Abstract: A system for storing encrypted data comprises a processor and a memory. The processor is configured to receive an encrypted segment. The encrypted segment is determined by breaking a data stream, a data block, or a data file into one or more segments and encrypting each of the one or more segments. The processor is further configured to determine whether the encrypted segment has been previously stored, and in the event that the encrypted segment has not been previously stored, store the encrypted segment. The memory is coupled to the processor and configured to provide the processor with instructions.

Abstract: Authentication requests are redistributed among a plurality of authentication servers and to centrally managing authentication affinities among distributed servers using a secure channels affinity service. A computer system instantiates a secure channel management service configured to manage secure channel connections. The secure channel management service receives state inputs from currently deployed authentication servers. The authentication servers may be configured to queue authentication requests for transmission to authentication servers. The computer system determines that, based on the received state input, at least one of the secure channels is to be remapped to a different authentication server. The computer system also remaps the determined secure channels to distribute future authentication requests among the authentication servers.

Abstract: An integrated circuit assembly having monitoring circuitry for observing the internal signals of the system so that its properties are captured. The system properties are manipulated so that they can be used as a pseudo random number and or as the basis number for an encryption key. The monitoring circuitry having: manipulation circuitry to transform monitored data and combine it with previously manipulated values; and registers to store previously manipulated values; and counters to count events; and condition detection circuitry for detecting when a signal is at a specific value or range of values. Optionally the monitoring circuitry which has the functionality for capturing system properties may be combined with other monitoring circuitry, which has the functionality required by a debug support circuit. The monitoring circuitry avoids replication of resources by sharing parts of specific monitoring circuits like counters.

Abstract: Some embodiments provide a system that authenticates a user. During operation, the system obtains an identifier for the user from an identification card associated with the user and displays a set of images to the user. Next, the system receives an image sequence comprising a sequence of images selected by the user from the set of images. Finally, the system authenticates the user based on the identifier and the image sequence.

Abstract: Computer systems and environments implemented herein permit a local machine increased participation in authorizing access to protected content. An operating system attests to a computing environment at a corresponding computer system. If the computing environment is one permitted to access protected content, the operating system is permitted to regulate further (e.g., application) access to protected content in accordance with a procreation policy. As such, authorization decisions are partially distributed, easing the resource burden on a content protection server. Accordingly, this computing environment can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Abstract: Segmented media content rights management is described. A media device can receive segments of protected media content from media content streams that each include a different version of the protected media content. A media content file can be generated to include the segments of the protected media content that are sequenced to render the protected media content for viewing. A file header object can be instantiated in a file header of the media content file, where the file header object includes DRM-associated features, such as one or more DRM licenses, properties, and/or attributes that correspond to the media content file to provision all of the segments of the protected media content together.

Abstract: The present invention relates to a method for multi-core processor based packet classification on multiple fields. The invention specifically proposes three methods to select partition points, two associated methods to select dimensions, then receiving packet information after the data structure of classification is constructed, and searching the data structure of classification according to packet information to get matched results. The present invention can be implemented on many types of multi-core processor based platforms which ensure favorable performance and adaptive capabilities for different network applications, and significantly reduce the product cost of high-end routers and firewalls.

Abstract: A system and method for providing network penetration testing from an end-user computer is provided. The method includes the step of determining at least one of a version of a Web browser of a target computer, contact information associated with an end-user that uses the target computer, and applications running on the target computer. The method also includes the steps of determining exploits that are associated with the running applications and that can be used to compromise the target computer, and launching the exploits to compromise the target computer. Network penetration testing may also be provided by performing the steps of determining an operating system of a target computer, selecting one of a group of modules to use in detecting services of the target computer, and detecting the services of the target computer.

Abstract: A method for evaluating potential attacks of worms, the method includes: associating, in response to information representative of a network and of worm entities, between worm entities and potential worm sources to provide associated worm sources; determining potential worm attacks that start from the associated worm sources; and evaluating at least one potential worm attack security metric associated with the potential worm attacks.

Abstract: Techniques for virtual private network (VPN) access are provided. A dynamic determination, in response to privileges, is made as to whether a principal and a device of a principal are to receive a thin client virtual private network (VPN) installation for a thin client VPN session between the principal and a remote site or whether a clientless VPN session is appropriate. Dynamic switching between the clientless VPN session and thin client VPN session is permissible when the principal supplies the appropriate credentials for such a switch.

Abstract: Defining a unified access management policy expression that unifies access control policy with events or workflows. Unified management policy information is stored. The unified management policy information defines permissions for access to resources together with events or workflows. A request is received to execute the one or more operations on one or more objects. The requested operation is verified against the unified management rules. Verifying includes performing a single retrieval, retrieving both the access control information and the events or workflows and calculating the applicability of the rule to the conditions represented by the request. Matching rules are applied, access control decisions performed and associated workflows are executed.

Abstract: A data loss prevention system, method, and computer program product are provided for determining whether a device is protected with an encryption mechanism before storing data thereon. In operation, data to be stored on a device is identified. Additionally, it is determined whether the device is protected with an encryption mechanism. Furthermore, there is conditional reaction, based on the determination.

Abstract: A method of checking revocation of a device and software, and transmitting data to a secure device and secure software whose keys have not been leaked is provided. The method includes receiving authentication information of a device requesting transmission of data, and authentication information of software accessing the data in the device; checking revocation of the device and the software, based on the received authentication information; and transmitting the data to the software of the device, when the device and the software are not revoked as a result of the checking. By doing so, during transmission of data, such as content or a license, it is possible to check security of a device and software being executed in the device, so that the data can be more safely transmitted.

Abstract: An information delivery device interacting with a user's eye, the device comprising an eye characteristic reader for reading at least one characteristic of the user's eye, a retinal projector for projecting information onto the retina, and an eye characteristic processor operative to receive at least one characteristic of the eye and to select the information based at least partly thereupon. A content protection system may comprise a multiplicity of such eye characteristic readers and a content protector receiving said at least one characteristic from such readers and controlling the user population's use of content to be protected based on that at least one characteristic. Related apparatus and methods are also provided.

Abstract: An authorization framework is provided that protects data records in a platform, such as a service-based platform, by requiring multiple level entities to be authorized with respect to the data records. For example, the data records can have an associated owner user that can grant access to other users with respect to the data. Additionally, however, the user can also grant access to certain applications that access the platform such that the data records can be initially closed for a user requiring the user to explicitly grant desired access to applications and/or users. In this regard, applications can be forbidden from accessing the data, even on behalf of the user, unless expressly authorized to do so by the user. Thus, the user can make informed decisions regarding who is to have access to its data.

Abstract: The present invention provides a method for protecting software based on network, which combines a client program that communicates with a server in C/S (or B/S) architecture with a key device, the client program authenticates a user using the key device for protecting software, the method includes the steps of: running the client program; authenticating the user using the key device by the client program; and continuing to run the client program with a server if the user has passed the authentication. In the prior art, the username and password are easy to intercept in transmission as plain text over network. In the method, the client program is combined with a key device. In addition, the complete client program cannot be executed without involving the server. Therefore, the strength of software protection is increased.

Abstract: A system and method to selectively isolate one or more unprotected computer devices from the rest of the computer system and/or from the network. The ability to isolate and/or authenticate the software and/or hardware on or interacting with the unprotected software and/or hardware provides for a secured system despite the presence or use of an unprotected computer device.

Abstract: A method for paging admission control for multi-service flows in a mobile packet domain is provided and comprises steps of when authentication of a mobile station accessing a connectivity service network through an access service network succeeds, assigning a service flow paging strategy for a downlink service flow of the mobile station, and sending the service flow paging strategy to the access service network; receiving, by the access service network, downlink data of a mobile station in IDLE state from a home agent, searching for a downlink service flow to which the downlink data belong, and judging whether the service flow admits paging according to the service flow paging strategy, and if yes, initiating a paging flow triggered by the downlink data.

Abstract: A network reputation system and its controlling method are provided. A credential and exchange component permits a user to generate credentials and exchange matching items with those persons having a social relationship with the user. A reputation evaluation component enables other users to make evaluations about an estimatee via the sharing of social network information. A query and response component receives a query from a person having a social relationship with the user for requesting an evaluation about the estimatee, and responds with an associated evaluation result to the person having a social relationship with the user, via the sharing of social network information and the evaluations made by the other users about the estimatee.

Abstract: Provided are apparatus, methods and/or computer program products for monitoring internet activity. A network is searched to detect network data indicative of actual and/or potential contact with a child. A report is generated that identifies a source of detected data and the report is sent to a responsible party.