Abstract: Memory security technologies are described. An example processing system includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can receive a content read instruction from an application. The processor core can identify a cache line (CL) from a plurality of CLs of a cryptographic cache block (CCB) requested in the content read instruction. The processor core can load, from a cryptographic tree, tree nodes with security metadata. The processor core can retrieve, from the memory, the CCB. The processor core can generate a second MAC from the CCB. The processor core can compare the first MAC with the second MAC. The processor core can decrypt the CCB using security metadata when the first MAC matches the second MAC. The processor core can send at least the identified CL from the decrypted CCB to the application.

Abstract: Techniques are provided for entering a secret into a security token using an embedded tactile sensing user interface with the purpose of verifying the secret against a stored representation of the same secret. In particular, an embodiment of the security token according to the invention comprises a tactile sensing user interface being arranged to receive a user-encoded secret, a decoding unit being arranged to generate a decoded secret by decoding the user-encoded secret, a comparison unit being arranged to compare the decoded secret with a copy of the secret stored in the token in order to verify the authenticity of a user. Thereby, the security token provides on-card matching functionality.

Abstract: Various systems, methods, and processes to protect virtual machine data in a cloud environment are disclosed. A request for requested data is received at an encryption virtual machine. The requested data is encrypted, and the encryption virtual machine is configured to receive the request from an application virtual machine via a loader. The requested data includes one or more operating system modules, and the operating system modules are configured to be used by the application virtual machine. The requested data is accessed in a storage volume, which is communicatively coupled to the encryption virtual machine. The requested data is then retrieved from the storage volume and decrypted at the encryption virtual machine. The decrypted data is then sent to the loader.

Abstract: Disclosed are various examples for providing a single sign-on experience for managed mobile devices. A management application executed in a computing device receives a single sign-on request from a managed client application executed by the same computing device. The management application determines that the client application is permitted to access a management credential for single sign-on use. The management application provides the management credential to the client application in response to the single sign-on request.

Abstract: A method of unlocking an electronic device having a touch-sensitive display includes at least the following steps: controlling the touch-sensitive display to have unlocking objects displayed at different locations for different time points; and when at least one contact is detected on the touch-sensitive display, determining whether to unlock the electronic device by referring to a contact status on the touch-sensitive display. Besides, a computer readable medium storing a program code is also provided, where the program code causes a processor to perform following steps when executed by the processor: controlling the touch-sensitive display to have unlocking objects displayed at different locations for different time points; and when at least one contact is detected on the touch-sensitive display, determining whether to unlock an electronic device by referring to a contact status on the touch-sensitive display.

Abstract: A web of trust in a distributed system is established. A root of trust for at least two components in the distributed system validates information for the distributed system. The validated information is then used to create additional information for the distributed system. Versions of the information are usable to validate subsequent versions of the information such that validation of a version of the information can be performed by using one or more previous versions to verify that the version is a valid successor of a previously validated previous version.

Abstract: Methods and apparatus are provided for generating a secret cryptographic key of a user computer connectable to a server via a network. A secret user value is provided at the user computer. A secret server value is provided at the server with a check value which encodes the secret user value and a user password. The user computer encodes the secret user value and an input password to produce a first value corresponding to said check value, and communicates the first value to the server. The server compares the first and the check values to check whether the input password equals the user password. If so, the server encodes the first and the secret server values to produce a second value and communicates the second value to the user computer. The user computer generates the secret cryptographic key by encoding the second value, the input password and the secret user value.

Abstract: A method and system for connecting an Internet of Things (IoT) hub to a wireless network. One embodiment of the method includes establishing a secure communication channel between an IoT hub and an IoT service through a client device using a first secret; generating a second secret on the client device and transmitting it to the IoT hub; encrypting a wireless key using the second secret to generate a first-encrypted key and transmitting it to the IoT service; encrypting the first-encrypted key using the first secret to generate a twice-encrypted key and transmitting it to the IoT hub over the secure communication channel; decrypting the twice-encrypted key at the IoT hub using the first secret to generate the first-encrypted key and decrypting it using the second secret to generate the wireless key usable to establish a secure wireless connection between the IoT hub and the local wireless network.

Abstract: Systems and methods are provided for providing login as a service. A system receives, via a customer server, a request from a user computer to login to a customer application provided by the customer server. The system outputs a login form to the user computer, receives a modified login form from the user computer, and determines whether the modified login form enables the user computer to login to the customer application. If the modified login form enables the user computer to login to the customer application, the system notifies the customer server that the modified login form enables the user computer to login to the customer application.

Abstract: An example method of decrypting electronic messages includes receiving, by an authentication module of a decryptor device, authentication requests from a plurality of destination clients. The method also includes receiving, by a decryption module of the decryptor device, encrypted electronic messages from the plurality of destination clients. The encrypted electronic messages are derived from a common electronic message sent by a common source client. The method further includes authenticating, based on an authentication table, the plurality of destination clients. The authentication table stores user credentials that are used to authenticate destination clients. The method also includes for each encrypted electronic message received from an authenticated destination client of the plurality of destination clients, decrypting the encrypted electronic message using a common private key and providing the decrypted electronic message to the authenticated destination client.

Abstract: A digital content provider is configured to identify, based at least in part on various customer user profiles, digital content that is to be pre-loaded onto one or more customer computing devices in advance of the digital content being available for at least one mode of consumption by the one or more computing devices. The digital content provider may use these user profiles, as well as other external information, to identify one or more customers that are to receive the digital content. Subsequently, the digital content provider may download the digital content onto each identified customer's one or more computing devices in advance of the at least one mode of consumption becoming available to the customers. Once the mode of consumption is made available, the digital content provider may enable the use of the pre-loaded digital content.

Abstract: In some embodiments, an apparatus includes a control chain generation module is configured to receive, from a control database, a security guideline control to be implemented with respect to a hardware asset. The control chain generation module is configured to select, based on requirements to satisfy the security guideline and attributes of the hardware asset, a security implementation control. The control chain generation module is configured to select a control assessor to monitor the compliance of the hardware asset with the security guideline and is configured to define a control chain including the security guideline control, the security implementation control, and the control assessor. The control chain generation module is configured to send an instruction to apply the control chain to the hardware asset such that the control assessor monitors the hardware asset for compliance with the security guideline.

Abstract: A system, method, server processing system, and computer program product for operating a registry. In one aspect, the server processing system is configured to: receive, from a user processing system in data communication with the server processing system, document data relating to an entity; receive, from the user processing system, access data indicative of an accessing party to be provided access to the document data if a defined trigger event occurs; store, in a data store associated with the server processing system, a registry for the entity indicative of the document data and the access data; determine that a defined trigger event has occurred; and in response to determining that that a defined trigger event has occurred, provide the accessing party read-only access to the document data via an access processing system in data communication with the server processing system.

Abstract: Responsive to a request to retrieve or store a file, a transformation pipeline may be created to efficiently transform file data one unit at a time in memory. The transformation pipeline includes a sequence of transformation streams, each containing a write method, a read method, and a transformation to be applied. The write method moves a unit of data, for instance, from a memory buffer into an associated stream. The read method reads the unit of data from the stream, calls an associated transformation, and passes the unit of data thus transformed to the next stream or a destination. This process is repeated until all desired and/or required transformations such as compression, encryption, tamper protection, conversion, etc. are applied to the unit of data.

Abstract: Disclosed are an apparatus and method of remotely communicating with a managed machine. One example method may include identifying the managed machine operating in a communication network, transmitting a connection establishment message to the managed machine over the communication network, and receiving an acceptance message from the managed machine. The method may also include requesting a screen capture of present operating conditions of the managed machine, and receiving the screen capture formatted in a compressed format. The administrator may be able to receive and view the screen capture via a compressed thumbnail format.

Abstract: Methods and apparatuses that enroll a wireless device into an enterprise service with a management server addressed in a management profile are described. The enrollment may grant a control of configurations of the wireless device to the management server via the management profile. In response to receiving a notification from the management server, a trust of the notification may be verified against the management profile. If the trust is verified, a network session may be established with the management server. The network session may be secured via a certificate in the management profile. Management operations may be performed for management commands received over the secure network session to manage the configurations transparently to a user of the wireless device according to the control.

Abstract: The disclosed computer-implemented method for detecting text display manipulation attacks may include (1) extracting a file name from a file that is under evaluation for malicious content, (2) inspecting, by a software security system, the file name for at least one control character that manipulates how the file name is displayed, (3) determining, based on inspecting the file name, that the file name includes the control character that manipulates how the file name is displayed, and (4) performing, by the software security system, a security action based at least in part on the determination that the file name includes the control character. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Methods are disclosed for incorporating a security gateway within a wireless mesh network. In one embodiment, the wireless mesh network is a heterogeneous mesh network. In one embodiment, a gateway node, which is part of the wireless mesh network, requests a connection to the core network through a security gateway. The security gateway responds by creating an IPSec tunnel and a GRE tunnel within the IPSec tunnel from itself to the gateway node. Once the gateway node is communicatively coupled to the security gateway via secure tunneling, the gateway node sends a mesh routing protocol to the security gateway.

Abstract: Systems and methods are presented for distributed validation of a digitally signed electronic document. A computing device accesses both a representation of the electronic document and a digital signature for the electronic document that includes a digest generated by the digital signature's creator by applying a one-way function to the electronic document. The computing device applies the same one-way function to the accessed representation of the electronic document to generate a new digest, and includes both the digital signature and the new digest in a request sent to a separate validation server. The request does not include the electronic document. The validation server generates validation results that depend on comparing the digest from the digital signature with the new digest, and that do not depend on having the electronic document available to the validation server. The computing device receives the validation results from the separate validation server.

Abstract: For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel encryption method for encrypting the data messages sent by the GVMs. The method initially receives a data message to send for a GVM executing on the host. The method then determines whether it should encrypt the data message based on a set of one or more encryption rules. When the process determines that it should encrypt the received data message, it encrypts the data message and forwards the encrypted data message to its destination; otherwise, the method just forwards the received data message unencrypted to its destination. In some embodiments, the host encrypts differently the data messages for different GVMs that execute on the host.