Abstract: A user may access an institution system via more than one communications channel, either by the same device (e.g., a mobile device accessing the institution system via a voice channel and a data channel) or by different devices (e.g., a personal computer via a web channel and a phone via a voice channel). If a user is not currently authenticated to a communications channel and attempts to access the institution system via a communications channel, the user may be authenticated using strong authentication. If the user is currently authenticated to the institution system via a communications channel and would like to engage a second communications channel to access the institution system, the user may authenticate to the second communications channel using both communications channels and weak authentication, such as single factor authentication or a challenge question.

Abstract: Authentication techniques are described to allow a person to be authenticated to interact with an organization, where a type of authentication can be determined based on an environment in which the person is located. For example, an authentication server can collect a status information related to a safety setting of a mobile device. The safety setting can be enabled, e.g., if a person is driving a vehicle. When enabled, the safety setting can prevent the person from performing one or more operations on the mobile device. Based on the collected status information, the authentication server can request the person to provide user information via the mobile device so that the authentication server can determine whether the person is authenticated to interact with an organization.

Abstract: Systems and methods are disclosed to implement a machine scanning system that stores machine access credentials in a distributed fashion in a pool of scanner nodes. In embodiments, a storage manager node is selected from the pool to manage the storage of each new credential. The storage manager partitions the credential into portions and distributes the portions among the nodes, which may store the portions under different encryptions. A credential storage metadata is updated to indicate portion assignments and also distributed. At scanning time, the node selected to perform the scan uses the credential storage metadata to gather the portions and reconstruct the credential. In embodiments, the portions may be assigned so that no single node holds all portions of the credential, and at least two nodes hold each portion. Advantageously, the disclosed storage scheme enhances the security and availability of access credentials used by the machine scanning system.

Abstract: A method of distributed authorization of one or more client applications to one or more connected devices. The method comprises: receiving at a connected device, from a browser executing a client application, a client token and an access request.

Abstract: Systems and methods electronically determine whether a dataset is permitted or excluded based on permission digital rules. Primary entities often are required, or choose to, exclude proposed relationship instances with secondary entities. The systems and methods described herein allow permission digital rules to be defined and applied to datasets obtained from secondary entities relating to a proposed relationship instance with the primary entity, and permit or exclude a resource from being produced for the dataset based on the permission digital rules.

Abstract: One example process may include identifying a paused active communication session between a client device and a server, releasing communication session resources dedicated to the communication session to a session resource pool, and re-establishing the active data session responsive to receiving a message from the client device including one or more session re-establishment parameters.

Abstract: A computing system and method has a pre-boot operating system stored in an encrypted form according to a first key on a first portion of a non-volatile data storage drive and a main operating system stored in an encrypted form according to a second key on a second portion of the non-volatile data storage drive. A system built in operating system (BIOS) chip is configured to initiate a first authentication process, obtain the first key after successful completion of the first authentication process, load and decrypt the pre-boot operating system into dynamic memory, and cause the pre-boot operating system to run. The pre-boot operating system is configured to initiate a second authentication process, obtain the second key after successful completion of the second authentication process, load and decrypt the main operating system into dynamic memory, and cause the main operating system to run.

Abstract: The described technology provides a single sign-on capability so that a user who is already signed on to a web application from a client application may not be required to sign-on again when he/she later needs access to the web application from the same or another client application. The technology also provides a multiple login prevention capability to detect multiple sign-on events using the same credentials and disable one or more of the associated multiple sessions.

Abstract: A system having an off-premises proxy server residing in a cloud computing environment and backend servers residing in an enterprise computing environment are provided. Requests received by the off-premises proxy server for access to a first, non-publicly accessible backend server are routed to a tunnel server which stores the request and waits to be polled by a tunnel agent connected to the first backend server. When the tunnel server is polled, the request is forwarded through an HTTP tunnel to the tunnel agent, which forwards it to the backend server for processing. Responsive information is returned to the tunnel agent, which forwards it through the HTTP tunnel to the tunnel server and returned through the off-premises proxy server to the remote application. Requests for access to a first, publicly accessible backend server are routed by the off-premises proxy server directly to the backend server for processing and return of responsive information.

Abstract: A system for providing access is configured to receive an application access request from an application for authorization to access and a sensitive data access request from the application for authorization to access a document that includes sensitive data. The system is further configured to determine to authorize access to the application in response to the application access request; to determine the user authentication device in response to the sensitive data access request; to provide a secondary request for authorization to access sensitive data to the user authentication device in response to the sensitive data access request, receive a secondary request response from the user authentication device to the secondary request; and to provide the secondary request response to the application enabling access to the sensitive data, where the document is encrypted for delivery to the application for the user using a blinding secret and an identity private key.

Abstract: Disclosed are various approaches for extending a single sign-on (SSO) session to multiple devices. If a device is enrolled as a managed device with a management service, a SSO session can be extended to the device if the user has previously authenticated with an identity provider from another device. The user is authenticated on the second device using a user-and-device token issued by the management service with which the device is enrolled as a managed device.

Abstract: This disclosure describes techniques for dynamically changing a user authorization with a service provider during an ongoing user session. The changing user authorization may be used to address changing confidence in an identity of a user consuming a service provided by the service provider. The changing user authorization may also be used to adjust a scope of a service to which a user has access. The present techniques may allow single-sign-on type protocols to accomplish the flexible and dynamic change-of-authorization functionality of some traditional protocols to handle ongoing client-server sessions, rather than simply revoking authorization for access to the service. For this reason, the present techniques are able to integrate advantages of traditional protocols with newer, single-sign-on-type protocols.

Abstract: Provided is an information linkage system, comprising: a processor; and a storage device coupled to the processor, the storage device holds identification information of a user and information on the user, which are added by a first organization, in association with each other, the processor: transmits to a second organization an information linkage application regarding information on any one item included in the information on the user; acquires, when the information linkage application is received, identification information of the user and information on the user of the item specified by the information linkage application, which are added by the second organization; and stores the acquired information in the storage device in association with the identification information of the user and the information on the user regarding the same user as a user identified by the acquired identification information, which are added by the first organization.

Abstract: A method of provisioning organization users in a multi-tenant database system includes receiving a request via a single sign-on protocol from an organization user to create a new multi-tenant database user account for access to the multi-tenant database system. The method retrieves rules that specify how to derive user permissions for access to the multi-tenant database system from stored user attributes of the organization user. The method continues with applying the rules to the stored user attributes to determine permissions for the users to access particular objects in the multi-tenant database system, and creating the new user account with the determined user permissions for access to the multi-tenant database system.

Abstract: Techniques for scam detection and prevention are described. In one embodiment, an apparatus may comprise an interaction processing component operative to generate a scam message example repository; submit the scam message example repository to a natural-language machine learning component; and receive a scam message model from the natural-language machine learning component in response to submitting the scam message example repository; an interaction monitoring component operative to monitor a plurality of messaging interactions with a messaging system based on the scam message model; and determine a suspected scam messaging interaction of the plurality of messaging interactions; and a scam action component operative to perform a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction. Other embodiments are described and claimed.

Abstract: A gateway performs silent authentication refreshes with an identity management platform in order to extend the expiration of a cookie provided to an endpoint that accesses network applications through the gateway.

Abstract: Methods, systems, apparatuses, and computer-readable media for updating an operational parameter of a device of a local network of interconnected devices are provided. A user-operated device, in association with an attempt to access the device, may provide an update to the operational parameter of the device. The user-operated device may send the update to the operational parameter before sending the device an operational command. The device may apply the update received from the user-operated device before performing an operation corresponding to the operational command.

Abstract: A system and method for authorizing a Client Device requested access, the method comprising: forming a proximity enforced Bluetooth® binded communication link between the Client Device and a Level of Assurance (LOA) Provider; providing a login screen to a user entity at the Client Device from a Relying Party (RP) Services Application; receiving login information from the user entity; obtaining identity of the user entity on the LOA Provider using a biometric information of the user entity; sending the biometric information, a private key and contextual identifiers to an LOA Server; and identifying the user entity at the LOA Server using the biometric information, the private key and the contextual identifiers and the Client Device in determining whether to grant access to the RP Services Application.

Abstract: Management and configuration of internet of things network connected devices is facilitated herein. A proxy device comprises a memory that stores executable instructions that, when executed by a processor, facilitate performance of operations that comprise determining a first identity and a first operational parameter of a first device and a second identity and a second operational parameter of a second device. The first device and the second device can be associated with a defined communication network. The proxy device can be provisioned within the defined communication network and can operate as a security update proxy node for the first device and the second device. The operations can also comprise facilitating a first security update at the first device and a second security update at the second device based on a determination that the first device and the second device have delegated responsibility for security synchronization to the proxy device.

Abstract: Methods, apparatuses, systems, and computer-readable mediums for sharing user credentials in federated authentication are described herein. An identity provider may receive a user credential from a user device. The identity provider may receive, from a relying party, a request for an access token. The identity provider may encrypt the user credential based on a nonce that is uniquely generated for the relying party. The identity provider may send a response to the relying party. The response may include the access token, the encrypted user credential, and the nonce.

Abstract: Embodiments as disclosed provide systems and methods that use a local authenticator within a domain to provide a credential to access a resource of the domain to a non-local requestor. When a request is received from a non-local requestor at the domain the non-local requestor can be authenticated based on the request. The local authenticator can then be accessed to obtain a credential. This credential may be the same type of credential provided to members of the domain when they authenticate using the local authenticator. The credential is provided to the non-local requestor so the non-local requestor can access the resource of the domain using the credential and authentication of the non-local requestor with respect to these accesses can be accomplished using the local domain authenticator and the credential.

Abstract: A method by one or more electronic devices to notify an administrator when it is safe to mitigate a non-compliant database configuration of a database. The method includes responsive to identifying the non-compliant database configuration of the database, applying a security rule that detects occurrences of database operations that make use of the non-compliant database configuration and responsive to a determination that the security rule has not been invoked for at least a threshold length of time, causing a notification to be sent to the administrator that indicates that it is safe for the administrator to mitigate the non-compliant database configuration.

Abstract: Disclosed are techniques and apparatuses that are configured to receive an indication that a web browsing session executing on an enterprise server needs additional information based on a request for additional information being sent to a client device. The request may include an identifier of the web browsing session and an identifier of an enterprise server that initiated the web browsing session. A globally unique identifier related to the web browsing session and an identifier of the enterprise server is stored in a common data store. The web browsing session may be paused when the web browsing session requests additional information from a client device. The client device may respond with the additional information. The system may provide the identifier of the enterprise server to a load balancing component so the identified web browsing session executing on the enterprise server may continue to be used.

Abstract: There is provided a method and system for carrying out two factor authentication, which renders an augmented reality environment or a virtual reality environment at the user device to depict an authentication object, and when a user interaction with the authentication object is detected, an authentication code received from an issuer server is displayed at the user device.

Abstract: A method for securing a networked computer system executing an application includes identifying a vulnerable computer resource in the networked computer system, determining all computer resources in the networked computer system that are accessible from, or are accessed by, the vulnerable computer resource, and prioritizing implementation of a remediation action to secure the vulnerable computer resource if a vulnerability path extends from the vulnerable computer resource to a critical computer resource that contains sensitive information. The remediation action to secure the vulnerable computer resource is a safe remediation action that does not impact availability of the application executing on the networked computer system.

Abstract: Systems and methods for using JavaScript Object Notation (JSON) Web Tokens for information security for a particular software-controlled application are disclosed. Exemplary implementations may: store information electronically, including different types of client-provided information, hardware information, key information, and permission information; provide individual JWTs that include individual expiration dates to individual users; receive a user request for continued access and/or use of the particular software-controlled application; perform different types of (automated) verification based on the client-provided information in the user request; and, responsive to particular results from the different types of verification, perform some combination of transferring a response to the user request and accepting or denying continued access and/or use of the particular software-controlled application.

Abstract: The present disclosure relates to managing activity taken with respect to cloud-based software services. A platform manages data objects processed by software services and/or those entities that initiate processing events. The platform uses identifiers such as, for example, a persistent identifier (PID) to track processing events, The platform implements rules and/or permissions related to the managed data objects and/or managed entities to determine whether processing events are in compliance. The platform may update database records, send alerts, send data graphs, or provide a real-time stream related to the managed data objects and/or managed entities.

Abstract: Techniques are disclosed to provide application extension-based authentication on a device under third party management. In various embodiments, a unique identifier associated with an authentication app is stored on the device. An app extension framework that enables a native app to request, via an app extension associated with the authentication app, access to a service with which the native app is associated is provided. The authentication app is configured to use the unique identifier to determine a security posture of the device and to grant or deny access to the service based at least in part on the security posture of the device.

Abstract: Disclosed are methods and systems for securely providing identity attributes. A server computer may receive, from a relying entity, a request for identity attributes associated with a target entity, wherein the request for identity attributes includes a session identifier associated with the target entity and an identifier of the relying entity. The server computer may validate the request based on the session identifier. The server computer may identify, based on the identifier of the relying entity, a package defining types of identity attributes for the relying entity and a data access token associated with the package. Based on validating the request, the server computer may transmit, to a digital identity provider, a request for a set of identity attributes corresponding to the package, the request comprising the data access token. The server computer may receive, from the digital identity provider, the set of identity attributes.

Abstract: A method includes receiving, by a content sharing platform, a request for content from a client device, the request for content comprising a session-based authentication token that pertains to a session between the client device and the content sharing platform. The content sharing platform can further validate the session-based authentication token and cause playback of the requested content to begin at the client device. Responsive to a valid content-based authentication token supplied by the client device, the content sharing platform can cause playback of the requested content to continue at the client device, wherein the valid content-based authentication token is based on an identifier of the requested content.

Abstract: An information processing apparatus includes an authenticator that authenticates a user so that the user accesses plural resources on a network, an acquirer that acquires conditions that are related to a strength of authentication information and are provided differently for the respective resources, and a controller that controls, when the user accesses one resource out of the plural resources, access to the one resource based on a condition related to the strength for the one resource and strength information related to the strength of the authentication information of the user that is used by the authenticator.

Abstract: A new control function is defined for the control plane of a 5G mobile network to enable the operator's mobile user, who is using a premium network slice, to access application services on the public Internet, by operator sign-on only when accessing the application on said slice. This unique single sign-on capability allows the user to bypass the service authentication after operator authenticates the mobile device by the user session establishment procedure. The new function registers a plurality of service applications, which sign-up for single sign-on capability. It also coordinates the mapping and storage of credentials of the user across the mobile operator's service and the service provider's application for each of said plurality of service applications, and transfers user credentials to the application so that the user's sign-in step is bypassed.

Abstract: A system includes one or more privacy vaults. At least one of the one or more privacy vaults is associated with at least one individual user, stores contents associated with the associated at least one individual user, and stores specific identification of a plurality of third-party entities, authorized to access at least a portion of the contents stored by the one or more privacy vaults, along with access permissions, one or more of the access permissions defined for each of the plurality of third-party entities. At least one of the access permissions defines accessibility of the contents for at least one of the plurality of third-party entities for which the at least one access permission is defined.

Abstract: Systems and methods for performing self-contained posture assessment from within a protected portable-code workspace are described. In some embodiments, an Information Handling System (IHS) may include a processor and a memory having program instructions that, upon execution, cause the IHS to: transmit, from an orchestration service to a local agent, a workspace definition that references an application, where the application comprises a first portion of code provided by a developer and a second portion of code provided by the orchestration service; and receive, from a local agent at the orchestration service, a message in response to the execution of the second portion of code within a workspace instantiated based upon the workspace definition. The second portion of code may inspect the contents of the runtime memory of the workspace upon execution, for example, by performing a stack canary check, a hash analysis, a boundary check, and/or a memory scan.

Abstract: A facility for performing accurate and real-time privacy-preserving biometrics verification in a client-server environment is described. The facility receives the user's biometrics data such as face, voice, fingerprint, iris, gait, heart rate, etc. The facility then processes and applies various privacy-preserving techniques to this data to complete enrollment and authenticate users, including but not limited to: encrypting data with a key using homomorphic encryption techniques and sending the encryption to the server; the server computes directly on the encryption and returns the result, which is also encrypted under the same key, to the client; the client optionally performs post-processing and decryption (in any order) and obtains the enrollment or authentication result. The facility may repeat this process to increase security level, resulting in more than 1 round trip between the client and the server.

Abstract: Disclosed are various approaches for relaying and caching authentication credentials. A single sign-on (SSO) token is received, the SSO token representing a user account authenticated with an identity manager. An authentication request is then sent to a service that is federated with the identity manager in response to receipt of the SSO token, the authentication request including the SSO token. An access token is received in response to the authentication request, the access token providing access to the service for the user account authenticated with the identity manager for a predefined period of time. The access token and a link between the access token and the SSO token are then cached.

Abstract: Disclosed is a method for secured communication by a V2X communication device. A method for secured communication by a V2X communication device comprises the steps of: receiving a message on the basis of V2X communication; extracting adaptive certificate pre-distribution (ACPD) target information when the message includes the ACPD target information; pre-authenticating a short-term certificate; and transferring the pre-authenticated short-term certificate so that the pre-authenticated short-term certificate can be broadcasted at a predicted position.

Abstract: Apparatus and method for managing devices within a trust boundary of a computer network. In some embodiments, a trust manager circuit uses a first registration authority to authenticate a plurality of processing devices to form a trust group. A new processing device is subsequently added to the group. The trust manager circuit uses a different, second registration authority to provisionally authenticate the new processing device in response to an unavailability of the first registration authority, and grants provisional rights to the new processing device. Once the first registration authority is once again available, the trust manager performs a full authentication of the new processing device and grants full rights to the device.

Abstract: A system uses a keyboard application to encrypt and decrypt e-mail, messages, and other digital data. By using quantum random number generators, the system has improved data security. Using a quantum random number, an agent (at a sender side) generates an encryption key which is used to automatically encrypt a message. The encryption key is stored at a key server. The encrypted message will be sent by an application using its standard transmission means such as SMTP, SMS, and others. The encrypted message can be automatically unencrypted by using an agent (at a recipient side) and retrieving the key from the key server. The system also provides an optional double encryption, where the message is encrypted with a user-generated password before being encrypted using the encryption key.

Abstract: Groups of devices may be prevented from accessing content by encrypting the content. A plurality of secrets associated with a decryption key may be generated using a secret sharing algorithm. The plurality of secrets may be sent to one or more groups of devices to derive the decryption key. A non-restricted subset of the groups of devices may receive one or more secrets. Devices within the non-restricted subset of the groups may be able to use one or more secrets to determine the decryption key for the content. Groups that do not receive one or more secrets may be unable to determine the decryption key for the content.

Abstract: A method for securing cloud applications is described. The method may include establishing a connection between a cloud application isolation portal, a cloud access security broker, and a cloud application based on an indication of the cloud application and a set of credentials associated with an end user of the cloud application, and managing, via the cloud application isolation portal and the cloud access security broker, a session between the cloud application and a computing device associated with the end user based on the connection between the cloud application isolation portal with the cloud access security broker and the cloud application.

Abstract: A system includes sensors disposed within a location for outputting presence signals to a smart device, for receiving an ephemeral ID signal from the smart device, for outputting sensor ID signals to the smart device, for receiving responsive data from the smart device and for determining presence of the smart device in response to the responsive data, an authentication server for receiving the sensor ID signals from the smart device, for determining the responsive data, and for providing the responsive data to the smart device, a hub device coupled to the sensors for receiving an indication of the determination of the presence of the smart device, for determining additional data associated with the smart device, for facilitating a physical change perceptible to a user of the smart device in response to the additional data, and for providing the presence data to a smart device associated with a first responder.

Abstract: In non-limiting examples of the present disclosure, systems, methods and devices for providing a unified cross-platform experience are provided. A connection between a first device and a second device may be established, wherein the first device operates on a first platform and the second device operates on a second platform. A plurality of executable actions that are specific to the second device may be identified by the first device. Execution of at least one of the plurality of executable actions by the second device may be requested by the an application executed on the first device. Information obtained via execution of the at least one executable action may be received by the first device and the first device may present and/or display that information.

Abstract: Systems and methods are provided for performing operations including receiving, by a messaging application server from a third-party application server, a request to generate a content item code that is associated with a third-party content item; generating, by the messaging application server, the content item code in response to receiving the request from the third-party application server; causing a representation of the content item code to be displayed; retrieving the third-party content item in response to a messaging application implemented on a user device capturing the image of the representation that is displayed; and enabling an image modification feature of the messaging application using the retrieved third-party content item.

Abstract: Systems and methods for recent file malware scanning are provided herein. In some embodiments, a security system may include a processor programmed to download one or more files; filter, by a first driver, the one or more downloaded files using a security zone identifier; scan, by the first driver, the filtered subset of one or more files for malware; store, by a second driver, a first set of information associated with each of the scanned files to indicate that each the filtered subset of one or more files have been scanned, wherein the first set of information is stored as metadata using alternative data stream (ADS) associated with each scanned file; monitor, by the second driver, changes to existing files based on the metadata stored; send instructions to rescan any existing file that has changed for malware; and update the information associated with any rescanned file's metadata using the ADS.

Abstract: A computer-implemented method improves the performance of write ahead logging. The method includes generating a set of query data and a set of log data, where the set of log data is configured to create a write ahead log, and the set of query data is configured to make changes to data in a database. The method also includes writing the set of query data to a virtual file system. The method further includes separating the set of log data into a set of control intervals, where each control interval includes an entry. The method includes writing, each entry into a log buffer, where the writing the set of query data to the virtual file system and the writing each entry into the log buffer are performed in parallel. The method also includes combining each entry into a complete log.

Abstract: Techniques are described for providing a cloud data collector (CDC) application for managing the generation of infrastructure templates. The CDC application provides graphical user interfaces that enable a user to provide inputs indicating configurations of data to be ingested by the data intake and query system, each configuration including one or more user accounts, in addition to data sources and regions associated with data sources. Using the configurations provided as input to the CDC application, the CDC application generates an infrastructure template that can be used to configure the service provider network to provide the requested security data to the data intake and query system.

Abstract: A method, system, and computer program product for providing protected remote access from a remote access client to a remote access server over a computer network through a plurality of inspections. A remote access configuration file is created for the remote access client. A digital hash of the configuration file is then generated. The digital hash is compared with a configuration file stored at a predefined web location. If the comparison results in a match between the digital hash and the stored configuration file, a digital hash comparison is performed between an encrypted remote access configuration file and an encrypted configuration file stored at the predefined web location. If the plurality of inspections are passed, the remote access client is released from a quarantine state and a virtual private network (VPN) connection to the remote access server is established.

Abstract: A method for providing secure single sign on includes receiving a first data object from an application hosting server, the first data object indicating at least a service provider name and identifying a configuration file corresponding to the service provider name, wherein the configuration file includes at least trusted identity information. The method also includes determining, using the configuration file corresponding to the service provider name, whether the first data object is valid and, in response to a determination that the first data object is valid, generating a response message.

Abstract: Systems and methods for embodiments of artificial intelligence systems for identity management are disclosed. Specifically, embodiments of an identity management system may provide identity management in association with cloud services used by an enterprise and, in particular, may provide identity management in association with cloud based services that may be accessed through federated access providers.