Abstract: For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel encryption method for encrypting the data messages sent by the GVMs. The method initially receives a data message to send for a GVM executing on the host. The method then determines whether it should encrypt the data message based on a set of one or more encryption rules. When the process determines that it should encrypt the received data message, it encrypts the data message and forwards the encrypted data message to its destination; otherwise, the method just forwards the received data message unencrypted to its destination. In some embodiments, the host encrypts differently the data messages for different GVMs that execute on the host.

Abstract: Aspects of this disclosure related to a computer-implemented method for using a first device to configure a second device to access a network. The method includes transmitting a request on a channel, the request containing information sufficient to inform a device that the system can configure the device to access a network through an access point. The method further includes receiving a response on the channel, the response sent by the device after the request and transmitting a request for security information from a server. The method further includes receiving security information from the server, using the security information to verify an identity of the device, and transmitting a security profile to the device, the security profile containing information sufficient to allow the device to connect to the access point to access the network.

Abstract: According to an example, an intrusion-prevention system may include a network interface to receive a subject data word via a network. The intrusion-prevention system may include hardware to determine whether the subject data word partially matches a signature data pattern, and determine whether the subject data word fully matches the signature data pattern if the subject data word partially matches the signature data pattern.

Abstract: To control privileges and access to resources on a per-process basis, an administrator creates a rule that may be applied to modify a token of a process. The rule may include an application-criterion set and changes to be made to the groups and/or privileges of the token. The rule may be set as a policy within a group policy object (GPO), where a GPO is associated with one or more groups of computers or users. When a GPO containing a rule is applied to a computer, a driver installed on the computer may access the rule(s) anytime a logged-on user executes a process. If the executed process satisfies the criterion set of a rule, the changes contained within the rule are made to the process token, and the user has expanded and/or contracted access and/or privileges for only that process.

Abstract: Systems and methods for generating secure passwords, personal identification numbers (PINs), and other user credentials using touch-aware devices are described. In some cases, an end user of a computing device may use a touch-sensitive interface (e.g., a touchscreen) to indirectly enter user credentials for accessing protected information or a protected computing resource using the computing device. The end user may indirectly enter the user credentials by entering information that is different from the actual user credentials. In one example, the touch-sensitive interface may display a plurality of numbers and paths connecting the plurality of numbers and the end user of the computing device may select a sequence of numbers of the plurality of numbers using a touch gesture. The computing device may generate a user credential different from the sequence of numbers using the sequence of numbers selected by the end user.

Abstract: An approach for hiding sensitive data in log files is provided. The approach uses a background program embedded within an operating system. The background program intercepts a write operation of an application and, in response to determining that the write operation is for a log file, gets content of the write operation. The background program checks a knowledge base that comprises information for the sensitive data and identifies the sensitive data in the content of the write operation. The background program masks the sensitive data in the content of the write operation, in response to determining that the content of the write operation has the sensitive data to be masked. In the log file, the background program writes modified content in which the sensitive data is masked.

Abstract: A mobility management entity (MME) receives a request for a key to establish a security context for communication between a base station and a user equipment in response to the user equipment requesting connectionless service with the base station. In response to receiving the request, the MME transmits a cookie to identify the security context stored by the base station.

Abstract: A computer located outside of an organizational computing environment is remotely prepared and configured to work in the organizational computing environment. A hypervisor operating system is installed and replaces the primary operating system of the computer, and the primary operating system, virtual software appliances (VSA) and virtual machines (VM) can execute as processes of the hypervisor. The hypervisor is configured to establish secure connection with organizational computing environment and to receive from it organization-configured image software for configuring the compute to work in the organizational computing environment. The secure connection can also be used for remote maintenance of the computer even when the computer operating system is faulty or inactive.

Abstract: To control privileges and access to resources on a per-process basis, an administrator creates a rule that may be applied to modify a token of a process. The rule may include an application-criterion set and changes to be made to the groups and/or privileges of the token. The rule may be set as a policy within a group policy object (GPO), where a GPO is associated with one or more groups of computers or users. When a GPO containing a rule is applied to a computer, a driver installed on the computer may access the rule(s) anytime a logged-on user executes a process. If the executed process satisfies the criterion set of a rule, the changes contained within the rule are made to the process token, and the user has expanded and/or contracted access and/or privileges for only that process.

Abstract: Technologies for securely pairing a first computing device with a second computing device include the first computing device to generate a session message key based on a key exchange with the second computing device. The first computing device receives a message including a hardware key certificate, 5 a cryptographically-signed communication, and a message authentication code from the second computing device. The cryptographically-signed communication is signed with a private hardware key of the second computing device. The first computing device validates the message authentication code, the certificate, and the signature received from the second computing device. After validation, the first computing device 10 identifies a user of the second computing device based on user-identifying data received from the second computing device.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network monitoring, user account compromise determination, and user behavior database system. The system monitors network actions of user accounts including user account access across multitudes of network accessible systems, determines user account transitions, and determines different types of high-risk user behavior indicative of compromise. Network actions can be obtained from generated information by the network accessible systems, and correlated across additional data sets including contextual ones. User interfaces are generated describing network actions of user accounts, and are configured for user interaction, which cause generation of updated user interfaces and access to electronic data sources to determine information relevant to the user interaction.

Abstract: A method, apparatus and computer program product are provided for configuring and controlling guest access sharing. In the context of a method, a method is provided that includes causing a network scan to be initiated and receiving the results of said network scan, the results comprising information regarding an access point and determining, based on the received results, whether the access point comprises two or more network interfaces. The method further includes causing a guest access sharing configuration procedure to be initiated if the access point comprises two or more network interfaces. The guest access sharing configuration procedure includes causing guest access information to be uploaded to a server. Another method is provided that includes receiving and storing guest access information, receiving a request to obtain the guest access information and causing the guest access information to be provided to a device if the device has permission to access it.

Abstract: Method and system for distributing token records in market environment is disclosed. At least one token record comprising a unique seed associated with a OTP token. Encryption key and decryption key are generated for assisting selective encryption and decryption of token record associated with OTP token. The token record is encrypted with the assistance of encryption key. One of encrypted token record and decryption key is provided into market environment. A device comprising an identifier for facilitating identification of token record associated with OTP token is provided into market environment together with the one of encrypted token record and decryption key. The identifier concealed by tamper-evident removable material such that any effort to reveal identifier will be readily apparent. The other of the encrypted token record and decryption key is provided to an entity in response to entity providing identifier.

Abstract: A device certificate binds an identity of a first device to a public key of the first device. The first device comprises a certificate authority service that creates for a process on the first device a process certificate certifying one or more capabilities of the process on the first device. The process certificate is presented to the second device. Upon validating the process certificate using the device certificate, the second device permits the process on the first device to have on the second device one or more of the verified certified capabilities.

Abstract: In one embodiment, a storage and privacy system stores and manages information associated with users and ensures and enforces access-control rules specified for the stored information.

Abstract: Disclosed is a system for mobile data isolation, comprising of a tag control management module and a mobile data management module. The tag control management module comprises a tag generator, a tag storage management module and a tag transmission control module. The mobile data management module primarily identifies user authority and data confidentiality level according to tags, operates and controls the mobile application of mobile data, to realize fine-grained confidentiality security protections of the mobile data. The mobile data management module is divided into security isolation control of a data processing process, security control of a data transmission process and security isolation control in data storage. Meanwhile, a method for mobile data isolation is also disclosed. Isolation and fine-grained operation and control of data on a mobile intelligent terminal can be performed effectively, realizing different confidentiality policies and ensuring the confidentiality security of mobile data.

Abstract: A secure element operating in conjunction with a secure partition of a system-on-a-chip (SoC) having set top box (STB) functionality allows for digital rights management (DRM) key handling in a mobile platform. The secure element can include a secure processing system (SPS) to be implemented as a hard macro, thereby isolating the SPS from a peripheral processing system (PPS). The secure element and the secure partition of the SoC may be operatively connected by a secure cryptographic channel.

Abstract: Methods and systems integrating sensitive or private data with cloud computing resources while mitigating security, privacy and confidentiality risks associated with cloud computing. In one embodiment, a computer network system includes a firewall separating a public portion of the computer network from an on-premises portion of the computer network, a database storing private data behind the firewall, and a user device connected with the computer network. The user device accesses an application hosted in the public portion of the computer network. In response, the application generates return information. The user device receives the return information and generates a request for private data based on at least a portion of the returned information. The request is transmitted to the database which generates a response including the requested private data. The response is transmitted in an encrypted form from the database via the computer network to the user device.

Abstract: This specification describes technologies relating to detecting anomalous user accounts. A computer implemented method is disclosed which evaluates an unknown status user account. The method described compares features associated with a plurality of known anomalous user accounts stored in a database to features present in the unknown account. A correlation value corresponding to the probability of a specific feature occurring in a particular anomalous user account is calculated and a dependence value corresponding to the degree of dependence between the given feature and at least one other feature is also calculated. A subset of features in the unknown account is generated comprising those features that possess a correlation value less than a threshold value and a dependence value below a maximum correlation value. A risk score for the unknown account is calculated by selecting those features from the subset that maximizes the correlation value.

Abstract: Embodiments of the present invention are directed to managing access to protected computer resources. More particularly, embodiments of the present invention provide systems and methods for modifying a user's ability to access a protected computer resource while the user is currently using the resource. If the privileges granted to a user for accessing the protected resource are altered, these alterations take effect in substantially real time. In an exemplary embodiment, a user data repository will initiate the process of altering the user's access privileges upon changes of data in the repository. In this way, it does not matter how or by whom the data in the repository is changed, but the change itself is sufficient to initiate a re-computation of a user's access privileges to the protected resource.