Sun Microsystems, Inc.

Oracle America, Inc.

Eduard De Jong

Moshe Levy

Albert Y Leung

Pieter H Hartel

A method for private personal identification number (PIN) management includes receiving a first PIN, receiving a first key used to scramble a second PIN that has been validated, receiving a first scrambled PIN comprising the second PIN scrambled with the first key, scrambling the first PIN with the first key to create a second scrambled PIN and validating the first PIN based at least in part on whether the first scrambled PIN matches the second scrambled PIN.

Method and apparatus for protecting against side channel attacks against personal identification numbers

A method for managing identification in a data communications network includes receiving a user-controlled secure storage device and enrolling the user with an authority network site. The enrolling includes providing information requested by the authority network site. The method also includes receiving user data in response to the enrolling, storing the user data in the user-controlled secure storage device, enabling the user-controlled secure storage device to release the user data and using the user data at a service provider network site to obtain a service.

Privacy and identification in a data communications network

A method for enhanced privacy protection in identification in a data communications network includes enrolling for a service on the data communications network, receiving a randomized identifier (ID) in response to the enrolling, storing the randomized ID and using the randomized ID to obtain services on the data communications network. An apparatus for obtaining a service on a data communications network includes an enrollment authority configured to accept an enrollment request. The enrollment authority is further configured to return enrollment results in response to the enrollment request. The enrollment results include user data and the enrollment results may be used obtaining a service from a service provider.

Enhanced privacy protection in identification in a data communications network

A method for statically allocating a procedure return address includes separating a software program including multiple procedures into a cyclic part and an acyclic part, allocating a static address for the return address of a procedure in the acyclic part and modifying at least one of the procedures to refer to the static address for the procedure return address.

Method and apparatus for deployment of high integrity software using static procedure return addresses

An apparatus for private personal identification number (PIN) management comprises a memory and a PIN comparator in communication with the memory. The PIN comparator is configured to ascertain a first delay period of a preceding PIN. The first delay period is greater than zero if the preceding PIN does not match a validated PIN and the first delay period equals zero if the preceding PIN matches the validated PIN. The PIN comparator is further configured to receive a current PIN after at least the first delay period and delay for a second delay period if the current PIN does not match the validated PIN. The second delay period is greater than the first delay period.

Apparatus for private personal identification number management

A method for private personal identification number (PIN) management comprises ascertaining a first delay period of a preceding PIN. The first delay period is greater than zero if the preceding PIN does not match a validated PIN and the first delay period equals zero if the preceding PIN matches the validated PIN. The method also includes receiving a current PIN after at least the first delay period and delaying for a second delay period if the current PIN does not match the validated PIN. The second delay period is greater than the first delay period.

Method for private personal identification number management

A method for enhanced quality of identification in a data communications network includes obtaining a user identifier that includes an identification server ID and an identification randomized ID. The identification server ID identifies an identification server peer group. The identification server peer group includes at least one server that maintains a mapping between an identification randomized ID and a user authentication peer group capable of authenticating a user associated with a particular randomized ID, and a mapping between the identification randomized ID and user information. The method also includes requesting authorization of the user by presenting the user identifier to a corresponding identification server peer group. Each server in the identification server peer group is configured to search for one or more matching entries including the randomized ID.

Enhanced quality of identification in a data communications network

A method for reducing dynamic memory allocation includes designing a software program using a memory allocation module for allocating memory, analyzing the software program to determine a bound on dynamic memory allocation and modifying the program based on the analyzing. According to one aspect, the program is modified to use static memory allocation in lieu of dynamic memory allocation based on the analyzing. According to another aspect, the program is modified to reduce the amount of dynamically allocated memory based on the analyzing.

Method and apparatus for deployment of high integrity software using reduced dynamic memory allocation

A method for designing a software program including multiple modules includes defining an initialization sequence wherein each of the modules is initialized according to a predetermined order. The method also includes defining calling order constraints wherein a first module may call a second module if the first module succeeds the second module in the allowed order. The method also includes creating a program specification for the software program. The program specification includes a module specification for each of the modules and each module specification indicates other modules called by an implementation of the module. According to one aspect, one of a plurality of initialization sequences is selected based upon the presence of one or more markers in a memory.

Method and apparatus for deployment of high integrity software using initialization order and calling order constraints

A method for portable device memory management includes determining an operational mode of a program configured to execute on the portable device based on validating the presence of one or more memory markers in the memory. The one or more memory marker includes a memory line having a predetermined length and including a data portion and a tag. The method also includes allowing one or more commands based on the operational mode and terminating execution of the program if at least one but less than a predetermined number of memory markers are validly present in the memory.

Growing community of inventors

San Mateo, CA, United States of America

Eduard De Jong