Abstract: The invention concerns API proxy based adaptive security. The invention implements adaptive security for API servers, while avoiding data bottlenecks and maintaining client experience. The invention provides methods and configurations for API security that may be employed at proxies for implementing routing decisions involving client messages received at said proxies. The invention also involves generating or collecting at proxies, log information that captures data corresponding to received client messages and responses from API servers—which log information correlates communications between clients, proxies and backend API servers, and includes data relevant for purposes generating API metrics and identifying anomalies and/or indicators of compromise.

Abstract: A system providing enhanced security for device based transactions, constituted of: a server associated with a network address; a first device associated with a user, the first device in communication with the server over a first communication channel responsive to an obtained server network address; a second device associated with the user arranged to obtain the server network address from the first device; and a mobile device server in communication with the second device over a second communication channel, the mobile device server in communication with the server via a third communication channel, the mobile device server arranged to: obtain the server network address from the second device over the second communication channel; obtain the server network address from a trusted source; and authorize to the server over third communication channel a transaction only in the event that the server network addresses are consonant.

Abstract: A secure element with a user security domain thereon, the user security domain constituted of: a security domain control circuitry; an encoder/decoder functionality responsive to the security domain control circuitry; and a secured keys storage in communication with the security domain control circuitry, the encoder/decoder functionality arranged to: encode data responsive to at least one first key stored on the secured keys storage, and output an encoded data; and decode received data responsive to at least one second key stored on the secured keys storage, and output a decoded data.

Abstract: A secure transaction system constituted of: a two dimensional platform arranged for variable display; at least one antenna arranged to receive a signal from a contactless element, each of the at least one antenna secured at a fixed location on the two dimensional platform; a transaction server; and a poster communication device in communication with each of the at least one antenna and with the transaction server, the poster communication device arranged to read an identifier of a contactless element juxtaposed with a particular one of the at least one antenna, and transmit the read contactless element identifier and identification information associated with the particular antenna to the transaction server.

Abstract: In some embodiments, a method includes receiving, from a client compute device and at a server, a request to access a resource. The request can include an identifier associated with the client compute device. The method can further include accessing risk information associated with the client compute device from an instance of a distributed database at the server using the identifier. The risk information is provided to the distributed database by a set of compute devices. Each compute device from the set of compute devices implements a different instance of the distributed database. The risk information can be analyzed to identify an access decision and a level of access to the resource can be granted to the client compute device based on the access decision.

Abstract: The presently disclosed subject matter includes a system, a method and a non-transitory program storage device configured for authorizing access of a user device to a service provider server. Responsive to a request to authenticate the identity of a user attempting to access an SP server via a user device (UD), an authentication server is configured to initiate at least one authentication operation using a second UD; in the event of a failure to receive a response to the at least one authentication operation from the second UD, the authentication server is configured to proceed according to an alternative authentication method which does not involve the second UD.

Abstract: The presently disclosed subject matter includes a system, a method and a non-transitory program storage device configured for authorizing access of a user device to a service provider server. Responsive to a request to authenticate the identity of a user attempting to access an SP server via a user device (UD), an authentication server is configured to initiate at least one authentication operation using a second UD; in the event of a failure to receive a response to the at least one authentication operation from the second UD, the authentication server is configured to proceed according to an alternative authentication method which does not involve the second UD.

Abstract: In some embodiments, a non-transitory processor-readable medium includes code to cause a processor to send, from an authorization client on a device to a client authorization module, an indication of multiple applications installed on the device, and receive, at the authorization client and in response to the indication, multiple application tokens from the client authorization module. Each individual application token from the multiple application tokens received by the authorization client is uniquely associated with an application from the multiple applications installed on the device. The authorization client provides each application its associated application token such that each application from the multiple applications can use that application token in order to be authenticated to an application server associated with the application.

Abstract: A system arranged to authenticate a user via its mobile device to a service provider, the system comprising: an authentication server; the user mobile device, the user mobile device provided with a verification application arranged to communicate with the authentication server; and a notification server in communication with the authentication server and arranged to transmit a notification to the user mobile device responsive to the authentication server, the authentication server arranged to provide a signed authentication to the service provider responsive to present and historical information regarding one of: the user mobile device; and an additional user device in communication with said authentication server, said signed authentication provided in accordance with a rule set determined by an authorized entity stored on said authentication server memory governing the required present and historical information attribute.

Abstract: A system arranged to authenticate a user via its mobile device to a service provider, the system comprising: an authentication server; the user mobile device, the user mobile device provided with a verification application arranged to communicate with the authentication server; and a notification server in communication with the authentication server and arranged to transmit a notification to the user mobile device responsive to the authentication server, the authentication server arranged to provide a signed authentication to the service provider responsive to present and historical information regarding one of: the user mobile device; and an additional user device in communication with said authentication server, said signed authentication provided in accordance with a rule set determined by an authorized entity stored on said authentication server memory governing the required present and historical information attribute.

Abstract: A system providing enhanced security for device based transactions, constituted of: a server associated with a network address; a first device associated with a user, the first device in communication with the server over a first communication channel responsive to an obtained server network address; a second device associated with the user arranged to obtain the server network address from the first device; and a mobile device server in communication with the second device over a second communication channel, the mobile device server in communication with the server via a third communication channel, the mobile device server arranged to: obtain the server network address from the second device over the second communication channel; obtain the server network address from a trusted source; and authorize to the server over third communication channel a transaction only in the event that the server network addresses are consonant.

Abstract: In some embodiments, a non-transitory processor-readable medium includes code to cause a processor to send, from an authorization client on a device to a client authorization module, an indication of multiple applications installed on the device, and receive, at the authorization client and in response to the indication, multiple application tokens from the client authorization module. Each individual application token from the multiple application tokens received by the authorization client is uniquely associated with an application from the multiple applications installed on the device. The authorization client provides each application its associated application token such that each application from the multiple applications can use that application token in order to be authenticated to an application server associated with the application.

Abstract: A secure element with a user security domain thereon, the user security domain constituted of: a security domain control circuitry; an encoder/decoder functionality responsive to the security domain control circuitry; and a secured keys storage in communication with the security domain control circuitry, the encoder/decoder functionality arranged to: encode data responsive to at least one first key stored on the secured keys storage, and output an encoded data; and decode received data responsive to at least one second key stored on the secured keys storage, and output a decoded data.

Abstract: In some embodiments, a non-transitory processor-readable medium includes code to cause a processor to send, from an authorization client on a device to a client authorization module, an indication of multiple applications installed on the device, and receive, at the authorization client and in response to the indication, multiple application tokens from the client authorization module. Each individual application token from the multiple application tokens received by the authorization client is uniquely associated with an application from the multiple applications installed on the device. The authorization client provides each application its associated application token such that each application from the multiple applications can use that application token in order to be authenticated to an application server associated with the application.

Abstract: In some embodiments, an apparatus includes an authorization module implemented in at least one of a memory or a processing device. The authorization module receives at a first time and from a first mobile application, a request for an access token associated with a second mobile application that includes an identifier associated with the second mobile application and a first random verification identifier. The authorization module provides to the first mobile application a signal representing an authorization code associated with the access token. The authorization module receives from the second mobile application at a second time a signal representing the authorization code, the identifier associated with the second mobile application, and a second random verification identifier. The authorization module provides a signal representing the access token to the second mobile application based in part on the first random verification identifier being equal to the second random verification identifier.

Abstract: In some embodiments, an apparatus includes an authorization module implemented in at least one of a memory or a processing device. The authorization module can receive from an application a request for an access token associated with the application that includes a scope identifier associated with a level of access to a resource module. The authorization module can select based on the scope identifier at least one authentication mode from a set of predefined authentication modes. The authorization module can also receive at least one credential assigned to at least one authentication mode. Additionally, the authorization module can send the access token to the application in response to authenticating a user of the application based on the at least one credential.

Abstract: In some embodiments, a non-transitory processor-readable medium includes code to cause a processor (e.g., on an enterprise server) to receive, from a communication device, a request for a client application, and in response to the request provision the installation file data associated with the client application to include an application token associated with the client application. The code is to cause the processor to send the installation file that includes the application token to the communication device such that the communication device uses the installation file to install the client application that authenticates to an application module using the application token extracted from the installation file.