Novell, Inc.

Apple Inc.

Partnet, Inc.

Emc Corporation

Novell Intellectual Property Holdings, Inc.

Cameron Craig Morris

Lloyd Leon Burch

Srinivas Vedula

Stephen Hugh Kinser

Stephen R Carter

Douglas Garry Earl

Douglas M Erickson

Herrick Gordon Muhlestein

Tammy Anita Green

Larry Hal Henderson

David Thomas Robinson

Stephen H Kinser

A method for performing anonymous authentication by an electronic device is described. The method includes obtaining biometric data. The method also includes enrolling biometric information based on the biometric data. The method also includes generating backup biometric information based on the biometric data. The backup biometric information includes a backup biometric template. The method also includes generating a backup public key and a backup private key. The method also includes enrolling the backup biometric information. Enrolling the backup biometric information includes distributing the backup biometric template, the backup public key and the backup private key among different entities.

Anonymous authentication using backup biometric information

A method for anonymous authentication by an electronic device is described. The method includes obtaining biometric data. The method also includes generating a token. The method also includes blinding the token to produce a blinded token. The method also includes sending the blinded token and biometric information based on the biometric data to a verifier. The method also includes receiving a signature of the blinded token from the verifier if corresponding biometric information is not stored by the verifier.

Systems and methods for verifying uniqueness in anonymous authentication

Techniques for personalizing content are presented. A principal requests access to content. Policy is evaluated in response to the request for the content. Scripts are processed in response to the policy evaluation to rewrite and modify the content. The modified content is then delivered to the requesting principal to personalize the content for the principal.

Techniques for personalizing content

Techniques for dynamic generation and management of password dictionaries are presented. Passwords are parsed for recognizable terms. The terms are housed in dictionaries or databases. Statistics associated with the terms are maintained and managed. The statistics are used to provide strength values to the passwords and determine when passwords are acceptable and unacceptable.

Techniques for dynamic generation and management of password dictionaries

Techniques for representing extensible markup language (XML) in an executable format are presented. An XML document is parsed into its components and content. The components and content are packaged as an executable. Some portions of the executable include authentication logic or policy logic that is subsequently enforced when the executable is processed. The executable is subsequently distributed to recipient machines. The machines process the executable and produce memory loaded versions of the components and content representing the XML document on the machines. The memory loaded versions of the components and content include conditionally added authentication logic of policy logic.

Representing extensible markup language (XML) as an executable having conditional authentication or policy logic

Techniques for modification of access expiration conditions are presented. A principal supplies a password associated with establishing access to a target resource. In response to the password, characteristics of the password are examined and a custom expiration condition is generated for the password in response to the characteristics and policy. When the custom expiration condition is satisfied, the password and access to the target resource become invalid for use. Moreover, the principal may interactively change a complexity level of any proposed password for purposes of attempting to enhance the expiration condition or for purposes of attempting to degrade the expiration condition.

Techniques for modification of access expiration conditions

Techniques for the local personalization of content are presented. A content personalization service is dynamically pushed from a server environment to a client processing environment associated with a principal on demand. The content personalization service interjects itself between content that the principal attempts to view and access within the client processing environment and modifies and personalizes that content on behalf of the principal before the principal can view or access the content.

Techniques for local personalization of content

Techniques for creating and using credentials for blinded intended audiences are provided. A principal desires access to a target service. An identity associated with the target service is hidden from an identity service via a random identifier. The identity service supplies an assertion with credentials and the random identifier. The principal sends the assertion and an access message, which also includes the random identifier to the target service. The target service compares the identifier included with the message to the identifier in the assertion and when a match occurs access is permitted to the target service, assuming other credentials associated with the assertion are satisfied as well.

Credentials for blinded intended audiences

Techniques for credential strength analysis via failed intruder access attempts are presented. Intruders attempting to access a secure network with failed credentials are monitored. The failed credentials are retained and evaluated in view of previously recorded failed credentials. Credential policy is updated in response to the evaluation and intruder trends and sophistication levels are also predicted in response to the evaluation.

Techniques for credential strength analysis via failed intruder access attempts

Techniques real-time adaptive password policies are presented. Patterns for passwords are regularly analyzed along with other factors associated with the patterns to dynamically determine password strength values. The strength values can change over time based on usage statistics. When a strength value falls below an acceptable threshold, passwords associated with that particular pattern can be downgraded or rejected in real-time and existing policy can be adapted to reflect the undesirability of that pattern.

Techniques for real-time adaptive password policies

Techniques for proxing services with a single sign on are provided. A principal authenticates to a first identity service. The first identity service is in a trusted relationship with a second identity service. An authentication request is sent to the second identity service and the request includes an authentication response supplied by the first identity service in response to successful authentication of the principal to the first identity service. In response to the authentication request and the accompanying response, the principal is authenticated for access to the second identity service. Furthermore, targeted services accessible to the second identity service are proxied from and to the principal during interactions between the principal and an external service of that principal.

Single sign on with proxy services

Techniques for port hopping are presented. A sender and a receiver engage in a communication session with one another and dynamically switch ports during that communication session. A decision to switch ports is based on a data length or packet count of a given transaction occurring during the communication session. The data length and packet count randomly and dynamically change during the communication session and varies from one transaction to another transaction. Any particular port to switch to during the communication session is also randomly and dynamically generated and varies from one transaction to another transaction.

Techniques for port hopping

Techniques for recognizing multiple patterns within a string of characters are presented. A dictionary is hierarchically organized, such that leaf nodes within the dictionary represents words defined in the dictionary. A string of characters are received. Each character within the string is traversed by attempting to match it with a character defined in the dictionary. As long as a match continues with the dictionary the characters within the string are traversed. Once a longest possible match to a word within the dictionary is found, the next character following the last matched character for the string is processed.

Techniques for recognizing multiple patterns within a string

Techniques for validating identities are provided. A sign-on request is authenticated for a given principal. Attributes associated with that principal are acquired from an identity service and compared against local maintained attributes for that principal. If the identity-service acquired attributes match the local attributes, then the principal is validated for access. During principal access, selective events drive updates to the identity-service acquired attributes, and the comparison with the local attributes is performed again to determine whether the validated principal is to be invalidated or is to remain validated.

Growing community of inventors

Saratoga Springs, UT, United States of America

Cameron Craig Morris