Entrust Corporation

Entrust Technologies Limited

Northern Telecom Limited

Stephen William Hillier

Paul C Van Oorschot

Michael Brownlie

Ron J Vandergeest

Ian H Curry

Josanne Mary Otway

Warwick S Ford

Gerrard Eric Rosenquist

James Arthur Turnbull

Dineshbhai Solanki

Eric C Jacksch

Ramon Jonathan Dilkie

Ray C H Cheng

Methods, systems and devices for providing RFID system security are provided that involve cryptographically encrypting data on a transponder and managing the release of the decryption information, decryption keys, or the data itself to a transceiver having a transaction with the transponder.

RFID transponder information security methods systems and devices

A computer network security system and method utilizes digitally signed and centrally assigned policy data, such as password length rules, that is unilaterally enforced at network nodes by node policy enforcement engines. The policy data may be variable on a per client or network node basis through a centralized authority, such as a certification authority. The computer network security system provides variable security policy rule data for distribution to at least one network node through a central security policy rule data distribution source, such as the certification authority. The central security policy rule data distribution source associates a digital signature to the variable security policy rule data to ensure the integrity of the policies in the system. Each network node uses a policy rule data engine and policy rule table to decode policy rule data and enforce the policy rules as selectively determined through the central authority.

Computer network security system and method having unilateral enforceable security policy provision

A method and apparatus for securely communicating data employs a third-party to facilitate decryption by the recipient. It is necessary for the recipient to interact with the third-party to decrypt received encrypted data. The third-party is unable to decrypt or read the encrypted data and records whether the recipient requested a decryption key generated by the third-party. The third party logs the request from the second party for the decryption key. The originator may then obtain the delivery status of the data from the third party to facilitate proof of submission, proof of delivery, or any other suitable information.

Method and apparatus for secure communications using third-party key provider

Methods and systems are provided which convey access control information from a first server to a second server through an end user device, for example in a system in which these servers and devices are all connected to the Internet. The method starts after the first server receives a message from the end user device. The first server in response to this message from the end user device sends a response message to the end user device containing the access control information to be conveyed to the second server, optionally after performing authentication. The response message also contains an instruction for the end user device to post a second message to the second server containing the information. The information is preferably contained in a content portion of the message. A hidden form may be used in the response message to contain the information. Optionally, the end user may be presented with an option to post the second message or not. This may allow conformance with data privacy laws requiring end user consent of data transfer. The instruction to post to the second server may consist of active content within the response message's content portion. This can be used to cause an end user device to store a cookie in association with a number of servers in different domains thereby implementing a multiple domain single sign-on function.

Systems and methods providing interactions between multiple servers and an end use device

A method and apparatus for dynamically accessing security credentials that are used to participate in a secure communication begins by obtaining virtual credentials of an entity, where the virtual credentials include a data specifier and/or an identifier. The data specifier functions as a pointer to a particular physical security credential, its data storage location, and the format of the physical security credential. The identifier functions as a pointer to secondary virtual credentials, which include at least one data specifier. The processing continues by generating physical security credentials based on the physical security credentials retrieved via the data specifiers. The processing then continues by utilizing the physical security credentials by an individual entity (e.g., a party, a server, an administrator, etc.) such that the individual entity may participate in a secured communication. If, during the secured communication, any of the physical security credentials change, the physical security credentials are updated in accordance with a synchronization record to maintain data synchronization.

Method and apparatus for dynamically accessing security credentials and related information

A method and apparatus for extending secure communication operations via shared lists is accomplished by creating a shared list in accordance with authorization parameters by one user and subsequently accessing the shared list via the authorization parameters by this and other users. To create the list, a user within the secured communication system determines whether it has been enabled, or authorized, to create a shared list. If so, the user identifies at least one other user to be added to the shared list. Having identified another user, the user creating the shared list verifies that the secure communication parameters (which includes a public key certificate of an end-user or of a certification authority) it has received regarding the another user is trustworthy. If the secure communication parameters are identified as trustworthy, the secure communication parameters of the another user are added to the shared list. To authenticate the shared list, the user creating the list digitally signs it. Once the shared list is created, other users, if authorized, may access the shared list to obtain certificates (e.g., encryption and/or signature verification certificates) of the users contained in the list.

Method and apparatus for extending secure communication operations via a

A method and apparatus for centralizing the processing of key and certificate life-cycle management is accomplished when security activation of a communication device has been detected. Security activation may occur at log-on of the secure communication device (e.g., a personal computer equipped with a security application, or applications), at activation of a security application, or at re-authentication of a security application. Once the security activation has been detected, the secured communication device accesses a depository of security information to retrieve relevant security information. The secured communication device then interprets the relevant security information to determine when local security parameters are to be changed. When local security parameters (e.g., encryption key pair, a corresponding encryption public key certificate, a signing key pair, and/or a corresponding verification public key certificate) are to be changed, the local security parameters are updated. Having done this, the secured communication device is then receptive to receiving access requests from a plurality of software applications. The access requests are each requesting that data created by a corresponding one of the plurality of software application be secured via the security application. In response to the request, the data is secured based on either the updated local security parameters or the existing local security parameters.

Method and apparatus for centralizing processing of key and certificate

A method which allows implementation of the revocation of public-key certificates facilitates engineering of certificate revocation lists (CRLs). It solves the practical problem of CRLs potentially growing to unmanageable lengths by allowing CRLs to be segmented, based on size considerations or priority considerations related to revocation reasons. The method is used to distribute CRL information to users of certificate-based public-key systems. It is also applied more generally to update any field in a certificate by reference to a secondary source of authenticated information.

Growing community of inventors

Ottawa, Canada

Stephen William Hillier