International Business Machines Corporation

Michael Baentsch

Peter Buhler

Thomas D Weigold

Thomas Eirich

Frank Hoering

Thorsten Kramp

Michael Peter Kuyper-Hammond

Marcus B Oestreicher

Reto Josef Hermann

Michael Charles Osborne

Harold D Dykeman

Tamas Visegrady

Thomas Gschwind

Andreas Schade

Diego Alejandro Ortiz-Yepes

Paolo Scotton

Luis Garcés-Erice

Sean G Rooney

Christopher Mark Kenyon

Douglas H Dykeman

Michael Kuyper

Frank Höring

Eirich Thomas

Michael P Kuyper

Frank Horing

Reto Hermann

A security device () is provided for facilitating management of secret data items such as cryptographic keys which are used by a remote server () to authenticate operations of the server (). The device () has a user interface (), control logic () and a computer interface () for connecting the device () to a local user computer () for communication with the remote server () via a data communications network (). The control logic is adapted to establish via the user computer () a mutually-authenticated connection for encrypted end-to-end communications between the device () and server (). In a backup operation, the secret data items are received from the server () via this connection. The control logic interacts with the user via the user interface () to obtain user authorization to backup secret data items and, in response, stores the secret data items in memory (). To restore secret data items to the server, the control logic interacts with the user via the user interface () to obtain user authorization to restore secret data items and, in response, sends the secret data items to the server () via said connection.

Management of secret data items used for server authentication

A computer to boot from a user trusted device, the user trusted device comprising a connection interface enabling connection with said computer, the method comprising: enabling said computer to start booting from the user trusted device upon connection of the user trusted device with said computer via said connection interface; instructing a processor of the computer to execute virtualization sensitive code and issue completion data upon completion of execution, which completion data depends on the virtualization sensitive code and its execution by the processor; determining, based on said completion data, whether the execution was not performed in a virtualized environment; and enabling said computer to complete booting from the user trusted device upon determining that the execution was not performed in a virtualized environment. The invention is further directed to a user trusted device enabling this method and to related systems.

User trusted device for detecting a virtualized environment

The present invention is directed to a handheld companion device, including: a screen, rigid physical connection means, communication means, adapted for setting up and supporting at least one communication link with at least one external computerized system; and a memory storing computerized methods. The present invention is further directed to related systems and methods for automatically rotating contents displayed on such devices, when rigidly attached on a handheld mobile device.

Automatic rotation of display contents of a handheld companion device rigidly attached to a handheld mobile device

A system and method for executing software modules on a computer, the method comprising: executing (S) a bootloader (), at least partly () in the computer (); and upon execution of the bootloader: accessing (S) requirements as to an initial set (IS) of software modules (SMn); and hardware specifications of the computer; determining (S) within said initial set, one or more candidate sets (CS, CS) of software modules that are compatible (S) with said hardware specifications and can (S) be stored as a RAM disk; and storing (S) the software modules of a final set (FS) on a RAM disk (), the final set (FS) being one of the one or more candidate sets, and instructing to execute the software modules stored on the RAM disk, wherein each of the initial set and the final set of software modules comprises application components and operating system image components, and preferably further comprises hardware component drivers.

Secure execution of software modules on a computer

A method, a secure device and a computer program product for securely managing files. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server via a host, the host connected to the server through a telecommunication network, upon receiving a request for using a file stored on the secure device, processing the request at the secure device according to an updated use permission associated to the file, where the updated use permission is obtained by instructing at the secure device to establish a connection between the secure device and the server via the host and updating at the device the use permission associated to the file, according to permission data sent from the server through the established connection.

Method, secure device, system and computer program product for securely managing files

A method, a secure device, a system and a computer program product for securely managing user access to a file system. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server through a telecommunication network establishing a connection between the secure device and the server, receiving at the secure device, through the established connection, data pertaining to a file system identifying files which are at least partly stored outside the secure device, exposing at the secure device the file system to a user, based on the data received from the server, the file system navigable by the user.

Method, secure device, system and computer program product for securely managing user access to a file system

The present invention is notably directed to a user trusted device (), comprising: a connection interface () enabling connection (S) with a computer (); and a persistent memory () storing modules (), which are configured, upon connection of the user trusted device () with said computer () via said connection interface (), to: enable said computer () to start booting (S, S) from the user trusted device (); map (S) firmware data to a code, the firmware data comprising program code of an initialization firmware and/or data accessible by the initialization firmware () of the computer while starting to boot; attest (S-S) trustworthiness of the code; and enable (S) said computer () to complete booting from the user trusted device () if the code is attested. The present invention is further directed to related systems and methods.

User trusted device to attest trustworthiness of initialization firmware

The present invention is notably directed to a method for enabling a computer () to boot from a user trusted device (), the user trusted device () comprising a connection interface () enabling connection (S) with said computer (), the method comprising: enabling (S) said computer () to start booting from the user trusted device () upon connection (S) of the user trusted device with said computer () via said connection interface (); instructing a processor () of the computer () to execute (S) virtualization sensitive code and issue (S) completion data upon completion of execution, which completion data depends on the virtualization sensitive code and its execution by the processor (); determining (S-S), based on said completion data, whether the execution was not performed in a virtualized environment; and enabling (S) said computer () to complete booting from the user trusted device () upon determining that the execution was not performed in a virtualized environment. The invention is further directed to a user trusted device enabling this method and to related systems.

A system and method of performing electronic transactions between a server computer and a client computer. The method implements a communication protocol with encrypted data transmission and mutual authentication between a server and a hardware device via a network, performs a decryption of encrypted server responses, forwards the decrypted server responses from the hardware device to the client computer, displays the decrypted server responses on a client display, receives requests to be sent from the client computer to the server, parses the client requests for predefined transaction information by the hardware device, encrypts and forwards client requests, displays the predefined transaction information upon detection, forwards and encrypts the client request containing the predefined transaction information to the server if a user confirmation is received, and cancels the transaction if no user confirmation is received.

System and method of performing electronic transactions

A mobile touch-generating device includes logic; a touch-generating system, including one or more touch-generating elements, operatively coupled to the logic and configured to generate touch events detectable by a touchscreen, via the elements; a network connectivity device operatively coupled to the logic to establish a secure connection with a server via a telecommunication network and receive data through an established secure connection; and a visualization device connectable to the logic to display contents according to data received through the established secure connection.

Mobile touch-generating device as secure loupe for touchscreen devices

The invention relates to a method for distribution of a set of credentials from a credential issuer to a credential user. The credential user is provided with a user device. A first channel and a second channel are provided for communication between the user device and the credential issuer. A shared key is distributed between the user device and the credential issuer by means of the second channel. A binary representation of the set of credentials with a predefined maximum level of deviation from a uniform distribution is generated. The binary representation of the set of credentials is encrypted by means of the shared key. The encrypted set of credentials is distributed via the first channel from the credential issuer to the user device. The encrypted set of credentials is decrypted by the user device by means of the shared key.

Distribution of credentials

A mobile touch-generating device having logic and a touch-generating system. The touch-generating system includes one or more touch-generating elements. The touch-generating system is operatively coupled to the logic to generate touch events via the one or more touch-generating elements, the touch events detectable by a touchscreen, such as, a capacitive sensing touchscreen. Also provided are: (i) a method of bidirectional communication between a mobile touch-generating device and a touchscreen device; and (ii) a computer readable non-transitory medium containing a computer program which, when executed, causes a computer to execute the steps of the above method.

Growing community of inventors

Gross, Switzerland

Michael Baentsch