Pervasive, user-centric network security enabled by dynamic datagram switch and an on-demand authentication and encryption scheme through mobile intelligent data carriers

• US 20040221163A1
• Filed: 01/16/2004
• Published: 11/04/2004
• Est. Priority Date: 05/02/2003
• Status: Active Grant

• Current Assignee: Giritech APS
• Original Assignee: Giritech APS
• Inventors: Jorgensen, Jimi T., Damon, Craig L., Arlaud, Christopher L., Pathuel, Jan
• Granted Patent: US 7,360,087 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 2209/08 Randomization, e.g. dummy operations or using noise
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

Methods and systems are provided for improving access control, administrative monitoring, reliability, as well as flexibility of data transmission and remote application sharing over a network. Secure, stable network connections and efficient network transactions among multiple users are supported by an open and distributed client-server architecture. A datagram schema is adapted to enable dynamic datagram switching in support of a multitude of applications and network services. Mobile intelligent data carriers are provided that allow for the implementation of an authentication and encryption scheme. The intelligent data carriers are adapted to target deliver applications to authorized users, thereby achieving access control to not only data but also applications. The authentication and encryption scheme in one embodiment is based on physical or performance biometrics. The methods and systems of this disclosure may be advantageously deployed in an enterprise network environment to support a wide spectrum of business, research, and administrative operations.

Claims

1. A system of secure network connectivity between one or more users and at least one network server, comprising:

at least one intelligent data carrier, issued to one user, wherein said intelligent data carrier comprises at least (i) one memory, adapted to store data, (ii) one input-output apparatus, adapted to input and output data, and (iii) one processor, adapted to process the data stored in said memory, wherein said intelligent data carrier is capable of connecting to a host computer device thereby transmitting data via said input-output apparatus over the network, and wherein said intelligent data carrier is adapted to establish a network identity for the user through an authentication and encryption scheme; and

a dynamic datagram switch for dynamic allocation and swapping of datagrams for a multiplicity of applications in service to the one or more users.

2. The system of claim 1, wherein said intelligent data carrier is mobile.

3. The system of claim 1, wherein said intelligent data carrier is implemented with one of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

4. The system of claim 1, wherein said authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the network server that the intelligent data carrier be authenticated;

(b) the network server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality through an event;

(d) the network server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the network server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each said data authentication object is a data vector object, capable of being analyzed using one or more classifiers;

(f) the network server analyzing said data authentication objects, according to said one or more classifiers, thereby determining the result of the authentication; and

(g) the network server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

5. The system of claim 4, wherein said event in step (c) comprises at least one of a click of a mouse, a touch on a screen, a keystroke, an utterance, and a biometric measurement.

6. The system of claim 4, wherein said demand in step (d) comprises at least one of a pseudo random and a true random code, wherein a pseudo random code is generated based on a mathematically pre-calculated list, and wherein a true random code is generated by sampling and processing a source of entropy outside of the system.

7. The system of claim 6, wherein said randomization is performed with one or more random generators and one or more independent seeds.

8. The system of claim 4, wherein said analyzing in step (f) is performed based on one or more analysis rules.

9. The system of claim 4, wherein said one or more analysis rule comprises classification according to the one or more classifiers of step (e).

10. The system of claim 9, wherein said classification comprises speaker verification, wherein the data object vectors involve two classes, the target speaker and the impostor, wherein each class is characterized by a probability density function, and wherein the determining in step (f) is a binary decision problem.

11. The system of claim 4, wherein said determining in step (f) comprises computing at least one of the sum, superiority, and probability from said one or more data vector objects, based on the one or more classifiers of step (e).

13. The system of claim 4, wherein said one or more classifiers in step (e) comprise a super classifier derived from the more than one data vector objects.

14. The system of claim 13, wherein said super classifier is based on physical biometrics, comprising at least one of voice recognition, fingerprints, handprints, blood vessel patterns, DNA tests, retinal or iris scan, and face recognition.

15. The system of claim 13, wherein said super classifier is based on performance biometrics, comprising habits or patterns of individual behaviors.

16. The system of claim 1, wherein said authentication and encryption scheme comprises symmetrical and asymmetrical multi-cipher encryption.

17. The system of claim 16, wherein said encryption uses at least one of output feedback, cipher feedback, cipher forwarding, and cipher block chaining.

18. The system of claim 17, wherein the encryption is based on Advanced Encryption Standard (AES) Rijndael.

19. The system of claim 1, wherein said authentication and encryption scheme implements Secure Key Exchange (SKE).

20. The system of claim 19, wherein SKE employs a public key system.

21. The system of claim 19, wherein SKE employs Elliptic Curve Cryptosystem (ECC) private keys.

22. The system of claim 1, wherein the authentication and encryption scheme comprises at least one of a logic test adapted to validate that the intelligent data carrier has been registered with the server, a device test adapted to validate the physical parameters at the intelligent data carrier and the host computer device, and a personal test adapted to authenticate the user based on event-level data.

23. The system of claim 1, wherein said multiplicity of applications comprises at least one of window-based remote terminal server applications, applications on 3270/5250 terminal emulators for mainframe, directly embedded applications, and multimedia applications, wherein the directly embedded applications comprise at least one of database applications, data analysis tools, Customer Relation Management (CRM) tools, and Enterprise Resource Planning (ERP) packages.

24. The system of claim 1, wherein said dynamic datagram switch comprises a datagram schema and a parser, wherein said datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein said datagram is adapted to carry (i) content data for network transmission and (ii) other information for managing and controlling network connections and support network applications, wherein each datagram type comprises a plurality of functions, and wherein said parser is adapted to parse the one or more datagram types.

25. The system of claim 24, wherein said datagram schema comprises at least one major datagram type and within said one major datagram type, at least one minor datagram type.

26. The system of claim 25, wherein the parser is adapted to parse a matrix of datagram types, said matrix comprising a first multiplicity of major datagram types and in each major datagram type of said first multiplicity, a second multiplicity of minor datagram types.

27. The system of claim 26, wherein the major datagram type is selected from the group consisting of (i) the server messages and connection control datagram, adapted to authenticate and control user connections, (ii) the content datagram, adapted to transmit the content data, (iii) the broadcast datagram, adapted to manage point-to-point, point-to-multipoint, and multipoint-to-multipoint data transmission, (iv) the connection proxy datagram, adapted to pass proxy data between the network server and the intelligent data carrier, (v) the instant message type, adapted to transmit messages in real-time, (vi) the large content transfer datagram, adapted to transfer oversized data and media files, (vii) the user directory datagram, adapted to search for network users, and (viii) the remote management datagram, adapted to remotely control network users.

28. The system of claim 27, wherein the server messages and connection control datagram comprises at least one of minor datagram types:

(i) the authentication request datagram, adapted to initiate an authentication request, (ii) the authentication reply datagram, adapted to send a response upon a request of authentication, and (iii) the authentication result datagram, adapted to send the result of an authentication session.

29. The system of claim 28, wherein the content datagram comprises at least one of minor datagram types:

(i) the normal content datagram, adapted to transmit the content data, (ii) the remote logging datagram, adapted to communicate with the network server and establish a login session, and (iii) the remote data collector datagram, adapted to transmit data from a remote connection.

30. The system of claim 29, wherein the content datagram further comprises at least one of minor datagram types:

(iv) the content approval request datagram, adapted to request verification of the content data transmitted, and (v) the content approval reply datagram, adapted to respond to a request of verification of the content data transmitted.

31. The system of claim 27, wherein the connection proxy datagram comprises at least one of minor datagram types:

(i) proxy data to server, adapted to pass proxy data to the network server from the intelligent data carrier, and (ii) proxy data from server, adapted to pass the proxy data from the network server to the intelligent data carrier.

32. The system of claim 27, wherein the instant message type comprises at least one of minor datagram types:

(i) the file transmission type, (ii) the audio-video transmission type, (iii) the instant mail message type, and (iv) the remote data collection type.

33. The system of claim 24, wherein each datagram in the datagram schema has a generic layout comprising:

(A) header fields for (i) one or more major datagram types, (ii) one or more minor datagram type, (ii) the datagram length, and (iii) a datagram checksum, and

(B) a datagram payload for carrying data in transmission.

34. The system of claim 33, wherein the generic layout comprises one or more additional header fields.

35. The system of claim 33, wherein the generic layout follows a TCP header.

36. The system of claim 1, wherein the intelligent data carrier further comprises a radar connector, wherein the radar connector interfaces the network and is adapted to monitor and control network connections.

37. The system of claim 36, wherein the network server further comprises a radar connector adapted to monitor and control network connections, wherein the radar connector of the network server is connected to the radar connector of the intelligent data carrier over the network.

38. The system of claim 37, wherein said radar connector is further adapted to detect lost connections and initialize contact to the network server thereby reestablishing connections.

39. The system of claim 1, further comprising an injector, adapted to connect an existing networks to the network server and transmit data between said existing network and the intelligent data carrier via the network server, wherein said existing network is wired or wireless.

40. The system of claim 39, wherein the injector further comprises a radar connector, interfacing the network and adapted to monitor and control network connections.

12. The system of claim 12, wherein the sum is one of a superior and a random sum computed from the one or more data vector objects.

41. A client-server communication system, comprising:

at least one server, comprising a dynamic datagram switch for dynamic allocation and swapping of datagrams for a multiplicity of network applications; and

at least one client, wherein the client is an intelligent data carrier, comprising at least (i) one memory, adapted to store data, (ii) one input-output apparatus, adapted to input and output data, and (iii) one processor, adapted to process the data stored in said memory, wherein said intelligent data carrier is capable of connecting to a host computer device thereby transmitting data via said input-output apparatus over the network, and wherein said intelligent data carrier is adapted to establish a network user identity through an authentication and encryption scheme for secure data transmission between said server and said client.

42. The client-server communication system of claim 41, wherein the intelligent data carrier is mobile.

43. The client-server communication system of claim 42, wherein said intelligent data carrier is implemented with one of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

44. The client-server communication system of claim 41, wherein said dynamic datagram switch comprises a datagram schema and a parser, wherein said datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein said datagram is adapted to carry (i) content data for network transmission and (ii) other information for managing and controlling network connections and support network applications, wherein each datagram type comprises a plurality of functions, and wherein said parser is adapted to parse the one or more datagram types.

45. The client-server communication system of claim 44, wherein said datagram schema comprises at least one major datagram type and within said one major datagram type, at least one minor datagram type.

46. The client-server communication system of claim 45, wherein the parser is adapted to parse a matrix of datagram types, said matrix comprising a first multiplicity of major datagram types and in each major datagram type of said first multiplicity, a second multiplicity of minor datagram types.

47. The client-server communication system of claim 46, wherein each datagram in the datagram schema has a generic layout comprising:

(A) header fields for (i) one or more major datagram types, (ii) one or more minor datagram type, (ii) the datagram length, and (iii) a datagram checksum, and

(B) a datagram payload for carrying data in transmission.

48. The client-server communication system of claim 41, wherein said authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the server that the client be authenticated;

(b) the network server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality through an event;

(d) the server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each said data authentication object is a data vector object, capable of being analyzed using one or more classifiers;

(f) the server analyzing said data authentication objects, according to said one or more classifiers, thereby determining the result of the authentication; and

(g) the server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

49. The client-server communication system of claim 48, wherein said event in step (c) comprises at least one of a click of a mouse, a touch on a screen, a keystroke, an utterance, and a biometric measurement.

50. The client-server communication system of claim 49, wherein said demand in step (d) comprises at least one of a pseudo random and a true random code, wherein a pseudo random code is generated based on a mathematically pre-calculated list, and wherein a true random code is generated by sampling and processing a source of entropy outside of the system.

51. The client-server communication system of claim 50, wherein said randomization is performed with one or more random generators and one or more independent seeds.

52. The client-server communication system of claim 48, wherein said analyzing in step (f) is performed based on one or more analysis rules.

53. The client-server communication system of claim 49, wherein said one or more analysis rule comprises classification according to the one or more classifiers of step (e).

54. The client-server communication system of claim 53, wherein said classification comprises speaker verification, wherein the data object vectors involve two classes, the target speaker and the impostor, wherein each class is characterized by a probability density function, and wherein the determining in step (f) is a binary decision problem.

55. The client-server communication system of claim 48, wherein said determining in step (f) comprises computing at least one of the sum, superiority, and probability from said one or more data vector objects, based on the one or more classifiers of step (e).

57. The client-server communication system of claim 48, wherein said one or more classifiers in step (e) comprise a super classifier derived from the more than one data vector objects.

58. The client-server communication system of claim 57, wherein said super classifier is based on physical biometrics, comprising at least one of voice recognition, fingerprints, handprints, blood vessel patterns, DNA tests, retinal or iris scan, and face recognition.

59. The client-server communication system of claim 57, wherein said super classifier is based on performance biometrics, comprising habits or patterns of individual behaviors.

60. The client-server communication system of claim 41, wherein said authentication and encryption scheme comprises symmetrical and asymmetrical multi-cipher encryption.

61. The client-server communication system of claim 41, wherein said encryption uses at least one of output feedback, cipher feedback, cipher forwarding, and cipher block chaining.

62. The client-server communication system of claim 61, wherein the encryption is based on Advanced Encryption Standard (AES) Rijndael.

63. The client-server communication system of claim 41, wherein said authentication and encryption scheme implements Secure Key Exchange (SKE).

64. The client-server communication system of claim 63, wherein SKE employs a public key system.

65. The client-server communication system of claim 63, wherein SKE employs Elliptic Curve Cryptosystem (ECC) private keys.

66. The client-server communication system of claim 65, wherein the authentication and encryption scheme comprises at least one of a logic test adapted to validate that the intelligent data carrier has been registered with the server, a device test adapted to validate the physical parameters at the intelligent data carrier and the host computer device, and a personal test adapted to authenticate the user based on event-level data.

67. The client-server communication system of claim 41, further comprising an injector, adapted to connect an existing network to the server and transmit data between the existing networks and the client via the server, wherein the existing network is wired or wireless.

68. The client-server communication system of claim 67, wherein the server, client, and injector each comprises a radar connector, wherein the radar connector interfaces the network and is adapted to monitor and control network connections, wherein the radar connector of the client is connected to the radar connector of the server over the network, and wherein the radar connector of the injector is connected to the radar connector of the server over the network.

69. The client-server communication system of claim 68, wherein the radar connector of the client is further adapted to detect lost connections and initialize contact to the server thereby reestablishing connections.

70. The client-server communication system of claim 41, wherein the server further comprises an encrypted virtual file system for dedicated data storage for the client.

56. The client-server communication system of claim 56, wherein the sum is one of a superior and a random sum computed from the one or more data vector objects.

71. An intelligent data carrier, comprising at least (i) one memory, adapted to store data, (ii) one input-output apparatus, adapted to input and output data, and (iii) one processor, adapted to process the data stored in said memory, wherein the intelligent data carrier is capable of connecting to a host computer device on a network thereby transmitting data via said input-output apparatus over the network, wherein the data transmission is through dynamically-switched datagrams, wherein the intelligent data carrier is adapted to establish a network user identity through an authentication and encryption scheme for secure network data transmission.

72. The intelligent data carrier of claim 71, wherein said authentication i i and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to a server on the network that the intelligent data carrier be authenticated;

(b) the server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality through an event;

(d) the server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each said data authentication object is a data vector object, capable of being analyzed using one or more classifiers;

(f) the server analyzing said data authentication objects, according to said one or more classifiers, thereby determining the result of the authentication; and

(g) the server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

73. The intelligent data carrier of claim 72, wherein said event in step (c) comprises at least one of a click of a mouse, a touch on a screen, a keystroke, an utterance, and a biometric measurement.

74. The intelligent data carrier of claim 72, wherein said demand in step (d) comprises at least one of a pseudo random and a true random code, wherein a pseudo random code is generated based on a mathematically pre-calculated list, and wherein a true random code is generated by sampling and processing a source of entropy outside of the system.

75. The intelligent data carrier of claim 74, wherein said randomization is performed with one or more random generators and one or more independent seeds.

76. The intelligent data carrier of claim 72, wherein said analyzing in step (f) is performed based on one or more analysis rules.

77. The intelligent data carrier of claim 76, wherein said one or more analysis rule comprises classification according to the one or more classifiers of step (e).

78. The intelligent data carrier of claim 77, wherein said classification comprises speaker verification, wherein the data object vectors involve two classes, the target speaker and the impostor, wherein each class is characterized by a probability density function, and wherein the determining in step (f) is a binary decision problem.

79. The intelligent data carrier of claim 72, wherein said determining in step (f) comprises computing at least one of the sum, superiority, and probability from said one or more data vector objects, based on the one or more classifiers of step (e).

80. The intelligent data carrier of claim 79, wherein the sum is one of a superior and a random sum computed from the one or more data vector objects.

81. The intelligent data carrier of claim 72, wherein said one or more classifiers in step (e) comprise a super classifier derived from the more than one data vector objects.

82. The intelligent data carrier of claim 81, wherein said super classifier is based on physical biometrics, comprising at least one of voice recognition, fingerprints, handprints, blood vessel patterns, DNA tests, retinal or iris scan, and face recognition.

83. The intelligent data carrier of claim 81, wherein said super classifier is based on performance biometrics, comprising habits or patterns of individual behaviors.

84. The intelligent data carrier of claim 71, wherein said authentication and encryption scheme comprises symmetrical and asymmetrical multi-cipher encryption.

85. The intelligent data carrier of claim 84, wherein said encryption uses at least one of output feedback, cipher feedback, cipher forwarding, and cipher block chaining.

86. The intelligent data carrier of claim 85, wherein the encryption is based on Advanced Encryption Standard (AES) Rijndael.

87. The intelligent data carrier of claim 71, wherein said authentication and encryption scheme implements Secure Key Exchange (SKE).

88. The intelligent data carrier of claim 87, wherein SKE employs a public key system.

89. The intelligent data carrier of claim 87, wherein SKE employs Elliptic Curve Cryptosystem (ECC) private keys.

90. The intelligent data carrier of claim 71, wherein the authentication and encryption scheme comprises at least one of a logic test adapted to validate that the intelligent data carrier has been registered with the server, a device test adapted to validate the physical parameters at the intelligent data carrier and the host computer device, and a personal test adapted to authenticate the user based on event-level data.

91. The intelligent data carrier of claim 71, said intelligent data carrier being mobile.

92. The intelligent data carrier of claim 91, said intelligent data carrier is implemented with one of USB keys, Compact Flash, Smart Media, Compact Disks, DVDs, PDAs, firewire devices, and token devices.

93. The intelligent data carrier of claim 71, wherein the dynamically-switched datagrams belong to one or more datagram types and are adapted to carry (i) content data for network transmission and (ii) other information for managing and controlling network connections and supporting network applications, wherein each datagram type comprises a plurality of functions.

94. The intelligent data carrier of claim 93, wherein the datagram types comprise at least one major datagram type and within the major datagram type, at least one minor datagram type.

95. The intelligent data carrier of claim 94, wherein the datagrams conform to a generic layout, said generic layout comprising:

(A) header fields for (i) one or more major datagram types, (ii) one or more minor datagram type, (ii) the datagram length, and (iii) a datagram checksum, and

(B) a datagram payload for carrying data in transmission.

96. A method for secure network communication, comprising:

issuing to a network user an intelligent data carrier, wherein the intelligent data carrier comprises at least (i) one memory, adapted to store data, (ii) one input-output apparatus, adapted to input and output data, and (iii) one processor, adapted to process the data stored in said memory, wherein the intelligent data carrier is capable of connecting to a host computer device on the network thereby transmitting data via said input-output apparatus over the network, wherein the intelligent data carrier is adapted to establish a network identity for the network user through an authentication and encryption scheme; and

providing a dynamic datagram switch in a server on the network for dynamic allocation and swapping of datagrams in support of a multiplicity of applications.

97. The method of claim 96, wherein the intelligent data carrier is mobile.

98. The method of claim 97, wherein said intelligent data carrier is implemented with one of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

99. The method of claim 96, wherein the dynamic datagram switch comprises a datagram schema and a parser, wherein the datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein the datagram is adapted to carry (i) content data for network transmission and (ii) other information for managing and controlling network connections and support network applications, wherein the datagram type comprises a plurality of functions, and wherein the parser is adapted to parse the one or more datagram types.

100. The method of claim 99, wherein the datagram schema comprises at least one major datagram type and within said major datagram type, at least one minor datagram type.

101. The method of claim 100, wherein the parser is adapted to parse a matrix of datagram types, said matrix comprising a first multiplicity of major datagram types and in each major datagram type of said first multiplicity, a second multiplicity of minor datagram types.

102. The method of claim 99, wherein each datagram in the datagram schema has a generic layout comprising:

(A) header fields for (i) one or more major datagram types, (ii) one or more minor datagram type, (ii) the datagram length, and (iii) a datagram checksum, and

(B) a datagram payload for carrying data in transmission.

103. The method of claim 96, wherein the authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the server that the intelligent data carrier be authenticated;

(b) the server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality through an event;

(d) the server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each said data authentication object is a data vector object, capable of being analyzed using one or more classifiers;

(f) the server analyzing said data authentication objects, according to said one or more classifiers, thereby determining the result of the authentication; and

(g) the server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

104. The method of claim 103, wherein said event in step (c) comprises at least one of a click of a mouse, a touch on a screen, a keystroke, an utterance, and a biometric measurement.

105. The method of claim 103, wherein said demand in step (d) comprises at least one of a pseudo random and a true random code, wherein a pseudo random code is generated based on a mathematically pre-calculated list, and wherein a true random code is generated by sampling and processing a source of entropy outside of the system.

106. The method of claim 104, wherein said randomization is performed with one or more random generators and one or more independent seeds.

107. The method of claim 103, wherein said analyzing in step (f) is performed based on one or more analysis rules.

108. The method of claim 107, wherein said one or more analysis rule comprises classification according to the one or more classifiers of step (e).

109. The method of claim 108, wherein said classification comprises speaker verification, wherein the data object vectors involve two classes, the target speaker and the impostor, wherein each class is characterized by a probability density function, and wherein the determining in step (f) is a binary decision problem.

110. The method of claim 103, wherein said determining in step (f) comprises computing at least one of the sum, superiority, and probability from said one or more data vector objects, based on the one or more classifiers of step (e).

111. The method of claim 110, wherein the sum is one of a superior and a random sum computed from the one or more data vector objects.

112. The method of claim 103, wherein said one or more classifiers in step (e) comprise a super classifier derived from the more than one data vector objects.

113. The method of claim 112, wherein said super classifier is based on physical biometrics, comprising at least one of voice recognition, fingerprints, handprints, blood vessel patterns, DNA tests, retinal or iris scan, and face recognition.

114. The method of claim 112, wherein said super classifier is based on performance biometrics, comprising habits or patterns of individual behaviors.

115. The method of claim 96, wherein said authentication and encryption scheme comprises symmetrical and asymmetrical multi-cipher encryption.

116. The method of claim 115, wherein said encryption uses at least one of output feedback, cipher feedback, cipher forwarding, and cipher block chaining.

117. The method of claim 116, wherein the encryption is based on Advanced Encryption Standard (AES) Rijndael.

118. The method of claim 96, wherein said authentication and encryption scheme implements Secure Key Exchange (SKE).

119. The method of claim 118, wherein SKE employs a public key system.

120. The method of claim 118, wherein SKE employs Elliptic Curve Cryptosystem (ECC) private keys.

121. The method of claim 96, wherein the authentication and encryption scheme comprises at least one of a logic test adapted to validate that the intelligent data carrier has been registered with the server, a device test adapted to validate the physical parameters at the intelligent data carrier and the host computer device, and a personal test adapted to authenticate the user based on event-level data.

122. The method of claim 96, further comprising providing a first radar connector in the intelligent data carrier and a second radar connector in the server, wherein the first radar connector is adapted to connected to the second radar connector over the network, wherein the first and the second radar connector are adapted to monitor and control network connections.

123. The method of claim 122, wherein the first radar connector is further adapted to detect lost connections and initialize contact to the second radar connector thereby reestablishing connections.

124. The method of claim 96, further comprising providing an encrypted virtual file system in the server for dedicated data storage for the client.

125. The method of claim 96, wherein the dynamic datagram switch performs datagram allocation and swapping in real time.

126. The method of claim 96, wherein the dynamic datagram switch performs datagram allocation and swapping based on memory pointers of two or more datagrams.

127. A method for target delivery of one or more applications to a user, comprising:

issuing the user an intelligent data carrier, adapted to dock onto a host computer device that is connected to a network on which a network server sits and communicate with the network server over the network, wherein the network server communicates with the intelligent data carrier through dynamically-switched datagrams, wherein the intelligent data carrier comprises at least (i) one memory, adapted to store data, (ii) one input-output apparatus, adapted to input and output data, and (iii) one processor, adapted to process the data stored in said memory;

the server authenticating the user through an authentication and encryption scheme; and

granting the user access to the one or more applications upon successful authentication.

128. The method of claim 127, wherein said one or more applications are preloaded on the intelligent data carrier or installed on the network server or the host computer device.

129. The method of claim 128, wherein the host computer device is connected to the network via wired or wireless means.

130. The method of claim 128, wherein the host computer device comprises at least one of a desktop or laptop computer, a personal digital assistant (PDA), a mobile phone, a digital TV, an audio or video player, a computer game consol, a digital camera, a camera phone, and a network-enabled domestic appliance.

131. The method of claim 130, wherein the network-enabled domestic appliance is one of a network-enabled refrigerator, microwave, washer, dryer, and dishwasher.

132. The method of claim 127, wherein said one or more applications comprise at least one of window-based remote terminal server applications, applications on 3270/5250 terminal emulators for mainframe, directly embedded applications, and multimedia applications, wherein the directly embedded applications comprise at least one of database applications, data analysis tools, Customer Relation Management (CRM) tools, and Enterprise Resource Planning (ERP) packages.

133. The method of claim 127, wherein said intelligent data carrier is mobile.

134. The method of claim 127, wherein said intelligent data carrier is implemented with one of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

135. The method of claim 127, wherein the dynamically switched datagrams belong to one or more datagram types and adapted to carry (i) content data for network transmission and (ii) other information for managing and controlling network connections and support network applications, wherein the datagram type comprises a plurality of functions.

136. The method of claim 135, wherein the datagram types comprises at least one major datagram type and within the major datagram type, at least one minor datagram type.

137. The method of claim 136, wherein the datagrams conform to a generic layout that comprises:

(A) header fields for (i) one or more major datagram types, (ii) one or more minor datagram type, (ii) the datagram length, and (iii) a datagram checksum, and (B) a datagram payload for carrying data in transmission.

138. The method of claim 127, wherein the authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the server that the intelligent data carrier be authenticated;

(b) the server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality through an event;

(d) the server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each said data authentication object is a data vector object, capable of being analyzed using one or more classifiers;

(f) the server analyzing said data authentication objects, according to said one or more classifiers, thereby determining the result of the authentication; and

(g) the server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

139. The method of claim 138, wherein said event in step (c) comprises at least one of a click of a mouse, a touch on a screen, a keystroke, an utterance, and a biometric measurement.

140. The method of claim 138, wherein said demand in step (d) comprises at least one of a pseudo random and a true random code, wherein a pseudo random code is generated based on a mathematically pre-calculated list, and wherein a true random code is generated by sampling and processing a source s of entropy outside of the system.

141. The method of claim 140, wherein said randomization is performed with one or more random generators and one or more independent seeds.

142. The method of claim 138, wherein said analyzing in step (f) is performed based on one or more analysis rules.

143. The method of claim 142, wherein said one or more analysis rule comprises classification according to the one or more classifiers of step (e).

144. The method of claim 143, wherein said classification comprises speaker verification, wherein the data object vectors involve two classes, the target speaker and the impostor, wherein each class is characterized by a probability density function, and wherein the determining in step (f) is a binary decision problem.

145. The method of claim 138, wherein said determining in step (f) comprises computing at least one of the sum, superiority, and probability from said one or more data vector objects, based on the one or more classifiers of step (e).

146. The method of claim 145, wherein the sum is one of a superior and a random sum computed from the one or more data vector objects.

147. The method of claim 138, wherein said one or more classifiers in step (e) comprise a super classifier derived from the more than one data vector objects.

148. The method of claim 147, wherein said super classifier is based on physical biometrics, comprising at least one of voice recognition, fingerprints, handprints, blood vessel patterns, DNA tests, retinal or iris scan, and face recognition.

149. The method of claim 147, wherein said super classifier is based on performance biometrics, comprising habits or patterns of individual behaviors.

150. The, method of claim 127, wherein said authentication and encryption scheme comprises symmetrical and asymmetrical multi-cipher encryption.

151. The method of claim 150, wherein said encryption uses at least one of output feedback, cipher feedback, cipher forwarding, and cipher block chaining.

152. The method of claim 151, wherein the encryption is based on Advanced Encryption Standard (AES) Rijndael.

153. The method of claim 127, wherein said authentication and encryption scheme implements Secure Key Exchange (SKE).

154. The method of claim 153, wherein SKE employs a public key system.

155. The method of claim 153, wherein SKE employs Elliptic Curve Cryptosystem (ECC) private keys.

156. The method of claim 127, wherein the authentication and encryption scheme comprises at least one of a logic test adapted to validate that the intelligent data carrier has been registered with the server, a device test adapted to validate the physical parameters at the intelligent data carrier and the host computer device, and a personal test adapted to authenticate the user based on event-level data.

157. The method of claim 127, further comprising providing a first radar connector in the intelligent data carrier and a second radar connector in the server, wherein the first radar connector is adapted to connected to the second radar connector over the network, wherein the first and the second radar connector are adapted to monitor and control network connections.

158. The method of claim 157, wherein the first radar connector is further adapted to detect lost connections and initialize contact to the second radar connector thereby reestablishing connections.

159. The method of claim 127, further comprising providing an encrypted virtual file system in the server for dedicated data storage for the intelligent data carrier.

160. The method of claim 127, wherein the datagrams are dynamically switched based on their memory pointers.