Abstract: An endpoint coupled in a communicating relationship with an enterprise network may include a data recorder configured to store an event stream of data indicating events on the endpoint including types of changes to computing objects, a filter configured to locally process the event stream into a filtered event stream including a subset of types of changes to the computing objects, and a local security agent. The local security agent may be configured to transmit the filtered event stream to a threat management facility, respond to a filter adjustment from the threat management facility by adjusting the filter to modify the subset of types of changes included in the filtered event stream, and respond to a query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

Abstract: A method comprises a server generating a server nonce and transmitting a server public key, a key signature and the server nonce to a device, the device verifying the server public key, signing the server nonce with a device private key, generating a device nonce, and transmitting the server nonce, the server nonce signature, a device public key, a device key signature, and the device nonce to the server, the server verifying the server nonce and the device public key, generating a session key, encrypting the session key with the device public key, signing the device nonce and the session key with a server private key, and transmitting the device nonce, the signed device nonce and session key, and the encrypted session key to the device, and the device verifying the device nonce, decrypting the encrypted session key with the device private key, and verifying the decrypted session key.

Abstract: There is provided a method comprising receiving a domain name system (DNS) query from a client computing device, decrypting the DNS query by a DNS resolver device, and requesting reputation information related to the FQDN from an agent device of the router apparatus. If a matching FQDN is not found in a local database, the DNS query is allowed to proceed from the DNS resolver device to a cloud DNS resolver, the IP and MAC address of the client computing device are logged and mapped to the local database, the reputation information related to the FQDN is requested from a cloud FQDN server, and if the reputation information indicates that the FQDN should be blocked, the local database is updated with the reputation information and further queries to the FQDN are blocked.

Abstract: A system is disclosed for securely communicating between a user device and a target device, which includes a user input receiving user inputs and a user device memory for storing at least one fixed dataset having a plurality of data bits and an inherent entropy. At least one predetermined harvest process is stored in ser device memory, which is operable within a main harvest process to distill the dataset to a predetermined bit length to define a private key of the user at a predetermined key length.

Abstract: A server system can include an internal computer network including at least one client server configured to establish a data transfer connection to an external computer network, and at least one proxy server system positioned between the internal computer network and the external computer network. The proxy server system can include a proxy server positioned between a first firewall and a second firewall, where the first firewall is positioned between the first proxy server and the internal computer network, and the second firewall is positioned between the proxy server and the external computer network. The server system can develop and maintain a proxy server system that includes a whitelist of sites deemed necessary and/or desirable for system operation. The whitelist can be updated as a user works with and uses the system. Such updates can take place continuously in real or near-real time or periodically as frequently as desired.

Abstract: In some embodiments, a system is a reverse-proxying HTTP cache server that handles user session management and dynamically forwards requests to origin/backend servers based on the content being requested. It caches data from origin servers in order to reduce the stress placed on each origin server. It uses encrypted authorization tokens to handle session management and is able to modify origin data on-the-fly in order to inject per-client authorization information into the data stream. It can enforce maximum concurrent session limits, user bans, limit exemptions, and time-limited live content previews.

Abstract: Providing an indication of user-tailored password strength is provided. A registration of a user in a password strength management service is received. A list of social media accounts corresponding to the user and access credentials corresponding to each social media account in the list is received from the user. Social media information corresponding to the user is gathered from the social media accounts using the access credentials corresponding to each social media account in the list. In response to receiving an input of a new password string by the user, password strength of the new password string is evaluated in view of the gathered social media information corresponding to the user.

Abstract: There is provided a method and system for digital rights enforcement. The method includes: determining digital content requested by a user via a selected user device; determining digital rights associated with the digital content; reviewing the digital rights to determine access rights relating to authorized devices for the user; determining whether the user has exhausted the access rights; and if the access rights are exhausted: determining at least one use factor for each of the user's previously authorized user devices; determining a previously authorized user device on which to revoke access to the digital content based on the at least one use factor; and revoking access rights to the previously authorized user associated device; otherwise downloading the digital content on the selected user device. The system includes a content review module and a revoker module.

Abstract: A system for dispersing access rights for routing devices in a network including a router, a key and a key socket, and a key-router validation server. The router and the physical key must be present and both must be validated by the key-router validation server before the router can establish a VPN network between remote external and internal networks. Neither the key nor the router does contain critical information for allowing access to networks. Losing either the key, or the router, does not endanger security of the networks. This is the essence of dispersed access rights.

Abstract: Examples herein describe systems and methods for concealing internal applications that are accessed over the internet. A user device can select a remote internal application to access using a client. The user device can send an access request to an open listening port of an access server. The access server can be a gateway and proxy to the internal application, which can reside elsewhere. The access server can open a different randomized access port for establishing the connection by proxy to the internal application. The port number for the access port can be identified in the access request at the listening port. The access server can open the access port for a short time interval. The connection can be made through the access port during that time interval. A firewall can then close the access port but maintain an established connection between the user device and the internal application.

Abstract: An apparatus is disclosed for storing a private key on an IoT device for encrypted communication with an external user device and includes a proximity-based communication interface, encryption circuitry and IoT functional circuitry.

Abstract: A secure communication system is disclosed for communication between first and second party devices. An input interface is provided for receiving from an external host a unique host factor in addition to a user input interface for receiving from a user a unique PIN for a user and a selection input for selecting one of the plurality of stored entropy stores as a user selected entropy store A first private key generator is operable for generating a private key using a key generation algorithm requiring the selected entropy store, the host factor and the unique user PIN. The second party device includes a second storage device for storing a plurality of entropy stores. An input interface is provided for receiving the same unique host factor as received by the first party device. A communication interface facilitates communication with the first party device to receive from the first party device a user PIN and an indication of the user selected entropy store.

Abstract: An improved authentication, identification, and/or verification system is provided in various embodiments. The system is provided for use in relation to provisioning access or establishing identity in relation to one or more human users, and may be used in a single site/scenario/system, or across multiple sites/scenarios/systems. A combination of biometric modalities and authentication mechanisms having diverse characteristics are utilized to establish identity, the diverse characteristics being utilized to modify aspects of identity management and access provisioning.

Abstract: Provided is a method for anonymizing datasets having sensitive information, including the steps of determining a dataset of records to be assigned to aggregation clusters; computing an average record of the dataset on the basis of a predefined repetition counter; finding a most distant first record to the average record using a distance measure; finding a most distant second record from the first record using the distance measure; forming a first aggregation cluster around the first record and a second aggregation cluster around the second record; and generating a new dataset by subtracting the first cluster and the second cluster from the previous dataset.

Abstract: There is a need for more effective and efficient network security coordination. This need can be addressed by, for example, techniques for network asset vulnerability detection. In one example, a method includes detecting network assets within a monitored computer network; and for each network asset: determining a vulnerability profile, determining a connectivity profile, determining a vulnerability designation based on the vulnerability profile for the network asset and a network vulnerability documentation repository, determining whether the vulnerability designation for the network asset indicates a positive vulnerability designation, and in response to determining that the vulnerability designation indicates the positive vulnerability designation, decoupling the network asset from the monitored computer network using the connectivity profile for the network asset.

Abstract: One or more sensors of an electronic device detect either authorization of an authorized user or a cessation of physical contact between an authorized user of the electronic device and the electronic device. A location detector determines a location of the electronic device when the authorization of the authorized user occurs or where the cessation of physical contact occurs. A geofence manager establishes a geofence about the location in response to detecting the authorization of the authorized user or the cessation of physical contact. One or more processors operate the electronic device in a normal mode of operation while the electronic device remains within the geofence and in an enhanced security mode of operation when the electronic device exits the geofence.

Abstract: User profiles of applications installed in a user environment, which may be compromised by malware, are managed to protect against such malware gaining access to sensitive data that may be contained in the user profiles. The method includes the steps of detecting, by a management agent of a user environment, a launch of an application within the user environment, verifying, by a filter driver, an identity of the application against a stored profile of the application, and responsive to determining that the identity of the application matches the stored profile of the application, importing, by the management agent, an encrypted user profile from a remote storage to local storage, decrypting, by the filter driver, the encrypted user profile, and providing the decrypted user profile to the application.

Abstract: A system, method, and computer program to implement Public Key Infrastructure (“PKI”)-based access controls on a computing device independently of the operating system's user identification and authorization system. A software application on a standalone, non-networked computing device detects a “smart card” with a PKI certificate identifying the card holder. The identity of the card holder is verified against a registry stored on the computing device separately from the operating system's user identification and authorization system. Verification of the identity of the card holder results in setting the state of the computer system as “authorized” or “unauthorized.” In the unauthorized state, user input and viewing of information is prevented. The software application may thus identify individual smart card holders and provide secure access to data and resources, and track authorized and unauthorized access on computing devices that must remain in an “always logged in” state.

Abstract: Provided is relative multifactor authentication for interactions between users and one or more entities. Relative multifactor authentication includes monitoring a set of attributes associated with a user during an interaction between the user and the entity. The set of attributes include at least two of a behavioral attribute, a health attribute, a geospatial attribute, and a device attribute. Relative multifactor authentication also include comparing respective parameters of attributes of the set of attributes with expected parameters and determining an authentication status based on the comparison and weighted values assigned to respective attributes of the set of attributes. The user is selectively authenticated to begin to continue the interaction based on the authentication status.

Abstract: Some embodiments of the invention provide a method for a trusted (or originator) device to modify the security state of a target device (e.g., unlocking the device) based on a securing ranging operation (e.g., determining a distance, proximity, etc.). The method of some embodiments exchanges messages as a part of a ranging operation in order to determine whether the trusted and target devices are within a specified range of each other before allowing the trusted device to modify the security state of the target device. In some embodiments, the messages are derived by both devices based on a shared secret and are used to verify the source of ranging signals used for the ranging operation. In some embodiments, the method is performed using multiple different frequency bands.