Abstract: A command filter module filters receives a plurality commands intended for receipt by devices interconnected within a utility grid. The command filter module may authorize the plurality of commands for execution by the respective devices based on predetermined set of command rules. Historical and real-time data may be implemented by the command filter module to perform an authorization decision for the plurality of commands. Authorized commands may be transmitted by the command filter module for receipt by the respective devices. The command filter module may generate rejection messages corresponding to unauthorized commands. The rejection messages may be transmitted to a source of an unauthorized command.

Abstract: An information processing apparatus includes a data processor and a storage. The storage is divided into a protected area to which access is limited and a general purpose area which is freely accessible, and configured to store in the general purpose area encrypted content, and an encrypted title key obtained by encrypting a title key to be applied to decrypt the encrypted content, and store in the protected area a binding key applied to encrypt the title key, and a hash value of the encrypted title key. The data processor is configured to determine, in response to a request for access to the protected area from an external apparatus, whether or not to permit the access, and permit, only when access permission determination is made, the access to the protected area.

Abstract: A computer-implemented method for facilitating access to shared resources within computer clusters may include identifying a quick response code captured by at least one computing system. The method may also include identifying information encoded in the quick response code captured by the computing system. The method may further include determining that the information encoded in the quick response code contains an activation key that facilitates activation of a software application. The method may additionally include applying, in response to this determination, the activation key to the software application in order to activate the software application without requiring a user of the software application to manually enter the activation key. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A technique for secure computation obfuscates program execution such that observers cannot detect what instructions are being run at any given time. Rather, program execution and memory access patterns are made to appear uniform. A processor operates based on encrypted inputs and produces encrypted outputs. In various examples, obfuscation is achieved by exercising computational circuits in a similar way for a wide range of instructions, such that all such instructions, regardless of their operational differences, affect the processor's power dissipation and processing time substantially uniformly. Obfuscation is further achieved by limiting memory accesses to predetermined time intervals, with memory interface circuits exercised regardless of whether a running program requires a memory access or not. The resulting processor thus reduces leakage of any meaningful information relating to the program or its inputs, which could otherwise be detectable to observers.

Abstract: The present invention relates to a system and methodology facilitating automation security in a networked-based industrial controller environment. Various components, systems and methodologies are provided to facilitate varying levels of automation security in accordance with security analysis tools, security validation tools and/or security learning systems. The security analysis tool receives abstract factory models or descriptions for input and generates an output that can include security guidelines, components, topologies, procedures, rules, policies, and the like for deployment in an automation security network. The validation tools are operative in the automation security network, wherein the tools perform security checking and/or auditing functions, for example, to determine if security components are in place and/or in suitable working order.

Abstract: A message processing device for processing messages has at least one reception buffer, a message includes at least one authentication element and one message content. The message is received and stored in the reception buffer. A characteristic variable of a priority for security checking of the message is determined as a function of the message content. A processing sequence for further message processing for the security checking, taking into account the at least one authentication element of the messages in the reception buffer is defined and carried out as a function of the characteristic variable.

Abstract: A system may receive a plurality of security threats and categorize each security threat in the plurality of security threats into security threat categories. The system may then determine, based at least in part upon an instance of a security threat category, a future occurrence of the security threat category and determine, based at least in part upon the future occurrence of the security threat category, that the security threat category is an emerging threat.

Abstract: A method and apparatus for detecting scans are described. In one example, a plurality of flows is allocated into a plurality of bins associated with different source internet protocol (SIP) addresses. A set of bin characteristics for at least one bin of the plurality of bins is generated if the at least one bin reaches a predefined flow capacity. Afterwards, the set of bin characteristics is compared to a scan characteristics list to determine if a potential scan exists.

Abstract: A method, system and computer program product for autonomic security configuration may include controlling a security configuration of at least one resource forming a solution based on a plurality of security requirements. The method may further include applying the plurality of security requirements across a plurality of resources independent of a resource type.

Abstract: A system is described that can perform a method for receiving a request to modify a universal integrated circuit card, generating a package comprising configuration data for modifying the universal integrated circuit card, instructing an over-the-air system to transmit the package encrypting the package with a transport key to generate an encrypted package, and transmitting the encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card. The system can also perform a method of providing a mobile network operator trusted service manager system information relating to the configuration data to enable the mobile network operator trusted service manager system to manage content and memory allocation of the universal integrated circuit card.

Abstract: Described is a technique for providing a host identifier for a host. A first portion associated with a characteristic of said host is received. A second portion including a non-deterministic component is received. The host identifier is formed using the first portion and the second portion. The host identifier is used to uniquely identify the host in a storage area network.

Abstract: A method for administering object-based multi-level security in a service oriented architecture includes: (a) defining a plurality of multi-level security attributes for each of selected respective life-cycle states of a plurality of life-cycle states of a service object; (b) receiving a request from a requestor for the service object; (c) determining permitted actions for the service object based upon at least one selected multi-level security attribute of the plurality of multi-level security attributes, and based upon at least one life-cycle state of the plurality of life-cycle states of the service object; and (d) generating a quality of service security contract based upon the determination of permitted actions.

Abstract: A method and apparatus for securing transactions using verified resource locations is described. In one embodiment, the method for authorizing a transaction request using published location information for at least one resource includes examining relationship data regarding at least one resource to identify at least one publisher computer and at least one subscriber computer, wherein the at least one publisher computer communicates location information for the at least one resource and in response to at least one transaction request from the at least one subscriber computer, comparing the location information with the at least one transaction request to verify at least one resource location.

Abstract: A system and method for presenting on-demand masking of data as a software service in a distributed environment is provided. An application hosted on a computing device receives request for access to application data from a user. Credentials of the user are first validated in order to determine whether the user is authorized to access the requested application data. For an authorized user, a category of the user is determined to ascertain whether the user is privileged to obtain full access. In case the user is a privileged user, unmasked application data is fetched from a database utility and provided to the user. In case the user is not a privileged user, application data access request is transferred to a data masking service. Application data is fetched from database utility, masked based on pre-defined masking rules and provided to the user.

Abstract: Mechanisms are disclosed that allow for execution of unsigned content and the securing of resources in a closed system when such unsigned content is executing on the system. For example, an access layer is used between an operating system layer of the closed system and the actual unsigned content. This access layer may contain various sub-layers, such as a graphics layer, an audio layer, an input layer, and a storage layer. These layers can control access that the unsigned content can have to the native operating system layers and the associated resources of the closed system. By providing such an access layer, unsigned content, e.g., video games, can run on the closed system that is typically designed to run only signed content.

Abstract: A method for disambiguating entities on a multi-level security display includes receiving a selection of a particular security level and rendering entities having a different security level in a visually distinct way. Visual distinction may include not drawing the entities on the multi-level security display.

Abstract: A computer receives an electronic document that includes a group of terms. The computer sends the electronic document to an information extraction program that extracts specific terms from the group of terms. Each of the specific terms that match to a certain extent with one of the attribute values in an electronic dictionary is identified. A value associated with the electronic document is generated based on the specific terms that match, and on an end-user that is attempting to access the electronic document.

Abstract: A system for transferring secured data has an authentication facilitator that transmits data indicative of a graphical key pad to a remote display device of a user computing device and, in response, receives from the user computing device icon location data indicative of locations of icons selected by a user. Additionally, the authentication facilitator recovers a personal identifier (PI) from the icon location data, translates the recovered PI to obtain a translated PI, and transmits the translated PI. The system further has a partner computing apparatus that receives the translated PI and allows the user access to a secured area based upon the translated PI.

Abstract: Active learning-based fraud detection techniques are provided in adaptive authentication systems. An authentication request from an authentication requestor is processed by receiving the authentication request from the authentication requester; comparing current data for the user associated with the user identifier with historical data for the user; generating an adaptive authentication result based on the comparison indicating a likelihood current user data is associated with a fraudulent user; and performing one or more additional authentication operations to improve learning if the request satisfies one or more predefined non-risk based criteria. The predefined non-risk based criteria comprises, for example, (i) the request receiving a riskiness score below a threshold based on current data and wherein the request was expected to have a risk score above a threshold, or (ii) the request being in a bucket having a number of tagged events below a threshold.

Abstract: According to one embodiment, a computer system executing a computer program is coupled to multiple secure network domains configured in a multi-level security architecture. The computer program simultaneously establishes a voice connection with a first terminal configured on a first secure network domain and a second terminal configured on a second secure network domain. The computer program may then selectively couple an electroacoustical transducer to the first terminal or the second terminal, and generate an indicator on a user interface indicating the security level of the selected terminal.

Abstract: A computationally implemented method includes, but is not limited to: determining that a computing device used by a first user has been transferred from the first user to a second user; and restricting access via the computing device to one or more items in response to said determining. In addition to the foregoing, other method aspects are described in the claims, drawings, and text forming a part of the present disclosure.

Abstract: A method and system are provided for secure messaging on mobile computing devices. The method and system provide for an indication of a security trust level associated with a security method used with an electronic message.

Abstract: A computer receives an electronic document that includes a group of terms. The computer sends the electronic document to an information extraction program that extracts specific terms from the group of terms. Each of the specific terms that match to a certain extent with one of the attribute values in an electronic dictionary is identified. A value associated with the electronic document is generated based on the specific terms that match, and on an end-user that is attempting to access the electronic document.

Abstract: The invention is directed to techniques for dynamic policy provisioning. A network security device may comprise a memory that stores a first policy that identifies a first set of patterns that correspond to a first set of network attacks and a second policy, and a control unit that applies the first policy to the network traffic to detect the first set of network attacks. The control unit, while applying the first policy, monitors parameters corresponding to one or more resources and dynamically determines whether to apply a second policy to the network traffic based on the parameters. The control unit, based on the dynamic determination, applies the second policy to the network traffic to detect a second set of network attacks and forwards the network traffic based on the application of the second policy. In this manner, the network security device may implement the dynamic policy provisioning techniques.

Abstract: The claimed subject matter provides a system and/or method that facilitates employing safety within an industrial environment. An enhancing component can implement at least one of a security level, authentication, authorization, or an access right to a validated action to at least one of the controller or the controller engine instance. The enhancing component can further separate two or more entities within the industrial environment, the first entity related to process control and the second entity related to process safety. Additionally, the enhancing component can employ at least one of a backup controller or a backup controller engine instance in the event of at least one of a software error or a hardware error within the industrial environment.

Abstract: Secure key management includes populating a section of information associated with a key, the section of information being populated with information relating to a level of protection of the key accumulated over time. Secure key management further includes securely binding the section of information to the key, wherein the key is encrypted.

Abstract: A communication method on a communication link between an aircraft and a ground station, the communication capable of being configured according to a plurality of safety levels in which, when the aircraft sends a request to a ground station to modify the safety level of the communication from a previous safety level to a new safety level and the aircraft does not receive an acknowledgement of the request by the ground station, the aircraft still accepts messages from the ground station according to the new security level.

Abstract: Each virtual machine in a set of virtual machines managed by the virtual machine manager is identified. For each virtual machine in the set, it is determined whether the respective virtual machine is online. For at least the virtual machines determined to be offline, a machine image is collected for each offline virtual machine. Security of the offline virtual machines is assessed from the collected images. For virtual machines identified as online, an agent is loaded on each online virtual machine in the set via the virtual machine manager. The loaded agents are used to assess security of the online virtual machines in the set.

Abstract: In certain embodiments, a method includes receiving a communication session request from a requesting node. The communication session request is received via a network facilitating communication among a number of nodes. A number of trust level values associated with the requesting node are accessed. Each of the number of trust level values is received from one of the number of nodes. The method further includes determining, based on a voting technique and the accessed trust level values associated with the requesting node, a validated trust level associated with the requesting node. The method further includes determining, based on the validated trust level associated with the requesting node, whether to allow the communication session request received from the requesting node.

Abstract: A method and associated systems for handling a service request in a hybrid computer system. The hybrid computer system includes an application server computer and at least two mainframe computers. The server computer receives a service request from a user application, determines that the service request does not request a memory-management function, associates the request with a single-digit numeric category, and selects one of the mainframe computers as being able to most efficiently provide the requested service. The server then translates the service request into a configuration compatible with the selected mainframe and with a mainframe operating system running on the selected mainframe, and transmits the translated request to the selected mainframe. The server receives a result from the mainframe and translates the result into a configuration compatible with the application server computer, with the user application, and with a server operating system running on the application server computer.

Abstract: A method for using a network appliance to efficiently buffer and encrypt data for transmission includes: receiving, by an appliance via a connection, two or more SSL records comprising encrypted messages; decrypting the two or more messages; buffering, by the appliance, the two or more decrypted messages; determining, by the appliance, that a transmittal condition has been satisfied; encrypting, by the appliance in response to the determination, the first decrypted message and a portion of the second decrypted message to produce a third SSL record; and transmitting, by the appliance via a second connection, the third record. Corresponding systems are also described.

Abstract: An apparatus providing for a secure execution environment. The apparatus includes a microprocessor that is configured to execute non-secure application programs and a secure application program, where the non-secure application programs are accessed from a system memory via a system bus. The microprocessor has a non-secure memory and a secure volatile memory. The non-secure memory is configured to store portions of the non-secure application programs for execution by the microprocessor, where the non-secure memory is observable and accessible by the non-secure application programs and by system bus resources within the microprocessor. The secure volatile memory is configured to store the secure application program for execution by the microprocessor, where the secure volatile memory is isolated from the non-secure application programs and the system bus resources within the microprocessor. The secure application program is decrypted using a processor unique key and is written to the secure volatile memory.

Abstract: Techniques are provided to receive at an encryption device from a control device an encryption request comprising a message and an identifier for a device. The control device and the device are associated with a security provider that provides secure content to the device using the message encrypted with a device key that is securely embedded in the device and also stored on the encryption device. The encryption device is associated with a key provider and the device key is not divulged to the security provider. At the encryption device, the device key is retrieved based on the identifier. The message is encrypted with the device key using a predetermined algorithm, and the encrypted message is then sent to the control device.

Abstract: Reflective factors are used in combination with a, one-time password (OTP) in order to strengthen a system's ability to prevent man in the middle (MITM) phishing attacks. These reflective factors may include information such as URL information, HTTPS, a server's certificate, a session key, or transaction information. These reflective factors help to ensure that a client that wishes to access a server is the legitimate client, because even if a phisher (including a phisher attacking the legitimate client in real time) records identifying information from the legitimate client, it cannot replicate the reflective information to authenticate itself with the server.

Abstract: Handset, computer software and method for protecting sensitive network information, available in the handset, from disclosure to an unauthorized server, by using an abstraction function module, the handset being connected to a network.

Abstract: A method for providing message protection includes generating a ciphered message based upon a first counter, a message, and a ciphering key. The method further includes generating an unciphered message authentication code (MAC) based upon the first counter, an integrity protection key, and either the message or the ciphered message, and transmitting security protected data, which includes the MAC and the ciphered message, over a transmission medium.

Abstract: A system is configured to receive a list of applications installed on a user device; obtain application profiles that identify risk levels associated with the applications; obtain a user profile that identifies a job level, security risk level, or an access level to confidential information associated with the user of the user device; identify a highest risk level authorized for the user device based on whether the job level is greater than a first threshold, the security risk level is greater than a second threshold, or the access level is greater than a third threshold; determine whether any of the risk levels are greater than the highest risk level; and transmit a notification that one of the applications is to be removed from the user device when one of the risk levels, associated with the one of the applications, is greater than the highest risk level.

Abstract: A method includes controlling security in a communication system that involves a node capable of routing traffic according to one or more security algorithms with respective security levels. The node is adapted to estimate at least one safety degree relating to the node, to select at least one security algorithm of the one or more security algorithms, depending on the estimated safety degree; and to activate the at least one security algorithm.

Abstract: A method and device for selectively protecting a control signal. The method includes: configuring, at a transmission end, a header comprising indication information representing whether the control signal is encrypted; performing, at the transmitting end, protection of the control signal by selecting one of schemes for protecting the control signal; and transmitting, by the transmission end to the reception end, the control signal comprising the header. The schemes for protecting the control signal include: a first scheme that protects confidentiality and integrity of the control signal, a second scheme that protects only the integrity of the control signal, and a third scheme providing no protection of the control signal.

Abstract: In one example, a network device may be configured to authenticate a user based on a first pre-shared secret associated with a first login request as a condition to granting the user limited access. The network device may be configured to determine whether a received second request for the user is associated with an additional level of access. The network device may be configured to, in response to determining that the second request is associated with the additional level of access, authenticate the user based on a second pre-shared secret as a condition to granting the user the additional level of access.

Abstract: A mechanism for the flow of access by derivation is provided. An access point may be any object, such as files or functions, to which the access recipient is granted access rights by the access provider. Access is typically represented by a relationship object referencing the access provider function, the access recipient function, and the access point object, and a set of access rights. This membership access relationship object is typically represented as a subtype of the access relationship. When a membership access relationship is created, typically a new associated persona function is generated, representing the new identity created for the access recipient function while serving as a member of the access point function. When a persona function is invited to be a member in another function, that in turn generates a membership and a second persona that is derived from the first persona, resulting in identity derivation.

Abstract: Concepts and technologies are disclosed herein for management of application access. A security management application can be configured to set access controls and/or other security settings relating to application programs. Additionally, or alternatively, particular functions and/or functionality associated with application programs may be individually configured. Settings reflecting the access controls and/or other security settings can be stored and can be applied at the user device. The security management application also can be configured to determine if security settings and/or access controls are to be overridden. Data can be collected from various sensors and/or other sources to use in determining if particular application programs and/or application program functionality is to be allowed. Thus, normally disallowed activities can be allowed in emergency conditions, when in a business location associated with a particular device, and/or at other times and/or under other circumstances.

Abstract: A system and method can be used to collect communication information including Layer 2 and Layer 3 information during normal communications between devices or other elements within a network. In a particular embodiment, the information can be generated as address resolution protocol tables and media access control tables, which are used to keep track of which elements are connected to other elements and to map network addresses to media access control identifiers. The communication information can be used in performing an action, such as servicing the system, auditing the system, checking for security breaches or policy violations, or other suitable action.

Abstract: A cloud service access and information gateway receives, from a user device, a request to access a cloud service. The cloud service access and information gateway determines an identity of a user making the request to access the cloud service and compares the identity of the user to a password vault control policy. The cloud service access and information gateway determines, based on the comparing, one or more sections of a split password vault to which the user has access. The split password vault comprises a first section storing a first set of log-in credentials and a second section storing a second set of log-in credentials.

Abstract: A wireless communication device comprises first processing circuitry configured to execute an RF operating system and second processing circuitry configured to execute an open operating system, wherein the first processing circuitry is linked to a secure memory device inaccessible to the second processing circuitry. The RF operating system is configured to receive protected data and store the protected data in the secure memory device. The open operating system is configured to receive a request for the protected data from one of a plurality of user applications and transfer the request to the RF operating system. In response to the request for the protected data, the RF operating system is configured to retrieve the protected data from the secure memory device, encrypt the protected data, and transfer the encrypted protected data to the open operating system for delivery to the one of the user applications associated with the request.

Abstract: An embodiment of the invention provides a method for security classification applying social norming. More specifically, content is received from a user via an interface; and, a data repository connected to the interface stores the content. A portal connected to the data repository identifies an attempt to access the content from a non-user. A program processor connected to the portal determines whether the content includes a security classification. When the content does not include a security classification, a communications module connected to the program processor sends an alert to the user. The alert includes a request to assign a security classification to the content. When the content includes a security classification, the communications module sends a message to the user, wherein the message includes a request to verify the security classification.

Abstract: Systems and methods for selective authorization of dependent code modules are provided. According to one embodiment, responsive to a monitored file system or operating system event initiated by an active process, a real-time authentication process is performed or bypassed on a code module to which the monitored event relates with reference to a whitelist that includes cryptographic hash values of approved code modules, which are known not to contain viruses or malicious code. The active process is allowed to load the code module when the authentication process is bypassed or when the cryptographic hash value of the code module matches one of the cryptographic hash values of approved code modules within the whitelist.

Abstract: The storage system includes a host computer; a management computer coupled to the host computer; a first storage device coupled to the host computer and the management computer, and including first port management information; and a second storage device coupled to the host computer, the management computer and the first storage device, and including second port management information. The first port management information and the second port management information include an identifier of a port on each storage device, an identifier of a volume in each storage device, an access restriction and an identifier of a port permitted access from the host computer to each storage device.

Abstract: Technology is provided for provisioning a user computer system with membership in a privilege set in order to execute a pre-release resource. Some examples of pre-release resources are alpha and beta versions of firmware or software which can be downloaded to user computer systems. The pre-release resources are associated with different privilege sets based on their security risk levels. In one example, a security risk level may represent a number of user computer systems at risk of an integrity failure of the pre-release resource. In other examples, the security risk may represent an operational layer of the user computer system affected by the resource or a level of security testing certification success for the pre-release resource. A privilege set identifier indicates membership in one or more privilege sets.

Abstract: To improve a communication system including two communication apparatuses in order to reduce a possibility of having communication thereof decrypted by a third party. The communication system includes a first communication apparatus and a second communication apparatus, where one of the communication apparatuses encrypts transmission subject data to generate encrypted data and transmits it to the other communication apparatus which then decrypts received encrypted data. Before performing encryption, each of the communication apparatuses cuts the transmission subject data by a predetermined number of bits to generate transmission subject cut data. In this case, each of the communication apparatuses varies the number of bits of the transmission subject cut data, and mixes dummy data of a size of which number of bits matches with the largest number of bits out of the numbers of bits of the transmission subject cut data into the transmission subject cut data other than that of the largest number of bits.