Abstract: The present disclosure provides a computer-readable medium, method and system for determining security vulnerabilities for a plurality of application programs used to provide television services to a customer device over a communications network. The method includes running a first scanning program against a first application program relating to a control panel for the customer device; running a second scanning program against a second application program that provides Internet content to the customer device; running a third scanning program against a third application program that relates to a component management system of customer premises equipment; and correlating security vulnerabilities identified utilizing the first, second, and third scanning programs.

Abstract: A method A method and system for managing role-based access control of token data using token profiles is described. In one method, a token processing system (TPS) receives a request from a TPS client over a network to perform an operation on entries of a token database. The TPS identifies a subset of the multiple groups that corresponds to the entries indicated in the request of the TPS client, determines to which of the identified groups the TPS client belongs using token profiles. For each group the TPS client belongs, the TPS determines a corresponding role for the TPS client from the token profiles. For each group the TPS belongs, the TPS allows the TPS client access to the entries of the respective group to perform the operation when the TPS client has the appropriate role assigned within the respective group.

Abstract: A method and system for managing role-based access control of token data using token profiles having predefined roles is described. In one method, a token processing system (TPS) assigns a TPS client a token profile for a group of multiple tokens, the token profile being stored in a profile data structure. The token profile specifies at least one of multiple predefined roles for the TPS client, each role associated with predefined access to entries of a token database. The TPS receives a request from the TPS client over a network to perform an operation on the entries of the token database that correspond to the group, and allows the TPS client access to the token database to perform the operation when permitted by the predefined roles specified in the token profile on the entries of the token database that correspond to the group identified by the token profile.

Abstract: An improved network protocol for mitigating network amplification attacks is provided. The absolute network load that any transient distributed attack can cause is bounded based on a resource crediting scheme. The protocol accumulates “credit” upon reception and detection of candidate attack request packets, and draws against that credit when transmitting responsive packets. In some implementations, the time frame of such an attack is also bounded using time limits applied to a resource crediting scheme. Other resources may also be bounded by the resource crediting scheme, including without limitation CPU utilization, storage capacity, power, etc.

Abstract: Disclosed are methods for user profiling for detecting insider threats including the steps of: upon a client application sending a request for a link, extracting at least one search keyword from a search session associated with the request; classifying the link into at least one classification; determining whether at least one classification is a monitored classification; capturing search elements of search sessions associated with the monitored classification; acquiring usage data from the search elements to create a user profile associated with a user's search behavior; and performing a statistical analysis, on a search frequency for the monitored classification, on user profiles associated with many users.

Abstract: One embodiment relates to a computer-implemented process for generating document fingerprints. A document is normalized to create a normalized text string. A first hash function with a sliding hash window is applied to the normalized text string to generate an array of hash values. Candidate anchoring points are selected by applying a first filter to the array of hash values. The anchoring points are chosen by applying a second filter to the candidate anchoring points. Finally, a second hash function is applied to substrings located at the chosen anchoring points to generate hash values for use as fingerprints for the document. Other embodiments and aspects are also disclosed.

Abstract: The present invention is directed toward secure access systems. Specifically, a method and system is provided that enhances the security of unidirectional communication protocols used in access control systems, such as the Wiegand protocol. The enhancements may include obfuscation of data, a two-way packet-mode communications, and blind synchronization of pseudo-random number generators.

Abstract: According to one embodiment, an encryption program operation management system includes an encryption key table creation module which creates encryption keys and creates an encryption key table including encrypted versions of the encryption keys and items of plaintext index information for recognizing the encryption keys, and an installation package creation module which creates an installation package including an encryption program, the encryption key table, and an installation program for installing the encryption program into a computer. The installation program causes the computer to carry out an operation of selecting one of the encrypted versions of encryption keys and an operation of creating and storing encryption key information including the selected one of the encrypted versions of encryption key and one of the items of plaintext index information associated with the selected one of the encrypted versions of encryption keys.

Abstract: Techniques to protect from open enhanced federation user enumeration are described. An apparatus may include a network interface operative to establish connections. The access edge server may further include an open enhanced federation (OEF) module communicatively coupled to the network interface. The OEF module may be operative to manage connections between multiple federated networks. In one embodiment, for example, the OEF module may comprise a peer authentication module operative to determine whether a peer making the request is an untrusted peer domain. The OEF module may further comprise a peer tracking module operative to retrieve a total request number and a total limit number associated with the untrusted peer, and compare the total request number with the total limit number to form a threat status indicator value. The OEF module may also comprise a peer authorization module operative to authorize the request based on the threat status indicator value. Other embodiments are described and claimed.

Abstract: A system and method for communication security receives a request from a first communication device for communication with a second communication device, and determines if the communication is to be secure. The system and method further requests identity verification from the second communication device if the communication is to be secure. In addition, the system and method establishes a secure communication between the first communication device and the second communication device when a valid password is received from the second communication device.

Abstract: A method and system is provided by which a trusted software agent can perform in a sharing violation free environment, which reduces complexity and eliminates interference with applications. A method for handling sharing violations in a computer system comprises intercepting a request by an application for access to a file, capturing a sharing violation raised by the operating system due to the said request, determining whether the sharing violation is due to the trusted agent, and if so holding the request by the application for access to the file until the trusted agent no longer holds the file, and then reprocessing the request by the application for access to the file. The application is not aware that the sharing violation due to the trusted agent occurred, or that the request was pending and reprocessed as at the end of the process it receives a file handle as if a sharing violation did not occur.

Abstract: Data packets are transmitted in a secure manner from an external network to a secure network. The secure network and the external network are interconnected via a firewall comprising a first interface with the external network and a second interface with the secure network. The firewall provides, over the second interface, a plurality of virtual interfaces. An association between items of specific information of the firewall and said virtual interfaces is stored in the firewall and in the secure network. It is determined whether to authorize the transmission of a packet received from the external network to the secure network on the basis of predefined security criteria. If the received packet is authorized, an item of specific information is selected to be transmitted to the secure network with the authorized packet. A virtual interface is then determined as a function of the item of specific information selected on the basis of the association.

Abstract: A method of encrypting compiled computer code instructions to be decrypted instruction by instruction during execution. The computer code instructions are encrypted using a chaining mode so that an encrypted instruction depends on the values of the instruction, the value of the preceding instruction and a pseudo-random number. As it may happen that the instruction can be arrived at from more than one preceding instruction, at least one of the preceding instructions is associated with a random number compensator for use during decryption of the encrypted instruction, so that the decryption of the encrypted instruction yields the same result regardless of which the preceding instruction was. Also provided are an encryption device, a decryption device and method, and a digital support medium storing encrypted compiled computer code instructions.

Abstract: An abnormal Internet Protocol Security (IPSec) packet control system and method utilizes IPSec configuration and session data to detect whether or not packets encrypted by an extended header are abnormal. The IPSec packet control system can include an extended header processing unit that receives an IPSec packet and extracts the data to be used in traffic control; check units for checking the packets in the stages of IPSec configuration and IPSec communication that receive the extracted data to determine whether or not the IPSec packet has passed; and a control unit that allows the IPSec to pass or to be blocked according to a determination result from the check units for checking the IPSec configuration and communication packets, where abnormal IPSec packets are blocked using the IPSec configuration and session tables without requiring them to be decrypted and encrypted.

Abstract: Disclosed are interconnectable personal computer architectures comprising secure, portable and persistent computing environments that provide secure computing sessions with persistence. The computing environments are implemented using a secure non-computing client device, such as a USB device, that interfaces with a host computer and, optionally, a trusted server. The secure non-computing client device is used to instantiate a secure BIOS and a secure cold or warm boot of the host computer, from the client device, in a host protected area of the host computer, or from the trusted server. The client device comprises a security device, such a trusted platform module, that encrypts and decrypts data transferred between the client apparatus and the host computer to provide a sealed computing environment on the host computer. The client device may implement keyboard logger attack prevention. The client device may also implement a high assurance guard to protect applications.

Abstract: When a user operates a processing apparatus through a touch panel, a fingerprint processing unit reads fingerprint information of the user's finger. Each time when the fingerprint processing unit reads fingerprint information, a CPU judges whether the read fingerprint information is identical to a fingerprint information of authenticated user. If being identical, the processing apparatus executes a process in accordance with an operation accepted through the touch panel. These two fingerprint information are identical each other if the operating user through the operation accepting panel is the authenticated user. It means that the processing apparatus judges whether the operating user is the authenticated user, each time when the user operates. If the user is the authenticated user, the process in accordance with the operation by this user is then executed.

Abstract: A computer extracts the header information from an electronic mail, including an originality guarantee. The computer generates a header characterization for the header information subject to originality guarantee, and extracts message body information from the electronic mail and generates a body characterization for the message body information as well. The generated characterization set applies the header characterization and the body characterization, combined. The verification information is added to the generated characterization set for applying a signature, and characterization set is linked to electronic mail.

Abstract: Disclosed is a method of receiving by a terminal a rights object (RO) from a rights issuer (RI) on behalf of a memory card, the method including, receiving, by the terminal, a trigger message for RO acquisition from the rights issuing server, comparing, by the terminal, trust anchor and ID of the memory card in a list included in the trigger message with a trust anchor and ID of the memory card within a context of the terminal, transmitting, by the terminal, a RO request message to the rights issuing server if the trust anchor and the ID of the memory card within the context are consistent with those within the list according to the comparison result, and receiving, by the terminal, a RO response message including a protected RO from the rights issuing server.

Abstract: Described herein are one or more implementations of a policy-management infrastructure that provides a universal policy-based solution across a spectrum of scenarios in a computing environment. At least one implementation of the policy-management infrastructure defines how policy-based data is structured or layered relative towards the data in other layers. Furthermore, a described implementation provides a mechanism for determining “overlap” and “conflicts” in policies.

Abstract: This cryptographic curve generation technique provides a faster way of constructing a genus 2 curve. The technique provides a procedure to compute isogenies between genus 2 curves over finite fields. Instead of looping over possible roots, as is typically done when solving Igusa class polynomials, the technique only finds one root and then applies the isogenies to find the others. The technique computes a set of polynomials that define all isogenies. To do this, for a given root of an Igusa class polynomial over a finite field, the technique computes a value of a small modular function ƒ. To the value of this function ƒ, the technique applies an isogeny to find an isogenous ƒ-value. The technique then transforms the ƒ-value back into an Igusa value. Once the Igusa class polynomials are solved they can be used to generate a genus 2 curve which can be used in cryptographic applications.