Abstract: The purpose of the present invention is to provide a portable terminal and an application software start-up system whereby the application software that is started up is limited depending on the state of a user, thereby providing an improved ease of use. For this purpose, an application software start-up method for an information processing device comprises: performing identity authentication based on static biological information; determining the state of the user by comparing dynamic biological information acquired from the body of the user with previously measured dynamic biological information; and limiting the application software that is started up in accordance with the determined state of the user and on the basis of a permission level that is set in advance for each application software item.

Abstract: A biometric electronic signature authenticated key exchange (“BESAKE”) token processing system. The system includes a storage location having a plurality of biometric reference templates. The system further includes an authentication computing system having a processor and instructions. The instructions configured to cause the authentication computing system to receive a signing party identifier and the BESAKE token from a signing party. The BESAKE token having a biometric sample encrypted using an encryption key. The instructions further configured to generate a decryption key and decrypt the encrypted biometric sample from the BESAKE token. The instructions further configured to match the biometric sample with a biometric reference template and transmit to a biometric service provider computing system a match request. The instructions further configured to determine a signing party identity via a binary match value.

Abstract: A device can (i) store public keys Ss and Sn for a network and (ii) record private key sd. A network can record a corresponding private keys ss and sn. The device can (i) generate a device ephemeral PKI key pair (Ed, ed) and (ii) send public key Ed to the network. The device can receive an ephemeral public key Es from the network. The device can calculate values for A: an elliptic curve point addition over Ss, Sn, and Es, and B: (sd+ed) mod n. The device can input values for X and Y into an elliptic curve Diffie Hellman key exchange (ECDH) in order to determine a mutually derived shared secret X5, where the network can also derive shared secret X5. The device can (i) use X5 to derive a key K2 and (ii) decrypt a ciphertext from the network using key K2.

Abstract: A system of smart edge sensors, wherein security and encryption is pushed to the edge of the network. In one example, an electronic device includes several sensors. The device is operated by a microprocessor. A plurality of smart edge devices are each interposed between a respective sensor and the microprocessor and intercepts communication between the sensor and the microprocessor. The smart edge device encrypt any data output by the sensor, and decrypt any data received from the microprocessor. A JTAG access is connected to a co-processor where executes a JTAG dongle to authenticate the sensor and an interface with the sensor.

Abstract: A method of data transfer from a tenant to a service provider comprises encrypting the data with a public key of a key pair generated by a secure device within the service provider system. The data thus cannot be accessed by the service provider during transmission. The data is generated with a corresponding access control list, which specifies that a valid certificate must be presented in order to grant a particular use of the data once stored. The tenant can thus retain control of the use of the data even though it has been transferred out of the tenant system. A method of controlling use of data securely stored in the service provider system comprises issuing a use certificate having an expiry time to the party requesting use of the data. The use certificate must be validated before use of the stored data is granted. This enables the tenant to grant use of the stored data for a limited time period.

Abstract: Verifiable, secure communications between a sender and a receiver on at least one shared communication channel is provided. A manicoded key encoder produces an argument of knowledge for a secret key to the at least one shared communication channel, and a manicoded message encoder provides an implication argument indicating that knowledge of the secret key enables access to message content of the manicoded message. The argument of knowledge is included in a key manifest for the secret key within a manicoded key, and the implication argument is included in a message manifest of a manicoded message. In this way, the sender may provide message content within the manicoded message, and the receiver may operate a decoder to access the message content. A verifier may use the manicoded key and the manicoded message to verify that the receiver has access to the message content.

Abstract: A method and system of performing an authentication of a person in order to activate a smart card for access to a secured resource is disclosed. The system and method are configured to collect image data and compare the image data to facial model data stored on the smart card. The system detects whether there is a match between the image data and any facial signatures previously collected and stored in the smart card. If there is a match, the system verifies an identity of the person and can be configured to automatically activate the smart card for a limited period of time.

Abstract: A computer-implemented method of making secure computer products is described, including a computer-implemented method of configuring a computer system configured to run an operating system, wherein the method of to enable the computer system to resist the execution of unauthorised software, the method comprising: instantiating an application programming interface to enable an application running on the computer system to access the functionality of the operating system; and applying a transform to the application programming interface to modify the application programming interface.

Abstract: Embodiments of the invention are directed to methods and systems for software module binding. Cryptographic keys and challenge elements can be exchanged between a first software module and a second software module to create a binding between the first software module and the second software module. As a result, a first software module can securely and authentically access sensitive data and functionality at a second software module, while unauthorized software modules can be prevented from accessing the sensitive data and functionality.

Abstract: Disclosed are various embodiments for controlling access to resources in a network environment. Methods may include installing a profile on the device and installing a certificate included in or otherwise associated with the profile on the device. A request to execute an application, and/or access a resource using a particular application, is received and determination is made as to whether the certificate is installed on the device based on an identification of the certificate by the application. If the certificate is installed on the device, then execution of the application and/or access to the resource is allowed. If the certificate is not installed on the device, then the request for execution and/or access is refused.

Abstract: Aspects of the disclosure relate to using secure authentication tokens to grant power of attorney. A computing platform may receive user input indicating a task and requesting that a power of attorney be granted to an individual. The computing platform may generate an authority token granting the individual the power of attorney to perform the task, and may send the authority token, along with task information indicating the task, to the individual. The computing platform may receive a validation request including the authority token and the task information. Based on successful validation, the computing platform may send validation information to an event processing system. After receiving confirmation that the task has been performed by the individual, the computing platform may update dashboard information to indicate that the task has been completed, which may cause the user device to display a dashboard indicating completion of the task.

Abstract: Various embodiments relate to a method performed by a processor of a computing system. An example method includes determining a first cryptographic algorithm utilized in a first block of a first blockchain. The first block of the first blockchain has a first unique block identifier. A second cryptographic algorithm utilized in a second block of the first blockchain is determined. The second block of the first blockchain having a second unique block identifier. A first cryptographic algorithm status transition (“CAST”) event is defined if the second cryptographic algorithm is different than the first cryptographic algorithm. A first CAST record is defined upon occurrence of the first CAST event. The first CAST record includes the second cryptographic algorithm and the second unique block identifier. The first CAST record is digitally signed and stored on a second blockchain. The second blockchain may be referenced out-of-band of the first blockchain.

Abstract: Computing system operational methods and apparatus are described. According to one aspect, a computing system operational method includes accessing user information regarding a user logging onto a computing device of the computing system, processing the user information to determine if the user information is authentic, as a result of the processing determining that the user information is authentic, first enabling the computing device to execute an application segment, and as a result of the processing determining that the user information is authentic, second enabling the application segment to communicate data externally of the computing device via one of a plurality of network segments of the computing system.

Abstract: A terminal selectively and passively monitors for predefined wireless network discovery advertisements/requests. Requests that match what are expected by the terminal or requests that are in a predefined format are verified. The requests lack any connection pairing passcode; rather, the passcodes are separately provided from connecting devices only after the discovery requests are verified. The terminal independently authenticates the passcodes before authorizing wireless sessions between the devices and the terminal. Wireless discovery settings are continuously changed by the terminal and are valid for only a preset time window, each setting corresponds to a Time-based One Time Password (TOTP) representing a passcode; the TOTP is dependent on and valid only for the corresponding setting and the corresponding time window. In an embodiment, the connection requests are preauthorized by a server for a time window in the future, and the terminal authenticates the requests without interaction with the server.

Abstract: A method includes forming a communication channel between a user device and an access device. The communication channel is then secured using a user device key pair in the user device and an access device ephemeral key pair in the access device. The access device then generates a session key using at least a private cryptographic key in the access device ephemeral key pair, and a public key in the user device key pair. The access device then uses the session key to secure an ultrawideband communication channel between the user device and the access device.

Abstract: A system includes a media source and a firewall system. The media source stores media content that includes one or both of an image or a video. The firewall system stores filtering criteria that include rules for blocking communication of all or a portion of the media content based at least in part on an identity of an individual appearing in the media content. The firewall system receives a request for the media content. The firewall system determines characteristics of a user that provided the request for the media content. The firewall system determines the identity of the individual appearing in the media content. Based at least in part on the characteristics of the user that provided the request for the media content, the identity of the individual appearing in the media content, and the filtering criteria, the firewall system determines an action for securing the media content.

Abstract: The disclosure relates to systems and methods for managing state using relatively small assistance from protected hardware. Obfuscated code segments may communicate with supporting protected hardware, store encrypted state values in main memory, and/or communicate via secure channels to secure platform hardware components. In various embodiments, consistent state may be achieved, at least in part, by computing secure tag information and storing the secure tag information in a secure and/or otherwise protected device register. Consistent with embodiments disclosed herein, the tag information may be used to derive keys used to encrypt and/or decrypt stored state information. Tag information may further be used in connection with verification operations prior to using the information to derive associated keys.

Abstract: Systems, methods, and related technologies for account access monitoring are described. In certain aspects, a login request associated with a device can be analyzed and a score determined. The score and a threshold can be used to determine whether to initiate an action.

Abstract: A mobile communications device is provided with a tagging module that tags outgoing communications. Upon receiving the tagged communication, a communications provider requests from a registered owner service identified in the tag whether the mobile communications device identified in the tag is registered with the registered owner service. Upon receiving confirmation from the registered owner service that the mobile communications device is registered with the service, the communications provider provides information regarding the location of the mobile communications device to the registered owner service.

Abstract: Methods, systems, and devices that support determining whether media data has been altered are described. Captured media data may be segmented into one or more subsets, and cryptographic representations (e.g., hashes) based on the subsets may be written to an immutable ledger, possibly along with metadata and other related data. A block of a blockchain may be created for each entry in the immutable ledger. A set of media data may be validated, if a corresponding immutable ledger exists, based on segmenting the set of media data into one or more subsets in accordance with the segmenting upon capture, creating candidate cryptographic representations (e.g., hashes) based on the subsets, and comparing the candidate cryptographic representations with contents of the corresponding immutable ledger.