Abstract: Systems and methods can secure against cross-site request forgery using client-side token storage. A client browser can initiate an action associated with a first web service and generate a token. The token may be stored in client-side storage at the computing device. An indicator of the action may also be stored within the client-side storage. A return link, associated with a passed copy of the token, may be generated. The client may perform the redirect and return to the first web service according to the return link. The passed copy of the token can be extracted from the return link. The indicator of the action and the stored token may be loaded from the client storage. The passed copy of the token and the stored token may be compared. The action according to the indicator of the action may be performed in response to the comparison matching.

Abstract: In particular embodiments, a method includes accessing a graph structure comprising a plurality of nodes and edges where each node represents a user, receiving a request to transmit content related to a first user to a second user, and prohibiting transmission of the content to the second user if the first user and the second user are connected in the graph structure through a series of edges and nodes that comprises an unauthorized node.

Abstract: Systems and methods are described for delegating permissions to enable account access to entities not directly associated with the account. The systems determine a delegation profile associated with a secured account of at least one customer. The delegation profile includes a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once the delegation profile is created, it can be provided to external principals or services. These external principals or services can use the delegation profile to obtain credentials for performing various actions in the account using the credentials of the delegation profile.

Abstract: In accordance with the teaching described herein, systems and methods are provided for providing secure access to a software application on a computing device. The software application may include a security framework having a set of predetermined security requirements. Prior to enabling access to the software application by a user, the computing device may, (i) verify installation of a device security configuration profile on the computing device, wherein the device security configuration profile certifies that the software application includes the set of predetermined security requirements, (ii) receive identifying information from the user via a user interface, (iii) verify the identifying information with an authentication server, and (iv) based on a successful verification of the identifying information, receive and store a security token. Access to the software application on the computing device may be provided for a specified period identified by the security token.

Abstract: A secure session of communication between two entities in a network is disclosed. Using client-server terminology, a client sends a connection-request to a server that authenticates the connection-request and transmits a session-request to the client in response. The client reverse-authenticates the session-request and then passively waits to receive a tunnel-request transmitted by the server. The tunnel-request sets up one or more overlapping tunnels between the client and the server to support the desired communications. Each of the tunnels exists only for a specified time and is replaced by another tunnel that is set up after a selected time delay after the start of a previous tunnel.

Abstract: A control system includes a controlled apparatus and a portable terminal apparatus that controls the controlled apparatus. The controlled apparatus includes an authentication code generating unit that generates an authentication code and an authentication code output unit that outputs the generated authentication code. The portable terminal apparatus includes a code input unit that inputs a code and a code transmitting unit that transmits the input code to the controlled apparatus. The controlled apparatus further includes a determining unit that determines whether the code transmitted from the code transmitting unit is the authentication code output from the authentication code output unit and whether a first period has elapsed since generation of the authentication code and a permission unit that permits control using the portable terminal apparatus in response to determination that the transmitted code is the output authentication code and the first period has not elapsed.

Abstract: A ring oscillator (RO) based Design-For-Trust (DFTr) technique is described. Functional paths of integrated circuit (IC) are included in one or more embedded ROs by (1) selecting a path in the IC, based on path selection criteria, that has one or more unsecured gates, and (2) embedding one or more ROs on the IC until a stop condition is met. An input pattern to activate embedded RO is determined. Further, a golden frequency which is a frequency at which the embedded RO oscillates, and a frequency range of the embedded RO are determined. A Trojan in the IC may be detected by activating the embedded RO (by applying the input pattern), measuring a frequency at which the embedded RO oscillates, and determining whether or not a Trojan is present based on whether or not the measured frequency of the RO is within a predetermined operating frequency range of the RO.

Abstract: Methods and apparatus for reducing security vulnerabilities in a client/server speech recognition system including one or more client computers and one or more server computers connected via a network. Decryption of sensitive information, such as medical dictation information, is performed on designated servers to limit the attack surface of unencrypted data. Management of encryption and decryption keys to restrict the storage and/or use of decryption keys on the server side of the client/server speech recognition system, while maintaining encrypted data on the server side is also described.

Abstract: A first device establishes a connection with a second device and attempts access, via the connection to an enterprise server of an enterprise. The first device may have a number of security perimeters, ones of which are allowed to use various communications proxies provided by the second device. If the first device and the second device are associated with a same common enterprise, an enterprise perimeter of the first device may be enabled to access the enterprise using an enterprise proxy of the second device.

Abstract: A method for conducting smart card transactions is provided that includes causing a computer to recognize communications from a mobile device as communications from a smart card reader containing a smart card, and conducting a smart card transaction in accordance with smart card security techniques with the mobile device.

Abstract: A privacy server protects private information by substituting a token or an identifier for the private information. The privacy server recognizes that a communication includes private information and intercepts the communication. The privacy server replaces the private information with a random or pseudo-random token or identifier. The privacy server maintains the private information in a local database and associates the private information for a particular person with the token or identifier for that person.

Abstract: Systems and methods are described for delegating permissions to enable account access. The systems utilize a delegation profile that can be created within a secured account of at least one user. The delegation profile includes a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once the delegation profile is created, it can be provided to external principals or services. These external principals or services can use the delegation profile to obtain credentials for performing various actions in the account using the credentials of the delegation profile.

Abstract: Embodiments are directed to securely filtering trust services records. In one scenario, a client computer system receives at least one of the following trust services records: a trust services certificate, a principal certificate, a group certificate and a trust services policy. The client computer system performs a time validity check to validate the trust services record's timestamp, performs an integrity check to validate the integrity of the trust services record and performs a signature validity check to ensure that the entity claiming to have created the trust services record is the actual creator of the trust services record. The client computer system then, based on the time validity check, the integrity check and the signature validity check, determines that the trust services record is valid and allows a client computer system user to perform a specified task using the validated trust services record.

Abstract: An example method disclosed herein to monitor Internet usage comprises intercepting, using a kernel extension executing in an operating system kernel of a device, a first request to be sent to a content source by a monitored client executing on the device, providing a first certificate to the client in response to intercepting the first request sent by the client to the content source, the first certificate associated with a meter that is to monitor Internet usage, sending a second request to the content source, receiving a second certificate that is associated with the content source in response to sending the second request to the content source, and obtaining a session key to decrypt encrypted traffic exchanged between the content source and the client, the session key being obtained from the client based on the first certificate and being sent to the content source based on the second certificate.

Abstract: Techniques for electronic signature process management are described. Some embodiments provide an electronic signature service (“ESS”) configured to manage electronic identity cards. In some embodiments, the ESS generates and manages an electronic identity card for a user, based on personal information of the user, activity information related to the user's actions with respect to the ESS, and/or social networking information related to the user. The electronic identity card of a signer may be associated with an electronic document signed via the ESS, so that users may obtain information about the signer of the document. Electronic identity cards managed by the ESS may also be shared or included in other contexts, such as via a user's profile page on a social network, a user's email signature, or the like.

Abstract: A system and method for low delay fast update, using multiple fast update pictures, for video streaming are disclosed. In one embodiment, a fast update request is received from a media client via a network by a media server to recover from packet losses. Further, one or more low delay fast update frames are generated based on packet loss statistics obtained during a steady state video streaming session by the media server. Furthermore, the generated one or more low delay fast update frames are sent to the media client to recover from the packet losses by the media server.

Abstract: Retrieval and local storage of data at mobile devices is managed by employing a scheduling policy based on a prediction policy of a preloader, a pre-render policy, and with respect to a current viewport state to reduce waiting time and mobile device resource usage. Portions of data maintained on a server associated with a client device are retrieved and preloaded into the client device memory to enable a user to view documents seamlessly while navigating through a document without overburdening the client device memory and/or processing capacity based on a prediction. A current viewing position of the document and user navigation on the document via a touch action or gesture are detected and next portion of data to present another portion of the document is predicted. A request manager may retrieve the requested data from the server and pre-rendered so that it is available when requested by the user.

Abstract: A system and method for detecting whether a user account has been compromised. A server computer determines, for a client device, a first identifier associated with the client device. The server computer analyzes an activity log associated with an account of a user to determine if an eavesdropping condition has been met during a given duration. The analysis includes: 1) determining that an eavesdropping activity has occurred during the given duration and determining that no normal activity has occurred during the given duration for the first identifier; 2) determining a second identifier associated with a second device used to access the user account; and 3) determining that a normal activity associated with the second identifier has occurred during the given duration.

Abstract: A method of using an account agent to access a superuser account shell of a computer device is disclosed. The method includes receiving an authentication request; verifying whether an identity authentication is passed; when the identity authentication is passed, establishing a secure channel between the account agent and a normal user account shell; and allowing controlling the superuser account shell of the computer device through the normal user account shell.

Abstract: Embodiments of a system and method for detecting a security compromise on a device are described. Embodiments may be implemented by a content consumption application configured to protect content decryption keys on a device, such as a computer system (e.g., a desktop or notebook computer) or a mobile device (e.g., a smartphone or tablet). For instance, the content consumption application may be configured to provide decryption keys for respective content to a media component (or another component of the operating system) if multiple conditions have been met. For instance, in various embodiments, the content consumption application may pass the key to the media component after ensuring that i) one or more security mechanisms of the device operating system have not been compromised and ii) one or more executable instructions of the content consumption application have not been tampered (e.g., instructions corresponding to a function that handles the decryption key(s)).