Abstract: Embodiments disclose a system and method for the integration of data and events to and from physical access control and security monitoring systems that is normalized to standardized definition for enforcement of standardized rules, created through a visual policy editor, affecting persistence, propagation of data and generation of alerts and notifications for physical security, network and IT systems. Data from disparate physical security systems is normalized for visual rule creation by rule object shapes representing normalized security systems, data and processes. A rules-based policy engine enforces security policies and generates actionable events. The overall system provides an integration platform, methods and processes for normalizing data from physical security systems, representation of physical security systems, data and processes for visual creation of rules using defined stencil objects, generating formatted rules, and enforcing these rules in real-time on security systems data and events.

Abstract: A network services platform provides services to remote enterprise networks. The services platform provides a control module to a computer in the enterprise network. The control module executes on the computer and interacts with the services platform to establish an Internet Protocol (IP) tunnel between the services platform and the computer. The control module also establishes a bridge between the IP tunnel and the enterprise network. The services platform allocates a unique private IP address space to the enterprise network, and translates IP addresses in network communications between enterprise network addresses and corresponding services platform addresses in the allocated unique private address space. The services platform provides network services to the enterprise network via the IP tunnel and bridge.

Abstract: The present invention is directed towards authentication tokens that are completely embedded in a non-conductive enclosure. The invention is based on the insight that it would be advantageous to separate the electronic data personalization of such tokens from the visual device personalization. The present application concerns an authentication token that allows communication with an external unit after the production of the nonconductive enclosure, in order to transmit or receive device identification data. As this communication need only take place during the manufacturing process, a low-power close-range transmission technique such as inductive coupling, capacitive coupling, or RFID communication suffices for this purpose. Accordingly, the present application discloses a method for manufacturing authentication tokens, and a token manufactured according to said method.

Abstract: The present patent application discloses a USB token that advantageously mimics a human interface device such as a keyboard in interacting with a host computer, thus removing the need for pre-installation of a dedicated device driver. This is accomplished by requiring the host computer to direct the input of the attached human interface devices of the keyboard type, including the USB token, exclusively to the program interacting with the USB token, by using cryptographic algorithms based on a shared secret, which require less data to be transferred than PKI-based algorithms, and by employing an efficient encoding scheme that minimizes the time needed to exchange information with the USB token, and minimizes the probability of generating ambiguity with input that might legitimately be generated by other attached human interface devices.

Abstract: A drive mechanism for a door operator comprises a drive member and a driven member. The drive member is adapted to be operably connected between a motor assembly for rotating the drive member and a door closer assembly rotating with the driven member. The drive member and the driven member both include a protrusion. The driven member protrusion moves in the free space defined by driving surfaces of the drive member protrusion. Rotation of the drive member from a first angular orientation to a second angular orientation causes rotation of the driven member for powered opening of the door. The driven member protrusion moves in the free space without engaging the protrusion surfaces when the door is opened manually and allowed to close.

Abstract: Format-preserving encryption and decryption processes are provided. The encryption and decryption processes may use a block cipher. A string that is to be encrypted or decrypted may be converted to a unique binary value. The block cipher may operate on the binary value. If the output of the block cipher that is produced is not representative of a string that is in the same format as the original string, the block cipher may be applied again. The block cipher may be repeatedly applied in this way during format-preserving encryption operations and during format-preserving decryption operations until a format-compliant output is produced. Selective access may be provided to portions of a string that have been encrypted using format-preserving encryption.

Abstract: The present invention relates to the field of pocket-size electronic devices, including credit card sized devices such as authentication tokens. It consists of an improvement of the well-known “raised ridge” to protect individual buttons from false key presses, obtained by applying embossing. A known problem with applying embossing to cards containing electronic components, is the fact that the embossing process may damage the components or the wiring inside the card. In the process according to the invention, an embossed ridge of a judiciously designed shape is used to avoid such damage.

Abstract: The invention relates to modulation and demodulation circuits, such as envelope detectors used to demodulate amplitude-modulated (AM) signals. By coupling an analog circuit to a port of a digital component, a compact envelope detector can be obtained, which achieves demodulation of AM signals for direct coupling into a digital input port. Accordingly, a compact envelope detector may be used in the data receiving part of a sealed device requiring post-manufacturing data transfer, in combination with additional components that provide electromagnetic coupling, such as inductive, capacitive, or radiative. An example of such a device is a credit card sized authentication token.

Abstract: A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.

Abstract: A method and appertaining system for implementing the method are provided that utilize predefined Best Practice Templates that are rules/criteria for assessing the security of a particular network and devices on the network. A value is determined for each object and connection within a network as to whether it passes or fails one of the Best Practice criteria, and a pass ratio is determined for a particular Best Practice. Numerous Best Practice tests may be run, and an overall total value based on the collective sum of the Best Practice measurements is determined. This value can be utilized to provide a user with information that relates to the overall security of a network and can be used in compliance determinations and network architecture design.

Abstract: A virtual file system is described that is implemented in a virtualization platform as a stackable file system layer that intercepts file operations between a hypervisor and a physical file system. The virtual file system encrypts (at least in part) VM files to be stored, organizes the encrypted VM files into VM sets, and then maps and stores the encrypted VM sets into storage pools. Storage and access to files within the VM sets is controlled through the use of administrator-determined policies governing storage, security, access control, authentication, and auditing. The system and method described herein allow a seamless integration between a data center (e.g., a private cloud) and computing resources served across the internet and supported by cloud service providers (e.g., public clouds) while ensuring that the security needs of customers and cloud service providers are met.

Abstract: Systems and methods for secure messaging are provided. A sender may encrypt content and send the encrypted content to a recipient over a communications network. The encrypted content may be decrypted for the recipient using a remote decryption service. Encrypted message content may be placed into a markup language form. Encrypted content may be incorporated into the form as a hidden form element. Form elements for collecting recipient credential information such as username and password information may also be incorporated into the form. At the recipient, the recipient may use the form to provide recipient credential information to the remote decryption service. The recipient may also use the form to upload the encrypted content from the form to the decryption service. The decryption service may provide the recipient with access to a decrypted version of the uploaded content over the communications network.

Abstract: A photoluminescent member is provided for an exit device. The photoluminescent member comprises a housing member for mounting to the exterior surface of the exit device. The housing member includes a photoluminescent portion for being energized by exposure to an ambient light source and operable to automatically emit visible light photoluminescently for a substantial period of time in low ambient light or dark conditions and without being energized by an electrical current so that the photoluminescent portion provides illumination to identify the exit device in the low ambient light or dark conditions for providing a visual cue directing a person to a location of the exit device.

Abstract: Systems and methods for implementing application control security are disclosed. In one embodiment, a system includes a first device, a decrypted white-list, and an executable program. The first device may be in electrical communication with a memory containing an encrypted white-list. The encrypted white-list may be decrypted using an identifier of a second device. The executable program may be referenced in the decrypted white-list.

Abstract: Personalization images are included in email messages to combat phishing attacks in which an attacker attempts to trick a user into divulging sensitive information over the Internet. When a recipient of an email message receives a message, the recipient can visually inspect the personalization image in the message. If the personalization image is missing or if the personalization image is not valid, the email recipient is alerted to the possibility of a phishing attack. Email message content may be encrypted. A gateway associated with an email message sender may be used to perform encryption operations on the message content. The gateway may create an html version of the email by placing the encrypted message content in an html wrapper. An image reference corresponding to the personalization image may be embedded in the html version of the message.

Abstract: The device of the present invention, having at least one activation button, is further equipped with a sensor adapted to detect conditions under which unintentional triggering of the activation button is likely. The sensor is operatively coupled with the activation button to suspend its effect when the target conditions are being detected. The undesired side-effects of false button activations, including battery drain and activation counter drift, are thus avoided, increasing the device's lifespan and user convenience. In a particular embodiment, the sensor is a decoy button located near the activation button, which serves to de-activate the activation button.

Abstract: Systems and methods for operating a saturated hash table are disclosed. In one embodiment, a system includes a hash table located in memory of a computer and a hash program in communication with the hash table. The hash table may include a plurality of index positions, and the hash program may be operable to populate the hash table with a first new digest value, where the first new digest value is associated with a first data item. The first new digest value may be stored at least at a first index position and a second index position of the hash table.

Abstract: A technique for searching for probable matches in a video surveillance system is disclosed. A new event, such as a face captured in an image set, is matched against other events in a database of events. A similarity score is generated based on the difference between the new event and other events in the database. The similarity score may be weighted by information external to the image sets. Because of limited system resources, an association between a new event and every other event in the system may not be kept. Thus, when searching for probable matches of a particular event, some events that are related to the particular event may not be initially selected. Such events may be associated with an event in a first set of events that are associated with the particular event. Therefore, a second set of events is selected that are associated with the first set of events.

Abstract: A system and system for controlling the execution of executable files. The executables are identified by either a cryptographic digest or a digital certificate. The cryptographic digest is computed from the binary image of the executable. An executable that is attempting to execute is intercepted by a protection module that consults a database of stored rules over a secure channel to determine whether or not the executable can be identified as a permitted executable and whether or not it has permission to execute on a particular computer system under certain specified conditions. If a stored permission is available, it is used to control the execution. Otherwise, the user is consulted for permission.

Abstract: The invention relates to the field of modulation and demodulation circuits, such as envelope detectors used to demodulate amplitude-modulated (AM) signals. By coupling an analog circuit to a port of a digital component, an envelope detector can be obtained, which achieves demodulation of AM signals for direct coupling into a digital input port. Accordingly, an envelope detector may be used in the data receiving part of a sealed device requiring post-manufacturing data transfer, in combination with additional components that provide electromagnetic coupling, such as inductive coupling, capacitive coupling, or radiative coupling. An example of such a device is a credit card sized authentication token.