Pervasive, user-centric network security enabled by dynamic datagram switch and an on-demand authentication and encryption scheme through mobile intelligent data carriers

• US 7,103,772 B2
• Filed: 05/02/2003
• Issued: 09/05/2006
• Est. Priority Date: 05/02/2003
• Status: Active Grant

• Current Assignee: Giritech APS
• Original Assignee: Giritech A/S (Soliton Systems K.K.)
• Inventors: Damon, Craig L., Arlaud, Christopher L., Pathuel, Jan, Jørgensen, Jimi T.
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): TRUONG, THANHNGA B
• Application Number:
  US10/428,895
• Publication Number:
  US 20050262343A1
• Time in Patent Office: 1,222 Days
• Field of Search: 713/168, 713/201, 380/201, 380/30, 709/223, 709/201, 709224-225, 709/203, 455/442, 455410-411, 370/328, 370/395.21, 370/392, 726/3, 726 11- 12
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/08 Randomization, e.g. dummy operations or using noise
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

Methods and systems are provided for improving security, efficiency, access control, administrative monitoring, reliability as well as integrity of data transmission and remote application sharing over a network. Secure, stable network connections and efficient network transactions among multiple users are supported by an improved client-server architecture. A datagram schema is provided, which enables dynamic datagram switching in support of a multitude of applications and network services. Mobile intelligent data carriers are provided, allowing for the implementation of an authentication and encryption scheme. They may be used to target deliver applications to authorized user, thereby controlling the access to not only data but also applications. Biometrics and other suitable authentication methodologies may be employed in delivering the pervasive, user-centric network security solutions disclosed. The methods and systems of this disclosure maybe advantageously implemented in any enterprise network environment to support a wide spectrum of business, research, and administrative operations.

Claims

1. A system of secure network connectivity between one or more users and at least one network server, wherein said secure network connectivity is user-centric and supports pervasive security, wherein said user-centric refers to that the system secures the one or more users instead of one or more devices employed by the users to connect to the network server, and wherein said pervasive security is security on demand, using one or more connecting devices, said system comprising:

at least one intelligent data carrier, issued to said one or more users, wherein said intelligent data carrier comprises at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting the digital information via said input-output apparatus, and wherein said intelligent data carrier is capable of establishing the identities of said one or more users through an authentication and encryption scheme; and

a dynamic datagram switch for dynamic allocation and swapping of datagrams for a multiplicity of applications in service to said one or more users, wherein said dynamic datagram switch comprises a datagram schema and a parser, wherein said datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein each datagram type comprises a plurality of functions, and wherein said parser is capable of parsing the one or more datagram types.

2. The system of claim 1, wherein said intelligent data carrier is mobile.

3. The system of claim 1, wherein said intelligent data carrier is selected from the group consisting of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

4. The system of claim 1, wherein said authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the network server that the intelligent data carrier be authenticated;

(b) the network server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality of authentication methods through an event;

(d) the network server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the network server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each of said one or more data authentication objects is a data vector object, capable of being analyzed using one or more classifiers;

(f) the network server analyzing said data authentication objects, according to said one or more classifiers, thereby determining a result of the authentication; and

(g) the network server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

5. The system of claim 4, wherein said event in step (c) comprises at least one of a click of a mouse, a touch on a screen, a keystroke, an utterance, and any suitable notification means.

6. The system of claim 4, wherein said demand in step (d) comprises at least one of a pseudo random and a true random password, wherein a pseudo random password is generated based on a mathematically pre-calculated list, and wherein a true random password is generated by sampling and processing a source of entropy outside of the system.

7. The system of claim 6, wherein the pseudo random or the true random password are generated with at least one seed from an indeterministic source, wherein said indeterministic source is a source that is not capable of being predicted from the parameters surrounding the network server or the intelligent data carrier.

8. The system of claim 6, wherein the pseudo random or the true random password are generated with one or more random generators and one or more independent seeds.

9. The system of claim 4, wherein said analyzing in step (f) comprises one or more analysis rules.

10. The system of claim 9, wherein said one or more analysis rules comprises classification according to the one or more classifiers of step (e).

11. The system of claim 10, wherein a randomization in data vector objects is performed in connection with the one or more classifiers.

12. The system of claim 10, wherein said classification comprises speaker verification, wherein the data object vector involves two classes, the target speaker and the impostor, wherein each speaker is characterized by a probability density function, and wherein the determining in step (f) is a binary decision problem.

13. The system of claim 4, wherein said one or more classifiers in step (e) comprises a super classifier, wherein more than one data vector objects exist for event level authentication, and wherein the determining in step (f) is based on at least one of superior and random sum computed from the data vector objects.

14. The system of claim 13, wherein said super classifier is used for physical biometrics, comprising at least one of voice recognition, fingerprints, handprints, blood vessel patterns, DNA tests, retinal or iris scan, and face recognition.

15. The system of claim 13, wherein said super classifier is used for performance biometrics, comprising habits or patterns of individual behaviors.

16. The system of claim 4, wherein said determining in step (f) is performed by computing at least one of the sum, superiority, and probability from said one or more data authentication objects, based on the one or more classifiers of step (e).

17. The system of claim 1, wherein said authentication and encryption scheme comprises symmetrical and asymmetrical multi-cipher encryption.

18. The system of claim 17, wherein said encryption uses at least one of output feedback, cipher feedback, cipher forwarding, and cipher block chaining.

19. The system of claim 1, wherein said authentication and encryption scheme implements Secure Key Exchange.

20. The system of claim 19, wherein the Secure Key Exchange employs a public key system.

21. The system of claim 19, wherein the Secure Key Exchange employs Elliptic Curve Cryptosystem private keys.

22. The system of claim 19, wherein the encryption is based on Advanced Encryption Standard Rijndael.

23. The system of claim 1, wherein said multiplicity of applications is selected from the group consisting of window-based remote terminal server applications, applications on 3270/5250 terminal emulators for mainframe, directly embedded applications, digital video, audio, and text based communications, and wherein the directly embedded applications are selected from the group consisting of database applications, data analysis tools, Customer Relation Management tools, and Enterprise Resource Planning packages, and any combination thereof.

24. The system of claim 1, wherein said datagram schema comprises at least one major datagram type and within said one major datagram type, at least one minor datagram type.

25. The system of claim 1, wherein the parser is capable of parsing a matrix of datagram types, said matrix comprising a first multiplicity of major datagram types and in each major datagram type of said first multiplicity, a second multiplicity of minor datagram types.

26. The system of claim 25, wherein the first multiplicity is 256 and the second multiplicity is 256.

27. The system of claim 24, wherein the major datagram type is selected from the group consisting of (i) a server messages and connection control datagram, capable of authenticating and controlling user connections, (ii) a content datagram, capable of managing the transmission of the content data, (iii) a broadcast datagram, capable of managing the real-time point-to-point, point-to-multipoint, and multipoint-to-multipoint data transmission, and (iv) a connection proxy datagram, capable of passing proxy data between the network server and the intelligent data carrier.

28. The system of claim 27, wherein the server messages and connection control datagram comprises minor datagram types selected from the group consisting of:

(i) an authentication request datagram, capable of initiating an authentication request, (ii) an authentication reply datagram, capable of sending a response upon a request of authentication, and (iii) an authentication result datagram, capable of sending the result of an authentication session.

29. The system of claim 27, wherein the content datagram comprises minor datagram types selected from the group consisting of:

(i) a normal content datagram, capable of transmitting the content data, (ii) a remote logging datagram, capable of communicating with the network server and establishing a login session, and (iii) a remote data collector datagram, capable of transmitting data from a remote connection.

30. The system of claim 29, wherein the content datagram further comprises minor datagram types selected from the group consisting of:

(iv) a content approval request datagram, capable of requesting verification of the content data transmitted, and (v) a content approval reply datagram, capable of responding to a request of verification of the content data transmitted.

31. The system of claim 27, wherein the connection proxy datagram comprises minor datagram types selected from the group consisting of:

(i) proxy data to server, capable of passing proxy data to the network server from the intelligent data carrier, and (ii) proxy data from server, capable of passing the proxy data from the network server to the intelligent data carrier.

32. The system of claim 24, wherein each datagram in the datagram schema has a generic layout comprising:

(A) the header fields for (i) a major datagram type, (ii) a minor datagram type, (iii) a datagram length, and (iv) a datagram checksum, and

(B) a datagram payload, carrying the content data in transmission.

33. The system of claim 32, wherein the datagram comprises one or more additional header fields.

34. The system of claim 32, wherein the major datagram type is an instant message type and the minor datagram type is selected from the group consisting of file transmission type, audio-video transmission type, instant mail message type, and remote data collection type.

35. The system of claim 32, wherein each datagram in the datagram schema is carried within a TCP packet.

36. The system of claim 35, wherein the generic layout of the datagram follows a TCP header.

37. The system of claim 1, further comprising one or more radar connectors capable of monitoring and controlling network connections.

38. The system of claim 37, wherein each of said radar connectors is further capable of detecting the lost connection and initializing contact to the network server thereby reestablishing the connection.

39. The system of claim 37 or 38, wherein each of the network server and the intelligent data carrier is connected to one of said radar connectors.

40. The system of claim 37, further comprising one or more injectors capable of connecting one or more existing networks to the network server and transmitting data between said existing network and the intelligent data carrier via the network server, wherein said existing network is wired or wireless, comprising one or more digital devices.

41. The system of claim 40, wherein said digital device is at least one of a computer, a Personal Digital Assistant (PDA), a digital mobile phone, a digital audio-video player, and a digital camera.

42. The system of claim 40, wherein the one or more injectors is each connected to a radar connector.

105. The system of claim 1, wherein said dynamic allocation and swapping is performed in real time.

106. The system of claim 1, wherein said dynamic allocation and swapping comprises the use of memory pointers of two or more datagrams.

43. A client-server communication system, comprising:

at least one server; and

at least one client, wherein each client is an intelligent data carrier, comprising at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting digital information via said input-output apparatus, wherein said intelligent data carrier is capable of establishing the identities of one or more users through an authentication and encryption scheme for secure data transmission between said server and said client, wherein said server further comprises a dynamic datagram switch for dynamic allocation and swapping of datagrams for a multiplicity of applications in service to said one or more users, wherein said dynamic datagram switch comprises a datagram schema and a parser, wherein said datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein each datagram type comprises a plurality of functions, and wherein said parser is capable of parsing the one or more datagram types.

44. The client-server communication system of claim 43, wherein said secure data transmission is characterized by user centric and pervasive security, wherein said user-centric security refers to securing one or more users instead of one or more devices employed by the users to connect to the network server, and wherein the pervasive security is security on demand, using one or more connecting devices.

45. The client-server communication system of claim 43 or 44, wherein the intelligent data carrier is mobile.

46. The client-server communication system of claim 43 or 44, wherein said intelligent data carrier is selected from the group consisting of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

47. The client-server communication system of claim 43 or 44, further comprising one or more injectors capable of connecting the server to one or more existing networks and transmitting data between said existing networks and the client via the server, wherein said existing network is wired or wireless, comprising one or more digital devices.

48. The client-server communication system of claim 47, wherein said digital device is at least one of a computer, a Personal Digital Assistant (PDA), a mobile phone, a digital audio-video player, and a digital camera.

49. The client-server communication system of claim 47, wherein each server, client, and injector is further connected to a radar connector, capable of monitoring and controlling network connections.

50. The client-server communication system of claim 49, wherein said radar connector is further capable of detecting a lost connection and initializing contact to the network server thereby reestablishing the connection.

51. The client-server communication system of claim 43 or 44, wherein the server further comprises an encrypted virtual file system, capable of secure storage of data in a virtual file system for each client.

52. An intelligent data carrier, comprising at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting digital information via said input-output apparatus, wherein said intelligent data carrier is capable of establishing the identities of one or more users through an authentication and encryption scheme for secure data transmission in a network, wherein said intelligent data carrier is capable of communicating with a server in the network, said server comprising a dynamic datagram switch for dynamic allocation and swapping of datagrams, wherein said dynamic datagram switch comprises a datagram schema and a parser, wherein said datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein each datagram type comprises a plurality of functions, and wherein said parser is capable of parsing the one or more datagram types.

53. The intelligent data carrier of claim 52, wherein said secure data transmission is characterized by user centric and pervasive security, wherein said user-centric security refers to securing one or more users instead of one or more devices employed by the users to connect to the network server, and wherein the pervasive security is security on demand, using one or more devices.

54. The intelligent data carrier of claim 52 or 53, said intelligent data carrier being mobile.

55. The intelligent data carrier of claim 52 or 53, said intelligent data carrier selected from the group consisting of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

56. A method for establishing user-centric, pervasive network security, wherein said user-centric refers to securing one or more users instead of one or more devices employed by the users to connect to a network server, and wherein the pervasive security is security on demand, using one or more connecting devices, said method comprising:

issuing to each of said one or more users an intelligent data carrier, wherein said intelligent data carrier comprises at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting the digital information via said input-output apparatus, and wherein said intelligent data carrier is capable of establishing the identities of said one or more users through an authentication and encryption scheme; and

providing a dynamic datagram switch for dynamic allocation and swapping of datagrams for a multiplicity of applications in service to said one or more users, wherein said dynamic datagram switch comprises a datagram schema and a parser, wherein said datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein each datagram type comprises a plurality of functions, and wherein said parser is capable of parsing the one or more datagram types.

57. The method of claim 56, wherein said intelligent data carrier is mobile.

58. The method of claim 57, wherein said intelligent data carrier is selected from the group consisting of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

59. The method of claim 56, wherein said authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the network server that the intelligent data carrier be authenticated;

(b) the network server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality through an event;

(d) the network server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the network server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each of said one or more data authentication objects is a data vector object, capable of being analyzed using one or more classifiers;

(f) the network server analyzing said data authentication objects, according to said one or more classifiers, thereby determining a result of the authentication; and

(g) the network server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

60. The method of claim 59, wherein said event in step (c) comprises at least one of a click of a mouse, a touch on a screen, a keystroke, an utterance, and any suitable notification means.

61. The method of claim 59, wherein said demand in step (d) comprises at least one of a pseudo random and true random password, wherein a pseudo random password is generated based on a mathematically pre-calculated list, and wherein a true random password is generated by sampling and processing a source of entropy outside of the system.

62. The method of claim 61, wherein the pseudo random or the true random password are generated with at least one seed from an indeterministic source, wherein said indeterministic source is a source that is not capable of being predicted from the parameters surrounding the network server or the intelligent data carrier.

63. The method of claim 61, wherein the pseudo random or the true random password are generated with one or more random generators and one or more independent seeds.

64. The method of claim 59, wherein said analyzing in step (f) comprises one or more analysis rules.

65. The method of claim 64, wherein said one or more analysis rules comprises classification according to the one or more classifiers of step (e).

66. The method of claim 65, wherein randomization in data vector objects is performed in connection with the one or more classifiers.

67. The method of claim 65, wherein said classification comprises speaker verification, wherein the data object vector involves two classes, the target speaker and the impostor, wherein each speaker is characterized by a probability density function, and wherein the determining in step (f) is a binary decision problem.

68. The method of claim 59, wherein said one or more classifiers in step (e) comprises a super classifier, wherein more than one data vector objects exist for event level authentication, and wherein the determining in step (f) is based on at least one of superior and random sum computed from the data vector objects.

69. The method of claim 68, wherein said super classifier is used for physical biometrics, selected from the group consisting of:

voice recognition, fingerprints, handprints, blood vessel patterns, DNA tests, retinal or iris scan, and face recognition.

70. The method of claim 68, wherein said super classifier is used for performance biometrics, comprising habits or patterns of individual behaviors.

71. The method of claim 59, wherein said determining of step (f) is performed by computing at least the sum, superiority, and probability from said one or more data authentication objects, based on the one or more classifiers of step (e).

72. The method of claim 56, wherein said authentication and encryption scheme comprises symmetrical and asymmetrical multi-cipher encryption.

73. The method of claim 72, wherein said encryption uses at least one of output feedback, cipher feedback, cipher forwarding, and cipher block chaining.

74. The method of claim 56, wherein said authentication and encryption scheme uses Secure Key Exchange and encryption.

75. The method of claim 74, wherein the Secure Key Exchange employs a public key system.

76. The method of claim 74, wherein the Secure Key Exchange employs Elliptic Curve Cryptosystem private keys.

77. The method of claim 74, wherein the encryption is based on Advanced Encryption Standard Rijndael.

78. The method of claim 56, wherein said multiplicity of applications is selected from the group consisting of window-based remote terminal server applications, applications on 3270/5250 terminal emulators for mainframe, directly embedded applications, digital video, audio, and text based communications, and wherein the directly embedded applications are selected from the group consisting of database applications, data analysis tools, Customer Relation Management tools, and Enterprise Resource Planning packages, and any combination thereof.

79. The method of claim 56, wherein said datagram schema comprises at least one major datagram type and within said one major datagram type, at least one minor datagram type.

80. The method of claim 79, wherein the parser is capable of parsing a matrix of datagram types, said matrix comprising a first multiplicity of major datagram types and in each major datagram type of said first multiplicity, a second multiplicity of minor datagram types.

81. The method of claim 80, wherein the first multiplicity is 256 and the second multiplicity is 256.

82. The method of claim 79, wherein the major datagram type is selected from the group consisting of(i) a server messages and connection control datagram, capable of authenticating and controlling user connections, (ii) a content datagram, capable of managing the transmission of the content data, (iii) a broadcast datagram, capable of managing the real-time point-to-point, point-to-multipoint, and multipoint-to-multipoint data transmission, and (iv) a connection proxy datagram, capable of passing proxy data between the network server and the intelligent data carrier.

83. The method of claim 80, wherein each datagram in the datagram schema has a generic layout comprising (A) the header fields for (i) a major datagram type, (ii) a minor datagram type, (iii) a datagram length, and (iv) a datagram checksum, and (B) a datagram payload, carrying the content data in transmission.

84. The method of claim 83, wherein the datagram comprises one or more additional header fields.

85. The method of claim 79 or 83, wherein each datagram in the datagram schema is carried within a TCP packet.

86. The method of claim 85, wherein the generic layout of the datagram follows a TCP header.

87. The method of claim 56, further comprising providing one or more radar connector, capable of monitoring and controlling network connections, wherein the network server and the intelligent data carrier is each connected to one of said one or more radar connectors.

88. The method of claim 87, wherein said radar connector is further capable of detecting a lost connection and initializing contact to the network server thereby reestablishing the connection.

89. The method of claim 56 or 87, further comprising providing one or more injectors capable of connecting one or more existing networks to the network server and transmitting data between said existing network and the intelligent data carrier via the network server, wherein said existing network is wired or wireless, comprising one or more digital devices.

90. The method of claim 89, wherein each of said digital devices is any one of:

a computer, a Personal Digital Assistant (PDA), a digital mobile phone, a digital audio-video player, or a digital camera.

91. The method of claim 89, wherein said one or more injector each is connected to a radar connector.

107. The method of claim 56, wherein said dynamic allocation and swapping is performed in real time.

108. The method of claim 56, wherein said dynamic allocation and swapping comprises the use of memory pointers of two or more datagrams.

92. A method for targeted delivering of one or more applications to an authorized user, comprising:

issuing to said user an intelligent data carrier, wherein said intelligent data carrier comprises at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting the digital information via said input-output apparatus, wherein said intelligent data carrier is capable of establishing the identity of said user through an authentication and encryption scheme; and

providing a computer device connecting to a network on which a network server sits, wherein the intelligent data carrier is capable of docking to said connecting device and being authenticated by said network server based on said authentication and encryption scheme, wherein said one or more applications are capable of being launched off said intelligent data carrier once the user is successfully authenticated, wherein said network server further comprises a dynamic datagram switch for dynamic allocation and swapping of datagrams for said one or more applications, wherein said dynamic datagram switch comprises a datagram schema and a parser, wherein said datagram schema comprises two or more datagrams, belonging to one or more datagram types, wherein each datagram type comprises a plurality of functions, and wherein said parser is capable of parsing the one or more datagram types.

93. The method of claim 92, wherein said one or more applications are preloaded on the intelligent data carrier or installed on said network server.

94. The method of claim 92, wherein said computer device is connected to the network via wired or wireless means.

95. The method of claim 92, wherein said computer device is at least one of a desktop or laptop computer, a personal digital assistant (PDA), a digital mobile phone, a digital TV, and any network-enabled digital audio-video device.

96. The method of claim 92, wherein said one or more applications are selected from the group consisting of database applications, data analysis tools, Customer Relation Management tools, Enterprise Resource Planning packages, window-based remote terminal server applications, applications on 3270/5250 terminal emulators for mainframe, digital video, audio, and text based communications, and any combination thereof.

97. The method of claim 92, wherein said intelligent data carrier is mobile.

98. The method of claim 92, wherein said intelligent data carrier is selected from the group consisting of USB key, Compact Flash, Smart Media, Compact Disk, DVD, PDA, firewire device, and token device.

99. The method of claim 92, wherein said authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the network server that the intelligent data carrier be authenticated;

(b) the network server presenting to the intelligent data carrier a plurality of authentication methods;

(c) the intelligent data carrier selecting one authentication method from said plurality through an event;

(d) the network server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier;

(e) the network server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each of said one or more data authentication objects is a data vector object, capable of being analyzed using one or more classifiers;

(f) the network server analyzing said data authentication object, according to said one or more classifiers, thereby determining the result of the authentication; and

(g) the network server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

100. The method of claim 99, wherein said event in step (c) comprises at least a click of a mouse, a touch on a screen, a keystroke, an utterance, and any suitable notification means.

101. The method of claim 100, wherein said demand in step (e) comprises at least a pseudo random and true random password, wherein a pseudo random password is generated based on a mathematically pre-calculated list, and wherein a true random password is generated by sampling and processing a source of entropy outside of the system.

102. A system of secure network connectivity between one or more users and at least one network server, wherein said secure network connectivity is user-centric and supports pervasive security, wherein said user-centric refers to that the system secures the one or more users instead of one or more devices employed by the users to connect to the network server, and wherein said pervasive security is security on demand, using one or more connecting devices, said system comprising at least one intelligent data carrier, issued to said one or more users,

wherein said intelligent data carrier comprises at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting the digital information via said input-output apparatus,

wherein said intelligent data carrier is capable of establishing the identities of said one or more users through an authentication and encryption scheme and supporting a multiplicity of applications in service to said one or more users, and

wherein said authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the network server that the intelligent data carrier be authenticated, (b) the network server presenting to the intelligent data carrier a plurality of authentication methods, (c) the intelligent data carrier selecting one authentication method from said plurality through an event, (d) the network server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier, (e) the network server transforming said authentication data received from the intelligent data carrier into one or more data authentication object, wherein each said data authentication object is a data vector object, capable of being analyzed using one or more classifiers, (f) the network server analyzing said data authentication object, according to said one or more classifiers, thereby determining the result of the authentication, and (g) the network server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

103. A method for establishing user-centric, pervasive network security, wherein said user-centric refers to securing one or more users instead of one or more devices employed by the users to connect to a network server, and wherein the pervasive security is security on demand, using one or more connecting devices, said method comprising issuing to each of said one or more users an intelligent data carrier,

wherein said intelligent data carrier comprises at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting the digital information via said input-output apparatus,

wherein said intelligent data carrier is capable of establishing the identities of said one or more users through an authentication and encryption scheme and supporting a multiplicity of applications in service to said one or more users, and

wherein said authentication and encryption scheme comprises the following sequential steps:

(a) a request being caused to forward from the intelligent data carrier to the network server that the intelligent data carrier be authenticated, (b) the network server presenting to the intelligent data carrier a plurality of authentication methods, (c) the intelligent data carrier selecting one authentication method from said plurality of authentication methods through an event, (d) the network server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier, (e) the network server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each of said one or more data authentication objects is a data vector object, capable of being analyzed using one or more classifiers, (f) the network server analyzing said data authentication object, according to said one or more classifiers, thereby determining the result of the authentication, and (g) the network server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.

104. A client-server communication system, comprising:

at least one server; and

at least one client, wherein each client is an intelligent data carrier, comprising at least (i) one memory, capable of storing digital information, (ii) one input-output apparatus, capable of inputting and outputting digital information, and (iii) one processor, capable of processing the digital information stored in said memory and connecting to a computer device thereby transmitting digital information via said input-output apparatus,

wherein said intelligent data carrier is capable of establishing identities of one or more users through an authentication and encryption scheme for secure data transmission between said server and said client, and

wherein said authentication and encryption scheme comprises the following sequential steps;

(a) a request being caused to forward from the intelligent data carrier to the network server that the intelligent data carrier be authenticated, (b) the network server presenting to the intelligent data carrier a plurality of authentication methods, (c) the intelligent data carrier selecting one authentication method from said plurality through an event, (d) the network server sending the intelligent data carrier a demand, based on said selected method, for authentication data from the intelligent data carrier, (e) the network server transforming said authentication data received from the intelligent data carrier into one or more data authentication objects, wherein each of said one or more data authentication objects is a data vector object, capable of being analyzed using one or more classifiers, (f) the network server analyzing at least one of said data authentication objects, according to said one or more classifiers, thereby determining a result of the authentication, and (g) the network server sending said result to the intelligent data carrier, indicating a successful or failed authentication attempt.