Abstract: Embodiments of the present invention are directed at methods and systems for providing a low value token buffer using only low value tokens (i.e., tokens that cannot be used to conduct transactions) within an organization to reduce access to high value tokens (i.e., tokens that are directly tied to real credentials and can be used to conduct transactions) within the organization. Accordingly, whenever a high value token is received by the organization, the high value token is changed to a low value token while being used within the organization. The low value token may be transformed to high value token upon (or before) delivery outside the organization.

Abstract: The presenting invention relates to techniques for implementing a secure operating environment for the execution of applications on a computing devices (e.g., a mobile phone). In The secure operating environment may provide a trusted environment with dedicated computing resources to manage security and integrity of processing and data for the applications. The applications may be provided with a variety of security services and/or functions to meet different levels of security demanded by an application. The secure operating environment may include a security engine that enumerates and/or determines the security capabilities of the secure operating environment and the computing device, e.g., the hardware, the software, and/or the firmware of the computing device. The security engine may provide security services desired by applications by choosing from the security capabilities that are supported by the secure operating environment and the computing device.

Abstract: Embodiments of techniques and systems for sharing user information between proximate devices are described. In embodiments, a first device may identify a physically-proximate device that may receive user information. Upon receiving an indication that a user of the first device may desire to share user information with a user of the second device, a determination may be made as to whether the two users have matching interests. In embodiments, the interest match determination may be made by a separate interest match evaluator. Upon determination of an interest match, the first device may then send a request to share user information to the second device. If a user of the second device approves the request, user information for the user of the first device may be shared with the user of the second device. Other embodiments may be described and claimed.

Abstract: A user requests to utilize anonymized user data to conduct a transaction. The anonymized user data keeps the user's sensitive data private, while still allowing certain entities to perform fraud analyses. The user configures a specific combination of user data elements to be anonymized prior to or at the time of the transaction. In some embodiments, the specific combination may be associated with a location or merchant type, which can also be selected by the user. The registration of a password associated with the anonymized user data may further increase security of the transaction.

Abstract: A method for exchanging strong encryption keys between devices using alternate input methods. At least two devices that want to communicate with one another are set in key exchange mode. The at least two devices are to communicate with one another using a short range radio or personal area network. The at least two devices negotiate with one another to determine which of the at least two devices will generate an encryption key, wherein device A represents the negotiated device and device B represents the non-negotiated device. Device A generates the encryption key and transmits the encryption key to device B using an out-of band transmission channel. The out-of-band transmission channel may be transmitting the encryption key via audio tones. A validation process determines whether the transmission of the encryption key via the out-of-band transmission channel was successful.

Abstract: Techniques for assessing the trustworthiness of a target device that a user device is attempting to communicate with are described. A user device may request one or more trustworthiness attributes of a target device before exchanging data with the target device. The user device may receive the one or more trustworthiness attributes of the target device, and determine, based on the received one or more trustworthiness attributes of the target device, a set of one or more security policies to enforce on a communication channel used for exchanging data between the user device and the target device. A communication channel between the user device and the target device can then be established according to the set of one or more security policies.

Abstract: A system and method for user certificate initiation, distribution, and provisioning in converged WLAN-WWAN interworking networks. A computing device operable in a wireless local area network sends a public key to a mobile device operable in a wireless cellular wide area network. The mobile device performs a bootstrapping procedure with a cellular operator in the wireless cellular wide area network to obtain a user certificate based on the public key. The mobile device sends the user certificate to the computing device for installation on the computing device. The user certificate may be used for digital signature, verification, and encryption purposes. The user certificate is also used in both the wireless local area network and the wireless wide area network for authenticating a subscriber when accessing services from both networks.

Abstract: Techniques described herein include a platform and process for provisioning user information onto a machine-to-machine device in order to enable the machine-to-machine device to conduct transactions utilizing the user information. In some embodiments, a user device is used to relay information between a machine-to-machine device and a provisioning service provider computer. In some embodiments, a machine-to-machine device is connected to the provisioning service provider computer via a network connection. Upon receiving a request to provision the machine-to-machine device, the service provider computer may identify the device from a device identifier. The service provider computer may generate an access credential or token for the machine-to-machine device. The access credential, token, and/or one or more policies may be provisioned onto the machine-to-machine device.

Abstract: A method for confirming that a user interacted with a resource provider before allowing the user to submit feedback associated with the resource provider is disclosed. A social network provider can query entities that are aware of the user's interaction history before activating a feedback function. Also, non-sensitive information can be used to identify the user.

Abstract: Methods and systems to display, in real time, detailed attribute information regarding a calling party. This information may be presented to a user in conjunction with an incoming voice call or message on the user's smartphone/mobile internet device (MID) or other mobile device. Such information can help him/her in real time real time to decide whether to respond to the communication. Attribute information is collected at a caller attributes processing server and communicated to a receiver device of the called party.

Abstract: Embodiments of the invention broadly described, introduce systems and methods for enabling the searching of encrypted data. One embodiment of the invention discloses a method for generating a searchable encrypted database. The method comprises receiving a plurality of sensitive data records comprising personal information of different users, identifying one or more searchable fields for the sensitive data records, wherein each searchable field is associated with a subset of the personal information for a user, generating a searchable field index for each of the one or more searchable fields, and encrypting the sensitive data records using a database encryption key.

Abstract: Systems, methods, apparatuses, and computer-readable media are described for securely installing, executing and/or migrating a security sensitive application in a trusted execution environment on a mobile device. For example, techniques described herein allow a mobile device to verify the operating environment of the mobile device, the security sensitive application itself and discover a trusted execution environment on the device to install the security sensitive application. Furthermore, techniques are disclosed for verifying the state of one or more applications on the mobile device against a synchronized copy of the trusted execution environment operating in the cloud and also migrating the state of one or more applications from a trusted execution environment from a first mobile device to a second mobile device in the event that the mobile device is compromised, lost, stolen or being upgraded.

Abstract: Embodiments of the invention provision multiple payment tokens on a communication device. The communication device may be provisioned with multiple limited use keys (LUK), each LUK being associated with a specific type of transaction. When the communication device is used for a transaction, the communication device automatically determines a type of the transaction and selects an appropriate LUK based on the determined transaction type. The selected LUK may be used to create a cryptogram, which can be used to verify the transaction.

Abstract: A system and method for user certificate initiation, distribution, and provisioning in converged WLAN-WWAN interworking networks. A computing device operable in a wireless local area network sends a public key to a mobile device operable in a wireless cellular wide area network. The mobile device performs a bootstrapping procedure with a cellular operator in the wireless cellular wide area network to obtain a user certificate based on the public key. The mobile device sends the user certificate to the computing device for installation on the computing device. The user certificate may be used for digital signature, verification, and encryption purposes. The user certificate is also used in both the wireless local area network and the wireless wide area network for authenticating a subscriber when accessing services from both networks.

Abstract: A mobile phone is disclosed. The mobile phone may receive a first request to generate an initial scannable image, and a second request to generate modified scannable image. The modified scannable image can include a static portion that corresponds to a static portion of the initial scannable image. The modified scannable image may also include another portion that has a different appearance than a corresponding portion of the initial scannable image.

Abstract: Embodiments of the invention broadly described, introduce systems and methods for enabling the searching of encrypted data. One embodiment of the invention discloses a method for generating a searchable encrypted database. The method comprises receiving a plurality of sensitive data records comprising personal information of different users, identifying one or more searchable fields for the sensitive data records, wherein each searchable field is associated with a subset of the personal information for a user, generating a searchable field index for each of the one or more searchable fields, and encrypting the sensitive data records using a database encryption key.

Abstract: A method of operating an electronic device comprises detecting access to private information stored in memory of the electronic device. The detecting is performed by a privacy management module downloadable to the electronic device as object code for execution on the electronic device and the access is performed by a client application program. The method further comprises tracking, using the privacy management module, the private information being accessed by the client application program, and reconfiguring the electronic device, using the privacy management module, to change the access to the private information by the client application program according to at least one privacy access policy stored in the electronic device.

Abstract: A method for requesting a credential associated with token in a multiple token layer environment is disclosed. A tokenization certificate serves to validate the identity of a credential requestor and provide information about the requestor's authorization for de-tokenizing a token. Also, a public key in the tokenization certificate is used to encrypt the credential for secure transmission to the requestor.

Abstract: A device, system, and machine-readable medium for headless sensor measurements are disclosed. In one embodiment, the device is exclusive of a display. The device includes a sensor head to retrieve an amount of measurement data from an environment. The device also includes an I/O interface, a memory, a non-volatile storage, processing logic, and sensor data access protocol (SDAP) manageability code. The SDAP manageability code may cause the processing logic to provide a sensor type and a measurement data payload type to a mobile communication device. The SDAP manageability code additionally may cause the sensor head to take a measurement, receive measurement data from the sensor head, packetize the measurement data, and transfer the measurement data payload to the mobile communication device.

Abstract: A system may configure at least a low power engine (LPE) and network interface circuitry when transitioning from an active state to a low-power state. The network interface circuitry may be configured to receive information from a network and to store any received information containing audio information into a memory location. The LPE may be configured to monitor the memory location, to retrieve the stored information from the memory location, to generate audio information based on the stored information and to provide the audio information to audio circuitry for playback. It is also possible for the LPE to receive audio information from the audio circuitry, to generate information for transmission based on the audio information and to store the information into a second memory location. The network interface circuitry may then retrieve the stored information from the second memory location and transmit the information to the network.