International Business Machines Corporation

Luke James O'Connor

Stefan Georg Hild

Carl Binding

Sandeep Kishan Singhal

Michael Steiner

Victor Shoup

Nevenko Zunic

David R Safford

Shai Halevi

Stephen Michael Matyas, Jr

Charanjit Singh Jutla

Don Coppersmith

Rosario Gennaro

Yen-Min Huang

Mohammed Peyravian

Guenter Karjoth

Bernhard Jansen

Michael Moser

Christopher Mark Kenyon

Michael Backes

Elsie A Van Herreweghen

Jonathan A Poritz

Heiko H Ludwig

The present invention relates to a privacy method for responding to read request. The present invention further relates to a device for generating a response signal and a computer program product. Methods and systems in accordance with embodiments of the invention validate, whether a read request is directed at a target tag to be protected, and, upon a match, respond to the read request by sending a response signal.

Privacy method, device and computer program

A method and system for verifying authenticity of an application in a computing-platform operating in a Trusted Computing Group (TCG) domain is provided. The method includes computing one or more integrity measurements corresponding to one or more of the application, a plurality of precedent-applications, and an output file. The output file includes an output of the application, the application is executing on the computing-platform. Each precedent-application is executed before the application. The method further includes comparing one or more integrity measurements with re-computed integrity measurements. The re-computed integrity measurements are determined corresponding to one or more of the application, the plurality of precedent-applications, and the computing-platform.

Method and system to authenticate an application in a computing platform operating in trusted computing group (TCG) domain

For detecting a blocker RFID tag, the following steps are conducted. First, a random identifier of a given bit length is created. Alternatively, an identifier is selected out of a probing set, which is stored on a data storage device. The probing set comprises of identifiers, which are not being used as identifiers for a given set of RFID tags. In a second step, a response from all RFID tags is requested having an identifier matching the random identifier or, respectively, the selected identifier. In a third step, it is determined, depending on receiving or not receiving a response, whether the blocker RFID tag is present.

Detecting a blocker RFID tag

A Transaction Authorization Method operating over a computer network comprising a plurality of interconnected computers and a plurality of resources, each computer including a processor, memory and input/output devices, each resource operatively coupled to at least one of the computers and executing at least one of the activities in the process flow, the method characterized in that it assembles an electronic authorization of a transaction in a manner which is verifiable by extracting and verifying whether role certificates of at least one type, associated with the authorization, are themselves authentic. The method eliminates the need of having to authorize each and every signature on a transaction individually by providing an authorization structure based on roles, this structure being accessible on a public network for verification that the transaction is authorized.

Method for inter-enterprise role-based authorization

A method of establishing a trustworthiness level of a participant in a communication connection between a first communication partner and a second communication partner is proposed whereby the communication behavior is adapted to the established trustworthiness level. The participant is equipped with a trustworthiness certificate and a therefrom separated securely stored participant private key. The first communication partner receives the trustworthiness certificate from the participant wherefrom the trustworthiness level is derived and established. The first communication partner tests whether the trustworthiness certificate belongs to the participant by using the participant private key. In case the trustworthiness certificate is confirmed by the test to belong to the participant, the first communication partner communicates the established trustworthiness level to the second communication partner. Then, at least one parameter of the communication behavior is chosen in dependence of the established trustworthiness level.

Method of establishing the trustworthiness level of a participant in a communication connection

A method of transmitting information data from a sender to a receiver via a transcoder is proposed. The information data comprises confidential information data which is encrypted and non-confidential information data. Security information and transcoding-type information is sent together with the partly encrypted information data to the transcoder which uses the security information and transcoding-type information during a transcoding step. The encrypted confidential information data is thereby transcoded without using its content while the non-confidential information data is transcoded, having access to its content.

Method of transmitting information data from a sender to a receiver via a transcoder

A method, system, and computer program product for establishing security parameters that are used to exchange data on a secure connection. A piggy-backed key exchange protocol is defined, with which these security parameters are advantageously exchanged. By piggy-backing the key exchange onto other already-required messages (such as a client's HTTP GET request, or the server's response thereto), the overhead associated with setting up a secure browser-to-server connection is minimized. This technique is defined for a number of different scenarios, where the client and server may or may not share an encoding scheme, and is designed to maintain the integrity of application layer communication protocols. In one scenario, a client requests a server to propose a message encoding scheme. If the client has security-sensitive data to transmit with its request, it waits for the proposed scheme before sending this sensitive data to the server. Otherwise, the server may inform the client of the message encoding scheme in the same transmission used to send a response to a client's request.

Piggy-backed key exchange protocol for providing secure, low-overhead browser connections when a client requests a server to propose a message encoding scheme

Methods and apparatus are provided for transcoding a data message, comprising a plurality of data fields (f-f) and an authentication code (Sgn(h)), to produce a transcoded message for transmission to a destination device (). The transcoding methods can be applied to such a data message which is received from a source device () wherein said data fields (f-f) have been coded in accordance with a first coding system, whereby respective data field codes (h-h) are generated for said data fields (f-f) and a message code (h) is derived from said data field codes (h-h), and wherein said message code (h) has been coded in accordance with a second coding system to generate said authentication code (Sgn(h)). For each data field (f-f) of the received data message it is decided whether to maintain, modify or omit that field. For a field to be maintained, that field is maintained in the transcoded message. For a field to be omitted, that field is coded in accordance with said first coding system to generate an omitted field code dependent upon the data field code (h) for that field, and that field is replaced by said omitted field code in the transcoded message. For a field to be modified, that field is coded in accordance with said first coding system to generate a modified field code dependent upon the data field code (h) for that field, and that field is replaced by a modified field, comprising modified data (f') and said modified field code, in the transcoded message. The received authentication code (Sgn(h)) is also included in the transcoded message. Sufficient information is thereby included in the transcoded message to enable the destination device to verify the transcoding operation.

Transcoding in data communications

A method, system, and computer program product for exchanging supplemental information fields between a client and server. This supplemental information can then be used by the server to complete a client's request for content stored at a particular location. For example, the supplemental information may be used to provide a customized response, or for access control to sensitive data. Preferably, the REDIRECT message of the Hypertext Transfer Protocol (HTTP) or the Wireless Session Protocol (WSP) is used to request the supplemental information, encoding a comma-separated list of attribute names in a request header for the desired supplemental information. This solution is designed to be backward-compatible.

Exchanging supplemental information fields between a client and a server

A method, system, and computer program product for establishing security parameters that are used to exchange data on a secure connection. A piggy-backed key exchange protocol is defined, with which these security parameters are advantageously exchanged. By piggy-backing the key exchange onto other already-required messages (such as a client's HTTP GET request, or the server's response thereto), the overhead associated with setting up a secure browser-to-server connection is minimized. This technique is defined for a number of different scenarios, where the client and server may or may not share an encoding scheme, and is designed to maintain the integrity of application layer communication protocols. In one scenario, a client and a server exchange secure messages using a trusted third party.

Piggy-backed key exchange protocol for providing secure low-overhead browser connections from a client to a server using a trusted third party

METHOD OF TRANSMITTING INFORMATION DATA FROM A SENDER TO A RECEIVER VIA A TRANSCODER, METHOD OF TRANSCODING INFORMATION DATA, METHOD FOR RECEIVING TRANSCODED INFORMATION DATA, SENDER, TRANSCODER AND RECEIVER

A method, system, and computer program product for establishing security parameters that are used to exchange data on a secure connection. A piggy-backed key exchange protocol is defined, with which these security parameters are advantageously exchanged. By piggy-backing the key exchange onto other already-required messages (such as a client's HTTP GET request, or the server's response thereto), the overhead associated with setting up a secure browser-to-server connection is minimized. This technique is defined for a number of different scenarios, where the client and server may or may not share an encoding scheme, and is designed to maintain the integrity of application layer communication protocols. In one scenario, a client and server share a common message encoding scheme.

Piggy-backed key exchange protocol for providing secure, low-overhead browser connections to a server with which a client shares a message encoding scheme

A method, system, and computer program product for establishing security parameters that are used to exchange data on a secure connection. A piggy-backed key exchange protocol is defined, with which these security parameters are advantageously exchanged. By piggy-backing the key exchange onto other already-required messages (such as a client's HTTP GET request, or the server's response thereto), the overhead associated with setting up a secure browser-to-server connection is minimized. This technique is defined for a number of different scenarios, where the client and server may or may not share an encoding scheme, and is designed to maintain the integrity of application layer communication protocols. In one scenario, a client proposes a message encoding scheme, but the server will not use this proposed scheme. The server proposes a different scheme, after which the client re-issues its request for secure content.

Piggy-backed key exchange protocol for providing secure, low-overhead browser connections when a server will not use a message encoding scheme proposed by a client

The present invention provides a technique, system, and computer program for a symmetric key block cipher. This cipher uses multiple stages with a modified Type-3 Feistel network, and a modified Unbalanced Type-1 Feistel network in an expansion box forward function. The cipher allows the block size, key size, number of rounds of expansion, and number of stages of ciphering to vary. The modified Type-3 cipher modifies the word used as input to the expansion box in certain rounds, to speed the diffusion properties of the ciphering. The modified Type-3 and Type-1 ciphers are interleaved, and provide excellent resistance to both linear and differential attacks. The variable-length subkeys and the S-box can be precomputed. A minimal amount of computer storage is required to implement this cipher, which can be implemented equally well in hardware or software (or some combination thereof).

Symmetric block cipher using multiple stages with modified type-1 and type-3 feistel networks

The present invention provides a technique, system, and computer program for a symmetric key block cipher. Variable block sizes and key sizes are supported, as well as a variable number of rounds. The cipher uses multiple stages of processing, where the stages have different structures and different subround functions, to provide excellent resistance to both linear and differential attacks. Feistel Type-3 networks are used, with different networks during different stages. The number of rounds may vary among stages. Subkeys are used in some, but not all, stages. The variable-length keys can be precomputed. A novel manner of using multiplication in a cipher is defined.

Growing community of inventors

Adliswil, Switzerland

Luke James O'Connor