryptosystem is initially used to establish secure communication links. Then, each secure communication link will be provided with a unique private encryption key from a private key cryptosystem. Every operational unit in the system will comprise a secure chip integrated circuit. These secure chips will comprise a programmable processor and a read--only memory. A plurality of personalization stations are used to provide each secure chip with a public/private encryption or signature key pair. The secure chips will execute a program from the read-only memory on the secure chips to verify that the public/private key pair has been received from an authorized source. Each secure chip will also be provided with a chain of authentication certificates originating from a trusted authority. The public signature key of the trusted authority will be programmed into the read-only memory of the secure chip ...

Automatic order or delivery confirmation method - using credit card office to transfer order received from source to order point so that PIN number not disclosed

The order or delivery confirmation method involves using transmission of a credit card identification code, together with a corresponding PIN number to the credit card central office (K), at which the validity of the source (G) is verified, before the order is transferred via a telephone link to the order point (N). A telephone confirmation is obtained between the order point and the source, before the order is dispatched. Pref. the subscriber station (1-3) at the order source (G) has an integrated printer providing a print-out of the order for written confirmation. ADVANTAGE - Prevents PIN code being freely accessible.

Authenticated cryptographic key exchange in digital subscriber network - using preliminary phase of multiplication in finite galois field with random number selection for public key

The subscribers (A,B etc.) are connected to a key distribution centre (SVZ) for the preauthentication phase in which they signal their identities in accordance with the El Gamal scheme. The centre selects a Galois field GF(q) and a primitive (alpha) which is raised to the power of a negative random number (x) to form the public part of the key. In the following exchange phase two subscribers produce a common secret key by a modified Diffie-Hellmann method. ADVANTAGE - Flexible enough for extension to new and individually distinguishable subscribers, and requires little memory capacity.

EXCHANGE ON BASE OF BLOKChEINA WITH TOKENIZATsIEI

Information security transmission system

Provided herein is an information security transmission system, comprising a first information equipment and a second information equipment, wherein the first information equipment can obtain at least one certification data, connecting to the second information equipment through a network for processing an information transmission, accordingly, a key pair used for encryption/decryption can be obtained through the certificate authority or that can be obtained without the certificate authority selectively, such that the information transmission security channel can be established and the data transmission security can be ensured. The first information equipment and the second information equipment respectively comprises a first dynamic codec and a second dynamic codec for processing a coding/decoding process depending on a dynamic code book, furthermore, an automatic error detecting mechanism and an error correcting mechanism can be associated for ensuring the data transmission security and the data correction especially at one time transmission.

Relay device, wireless communications device, network system, program storage medium, and method

A relay device first uses latest authentication data to determine whether request-authentication data transmitted from a wireless communications device is valid. If the latest authentication data is used to determine that the request-authentication data is valid, the relay device carries out relayed communications with the wireless communications device. If the latest authentication data is used to determine that the request-authentication data is invalid, the relay device next uses a former authentication data to determine whether the request-authentication data is valid. If the former authentication data is used to determine that the request-authentication data is valid, the relay device provides the wireless communications device with the latest authentication data to update authentication data in the wireless communications device.

Method and system for a real-time interactive web/media-based electronic new or remote hire document processing system interfaced/interlink to an employer authorized distal/remote notaries public or 3rd party agent

Disclosed is an interactive web based method and system facilitating an employee to virtually and electronically process their employee eligibility verification and certification with a live remote Notary Public or authorized third party agent; comprising on demand functionality implementing web-based appointment booking, on-line payment platform, secure web based interactive videoconferencing communication 42 in real-time, digital webcam, real-time identification authenticating, digital video secure socket layer signing certificate, secure digital and annotating signing, network document delivery system, and secure archive. Method and system for a real-time interactive web/media based electronic new or remote hire document processing system interfaced/interlinked to an employer authorized distant/remote notaries public or 3 rd party agent.

Method and system for optimizing authentication procedures in media independent hanodver services

A method and system for establishing security association mechanism between a Mobile Node (MN) and a plurality of Point of Services (PoS) are provided. The method includes sending a first request from primary PoS to secondary PoS. The primary PoS then receives a first response along with a derived first key. The first key is derived at the secondary PoS. The method further includes receiving a second request from the MN at the primary PoS. The method then derives a second key based on a MN identity and the derived first key. Thereafter, the method sends a second response along with a second key from the primary PoS to the MN. Further, the method establishes communication between the MN and secondary PoS based on the second key received by the MN and the second key generated at the secondary PoS.

Privacy-Preserving Metering

Privacy protecting metering is described such as for electricity, gas or water metering, metering use of cloud computing resources, traffic congestion charging and other metering applications. In examples, fine grained user consumption data is kept private and not disclosed to a provider of a resource consumed by the user. In examples, a bill generator receives certified meter readings and a certified pricing policy and generates a bill which omits fine grained user consumption data. For example, the bill generator generates a zero knowledge proof that the bill is correct and sends that proof to a provider together with the bill. In examples a provider is able to check that the bill is correct using the zero knowledge proof without finding out the user's private consumption data. In an embodiment the pricing policy is stored as signed rows of a table to enable efficient generation of the zero knowledge proof.

Mobile out-of-band authentication service

Certain embodiments enable authentication of an application session at a client machine by using authentication values and user-identification values that are received from a mobile communication device. The mobile communication device provides an out-of-band channel for validating the session and enables secure authentication for a variety of applications.

Secure cloud computing system

The present invention provides a method and apparatus for securing electronic systems, including computers, information appliances and communication devices. The invention in question addresses the problem of preventing compromise by severe attacks directed at the protected systems. A severe attack could mean any of the following: low level debugging, use of in-circuit emulators or logic analyzers, removal of silicon dice and inspection including by lapping and micro-photography, and other well-known methods of attack such as distributed denial of service. In order to protect systems and data from such severe attacks, a mechanism is required whose operation is irreparably altered by the attempt to understand its operation through such attacks. Moreover, the mechanism must cease operation instantly upon detection of any intrusion associated with an attack, whether by software or by hardware based means.

Method and devices for secure communications in a telecommunications network

A secure communications method is provided for use in a telecommunications network, wherein a transaction between an entity A and an entity B of the network comprises: entity A sending an authorization request to an Authorization Server S, in which request the entity A identifies itself and authenticates itself; the entity A declares to the Authorization Server its intention to communicate with a certain entity B; the Authorization Server determines a secret key that it shares with the entity B; the Authorization Server generates a session key and sends it to the entity A; the session key being a one-way function of the secret key and also being a function of an integer (transaction number) allocated to the transaction; the Authorization Server also generates a transaction identifier that is a function depending at least on the transaction number in non-invertible manner.

Location verification in quantum communications

Methods and systems for verifying the location of a communication transceiver using quantum communication channels are described. Communications transceivers at different known locations are used having a secure channel therebetween to verify the location of the communication transceiver at a location to be verified using entangled particles transmitted using the quantum communication channels.

Digital works having usage rights and method for creating the same

Digital work adapted to be distributed within a system for controlling at least one of the distribution and use of digital works. The digital work includes digital content representing a portion of a digital work suitable for being rendered by a rendering device and usage rights associated with the digital content. The usage rights specify a manner of use indicating one or more stated purposes for which the digital work can be at least one of used and distributed by an authorized party.

Digital works having usage rights and method for creating the same

Digital work adapted to be distributed within a system for controlling at least one of the distribution and use of digital works. The digital work includes digital content representing a portion of a digital work suitable for being rendered by a rendering device and usage rights associated with the digital content. The usage rights specify a manner of use indicating one or more stated purposes for which the digital work can be at least one of used and distributed by an authorized party.

Authentication method and apparatus in a communication system

An authentication method and apparatus in a communication system are provided. In a method for authenticating a first node at a second authentication server in a communication system comprising the first node registered to a first authentication server and a second node registered to the second authentication server, an authentication request message requesting authentication of the first node is received from the second node, the authentication request message is transmitted to the first authentication server, and upon receipt of an authentication success message indicating successful authentication of the first node from the first authentication server, the authentication success message is transmitted to the second node.

System and methods for identity attribute validation

A method of identity attribute validation at a computer server involves the computer server receiving an identity attribute validation request from a communication terminal. The computer server further receives a credential, and is configured with an attribute disclosure profile of attributes authorized for disclosure to the communication terminal. The computer server determines the validity of the credential, and provides the communication terminal with a response to the identity attribute validation request based on an outcome of the credential validity determination. The attribute validation response includes attributes data associated with the credential authorized for disclosure by the attribute disclosure profile but excludes attributes data associated with the credential not authorized for disclosure by the attribute disclosure profile.

Virtual account based new digital cash protocols

Virtual account based digital cash protocols employ two pairs of private and public keys. Each public key is certified separately and the protocols do not use any blind signature schemes. As a result, the virtual account based digital cash protocols provide strong protection of the user privacy by using two certified public keys instead of a blind signature. One pair of certified keys consists of one master user private key and one master user public key. A second pair of certified keys consists of one pseudonym user private key and one pseudonym user public key. The use of a master key pair and a pseudonym key pair circumvents the need for blind signatures. As a result, the proposed protocols do not require blind signatures and do not add additional overhead and security requirements necessitated by conventional blind signature schemes. The protocols use public key protocols, digital signatures and symmetric key protocols, which may be readily implemented in standard information security based systems based on cryptographic constructs. In addition, the protocols may be deployed in mobile, off-line, and on-line settings.

Systems and methods for generating modular security delegates for applications

Embodiments of the present teachings relate to systems and methods for generating modular security delegates for application instances, including, for example, applications usable on physical machines, virtualized environments, in the cloud, etc. According to embodiments, in a multiple network environment, multiple machines (or clients) can be configured, each having a defined security level. Each machine can include a plurality of application instances and corresponding security delegates for various defined security levels. For example, the defined security levels can be based on various authentication mechanisms, including, Kerberos, NT Lan Manager (NTLM) authentication protocol, secure sockets layer/transport security layer (SSL/TSL), token authentication, virtual private network (VPN), remote access security (RAS), digest authentication, etc.

Encryption information transmitting terminal

The communication unit transmits and receives a communication message. The authentication processor performs an authentication process for establishing the network connection by transmitting and receiving an authentication message to and from an authentication server through the communication unit. The encryption information generator generates an encryption key shared with the authentication server when the authentication process is successfully completed. The first message generator generates a first communication message instructing the destination device to acquire the encryption key from the authentication server. The second message generator generates a second communication message including data to be transmitted to the destination device. The communication unit transmits the first communication message to the destination device, encrypts the second communication message with the encryption key, and transmits an encrypted second communication message to the destination device.

User impersonation/delegation in a token-based authentication system

A “trusted service” establishes a trust relationship with an identity provider and interacts with the identity provider over a trusted connection. The trusted service acquires a token from the identity provider for a given user (or set of users) without having to present the user's credentials. The trusted service then uses this token (e.g., directly, by invoking an API, by acquiring another token, or the like) to access and obtain a cloud service on a user's behalf even in the user's absence. This approach enables background services to perform operations within a hosted session (e.g., via OAuth-based APIs) without presenting user credentials or even having the user present.

Methods to authenticate access and alarm as to proximity to location

Methods for authenticating access and providing positional awareness using mobile phones. Embodiments for authenticating access include receiving identification indicia from a person seeking access, sending a message to a person having authority for access, and receiving either a second message indicating that the person has taken an affirmative action to indicate authorization, or a password that was provided in the first message. Access may be computer access or physical access, as examples. Methods of providing positional awareness include obtaining or storing location coordinates, monitoring the location of a mobile phone, and providing an alarm, for example, through a second mobile phone. In a number of embodiments, location coordinates are automatically obtained from Internet websites. In some embodiments, parents can monitor the location of their children to make sure they do not get too close to a reported residence of a registered sex offender, for instance.

Dnssec signing server

Systems and methods for performing DNSSEC signing are described in which digital signature operations may be performed by a network accessible signing server that is configured to interact with a separate client application. Exemplary methods may include receiving a signing request at the signing server from the client application to sign first data. The signing server may determine an active KSK and/or an active ZSK for the first data. The first data may then be transmitted by the signing server to a digital signature modules, which may include, for example, a hardware support module, or software signing applications. The signing server may receive a digitally signed version of the first data from the digital signature module, and provide the signed first data to the client application.

Single sign-on between applications

A single sign-on (SSO) system uses simple one-to-one trust relationships between individual applications and an SSO service to extend log in services from one application to another. Each application retains its own login policies and can separately make a decision whether to trust the SSO request or challenge the user for login credentials. By structuring the SSO system to use simple identity mapping, there is no requirement for consolidating user identity records from multiple applications into a single database with its attendant overhead and dependency risks.

Maintaining privacy for transactions performable by a user device having a security module

A method and system for maintaining privacy for transactions performable by a user device having a security module with a privacy certification authority and a verifier are disclosed. The system includes an issuer providing an issuer public key; a user device having a security module for generating a first set of attestation-signature values; a privacy certification authority computer for providing an authority public key and issuing second attestation values; and a verification computer for checking the validity of the first set of attestation signature values with the issuer public key and the validity of a second set of attestation-signature values with the authority public key, the second set of attestation-signature values being derivable by the user device from the second attestation values, where it is verifiable that the two sets of attestation-signature values relate to the user device.

System and method for utilizing content in accordance with usage rights

Apparatus, method, and media for utilizing content. An exemplary method comprises storing a description structure comprising one or more usage rights, storing content associated with the one or more usage rights, receiving a request for the content, the request corresponding to a utilization of the content, determining whether the utilization corresponds to at least one of the one or more usage rights, determining whether the computing device is an authorized device, and utilizing the content in accordance with the at least one of the one or more usage rights based at least in part on a determination that the utilization corresponds to the at least one of the one or more usage rights and a determination that the computing device is an authorized device.

Peer-to-Peer Trusted Network Using Shared Symmetric Keys

A unique, strong, shared, symmetric network-wide key (or a limited number of group-wide keys) is generated by a central authority and initially provisioned to nodes in a network, which use it for ensuing traffic encryption. Nodes establish trust by sending each other authentication messages encrypted with the shared secret key, and thereupon adding each other to their respective trust lists. Also, an optional rekeying scheme whereby an existing shared secret key can be replaced by a new secret key that is introduced by the central authority and automatically propagated from node to node through the network.

Method and system for encryption of messages in land mobile radio systems

A method and system for authentication of sites in a land mobile radio (LMR) system and encryption of messages exchanged by the sites. In some embodiments, the method includes transmitting a certificate created by a trusted authority by applying a function to a first site public key using the trusted authority's private key to generate a reduced representation, which is encrypted with the trusted authority's private key. Other sites may receive the certificate, decrypt it using the trusted authority's public key, and authenticate the first site. The method may further include generating a session key, encrypting it with the public key of the first site, and transmitting the encrypted session key to the first site. The first site decrypts the encrypted session key with the first site's private key, and transmits a message encrypted with the shared session key to other sites for decryption using the session key.

Near-field communication based payment methods

A method of performing a payment transaction is provided. Transaction information is received from a payee, which has been provided to the payee by a payor using near-field communications and includes a payment amount and payee account information. A transaction authentication request is sent to the payor, and, after a transaction authentication is received from the payor, the payment amount is sent to the payee. After the payment has been completed, a payment confirmation is sent to the payor. A method for processing a payment transaction using a generated remittance key is also provided. The remittance key, which includes an encrypted alphanumeric key having a payment amount and payment provider account information for a payor, is generated and transmitted to a payee who, in turn, transmits the remittance key to a remittance agent. The remittance agent transmits the remittance key and a payment request to a payment provider who processes the request and transmits a payment to the payee.

Url-based certificate in a pki

A method of requesting and issuing a certificate from certification authority for use by an initiating correspondent with a registration authority is provided. The initiating correspondent makes a request for a certificate to the registration authority, and the registration authority sends the request to a certificate authority, which issues the certificate to the registration authority. The certificate is stored at a location in a directory and this location is associated with a pointer such as uniform resource locator (URL) that is derived from information contained in the certificate request. The initiating correspondent computes the location using the same information and forwards it to other corespondents. The other correspondents can then locate the certificate to authenticate the public key of the initiating correspondent.

SYSTEMS AND METHODS FOR SECURING NETWORK COMMUNICATIONS

Secure communications may be established amongst network entities for performing authentication and/or verification of the network entities. For example, a user equipment (UE) may establish a secure channel with an identity provider, capable of issuing user identities for authentication of the user/UE. The UE may also establish a secure channel with a service provider, capable of providing services to the UE via a network. The identity provider may even establish a secure channel with the service provider for performing secure communications. The establishment of each of these secure channels may enable each network entity to authenticate to the other network entities. The secure channels may also enable the UE to verify that the service provider with which it has established the secure channel is an intended service provider for accessing services. 1. In a system comprising a user equipment (UE) , a service provider , and an identity provider , a method for establishing secure communications between the service provider and the UE , the method comprising:establishing, at the UE, a secure channel between the UE and the service provider;sending, to the identity provider, authentication parameters for performing an authentication of the UE with the identity provider;determining, at the UE, an authentication assertion that indicates a successful authentication of the UE; andverifying, at the UE, that the service provider with which the secure channel has been established is an intended service provider for performing authentication for access to services, wherein the service provider is verified using at least one parameter generated during the authentication of the UE with the identity provider or during the establishment of the secure channel.2. The method of claim 1 , further comprising binding the authentication of the UE to the establishment of the secure channel.3. The method of claim 2 , wherein the authentication of the UE comprises a Session Initiation ...

System and Apparatus for Facilitating Transactions Between Two or More Parties

The present invention provides a system and apparatus for facilitating a transaction between two or more parties. A server computer is used to determine whether a contact information and an identity validation information of a second party are accurate. Whenever the contact information and the identity validation information of the second party are accurate, one or more documents are modified by attaching and identity validation from a first party and the identity validation from the second party to the one or more documents. 1. An apparatus for facilitating a transaction between two or more parties comprising:a network interface;one or more data storage devices;one or more processors communicably coupled to the network interface and the data storage devices; anda non-transitory computer readable medium encoded with a computer program communicably coupled to the one or more processors to determine whether a contact information and an identity validation information of a second party are accurate, and whenever the contact information and the identity validation information of the second party are accurate, modifying one or more electronic documents by attaching an identity validation from a first party and the identity validation from the second party to the one or more electronic documents.2. The apparatus as recited in claim 1 , wherein the one or more processors further provide the one or more electronic documents from the first party to the transaction.3. The apparatus as recited in claim 1 , wherein the one or more electronic documents contain one or more contractual terms and conditions and a contact information of the first party.4. The apparatus as recited in claim 3 , wherein all the one or more contractual terms and conditions have been agreed to by the first party and are locked against future changes.5. The apparatus as recited in claim 1 , wherein the one or more processors further provide the modified one or more electronic documents to each party.6. ...

Method and system for sending a message through a secure connection

The method and system enable secure forwarding of a message from a first computer to a second computer via an intermediate computer in a telecommunication network. A message is formed in the first computer or in a computer that is served by the first computer, and in the latter case, sending the message to the first computer. In the first computer, a secure message is then formed by giving the message a unique identity and a destination address. The message is sent from the first computer to the intermediate computer after which the destination address and the unique identity are used to find an address to the second computer. The current destination address is substituted with the found address to the second computer, and the unique identity is substituted with another unique identity. Then the message is forwarded to the second computer.

Updating data stored in a dispersed storage network

A method begins by a dispersed storage (DS) processing module receiving a modified data object, wherein the modified data object is a modified version of a data object and the data object is divided into a plurality of data segments and stored in the DSN. The method continues with the DS processing module mapping portions of the modified data object to the plurality of data segments that includes creating a middle data segment of a second plurality of data segments based on a corresponding middle data segment of the plurality of data segments when the a portion of the portions corresponds to middle data of the modified data object. The method continues with the DS processing module encoding the middle data segment using a dispersed storage error coding function to produce an encoded data segment and overwriting the corresponding middle data segment with the encoded data segment in the DSN.

System and method for intelligence based security

Included in the present disclosure are a system, method and program of instructions operable to protect vital information by combining information about a user and what they are allowed to see with information about essential files that need to be protected on an information handling system. Using intelligent security rules, essential information may be encrypted without encrypting the entire operating system or application files. According to aspects of the present disclosure, shared data, user data, temporary files, paging files, the password hash that is stored in the registry, and data stored on removable media may be protected.

Timestamp-based token revocation

A token used when a first device authenticates itself to a third device may be associated with a token issue timestamp. Upon receipt of an indication that all previously issued tokens are to be revoked, a second device may store a revocation timestamp. Upon receiving, from the second device, a request for establishing conditions for a file transfer, from the first device, and an indication of a token issue timestamp associated with the request, the second device may compare the token issue timestamp to the revocation timestamp. Responsive to determining, based on the comparing, that the token issue timestamp precedes the revocation timestamp, the second device may deny the request.

SPS Authentication

Method and apparatus for SPS authentication, for example for use with GPS, are disclosed. The method may include receiving a first set of Y codes from a plurality of satellites, generating authentication decisions using W code estimates extracted from the first set of Y codes for satellite channels corresponding to the plurality of satellites, and generating an authentication response according to authentication decisions generated for the satellite channels.

Method and System for Transmitting Control Data in a Manner that is Secured Against Manipulation

A method and system for detecting manipulation when control data are transmitted from a first control unit to a second control unit via a network, which includes generating integrity check information data for the control data transmitted by the first control unit via an integrity check generating unit on the transmitter side, calculating a cryptographic checksum for the integrity check information data generated on the transmitter side via the integrity check generating unit, transmitting the integrity check information data and the cryptographic checksum to an integrity check verifying unit that verifies the cryptographic checksum on the receiver side, generating integrity check information data on the receiver side for the control data received by the second control unit using the integrity check verifying unit, and comparing the integrity check information data and the integrity check information data with the cryptographic checksum to detect the manipulation of the transmitted control data.

SYSTEM AND METHOD FOR PROVIDING SECURITY IN MOBILE WiMAX NETWORK SYSTEM

A method for providing security between a radio access station and an access control router in a mobile microwave access network includes: receiving, by the radio access station and the access control router, the same certificate from a licensed certification authority; generating, by the access control router, an access service network traffic encryption key (asn_TEK); encrypting, by the access control router, a message to be transmitted with the generated asn_TEK and transmitting the encrypted message to the radio access station; verifying, by the radio access station, the certificate of the licensed certification authority appended to the message received from the access control router to check the asn_TEK, and decrypting the message received from the access control router to obtain an actual message; encrypting, by the radio access station, the actual message with the checked asn_TEK and transmitting the encrypted message to the access control router.

User Identity Management and Authentication in Network Environments

Systems, devices, and methods for sending, by a first computing device to a second computing device, a set of authentication information; determining, by the second computing device, a globally unique identifier associated with the set of authentication information; determining, by the first computing device, a set of properties associated with the received request based on the determined globally unique identifier; and establishing, by the first computing device, a communication channel to the second computing device, wherein the communication channel is established based on the determined set of properties.

Jump to Collaborator Cursor

Various features and processes related to document collaboration are disclosed. In some implementations, animations are presented when updating a local document display to reflect changes made to the document at a remote device. In some implementations, a user can selectively highlight changes made by collaborators in a document. In some implementations, a user can select an identifier associated with another user to display a portion of a document that includes the other user's cursor location. In some implementations, text in document chat sessions can be automatically converted into hyperlinks which, when selected, cause a document editor to perform an operation.

Implementation process for the use of cryptographic data of a user stored in a data base

A security module (“SM”) implements user cryptographic data by means of a user terminal. The cryptographic data is encrypted by a first encryption key established from a secret key from the terminal and the user's authentication element and by a second encryption key specific to the SM. An authentication is performed between the SM and the terminal, based on an asymmetric cryptographic protocol, and, in the event of a positive authentication of the SM and the terminal, an authentication of the SM and the user is performed. In the event of positive authentication between the SM and the terminal and between the SM and the user, the SM obtains the user's cryptographic data, and the terminal calculates the first encryption key and sends the first encryption key to the SM. The user's cryptographic data is decrypted by the SM using the second encryption key and then the first encryption key.

SECURE MECHANISMS TO ENABLE MOBILE DEVICE COMMUNICATION WITH A SECURITY PANEL

A method of arming or disarming a building security system includes transferring an electronic security credential file from an authorizing environment to a mobile computing device. The electronic security credential file is read by the mobile computing device to extract authentication data. The authentication data is transmitted from the mobile computing device and received at the building security system. Within the building security system, the authentication data is used to verify that a user of the mobile computing device is authorized to communicate with the building security system. The mobile computing device is enabled to communicate with the building security system only if the electronic security credential file has been used to verify that a user of the mobile computing device is authorized to communicate with the building security system. 1. A method of operating a building security system , comprising the steps of:transferring an electronic security credential file from an authorizing environment to a mobile computing device;reading and interpreting the security credential file within a software application executing on the mobile computing device;receiving from the mobile computing device at a building security system a communication including authentication data transmitted in the electronic security credential file;within the building security system, using the authentication data to verify that a user of the mobile computing device is authorized to communicate with the building security system; andenabling the mobile computing device to communicate with the building security system only if the authentication data stored in the electronic security credential file has been used to verify that a user of the mobile computing device is authorized to communicate with the building security system.2. The method of claim 1 , wherein the electronic security credential file is electronically transferred from the authorizing environment to the mobile computing ...

Clustered aaa redundancy support within a radius server

In general, techniques are described for supporting interchassis redundancy (ICR) by a plurality of network access servers (NASes) that are members of an ICR. For example, techniques may be used to associate, within a RADIUS server, multiple NAS identifiers for the NASes with a single NAS identifier alias. The RADIUS server is configured to handle RADIUS protocol messages from any member of the ICR cluster as though the RADIUS protocol messages issued from a single NAS having the NAS identifier alias.

Integrating Server Applications with Multiple Authentication Providers

Online and on-premise applications identify trusted authentication providers. The applications are configured with a list of trusted issuers of authentication credentials. When an application receives a request requiring authentication, the application returns a 401 response that includes the trusted issuer list. The requesting application compares the trusted issuer list from the 401 response to its own list of authentication providers. If there is a match between the two lists, then the requesting application creates a self-issued token for the authentication provider. The authentication provider uses the self-issued token to generate an authentication token for the requesting application. The requesting application may also directly create a token for a target partner application, without an authentication provider, if there is a direct trust between the two applications.

Apparatus, methods, and computer program products providing dynamic provable data possession

In one exemplary embodiment, a method includes: storing data for a file, organized as blocks, each having a portion of the file; and maintaining a skip list for the data. The skip list is an ordered tree structure having a root node, internal nodes and leaf nodes. Each leaf node corresponds to a block. Each node has a rank value corresponding to size of a subtree rooted at the node. The skip list employs a hashing scheme. The hash value of the root node and internal nodes is computed from a level of the node, the rank value and an interval between the node and another linked node to the right of or below the node. The hash value of the leaf nodes is computed from a level of the node, the rank value and an interval associated with the node.

Protecting privacy of shared personal information

Methods and apparatus are described to protect personal information by decoupling it from user identity. According to specific embodiments, this is accomplished by associating each user with an anonymous token that is decoupled from the user's identity. Personal information (e.g., a user's physical or geographic location) is stored in association with this anonymous token, with no apparent connection to the user. Those allowed to access the personal information—including the owner himself—are granted the ability through a variety of mechanisms to connect the anonymous token back to the owner. The personal information can then be retrieved by locating the data stored in association with the anonymous token in the data store.

APPARATUSES, SYSTEMS, AND METHODS FOR RENEWABILITY WITH DIGITAL CONTENT PROTECTION SYSTEMS

In one embodiment of the invention, a format for renewability content (e.g., a System Renewability Message (SRM)) corresponding to a content protection protocol (e.g., High-Bandwidth Digital Content Protection (HDCP)) may be interoperable with devices that are compliant with different versions of the standard (e.g., HDCP1.x and 2.x devices) and that include different amounts of storage for the renewability content (e.g., first and second generation devices). 1. An apparatus comprising:a processor to process privilege renewability content, wherein (a) the system is to transfer protected content to a receiver device and (b) the renewability content is to include first and second type renewability content portions that respectively comprise first and second unique privilege-revoked identifiers for receiver devices; anda memory, coupled to the processor, to store the first portion but not the second portion based on whether the system is a first type system, wherein first type devices have less memory capacity to store privilege renewability content than second type devices.2. The apparatus of claim 1 , wherein the processor is to:obtain a unique first identifier for a first receiver device compliant with a version of a content protection protocol;obtain a unique second identifier for a second receiver device compliant with another version of the content protection protocol; andsend the protected content from the system to both receiver devices based on determining the first and second identifiers are not included in the privilege renewability content.3. The apparatus of claim 2 , wherein the system and first and second receiver devices are included in a heterogeneous claim 2 , multi-type HDCP system.4. The apparatus of claim 1 , wherein the processor is to: (a) separate the first portion from the second portion based on the system being a first type system claim 1 , and (b) store the separated first portion in the memory but not the second portion.5. An article ...

Method of performing a financial transaction via unsecured public telecommunication infrastructure and an apparatus for same

A method of performing a financial transaction via unsecured public telecommunication infrastructure comprising collecting data relating to a specified financial transaction type; building a transaction token including collected data and/or data derived from the collected data; encrypting the transaction token; creating a financial transaction protocol message incorporating the encrypted transaction token as dependent on a selected transport channel through which the message is to be conveyed; and conveying the financial transaction protocol message using the selected transport channel and by way of the unsecured public telecommunication infrastructure to a destination where the financial transaction protocol message will be further processed is disclosed.

Systems and methods for generating and authenticating one time dynamic password based on context information

The invention relates to a system and method for generating and authenticating one time dynamic password based on the context information related to a user. It involves retrieving user context information and generating a dynamic value based on that. The first one time dynamic password is generated at the user device using the first dynamic value and the user PIN. The first dynamic value along with the user identifier is sent to the authentication server. The authentication server sends the user identifier to the context management server. The context management server has access the context information used to generate the first dynamic value and based on that they generate a second dynamic value. The authentication server receives this value and generates the second one time dynamic password and if it matches with the first one time dynamic password then the authentication server authenticates the first one time dynamic password.

Method and system for traffic engineering in secured networks

Aspects of a method and system for traffic engineering in an IPSec secured network are provided. In this regard, a node in a network may be authenticated as a trusted third party and that trusted third party may be enabled to acquire security information shared between or among a plurality of network entities. In this manner, the trusted third party may parse, access and operate on IPSec encrypted traffic communicated between or among the plurality of network entities. Shared security information may comprise one or more session keys utilized for encrypting and/or decrypting the IPSec secured traffic. The node may parse IPSec traffic and identify a flow associated with the IPsec traffic. In this manner, the node may generate and/or communicate statistics pertaining to said IPSec secured traffic based on the flow with which the traffic is associated.

Intercepting key sessions

In some implementations, a method for providing a session key to a third party includes identifying a private key associated with a public key certificate in response to an event. A session key for a communication session is based, at least in part, on the private key, an associated seed for a random number generator, and public keys assigned to user equipment participating in the communication session. The private key associated with the public key certificate is automatically transmitted to an interception authority. The interception authorities are configured to grant a third party access to the private key and the associated seed to in response to a request from a third party authorized to access the communication session.

SYSTEM AND METHOD FOR AUTHENTICATION OF A COMMUNICATION DEVICE

A system and method for authentication of a communication device is disclosed. A system that incorporates teachings of the present disclosure may include, for example, a communication device having a controller element to compute a shared secret key based at least in part on a communication device private key and a cryptography algorithm, where the communication device private key is stored in an identity module of the communication device and is unknown to an authentication center, and wherein the communication device is authenticated by the authentication center based at least in part on the shared secret key. Additional embodiments are disclosed. 1. A non-transitory computer-readable storage medium , comprising computer instructions that , when executed by a processor , causes the processor to perform operations comprising:generating an authentication center private key at an authentication center, wherein the authentication center comprises a network proxy including a communication interface for communicating with a gateway that provides voice, video, internet protocol television and data communication services between voice over internet protocol terminals;computing an authentication center public key based at least in part on the authentication center private key and a reference point in a cryptography algorithm;receiving a communication device public key computed by a communication device based at least in part on a communication device private key and the reference point in the cryptography algorithm, wherein the communication device private key is stored in an identity module of the communication device, wherein the communication device private key is provided to the communication device from a third party network, wherein the cryptography algorithm is an elliptic curve algorithm having a base point, wherein the third party network is operated by a single party source, and wherein the authentication center private key, the communication device private key, ...

Anonymous access to a service by means of aggregated certificates

A method of anonymous access to a service, comprising the allocation, by at least one certifying entity, of a plurality of certificates to a user entity, the certificates being calculated on the basis of at least one attribute associated with the user entity, the calculation, by the user entity, of an aggregated certificate on the basis of a plurality of certificates among the certificates allocated to the user entity, the calculation, by the user entity, of a proof of knowledge of the aggregated certificate and a verification, performed by a verifying entity, of at least one of these certificates by means of said proof of knowledge, the access to the service being provided by the verifying entity to the user entity as a function of the result of this verification.

Authentication device, authentication method, program, and signature generation device

Provided is an authentication device including a key setting unit for setting sεK n to a secret key and setting a multi-order polynomial f i (x 1 , . . . , x n ) (i=1 to m) on a ring K and y i =f i (s) to a public key, a message transmission unit for transmitting a message c to a verifier, a verification pattern reception unit for receiving information on one verification pattern selected by the verifier from k (k≧3) verification patterns for one message c, and a response transmission unit for transmitting, to the verifier, response information, among k types of response information, corresponding to the information on the verification pattern received by the verification pattern reception unit, where the response information is information that enables calculation of the secret key s in a case all of the k verification patterns for the message c performed by using the k types of response information have been successful.

SYSTEMS AND METHODS FOR AUTHENTICATING AN ELECTRONIC MESSAGE

Systems and methods are disclosed for authenticating electronic messages. A data structure is generated by a computer server which allows for the authentication of the contents and computer server identity of a received electronic message and provides a trusted stamp to authenticate when the message was sent. Data which can authenticate the message, the computer server identity, and the time the message was sent is included into a data structure which is called an Electronic PostMark (EPM). 131-. (canceled)32. A computer-implemented method for authenticating an electronic message , comprising:receiving, by an authentication server at a predetermined time, a request to authenticate the electronic message and a hash value derived from the electronic message; the hash value;', 'time and date information;', 'branding data from a system registry; and', 'a digital signature generated for the electronic postmark data structure;, 'generating an electronic postmark data structure, the electronic postmark data structure comprising at least one ofstoring a copy of the the electronic postmark data structure in a log file; andsending the electronic postmark data structure to a recipient client.33. The method of claim 32 , further comprising:generating an authorized digital key for the electronic postmark data structure, wherein a recipient can use the authorized digital key to verify the electronic postmark data structure; andsending the digital key to the recipient client.34. The method of claim 32 , further comprising:generating a public digital key for a recipient; andexporting the public digital key to a key authenticator.35. The method of wherein the step of exporting the public digital key to a key authenticator includes using a key authenticator which is one of a key signing authority or a certificate authority.36. The method of claim 32 , further comprising the step of:receiving updates to the time and date information.37. The method of claim 32 , wherein the branding ...

Method and apparatus

A method comprises certifying at least a part of offload configuration information for an application, said application for use in an offload environment.

TRULY ANONYMOUS CLOUD KEY BROKER

Embodiments of systems and methods for providing anonymous cloud encryption are provided. One embodiment of a method for providing anonymous cloud encryption includes communicating an anonymizing token to a key broker. Additionally, the method may include communicating at least one encryption key associated with the anonymizing token to the key broker. The method may also include conducting a secure anonymous transaction with a cloud service using at least one of the encryption keys associated with the anonymizing token. 1. A method comprising:communicating an anonymizing token to a key broker;communicating at least one encryption key associated with the anonymizing token to the key broker; andconducting a secure anonymous transaction with a cloud service using at least one of the encryption keys associated with the anonymizing token.2. The method of claim 1 , wherein conducting a secure anonymous transaction further comprises storing data on a cloud storage facility claim 1 , the data being encrypted using a data encryption key claim 1 , the data encryption key being associated with the anonymizing token.3. The method of claim 1 , further comprising enabling a collaborator to access the cloud service claim 1 , wherein the collaborator is configured to:communicate a second anonymizing token to the key broker;communicate at least one encryption key associated with the second anonymizing token to the key broker; andconduct a secure anonymous transaction with a cloud service using at least one of the encryption keys associated with the second anonymizing token.4. The method of claim 3 , further comprisingcommunicating a collaboration token between the key broker, the client, and the collaborator;communicating at least one collaboration key between the key broker, the client, and the collaborator, the at least one collaboration key being associated with the collaboration token; andfacilitating collaboration in one or more secure anonymous transactions with the cloud ...

TRACING DEVICE AND METHOD

A tracing method performed by a traceability device for validating a process having a purity of steps. During at least one step of the process, there is a step of receiving a marking message sent by a marking device; and a step of determining a new fingerprint as a function of the marking message and of a preceding fingerprint, by using a hash function; and a step of sending a validation message including the most recently determined new fingerprint to a validation device. During at least one step of the process, there is a step of determining an object signature as a function of the marking message by using an asymmetric signature function and a private key of the traceability device associated with a public key of the traceability device, and a step of determining a new fingerprint as a function of the object signature. 1. A tracing method performed by a traceability device for validating a process made up of a plurality of steps , the tracing method comprising:during at least one step of the process:a step of receiving a marking message sent by a marking device; anda step of determining a new fingerprint as a function of said marking message and of a preceding fingerprint, by using a hash function; anda step of sending a validation message including the most recently determined new fingerprint to a validation device;wherein, during said at least one step of the process, said tracing method comprises a step of determining an object signature as a function of said marking message by using an asymmetric signature function and a private key of the traceability device associated with a public key of the traceability device, with the step of determining a new fingerprint comprising determining the new fingerprint as a function of said object signature.2. A tracing method according to claim 1 , wherein the marking message comprises a step public key and a signature of said step public key as performed by a trusted entity claim 1 , the method including a step of storing ...

System and method for enabling unconfigured devices to join an autonomic network in a secure manner

A method in an example embodiment includes creating an initial information package for a device in a domain of a network environment when the device is unconfigured. The method further includes communicating the initial information package to a signing authority, receiving an authorization token from the signing authority, and sending the authorization token to the unconfigured device, where the unconfigured device validates the authorization token based on a credential in the unconfigured device. In more specific embodiments, the initial information package includes a unique device identifier of the unconfigured device and a domain identifier of the domain. In further embodiments, the signing authority creates the authorization token by applying an authorization signature to the unique device identifier and the domain identifier. In other embodiments, the method includes receiving an audit history report of the unconfigured device and applying a policy to the device based on the audit history report.

SYSTEMS AND METHODS FOR VERIFYING UNIQUENESS IN ANONYMOUS AUTHENTICATION

A method for anonymous authentication by an electronic device is described. The method includes obtaining biometric data. The method also includes generating a token. The method also includes blinding the token to produce a blinded token. The method also includes sending the blinded token and biometric information based on the biometric data to a verifier. The method also includes receiving a signature of the blinded token from the verifier if corresponding biometric information is not stored by the verifier. 1. A method for anonymous authentication by an electronic device , comprising:obtaining biometric data;generating a token;blinding the token to produce a blinded token;sending the blinded token and biometric information based on the biometric data to a verifier; andreceiving a signature of the blinded token from the verifier if corresponding biometric information is not stored by the verifier.2. The method of claim 1 , further comprising sending the token and the signature to a storage device.3. The method of claim 2 , further comprising obtaining access to privacy sensitive information from the storage device if the signature is authenticated by the storage device.4. The method of claim 1 , further comprising unblinding the received signature to produce an unblinded signature.5. The method of claim 1 , further comprising:obtaining additional biometric data;sending additional biometric information based on the additional biometric data to the verifier to determine whether the additional biometric information corresponds to biometric information stored on the verifier; andreceiving an indication from the verifier whether the additional biometric information corresponds to biometric information stored on the verifier.6. The method of claim 5 , further comprising receiving an indication that a patient associated with the additional biometric information has previously received a signature for obtaining access to privacy sensitive information.7. The method of claim ...

System and method for controlling access to secure resources

A system and method for controlling access to a secure resource in a device are disclosed. In some embodiments, the device may include a processor capable of receiving a first request from a first application of a plurality of applications executable by the processor, where the first request requests access to the secure resource, and the first request identifies the plurality of applications. In response to the first request, the processor is capable of generating a ticket associated with the secure resource and with each of the plurality of applications, and then storing the ticket in a memory. After receiving a second request from a second application requesting access to the secure resource, the processor is capable of granting the second application access to the secure resource, if the ticket associated with the secure resource exists and if the ticket is associated with the second application.

System for Efficiently Handling Cryptographic Messages Containing Nonce Values in a Wireless Connectionless Environment

A system for determining the validity of a received cryptographic message while ensuring for out-of-order messages is utilized to provide for secure communications among peers in a network. In particular, a secure communication module may be configured to accept the cryptographic message in response to a received nonce value of the received message is greater than the largest nonce value yet seen, the secure communication module may be configured to compare the received nonce value with a nonce value acceptance window. If the received nonce value falls outside the nonce acceptance window, the secure communication module may be further configured to reject the received message and assume that a replay attack has been detected. If the received nonce value falls within the nonce acceptance window, the secure communication module may be further configured to determine if the received nonce value has been seen before by comparing the received nonce value with a replay window mask. If the received nonce has been seen before, the secure communication module may be further configured to reject the received message and assume a replay attack. Otherwise, the secure communication module may be further configured to accept the message and add the received nonce value to the replay window mask. 1. A method of processing messages , comprising:comparing a nonce value of a received message with a largest nonce value yet seen;comparing said nonce value to an acceptance window in response to said nonce value not exceeding said largest nonce value yet seen; andrejecting said received message in response to said nonce value falling outside said acceptance window.2. The method according to claim 1 , further comprising:designating said nonce value as a nonce value seen in response to said nonce value exceeding said largest nonce value yet seen.3. The method according to claim 1 , further comprising:replacing said largest nonce value yet seen with said nonce value in response to said ...

Out-of-band remote authentication

In an embodiment a single user authentication event, performed between a trusted path hardware module and a service provider via an out of band communication, can enable a user to transparently access multiple service providers using strong credentials that are specific to each service provider. The authentication event may be based on multifactor authentication that is indicative of a user's actual physical presence. Thus, for example, a user would not need to enter a different retinal scan to gain access to each of the service providers. Other embodiments are described herein.

Message originator token verification

A digital signature of a message originator of a message is validated by a processor on message retrieval by a message recipient as a first-tier validation of the message. In response to a successful first-tier validation of the digital signature of the message originator, a transaction token and a message originator identifier are extracted from a message payload of the message. Communication is initiated with a verification service within a secure messaging environment of the message originator as a second-tier validation of the message using the extracted transaction token and the extracted message originator identifier to confirm whether the secure messaging environment of the message originator generated the transaction token and inserted the transaction token into the message payload. Results of the second-tier validation of the message with the verification service within the secure messaging environment of the message originator are determined.

System And Method For Securely Binding And Node-Locking Program Execution To A Trusted Signature Authority

A system and method is disclosed for securely binding an arbitrary program to an authorized instance of a generic execution platform. Once the binding process occurs, the protected software application will not exhibit correct behavior unless run on the execution platform to which it is bound. The system and method withstands repeated attacks which tamper with the software application and the execution platform. The system and method present a mechanism to bind a program, P, to any un-trusted execution platform, E, which contains a Trusted Signing Authority (TSA). The TSA may take many alternate forms including a trusted platform module, secure processor, kernel driver, and hardened software agents.

Interactive Authentication

The present disclosure describes methods, systems, and computer program products for interactive authentication can include receiving a valid authentication credential or an invalid authentication credential associated with a digital identity. The credentials can be received from an end user at an input device in association with a login attempt. If a valid authentication credential is received, it is determined whether an identification token is received with the valid authentication credential. If received, the identification token is identified as a token included in a list of valid tokens associated with the digital identity at an authentication system. In response to the determination that the identification token is included in the list of valid tokens, it is determined whether a lockout period associated with the identification token in the list of valid tokens has expired. If expired, the end user associated with the login attempt can be authenticated.

Client Authentication During Network Boot

A secure mechanism for performing a network boot sequence and provisioning a remote device may use a private key of a public key/private key encryption mechanism to generate a command by a server and have the command executed by the device. The command may be used to verify the authenticity of the remote device, and may be used to establish ownership of the device. After authenticity and, in some cases ownership is established, bootable software may be downloaded and executed. The remote device may be provisioned with software applications. One mechanism for performing the initial encrypted commands is through a Trusted Platform Module. In many embodiments, the public key for the initial encrypted communication may be provided through a trusted second channel.

System and method of extending oauth server(s) with third party authentication/authorization

In accordance with various embodiments, systems and methods that provide for authorization of access to protected resources. Such a system can include a plurality of applications, executing on one or more application servers. The system can also include an authorization server which is operable to interface with one or more remote and/or non-co-located third party authentication servers. Each application can (a) receive a request for authorization to access a controlled resource; (b) redirect the request for authorization to a configurable authentication endpoint identifying a third party authentication server; (c) receive authorization information from the third party authorization server; and (d) issue an authorization code for access to the protected resource.

ELECTRONIC FILE SENDING METHOD

An electronic file sending method is provided to securely and easily send en electronic file to a receiver. A receiving apparatus receives from a sending apparatus an electronic mail including an encrypted electronic file. The sending apparatus uses a public key of a management server to encrypt a decryption password that is necessary to decrypt the encrypted electronic file and sends the encrypted decryption password to the management server. In association with a file identifier of the electronic file, the management server stores the decryption password and an electronic mail address of a correct receiver, who is a receiver of the receiving apparatus. The receiving apparatus sends to the management server the file identifier of the electronic file and the electronic mail address of the receiver. The management server uses a public key of the receiving apparatus to encrypt the password and sends the encrypted password to the receiving apparatus. 1. A method comprising:receiving at a server a first encrypted password from a sending apparatus, the first encrypted password being a password first encrypted by the sending apparatus and being necessary to decrypt an encrypted electronic file, the encrypted electronic file sent from the sending apparatus to a receiving apparatus without going through the server;first decrypting the first encrypted password to obtain the password at the server; andsending a second encrypted password from the server to the receiving apparatus, the second encrypted password being the password second encrypted by the server.2. The method according to claim 1 , wherein the sending apparatus uses a first encryption key to first encrypt the password;wherein the first decrypting includes using a first decryption key corresponding to the first encryption key, andwherein one of the first encryption key and the first decryption key is public, and one of the first encryption key and the first decryption key is private.3. The method according to ...

Learning a New Peripheral Using a Security Provisioning Manifest

A secure provisioning manifest used to authenticate and securely communicate with peripherals attached to a computer is provided with techniques to learn about a new peripheral not authorized to be attached to the computer and possibly gain authorization for the peripheral. A secure I/O module, that is separate from an operating system and transaction software executed by a processor of the computer, uses the secure provisioning manifest to authenticate and establish a secure encrypted session for communicating with each peripheral authorized to be attached to the computer. When an unauthorized peripheral is found, identifying information for the peripheral is transmitted to an enterprise provisioning server with a request to authorize the peripheral. 1. A method implemented by a secure I/O module of a computer , the computer includes a main processor that executes an operating system but cannot access elements within the secure I/O module , the method comprising:polling a peripheral attached to the computer and receiving identification information for the peripheral;determining the received identification information for the polled peripheral does not match peripheral identification information stored within a secure provisioning manifest stored in the secure I/O module;transmitting to a remote server a request for authorization to use the polled peripheral wherein the request includes the received identification information for the peripheral;receiving from the remote server a response to the request; and authenticating the peripheral using information stored in the updated secure provisioning manifest; and', 'establishing a secure encrypted communication session with the authenticated peripheral using information stored in the updated secure provisioning manifest., 'determining the received response includes an updated secure provisioning manifest and performing steps that include2. The method of claim 1 , further comprising:determining the received response does ...

System and method for secure provisioning of an information handling system

Systems and methods for reducing problems and disadvantages associated with provisioning of information handling systems, including without limitation those associated with bare metal provisioning of information handling systems, are disclosed. A system may include a processor, and a memory and an access controller each communicatively coupled to the processor. The access controller may store an enterprise public key associated with an enterprise private key and a platform private key associated with the system. The access controller may be configured to: (i) authenticate communications received from a provisioning server communicatively coupled to the access controller based at least on an enterprise public certificate associated with the provisioning server and (ii) establish an asymmetrically cryptographic communications channel between the access controller and the provisioning server based at least on a platform public key associated with the platform private key, the platform private key, the enterprise public key, and the enterprise private key.

AUTOMATIC USER AUTHENTICATION AND IDENTIFICATION FOR MOBILE INSTANT MESSAGING APPLICATION

Automatic identification and authentication of a user of a mobile application entails receiving from the wireless communications device a unique device identifier and an e-mail address corresponding to the wireless communications device, associating a registration identifier with the unique device identifier and the e-mail address, generating an authentication token, and communicating the authentication token and the registration identifier to the wireless communications device. 1. A method for automatic identification and authentication of a user of a mobile application executing on a wireless communications device , the method comprising:receiving in a server from a wireless communications device both a unique device identifier identifying the device, and also an e-mail address corresponding to the wireless communications device;associating a registration identifier with both the unique device identifier and also the e-mail address;generating an authentication token; andreturning the registration identifier and the authentication token to the device; and,subsequently receiving the registration identifier and the authentication token from the device and processing the received registration identifier as a functional equivalent of a login id and the authentication token as a functional equivalent of a password so as to authenticate the device into the server without requiring a manual input of a login id and password by an end user.2. The method as claimed in wherein the mobile application is an instant messaging application and wherein the server is an instant messaging server.3. The method as claimed in wherein receiving the unique device identifier and the e-mail address comprises receiving an authentication request including an encrypted unique device identifier and an encrypted e-mail address via an instant message session from the device to the instant messaging server.4. The method as claimed in wherein returning the authentication token and the registration ...

Format-preserving cryptographic systems

Key requests in a data processing system may include identifiers such as user names, policy names, and application names. The identifiers may also include validity period information indicating when corresponding keys are valid. When fulfilling a key request, a key server may use identifier information from the key request in determining which key access policies to apply and may use the identifier in determining whether an applicable policy has been satisfied. When a key request is authorized, the key server may generate a key by applying a one-way function to a root secret and the identifier. Validity period information for use by a decryption engine may be embedded in data items that include redundant information. Application testing can be facilitated by populating a test database with data that has been encrypted using a format-preserving encryption algorithm. Parts of a data string may be selectively encrypted based on their sensitivity.

Policy Based Authentication

Methods and systems for expedited authentication for mobile applications are described herein. A user of a mobile device may authenticate with an enterprise system, and thereby be granted access to enterprise applications and services on the mobile device. The user may then activate an application in a managed partition of the mobile device. The application may determine that the enterprise system supports expedited authentication. The application may request expedited authentication, and the request may be compared to policies for expedited authentication. If the request is permitted, the application may be granted access to an authorization code for expedited authentication. The application may then perform the expedited authentication, and the user may be granted access to the application when the expedited authentication has completed. 1. A computer-implemented method comprising:providing at least one application programming interface (API) absent receipt of data indicative of user authentication, the API configured to enable access to one or more applications of a computing device;determining an availability of the API based on one or more rules received by the computing device; andexchanging an authorization code for an access token in response to determining that the API is available, the access token being configured to provide access to an application of the one or more applications.2. The method of claim 1 , wherein determining the availability of the API comprises comparing a current time to permitted times claim 1 , in the one or more rules claim 1 , for accessing the application.3. The method of claim 1 , wherein determining the availability of the API comprises comparing a current location of the computing device to permitted locations claim 1 , in the one or more rules claim 1 , for accessing the application.4. The method of claim 1 , wherein the application is a secure application executing within a managed partition of a mobile device.5. The method ...

MECHANISM FOR SECURE AND RESILIENT CONFIGURATION UPGRADES

Various systems and methods for providing secure and resilient configuration upgrades are described herein. A system, includes a processor; and memory to store instructions, which when executed by the processor, cause the system to: receive at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI comprising reserved hardware resources of the first network node; verify, by the RSI, provenance of the update; apply, by the RSI, the update to modify a configuration of the RSI or the host partition; test, by the RSI, the modified configuration of the RSI or the host partition; and provide a cryptographic proof that the test was completed and an update status to an update coordinator. 1. A system , comprising:a processor; and receive at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI comprising reserved hardware resources of the first network node;', 'verify, by the RSI, provenance of the update;', 'apply, by the RSI, the update to modify a configuration of the RSI or the host partition;', 'test, by the RSI, the modified configuration of the RSI or the host partition; and', 'provide a cryptographic proof that the test was completed and an update status to an update coordinator., 'memory to store instructions, which when executed by the processor, cause the system to2. The system of claim 1 , wherein the source is a local device.3. The system of claim 2 , wherein the instructions cause the system to: after receiving the update from the source claim 2 , verifying device credentials of the local device and chain of custody of the update.4. The system of claim 1 , wherein the source is a peer RSI partition at a second network node.5. The system of claim 4 , wherein the instructions to receive the update from the source comprise ...

METHOD AND COMPUTER PROGRAM PRODUCT FOR ORDER PRESERVING SYMBOL BASED ENCRYPTION

Techniques for sorting encrypted data within a software as a service (SaaS) environment. Data is encrypted on a per symbol basis with a symbol based encryption module. Sort and search functionality preserving encryption that allows other modules to sort tokens and to search for tokens is provided. Encrypted tokens that have been encrypted by the symbol based encryption module are stored in a database. Access to the encrypted tokens is provided through the SaaS environment. 1. A method for generating an encryption dictionary , the method comprises:generating a random value for each plaintext symbol of multiple plaintext symbols; andcalculating a random token for each plaintext symbol based on a random value of the plaintext symbol and on random values of other plaintext symbols that have a lower lexicographic value than the plaintext symbol; wherein the calculating comprises applying a monotonic function; wherein the encryption dictionary comprises a mapping between the multiple plaintext symbols and random token of the multiple plaintext symbols.2. The method according to claim 1 , comprising calculating the random token of plaintext symbol by summing the random values of other plaintext symbols that have a lower lexicographic value than the plaintext symbol.3. The method according to claim 1 , comprising calculating the random token of the plaintext symbol by applying a weighted sum of the random values of other plaintext symbols that have a lower lexicographic value than the plaintext symbol.4. The method according to claim 1 , comprising calculating multiple random tokens for a single plaintext symbol.5. The method according to claim 4 , comprising calculating multiple random tokens for a single plaintext symbol that has a popularity level that exceeds a predefined popularity level.6. The method according to claim 4 , calculating multiple random tokens for the single plaintext symbol so that values of random tokens of other plaintext symbols are outside a range ...

OFFICIAL VETTING USING COMPOSITE TRUST VALUE OF MULTIPLE CONFIDENCE LEVELS BASED ON LINKED MOBILE IDENTIFICATION CREDENTIALS

In an example, a subject using a user mobile-identification-credential device (UMD) requests vetting by a vetting system, which receives verified subject information associated with a level-n mobile identification credential (MIC-n) that UMD received from a level-n authorizing party system (APS-n). MIC-n is linked to lower level MIC-0 to MIC-(n−1). The vetting system, as level-n relying party system (RPS-n), uses the verified subject information associated with the linked MIC-0 to MIC-n to verify or not verify the identity of the subject, develops an identity profile of the subject, and determines a vetting result of the subject by calculating a composite trust score based on MIC trust values for the multiple levels of MIC. MIC-i (i=1 to n) is linked to MIC-(i−1) which UMD received from APS-(i−1), and APS-i is RPS-(i−1) which verified the identity of the subject using verified subject information associated with MIC-(i−1), such that MIC-0 to MIC-n are linked. 1. A method for vetting an individual as a subject to be vetted , the method comprising:receiving, by a vetting system of a vetting service, a vetting request from a subject device of the subject;sending, by the vetting system to the subject device, a request for identification information of the subject;receiving, by the vetting system, part or all of subject information associated with a level-n mobile identification credential (MIC-n) which the subject device received from a level-n authorizing party system (APS-n), the subject having consented to release the part or all of subject information to the vetting system, the part or all of subject information having been verified, the MIC-n being linked to lower level mobile identification credentials from MIC-0 to MIC-(n−1);using, by the vetting system as a level-n relying party system (RPS-n), the verified part or all of subject information associated with the linked MIC-0 to MIC-n to verify or not verify the identity of the subject;developing an identity ...

Secretless and secure authentication of network resources

Disclosed embodiments relate to secretless and secure communications with access-protected network resources. Techniques include identifying a request from a client service to access an access-protected network resource; automatically identifying an identity token uniquely associated with the client service for enabling autonomous authentication of the client service using the identity token; providing, from a secretless connection broker to an authentication credential provider, the identity token uniquely associated with the client service; receiving, from the authentication credential provider, based on the identity token and conditional on successful authentication of the client service, a connection credential; establishing a secure connection with the access-protected network resource using the connection credential; and exchanging secure communications with the access-protected network resource. 1. A non-transitory computer readable medium including instructions that , when executed by at least one processor , cause the at least one processor to perform operations for secretless and secure communications with access-protected network resources , the operations comprising:identifying, at a secretless connection broker, a request from a client service to access an access-protected network resource, wherein the client service lacks information required for a connection with the access-protected network resource;automatically identifying, based on the request, an identity token uniquely associated with the client service for enabling autonomous authentication of the client service using the identity token;providing, from the secretless connection broker to an authentication credential provider, the identity token uniquely associated with the client service;receiving, from the authentication credential provider, based on the identity token and conditional on successful authentication of the client service, a connection credential for enabling the secretless ...

Mobile-OTP Based Authorisation of Transactions

Embodiments of the present disclosure relate to methods and systems for authenticating and authorizing mobile-One Time Password (m-OTP) based transactions. A cardholder (101) can generate the m-OTP in an issuer mobile application (301) and enter in a checkout page for completing the transaction. Once the m-OTP is entered, a merchant system (104) generates a transaction message comprising the m-OTP and a unique identifier indicating that the transaction message comprises the m-OTP. Is submitted to a directory server (106) which sends the transaction message to an issuer system (107) for authentication and authorization. The issuer system (107) generates a response message comprising a result of authentication and authorization of the transaction message. The directory server (106) routes the response message to the merchant system (104) via the acquirer system (105).

METHOD AND SYSTEM FOR AUTHORIZATION USING A PUBLIC LEDGER AND ENCRYPTION KEYS

A method for conveying a data message using a public ledger includes: generating, by a generation module of a processing server, a data message, wherein the data message comprises one or more data values; electronically transmitting, by a transmitting device of the processing server, a data signal superimposed with the generated data message to a first computing system; receiving, by a receiving device of the processing server, a data signal superimposed with an encrypted message from the first computing system, wherein the encrypted message is generated via application of one or more encryption algorithms to the generated data message using at least one encryption key; appending, by the generation module of the processing server, an identification value to the encrypted message; and submitting, by the transmitting device of the processing server, the appended encrypted message to a public ledger associated with a second computing system. 1. A method for securely conveying a transaction message , comprising:applying, by a first computing system, one or more encryption algorithms to a data message using at least one encryption key to generate an encrypted message;transmitting, by the first computing system, the at least one encryption key to a third computing system different from a processing server, wherein the third computing system acts as a node in a blockchain network;receiving, by a receiving device of the processing server from the first computing system, a data signal superimposed with the encrypted message, wherein the processing server does not receive the at least one encryption key;appending, by the processing server, an identification value to the encrypted message;submitting, by the transmitting device of the processing server, the appended encrypted message to a second computing system, wherein the second computing system is a node in the blockchain network;adding, by the second computing system acting as a node in the blockchain network, the ...

Brand Online Content Dissemination to Retailer Social Media Outlets

A service provider operates between a Brand and multiple Retailers, establishing a relationship between them and enabling the flow of content between the Brand and the Retailers, specifically to social media outlets of the Retailers. The service provider is used by either the Brand or the Retailer. The service provider links Brand content with multiple Retailer social media sites while taking into consideration preferences, settings, and requirements of the Retailers. The digital assets of the Brand are automatically posted in a randomized manner to the multiple Retailers such that a Retailer does not have to expend resources or time to have such postings made to its social media sites. 1. A method of posting digital content to a service providers web page created by a entity and at least one retailer entity independent of said brand entity accessing said digital content on said service providers web page and said at least one retailer entity having a social media web page which sells at least one product sold by said brand entity , and said retailer entity issuing a time dependent token that identifies and allows said at least one retailer entity web page access to said service providers web page and said token providing security of said digital content and access to said digital content for the specified time specified by the said retailer entity , the method comprising:drafting a schedule for releasing digital content promoting at least one product by said brand entity;updating said digital content as needed; 'creating a retailer-oriented communication including a link for a brand program sign-up page for use by the retailer entity and transmitting the communication using said token to the retailer entity;', 'storing said digital content on said service providers web page,'}said retailer entity using said token and selecting parameters relating to digital content type to be posted to the retailer social media web page;selecting parameters relating to frequency ...

SECURE AUTHENTICATION SYSTEM AND METHOD

Methods and systems pertaining secure transaction systems are disclosed. In one implementation, a computer with a verification token associated with a computer can send user authentication data as well as a secure datum to a control server. The verification token may obtain the secure datum from a validation entity. The control server can validate the secure datum and authentication data and can generate a payer authentication response. 1112.-. (canceled)113. A method comprising:receiving, a Purchase Authentication Page by a computer from a control server over a communications network, the Purchase Authentication Page having a user response posting field to receive a response from a user to authenticate the user; andproviding, a returned Purchase Authentication Page by the computer to the control server over the communications network, the returned Purchase Authentication Page having a user response disposed in the user response posting field and a secure datum received from a verification token associated with the computer, wherein the control server thereaftercompares at least a portion of the received user response to a stored user response to make a first determination of whether a match exists,compares the received secure datum to a stored secure datum to make a second determination of whether a match exists, andgenerates a Payer Authentication Response message based on at least the first and second determinations.114. The method of claim 113 , wherein the secure datum was received by the verification token from a validation entity after the validation entity validates information received from the verification token.115. The method of wherein the secure datum is generated based on an identity of a merchant with which the user conducts a transaction claim 113 , and a date or time of the transaction.116. The method of wherein the secure datum is generated based on an identifier associated with the verification token or an IP address of the computer.117. The ...

Digital Identity Escrow Methods and Systems

An illustrative method includes an escrow system receiving an access request from a service provider system for the service provider system to have access to a digital identity of a user when the user attempts to access a service provided by the service provider system; transmitting, based on the access request, an authorization request to a computing device associated with the user, the authorization request prompting the user to authorize sharing of the digital identity with the service provider system, the transmitting of the authorization request comprising transmitting a push notification to the computing device, and receiving, from the computing device associated with the user, authorization data indicating that the user authorizes sharing of the digital identity with the service provider system. 1. A method comprising:receiving, by an escrow system, an access request from a service provider system for the service provider system to have access to a digital identity of a user when the user attempts to access a service provided by the service provider system;transmitting, by the escrow system based on the access request, an authorization request to a computing device associated with the user, the authorization request prompting the user to authorize sharing of the digital identity with the service provider system, the transmitting of the authorization request comprising transmitting a push notification to the computing device; andreceiving, by the escrow system from the computing device associated with the user, authorization data indicating that the user authorizes sharing of the digital identity with the service provider system.2. The method of claim 1 , further comprising providing claim 1 , by the escrow system based on the receiving the authorization data from the computing device associated with the user claim 1 , the service provider system with access to the digital identity.3. The method of claim 2 , wherein the providing of the service provider system ...

METHOD FOR ASSEMBLING AUTHORIZATION CERTIFICATE CHAINS

A method for assembling authorization certificate chains among an authorizer, a client, and a third party allows the client to retain control over third party access. The client stores a first certificate from the authorizer providing access to a protected resource and delegates some or all of the privileges in the first certificate to the third party in a second certificate. The client stores a universal resource identifier (URI) associated with both the first certificate and the third party and provides the second certificate and the URI to the third party. The third party requests access to the protected resource by providing the second certificate and the URI, without knowledge or possession of the first certificate. When the authorizer accesses the URI, the client provides the first certificate to the authorizer, so that the client retains control over the third party's access. 1. (canceled)2. At least one non-transitory machine-accessible medium , with instructions stored thereon , which when executed by at least one processor of an authorizer , cause the authorizer to:receive, over a network via a network interface device of the authorizer, a resource request from a third party, the resource request including a second certificate and a universal resource identifier (URI) to access a first certificate of a client; andattempt to access, over the network via the network interface device, the URI wherein a response to the URI access attempt indicates whether the third party resource request is to be granted, the response to the URI access attempt coming from the client and including a copy of the firm certificate, wherein the copy of the firm certificate is never received by the third party.3. The at least one non-transitory machine-accessible medium of claim 2 , wherein the content of the firm certificate is not revealed to the third party.4. The at least one non-transitory machine-accessible medium of claim 2 , with further instructions stored thereon claim 2 , ...

Blockchain-based anonymous transfers zero-knowledge proofs

Disclosed is a mechanism for performing an anonymous transfer using a blockchain. A sender's device generates a commitment based on a serial number of a zero-knowledge token and a value of the zero-knowledge token. Moreover, the sender's device generates a range proof and a balance proof for the commitment. The range proof verifies that the value of the zero-knowledge token is within a preset range. The balance proof verifies that the value of a set of input tokens is greater than or equal to the value of the zero-knowledge token. The sender's device sends a conversion request to the blockchain network. The conversion request consumes the set of input tokens and generates the zero-knowledge token. The conversion request includes the generated commitment, the generated range proof, and the generated balance proof.

Secure Authentication Of A Device Through Attestation By Another Device

Methods and systems for secure authentication of a first device through attestation by one or more other devices are described herein. A server may receive, from an untrusted client device, a request for access to one or more services associated with the server. The server may generate a challenge code. The server may send, to the untrusted client device, a request for attestation of the untrusted client device. The server may receive, from a trusted client device, an indication that the trusted client device attests to an identity of the untrusted client device. Based on the indication that the trusted client device attests to the identity of the untrusted client device, the server may grant, to the untrusted client device, access to the one or more services associated with the server. 1. A method comprising:receiving, by a server from an untrusted client device, a request for access to one or more services associated with the server;generating, by the server, a challenge code;sending, by the server to the untrusted client device, a request for attestation of the untrusted client device, wherein the request for attestation comprises the challenge code;receiving, by the server from a trusted client device, an indication that the trusted client device attests to an identity of the untrusted client device, wherein the indication comprises the challenge code; andbased on the indication that the trusted client device attests to the identity of the untrusted client device, granting, by the server and to the untrusted client device, access to the one or more services associated with the server.2. The method of claim 1 , wherein the challenge code comprises a one-time challenge code claim 1 , and wherein the generating the challenge code comprises generating the challenge code using a random number generator associated with the server.3. The method of claim 1 , wherein the request for attestation further comprises an identifier for the server.4. The method of claim 1 , ...

Multi-layer biometric authentication

Apparatus and methods for generating secure electronic document authentication are provided. Authentication may include formulating “electronic signatures” or any other validation of electronic information. Apparatus and methods may include capturing a target biometric feature to authenticate the electronic information. The target biometric feature may include a combination or sequence of biometric features. In some embodiments, the target biometric feature may be captured without specially prompting a user to submit a biometric feature. A captured target biometric feature may be augmented by generation of a one-time-password using a token stored locally on a mobile device. Authentication processes described herein provide more secure, accurate authentication for electronic information.

Controlling Exposure of Sensitive Data and Operation Using Process Bound Security Tokens in Cloud Computing Environment

Exposure of sensitive information to users is controlled using a first security token containing user identity and user credentials to represent the user who requests services, and a second security token containing two other identities, one identifying the token issuer and the other identifying the owning process. When requesting services, the token-owning process sends a security token to indicate who is making the request, and uses its key to digitally sign the request. The token-owning process signs the request to indicate that it endorses the request. A receiving server accepts a request if (1) the token-owning process endorses the request by signing the request; (2) the token is valid (token is signed by its issuer and the digital signature is verified and unexpired); (3) user entity, which can be a real user or a deployment or a server process, that is represented by the token has the authorization to access the specified resources; and (4) the token-owning process is authorized to endorse the user entity represented by the token to access the specified resources. 1. A method for controlling exposure of sensitive data and using process bound security tokens comprising:representing a service requester using one or more security tokens containing a user identity, one or more user credentials, an identity of a token issuer, and an identity of the owning process;responsive to requesting services and subsequent authenticating to a server process, issuing the one or more security tokens including an issuer key name which indicates a key which was used to sign the security token;responsive to receiving the security token, using an issuer process name and the issuer key name to uniquely identify a public key needed to verify a token issuer digital signature; andresponsive to verifying the token issuer digital signature, granting access to a requested process or server resource to the requesting service.2. The method as set forth in wherein an owning process of a ...

SYSTEMS AND METHODS FOR DISTRIBUTING AND SECURING DATA

A robust computational secret sharing scheme that provides for the efficient distribution and subsequent recovery of a private data is disclosed. A cryptographic key may be randomly generated and then shared using a secret sharing algorithm to generate a collection of key shares. The private data may be encrypted using the key, resulting in a ciphertext. The ciphertext may then be broken into ciphertext fragments using an Information Dispersal Algorithm. Each key share and a corresponding ciphertext. Fragment are provided as input to a committal method of a probabilistic commitment scheme, resulting in a committal value and a decommittal value. The share for the robust computational secret sharing scheme may be obtained by combining the key share, the ciphertext fragment, the decommittal value, and the vector of committal values. 1. (canceled)2. A method for verifying a share of data , the method comprising:receiving, from a storage device, a fragment comprising data to be verified, a decommittal value, and a plurality of committal values, wherein the data to be verified comprises a string of characters;determining a consensus committal value from the plurality of committal values;calculating a hash value using the string of characters;comparing the calculated hash value to the consensus committal value;in response to determining that the calculated hash value equals the consensus committal value, storing to memory an indication that the data to be verified is a valid share of data; andin response to determining that the calculated hash value does not equal the consensus committal value, storing to memory an indication that the data to be verified is not a valid share of data.3. The method of claim 2 , wherein determining the consensus committal value comprises identifying a most frequently occurring committal value of the plurality of committal values.4. The method of claim 2 , wherein determining the consensus committal value comprises:receiving an identification ...

ON-CAR-DATA RECORDING APPARATUS AND IN-TRAIN-IMAGE DATA MANAGING SYSTEM

An on-car-data recording apparatus mounted on a train to record image data, which is data of a video or an image photographed by an image pickup apparatus set in the train, including: a secret-key retaining unit that retains a secret key paired with a public key for electronic signature for which certification by a certification authority is completed, a train-specific-information managing unit that manages information specific to the own train capable of specifying a traveling position of the own train, an electronic-signature generating unit that integrates, the image data and the information managed by the train-specific-information managing unit, calculates a hash value of obtained integrated data, and generates an electronic signature on the basis of the calculated hash value and the secret key, and an image data managing unit that retains the generated electronic signature and the image data used in generating the electronic signature in association with each other. 1. An on-car-data recording apparatus mounted on a train to record image data , which is data of a video or an image photographed by an image pickup apparatus set in the train , the on-car-data recording apparatus comprising:a secret-key retaining unit that retains a secret key paired with a public key for electronic signature for which certification by a certification authority is completed;a train-specific-information managing unit that manages information specific to the own train capable of specifying a traveling position of the own train;an electronic-signature generating unit that integrates, every time the image data is generated by the image pickup apparatus, the generated image data and train specific information, which is the information managed by the train-specific-information managing unit, calculates a hash value of obtained integrated data, and generates an electronic signature on the basis of the calculated hash value and the secret key; andan image data managing unit that retains ...

Automated provisioning of certificates

In a computer-implemented method for automated provisioning a certificate in a computing system a certificate signing request is accessed from a computing node by a centralized management tool of the computing system. The certificate signing request is provided to a certificate authority by the centralized management tool. A signed certificate is accessed from the certificate authority for the computing node. The signed certificate is provided to the computing node, by the centralized management tool, such that there is automated provisioning of the signed certificate at the computing node to establish trust of the computing node in the computing system.

CLIENT DEVICE WITH CERTIFICATE AND RELATED METHOD

A client device for hearing device communication, includes: a processing unit; a memory unit; and an interface; wherein the memory unit has a client device key and a client device certificate stored therein; and wherein the processing unit is configured to receive a connection response comprising a hearing device identifier via the interface, generate one or more keys including a certificate key based on the hearing device identifier and the client device key, and obtain an authentication message based on the certificate key and the client device certificate; wherein the processing unit is configured to obtain the authentication message by encrypting the client device certificate with the certificate key to obtain an encrypted client device certificate, and including the encrypted client device certificate in the authentication message; and wherein the interface is configured to transmit the authentication message. 1. A client device for hearing device communication , the client device comprising:a processing unit;a memory unit; andan interface;wherein the memory unit has a client device key and a client device certificate stored therein; and receive a connection response comprising a hearing device identifier via the interface,', 'generate one or more keys including a certificate key based on the hearing device identifier and the client device key, and', 'obtain an authentication message based on the certificate key and the client device certificate;, 'wherein the processing unit is configured to'}wherein the processing unit is configured to obtain the authentication message by encrypting the client device certificate with the certificate key to obtain an encrypted client device certificate, and including the encrypted client device certificate in the authentication message; andwherein the interface is configured to transmit the authentication message.2. The client device according to claim 1 , wherein the one or more keys comprise a hearing device key;wherein the ...

SYSTEM FOR EMBEDDING SEARCHABLE INFORMATION, ENCRYPTION, SIGNING OPERATION, TRANSMISSION, STORAGE AND RETRIEVAL

A cell phone is disclosed for acquiring information to be transmitted to a receiving facility and for transmitting such thereto. A capture device captures information from an external source. A processor is provided for associating with the captured information a representation of the date and time of the capture of the information, such that the representation of the date and time information in association with the captured information forms augmented captured information. The processor also places the augmented captured information in association with subscriber information in a transmission of the augmented captured information to a receiving facility requiring such subscriber information. A transmitter transmits the transmission including the augmented captured information and the subscriber information to the receiving facility. An encryptor encrypts the augmented captured information with a symmetrical encryption algorithm to provide encrypted augmented captured information in the transmission with the subscriber information. 1a capture device for capturing the image or other information;a local verification device for indelibly marking the captured image or other information with the date, time, location and information identifying the creator of the data;a transmitter for transmitting the locally verified captured image or other information in real time to a secure storage facility; andsaid capture device receiving and verifying acknowledgment of the receipt of the transmitted locally verified captured image or other information to the storage facility.. An apparatus for recording image or other data in real time, comprising: This application is a continuation of U.S. application Ser. No. 15/450,494, filed on Mar. 6, 2017, and entitled SYSTEM FOR EMBEDDING SEARCHABLE INFORMATION, ENCRYPTION, SIGNING OPERATION, TRANSMISSION, STORAGE AND RETRIEVAL, published on Jun. 22, 2017, as U.S. Patent Application Publication No. US 2017/0178271, now U.S. Pat. No. 9,922, ...

Cryptographically attested resources for hosting virtual machines

Approaches to enable the configuration of computing resources for executing virtual machines on behalf of users to be cryptographically attested to or verified. When a user requests a virtual machine to be provisioned, an operator of the virtualized computing environment can initiate a two phase launch of the virtual machine. In the first phase, the operator provisions the virtual machine on a host computing device and obtains cryptographic measurements of the software and/or hardware resources on the host computing device. The operator may then provide those cryptographic measurements to the user that requested the virtual machine. If the user approves the cryptographic measurements, the operator may proceed with the second phase and actually launch the virtual machine on the host. In some cases, operator may compare the cryptographic measurements to a list of approved measurements to determine whether the host computing device is acceptable for hosting the virtual machine.

METHODS AND SYSTEMS OF DATA SECURITY IN BROWSER STORAGE

Mechanisms and methods are provided for managing OAuth access in a database network system, and extending the OAuth flow of authentication to securely store the OAuth encrypted refresh token in the storage available with current browsers or any other non-secure storage on user system. 1. A nontransient machine readable medium storing one or more machine instructions , which when invoked cause a processor to implement a method comprising:at a server that includes at least a processor system having at least one processor and memory system, receiving a passcode and content;if the passcode is authenticated, in response to the receiving of the passcode and the content, performing the following,placing, by the server, the content and passcode into a file/blob;creating, by the server, a unique encryption key;encrypting, by the server, the file having the content and the passcode (as plain text or 1-way hash generated using a cryptographic hash function) with the unique encryption key; andsending from the server to the user system the encrypted data and a unique identifier for the encrypted file having the passcode and content.2. The nontransient machine readable medium of claim 2 , further comprising:storing the content and passcode that were encrypted in a local database at the server.3. The nontransient machine readable medium of claim 2 , the content being a token for refreshing an access to another server.4. The nontransient machine readable medium of claim 2 , the method further comprising:sending the content from the server to another server; andin response to the sending, receiving a token from the other server.5. A nontransient machine readable medium storing one or more machine instructions claim 2 , which when invoked cause a processor to implement a method comprising:receiving, at a server that includes at least a processor system having at least one processor and memory system, a passcode and encrypted content and a unique key identifier; querying a local ...

COMMUNICATION SYSTEM, NON-TRANSITORY COMPUTER-READABLE RECORDING MEDIUM STORING CONNECTION APPLICATION FOR TERMINAL, AND COMMUNICATION DEVICE

A terminal of a communication system may obtain location information of a server of the communication system and related information related to a public key of a communication device of the communication system by using a computer program. The terminal may send a web page request to the server by using a browser program, receive web page data from the server by using the browser program, display as web page by using the browser program and activate the connection application by using the browser program. The terminal may obtain the public key by using the connection application, send an authentication request to the communication device by using the connection application, receive an authentication response from the communication device by using the connection application and execute a target communication with the communication device by using the connection application. 1. A communication system comprising:a communication device; anda terminal; a terminal-side wireless interface configured to execute a wireless communication according to a predetermined communication scheme of Wi-Fi standard;', 'a display unit;', 'a terminal-side processor; and', 'a terminal-side memory storing a computer program, and a connection application for establishing a wireless connection between a pair of devices,, 'wherein the terminal compriseswherein the computer program includes computer-readable instructions configured to, when executed by the terminal-side processor, cause the terminal to:obtain location information and related information related to a public key of the communication device,wherein the connection application is activated in response to obtaining the local information,wherein the connection application includes computer-readable instructions configured to, when executed by the terminal-side processor, cause the terminal to:obtain the public key related to the related information;send an authentication request according to the predetermined communication scheme to ...

Multichannel device utilizing a centralized out-of-band authentication system (cobas)

A multichannel security system is disclosed, which system is for granting and denying access to a host computer in response to a demand from an access-seeking individual and computer. The access-seeker has a peripheral device operative within an authentication channel to communicate with the security system. The access-seeker initially presents identification and password data over an access channel which is intercepted and transmitted to the security computer. The security computer then communicates with the access-seeker. A biometric analyzer—a voice or fingerprint recognition device—operates upon instructions from the authentication program to analyze the monitored parameter of the individual. In the security computer, a comparator matches the biometric sample with stored data, and, upon obtaining a match, provides authentication. The security computer instructs the host computer to grant access and communicates the same to the access-seeker, whereupon access is initiated over the access channel.

Cryptographic Device that Binds an Additional Authentication Factor to Multiple Identities

Binding a security artifact to a service provider. A method includes generating a pseudonym for a security artifact. The pseudonym is an identifier of the security artifact to the service provider that is unique to the service provider in that the pseudonym is not used to identify the security artifact to other service providers. Further, the pseudonym uniquely identifies the particular security artifact to the service provider even when a user has available a number of different security artifacts to authenticate to the same service provider to access a user account for the user. The method further includes providing the pseudonym for the security artifact to the service provider. The pseudonym for the security artifact is bound with a user account at the service provider for a user associated with the security artifact.

Client-side security key generation

Techniques are provided for client-side security key generation. An initial request is received from an application executing on a client device. The application includes a security component includes security code. In response to the initial request, a key component is generated. The key component includes one or more parameters from which a valid security key can be generated at the client device by executing the security code. The key component is provided to the client device. A security key associated with a request from the client device to an application server is received. The security key is checked for validity. In response to determining that the security key is valid, processing of the request by the application server is caused.

AUTHENTICATION METHOD, DEVICE, SERVER, AND SYSTEM, AND STORAGE MEDIUM

The present disclosure discloses an authentication method performed at a server, including: generating, based on a first account that is possessed by a user of a first device and that corresponds to a first application, corresponding token information; sending the token information to the first device to be shared by the first device with devices in a device group in a replication restriction manner; performing, based on the token information, authentication on a second device that is in the device group; granting permission of accessing the first account to the second device when the authentication succeeds; and triggering the first device to switch from a state of first account-based login to the first application to a state of suspending the login to the first application when it is determined that the second device logs in to the first application based on the permission of accessing the first account. 1. An authentication method performed at a server having one or more processors and memory storing one or more programs to be executed by the one or more processors , the method comprising:generating, based on a first account that is possessed by a user of a first device and that corresponds to a first application, token information corresponding to the first account, the token information representing that the user of the first device has the ownership of the first account;sending the token information to the first device, the token information being shared by the first device with devices in a device group in a replication restriction manner;performing, based on the token information, authentication on a second device that is in the device group and that has the token information;granting permission of accessing the first account to the second device when the authentication succeeds, to support the second device to log in to the first application by using the first account; andtriggering the first device to switch from a state of first account-based login to the ...

TOKEN AND CRYPTOGRAM USING TRANSACTION SPECIFIC INFORMATION

Systems and methods for token processing are disclosed. An access device can provide access device data to a mobile communication device. The communication device generates a token request including the access device data and communication device data and sends the token request to a server computer. The server computer returns a token and a token cryptogram to the mobile communication device. The token and the cryptogram may be used in a transaction. 1. A method comprising:receiving access device data by a mobile communication device from an access device;generating, by the mobile communication device, a token request including the access device data and communication device data;sending, by the mobile communication device, the token request to a server computer, wherein the server computer thereafter determines a token and generates a cryptogram, the cryptogram generated using the access device data and the communication device data;receiving, by the mobile communication device, the token and the cryptogram; andproviding, by the mobile communication device, the token and the cryptogram to the access device, wherein the access device forwards the cryptogram and the token to the server computer, which verifies the cryptogram and processes the token.2. The method of , wherein the access device data comprises location information of the access device , and wherein the communication device data comprises location information of the communication device. The method of , wherein the cryptogram is generated using token specific information , the token specific information including when the token was requested.4. The method of claim 1 , wherein the access device data was present in a two-dimensional code displayed on the access device.5. The method of claim 1 , wherein the access device data comprises a resource provider ID and a transaction initiate timestamp.6. A communication device comprising;a processor, anda computer readable medium, the computer readable medium ...

Service activation using algorithmically defined key

Systems and methods for service activation using algorithmically defined keys are disclosed. A consumer who has a relationship with a first party may wish to enroll in a service provided by a third party. The first party can maintain control of such enrollments through the use of algorithmically defined keys. The algorithmically defined keys also allow the third party service provider to verify data provided by the consumer as matching data stored by the first party. The verification provides for data synchronization without requiring the third party to have access to the first parties data systems.

METHOD FOR SECURE CONNECTION

The invention relates a method involving calling of hardware components (i.e. memory, keyboard, microphone, user interface, etc.) being controlled by software units from trusted execution environment []; and encryption of the input from these elements within the trusted execution environment []; and transmission of the said encrypted data preferably normalized methods to the application in the rich environment []; transmission of the said encrypted data to the receiver via the application in the rich environment [] via the methods of the application of the rich environment []; transmission of the said encrypted data using protocols/methods of the application running in the rich environment []; and at the receiving device being opened at the trusted execution environment [] and being displayed to the user as such. 1101102. The invention disclosed is a method a secure connection via a connectivity application [] within a trusted execution environment [] compromising;{'b': 104', '101', '103', '108', '102, 'a. Receiving of input from the sender [] via the connectivity application [] operating on, the rich environment [] where input elements [] being called from within the trusted execution environment [];'}{'b': 102', '107', '102, 'b. The input received within the trusted execution environment [] being subject to encryption [] within the trusted execution environment [];'}{'b': 102', '102', '102, 'c. The message transferred to outside of the trusted execution environment [] as encrypted and transfer of the message to the connectivity application [] as encrypted and being transferred to the receiver by the connectivity application [] by regular methods;'}{'b': 105', '102, 'd. The message transferred to the receiver [] being available in encrypted form; the available message being displayed in a way making available the user to distinguish; the message being transferred to the trusted execution environment [] and being decrypted within;'}{'b': 107', '110', '102, 'e. With ...