Abstract: The monetization of downloadable files associated with a custodial host site based on resolving custodianship to a referrer publisher with subsequent presentation of monetized content within a modal overlay is disclosed. A request from a client device has a resource identifier and a referrer publisher identifier. The request for the downloadable file is evaluated against one or more publisher and custodianship policy rules, which relate to a file extension of the downloadable file, a format of the resource identifier, a custodial domain on which the downloadable file is stored, and a referral domain as specified in the referrer publisher identifier. When custodianship is resolved, a modal overlay on which monetized content is incorporated is presented on the client device. The modal overlay is concurrently displayed with the transfer of the downloadable file to the client device.

Abstract: System and method embodiments are provided for segment integrity and authenticity for adaptive streaming. In an embodiment, the method includes receiving at a data processing system a segment of a media stream, determining, with the data processing system, a digest or a digital signature for the segment, and comparing, with the data processing system, the digest/digital signature to a correct digest or a correct digital signature to determine whether the segment has been modified.

Abstract: Objects in a shared storage system can be marked as including prohibited content. Incidents that result in objects being so marked can be stored in an incident history associated with a user responsible for those objects. The incident history can be processed to identify repeat offenders and modify access privileges of those users. However, when objects are shared by one user with another user, prohibited content is blocked from being shared, while the remainder of the shared objects can be accessed by the other user. Functions that allow sharing of content are implemented so as prevent sharing of prohibited content with another user, while allowing other content to be shared. If a group of files or objects is shared, then the presence of prohibited content in one object in the group results in that prohibited content not being shared, but the remaining files or objects are still shared.

Abstract: A computer implemented method for wireless communications access security, the method comprising: measuring at least one parameter during a wireless communication with an active access point, calculating at least one indicator from the measured parameter(s), and determining a threat indication by applying a threat evaluation function on the calculated indicator(s).

Abstract: Embodiments are directed towards managing data storage for secure storage of shared documents. A user or an application may provide data destined for encryption and a public key. Instruction set information that references at least a seed file that may be installed on the network computer may be generated. An encryption key based on the instruction set information may be generated. Header information that includes the instruction set may be generated. And, the header information may be encrypted using the public key. A secure bundle that includes the public key, the encrypted header information, and the encrypted data may be generated and provided to the user that provided the data and the public key or the application that provided the data and the public key. Decrypting the data included in the secure bundle the above actions are generally performed in reverse.

Abstract: Systems and methods may provide for receiving runtime input from one or more unlock interfaces of a device and selecting a level of access with regard to the device from a plurality of levels of access based on the runtime input. The selected level of access may have an associated security policy, wherein an authentication of the runtime input may be conducted based on the associated security policy. In one example, one or more cryptographic keys are used to place the device in an unlocked state with regard to the selected level of access if the authentication is successful. If the authentication is unsuccessful, on the other hand, the device may be maintained in a locked state with regard to the selected level of access.

Abstract: A cloud service usage assessment system analyzes network traffic from an enterprise data network and generates cloud service usage analytics for the enterprise. In some embodiments, the cloud service usage analytics may include cloud service usage risk assessment. The cloud service usage assessment system is advantageous applied to assess network security in view of an enterprise's adoption of multiple cloud based services.

Abstract: The embodiments described herein describe technologies for a device definition process to establish a unique identity and a root of trust of a cryptographic manager (CM) device, the CM device to be deployed in a CM system. The device definition process can take place in a device definition phase of a manufacturing lifecycle of the CM device. One implementation includes a non-transitory storage medium to store an initialization application that, when executed by a CM device, causes the CM device to perform a device definition process to generate a device definition request to establish the unique identity and the root of trust. In response to the device definition request, the initialization application obtains device identity and device credentials of the CM device and stores the device definition request in storage space of a removable storage device.

Abstract: A virtual computing environment service may receive a request from a customer to provision a virtual computing environment and join the virtual computing environment to a managed directory. The virtual computing environment service may provision the virtual computing environment and uses a set of administrator credentials from the customer and a set of credentials corresponding to the environment to access the managed directory and request joining of the environment to the managed directory. In response, the managed directory may create a computer account corresponding to the environment and which enables the environment to be used to access the managed directory. The virtual computing environment service may then enable the customer to specify one or more users that may utilize the virtual computing environment to access the managed directory.

Abstract: A computer system identifies malicious Uniform Resource Locator (URL) data items from a plurality of unscreened data items that have not been previously identified as associated with malicious URLs. The system can execute a number of pre-filters to identify a subset of URLs in the plurality of data items that are likely to be malicious. A scoring processor can score the subset of URLs based on a plurality of input vectors using a suitable machine learning model. Optionally, the system can execute one or more post-filters on the score data to identify data items of interest. Such data items can be fed back into the system to improve machine learning or can be used to provide a notification that a particular resource within a local network is infected with malicious software.

Abstract: According to one embodiment, a transparent security gateway is coupled between a client end station (CES) and a web application server (WAS). The security gateway monitors an encryption protocol handshake between the CES and the WAS to capture, using a provided private key of the WAS, a generated symmetric key to be used for an encryption layer connection. Using the captured symmetric key, the security gateway receives an encrypted connection record of the encryption layer connection, decrypts the encrypted connection record to yield a plaintext connection record, modifies the plaintext connection record, encrypts the modified plaintext connection record using the symmetric key, and transmits one or more packets carrying the encrypted modification plaintext connection record instead of the received encrypted connection record such that neither the CES or WAS is aware of the modification of the encrypted data.

Abstract: A plurality of security events is detected in a computing system, each security event based on at least one policy in a plurality of security policies. Respective interactive graphical representations are presented in a graphical user interface (GUI) of either or both of the security events or security policies. The representations include interactive graphical elements representing the respective security events or security policies. User selection of a particular event element via the interactive GUI causes a subset of the security policies to be identified, each security policy in the subset serving as a basis for at least one particular security event represented by the particular event element. User selection of a particular policy element via the interactive GUI causes a subset of the security policies to be identified, each security event in the subset based at least in part on a particular security policy represented by the particular policy element.

Abstract: A method of providing restricted access to computer application information via a computing device includes: displaying a limited-access icon on a display of the computing device, the limited-access icon including a function indicator and code-entry segments that can be selected by a user of the computing device, each of the code-entry segments including a visual indicator; receiving a selection sequence of user selections of selected ones of the code-entry segments; and performing a limited-access function corresponding to the function indicator in response to the selection sequence corresponding to an authorized sequence.

Abstract: A method includes binding, using a plurality of processors, a process to a wildcard address and a port on each of a plurality of nodes. The process receives, on a redirector node, a first request for a first address of a first volume located on the cluster from a first client. The first request is sent to the port and a first address associated with a first virtual local area network (VLAN) that is not the wildcard address. The process determines the first address from the first request and a name of the first VLAN based on the first address. The process determines a first node that contains information regarding the first volume and an address of the first node that is part of the first VLAN. The process determines that a volume identifier associated with the first volume of the first request is present on a volume list.

Abstract: A dynamic root of trust can be injected in an application module on a client device using a backend server and can be continuously monitored to ensure authenticity, integrity and confidentiality at load time, run time and update time of the application module. The dynamic root of trust can be updated directly from the backend server and can be used to establish a time bound trust chain for the other software modules loaded and executed as part of the application module.

Abstract: Methods, devices, systems, and non-transitory process-readable storage media for a computing device to reversibly obfuscate contents of a digital file includes generating a binary string by applying a shared hash function to a public filename of the digital file. The method may include subdividing the digital file into a first plurality of data segments corresponding to one of a number of bits represented by the generated binary string and a file size of the digital file, shuffling the first plurality of data segments using a shared, looping shuffle algorithm. Each shuffling operation of the shared, looping shuffle algorithm may use a different bit of the generated binary string in a predefined first sequence. The shuffled first plurality of data segments may be combined to obtain a shuffled digital file. A reverse of the method may be performed to obtain the original digital file.

Abstract: A message digester includes an append bits module that appends padding bits to a message, an append length module that appends length data to the message, the length data representing an amount of data in the message, an initialization module that stores predetermined values in buffers, an array that stores constants, and a looping message-digest calculation module that generates a message digest based on the message, padding bits, length data, the predetermined values in the buffers, and the constants.

Abstract: One embodiment of the invention is a method utilizing a CAPTCHA to generate a human likeness score including blocks: a) receiving a user solution to the CAPTCHA; b) receiving a user interaction pattern descriptive of an interaction undertaken by the user, through a graphical interface of the CAPTCHA, to achieve the user solution; c) determining the accuracy of the user solution; d) comparing the user interaction pattern against an interaction model generated from interaction patterns of previous users; e) calculating the human likeness score based upon the determination of block c) and the comparison of block d), wherein the human likeness score lies within a continuum of human likeness scores.

Abstract: Techniques from the proposed invention relate to providing enhanced security. For example, techniques described herein allow a computer system, such as a mobile device, to support a wide variety of security functions and security sensitive applications on a mobile device by providing enhanced security via secure input and output data transmission and verification through a secure module. The secure module may cause user interfaces to be provided to users by providing obfuscated user interface data to the operating system that do not reveal elements that are part of the user interfaces. The secure module may receive obfuscated user input values representing user input values, and de-obfuscate these user input values, whereby the actual input values are not exposed to the underlying operating system. The secure module may track the flow of user input/output data through the computing device to ensure the integrity and authenticity of this data.

Abstract: Methods and systems for filtering communication packets using a multi-stage filtering system that receives a large volume of communication packets from a communication network that filters the packets in two or more successive stages. The system comprises at least one front-end filtering unit and multiple back-end filtering units. Typically although not necessarily, the front-end filtering unit filters the packets based on layer-2 to layer-4 attributes of the packets. The back-end filtering units, on the other hand, filter the packets based on content extracted from the packet payloads. The back-end filtering units may perform filtering, for example, based on keyword spotting, application classification, malware detection and other content-related criteria. The front-end filtering unit typically performs filtering at the individual packet level and/or at the level of request-response transactions.