Red Hat, Inc.

Robert B Lord

Steven William Parkinson

Robert J Relyea

Nang Kon Kwan

A method includes detecting a security token device that is un-formatted with respect to an enterprise, wherein the security token device comprises a first cryptographic authentication key, and formatting, by a processor, the security token device by replacing the first cryptographic authentication key of the security token device with a second cryptographic authentication key that is specific to a security requirement of the enterprise.

Smartcard formation with authentication

An embodiment relates generally to a method of binding a token to a user. The method includes receiving a token embedded with an address and inserting the token into a computer. The method also includes connecting to the address stored on the token and binding a user to the token based on information from the address.

Token Registration

An embodiment generally relates to a method of managing tokens. The method includes detecting a presence of a token at a client and determining a status of the token. The method also includes formatting the token at the client in response to the status of the token being unformatted.

Smartcard formation with authentication keys

Embodiments of the present invention provide for recycling a locked token in an enterprise. A secure connection can be established between a locked token and a server and a security process activated to determine an identity of an authorized user of the locked token. An unlock procedure can be activated to unlock the locked token upon receipt of an out-of-band parameter associated with a requester of the unlock procedure to produce an unlocked token. The out-of-band parameter can be provided by the requester of the unlock procedure in an independent communication to an enterprise agent associated with the security server so as to verify that the requester is the authorized user of the locked token. A password reset process associated with a new password for the unlocked token can be activated to provide an assigned password or a password entered by the requester.

Token recycling

An embodiment generally relates to a method of increasing user convenience. The method includes displaying a log-in user interface and receiving an authentication attempt in the log-in user interface. The method also includes determining a status of the authentication attempt and delaying a completion of an authentication attempt by a time-based function in response to a status being a failed authentication attempt.

Time-based function back-off

An embodiment relates generally to a method of assigning roles to a token. The method includes determining a first role for a first participant on a token and providing exclusive access to a first section of the token for the first participant base on the first role. The method also includes determining a second role for a second participant on the token and providing exclusive access to a second section of the token for the second participant based on the second role.

Methods and systems for assigning roles on a token

A method and system for optimizing transmission of electronic messages. In one embodiment, the method includes maintaining a database to store electronic messages received from various clients. The method further includes receiving a new electronic message from a client, determining whether the new electronic message is associated with one or more messages stored in the database. If the new electronic message is not associated with any messages stored in the database, the new electronic message is sent to the recipients. If the new electronic message is associated with some messages stored in the database, the new electronic message is sent to the recipients, and in addition, the associated messages that are not stored locally at a particular recipient are sent to this recipient.

Method and system for optimizing transmission of electronic messages

Embodiments of the present invention may detect an access attack by analyzing the passwords from successive access requests in an access session or by analyzing successive access attempts to determine patterns in the access information. For example, the analysis may consist of examining the access information to determine cycling in passwords of the access information. Cycling passwords may consist of password that are varied in a predictable or repetitive manner such as 'aaaa', 'aaab', &#x201c;aaac&#x201d;, &#x201c;aaad&#x201d;, etc. In addition, the usernames and passwords from successive access requests in an access session are analyzed to determine patterns in both the usernames and passwords. The analysis may consist of examining the access information to determine the use of identical passwords for various usernames. The analysis may also detect the cycling of passwords across multiple usernames.

Methods and systems for detecting an access attack

Systems and methods for providing a multiple source entropy feed for a PRNG that is used to generate server-side encryption keys are disclosed. A data recovery manager may collect additional entropy sources that feed into the PRNG between each key generation. The entropy may be collected from a variety of sources, for example, high-resolution timer intervals between input/output interrupts, hard disk access operations, and the like. The number of bits of entropy collected may be configured for each key generation.

Methods and systems for entropy collection for server-side key generation

An embodiment relates generally to a method of selecting certificates. The method includes invoking a send option for an email client and displaying a send mail user interface for the email client. The method also includes displaying a default certificate in a graphical user element in the send mail user interface.

Method, apparatus and system for secure electronic mail

A method and apparatus for providing a graphical user interface to present electronic messages. In one embodiment, the method includes providing a user interface presenting a first electronic message to a recipient, where the first electronic message is associated with a segment of a second electronic message. The method further includes identifying the associated segment of the second electronic message to the recipient in the user interface, and allowing the recipient to view the second electronic message in an original form.

GUI for presenting electronic messages

A method and apparatus for composing electronic messages. In one embodiment, the method includes dividing a first electronic message into one or more segments, uniquely identifying each of the segments of the first electronic message, and storing the first electronic message in a repository with unique identifiers of the segments. The segments can then be individually accessible by a user viewing the first electronic message.

Method and system for composing electronic messages

In one embodiment, an apparatus and method for partitioning data on a smartcard dependent on an entered password are disclosed. In one embodiment, the method includes maintaining multiple containers in a smartcard, associating a different personal identification number (PIN) with each of the multiple containers, and accessing contents of a container when an associated PIN for the container is provided by a user of the smartcard. Other embodiments are also described.

Growing community of inventors

Mountain View, CA, United States of America

Robert B Lord