Abstract: A method of verifying an account login request may include identifying one or more Internet Protocol (IP) addresses as potentially malicious and, for each identified IP address, determining a first value equal to a number of times over a period of time that the IP address was identified by the computing device as potentially malicious, determining a second value equal to a number of times over the period of time that the IP address was confirmed to be potentially malicious by one or more account users, determining a proportion value associated with the IP address by determining a ratio of the second value to the first value, labeling the IP address as safe or unsafe based on at least the proportion value associated with the IP address, and maintaining, by the computing device, a list of the IP addresses and corresponding labels.

Abstract: A data-processing system having at least one operating memory holding operating data is provided with a protection unit having an execution environment protected from unauthorized access. At least one monitoring logic in the execution environment is connected to the operating memory for monitoring unauthorized modifications, access, or similar protection violations of the operating data stored in the operating memory and for generating an output on detection of such a protection violation. A protection logic in the execution environment holds replacement data capable of replacing the operating data and is connected to the monitoring logic for, on generation of the output, providing to the operating memory the replacement data for the operation or for a substitute operation of the data-processing system.

Abstract: In a vehicle communication network, some vehicles may be used by attackers to send false information to other vehicles which may jeopardize the safety of other vehicles. Vehicles should be able to detect malicious communications activities and to mitigate the impact of malicious vehicles by evicting (eliminating) suspected malicious vehicles from the system. Evicting a vehicle is to ignore the messages sent from the vehicle for a specified time period. Voting and sacrifice principles are combined using a mathematical model based on the “Mafia Game”. The Mafia Game model focuses on the relative size of the group of attackers within a neighborhood necessary to dominate the entire network in the neighborhood (i.e., to eventually evict all the innocent vehicles).

Abstract: A pool of public keys, having a pool size, is received from a first device. The pool size reflects a target number of keys to be included in the pool. One of the received public keys included in the pool of keys is designated as a reserve key. A public key is selected from the pool of received public keys for use in conjunction with encrypting a communication to the first device. The selecting includes preferentially selecting a public key that is not designated as a reserve key, if at least one such key is present in the pool in addition to the reserve key. The size of the pool can be dynamically adjusted.

Abstract: Embodiments of the present invention provide methods, system and machine-readable media for dynamically providing identity management or other services. According to one embodiment, dynamically providing services can comprise receiving a request related to an unknown principal. A service to which the principal is known can be selected. Once a service to which the principal is known has been located, an identity management result can be obtained from the selected service. The method can further comprise determining based on the identity management result whether the principal is authorized to access a requested resource. In response to determining the principal is authorized, the requested resource can be accessed.

Abstract: An encryption realization method and system are disclosed. The method includes: a network-side device and a group call terminal maintaining the same list of push-to-talk (PTT) authentication key K values respectively; during each group call, the network-side device calculating an authentication vector (AV) according to a generated random number (RAND), an authentication sequence number (SQN), a PTT authentication key K value selected from the list of PTT authentication key K values and public network authentication functions; and according to the RAND and an authentication token (AUTN) in the AV acquired from the network-side device, the group call terminal performing authentication to generate an cipher key (CK).

Abstract: A method for ascertaining access permissions of users to computer resources on a storage unit, the method including grouping users into a plurality of user groups wherein all members of at least one of the user groups have at least nearly identical user/resource access permissions to the computer resources, grouping resources into a plurality of resource groups wherein all members of at least one of the resource groups have at least nearly identical resource/user access permissions, ascertaining whether a given user is a member of a user group, if the given user is a member of a user group, ascribing to the given user the user/resource access permissions of the user group, ascertaining whether a given resource is a member of a resource group, and if the given resource is a member of a resource group, ascribing to the given resource the resource/user access permissions of the resource group.

Abstract: A system for securely downloading and playing coherent digital content such as music and preventing its play by unauthorized users. The system may include mass server/storage devices for receiving and storing digital content having predetermined gaps; and client devices communicating with the server/storage devices, and providing authorization to proceed. During playing of the digital content by the client devices, the missing gaps may be filled into the appropriate places, to allow the play of the coherent digital content.

Abstract: In various embodiments, a control client is configured to determine whether or not the most current configuration profile has been installed within a corresponding mobile device. In particular embodiments, the client is configured to store its own copy of a configuration profile and to compare its copy with the most current configuration profile generated by a device management system as well as to the configuration profile currently installed and applied by a configuration manager within the mobile device. Each configuration profile includes an embedded verification token that facilitates this process. Furthermore, the client may be configured to inform the device management system as to whether or not the current configuration profile has been installed. The device management system may govern enterprise access by the mobile device based on whether or not the current configuration profile has been installed.

Abstract: Techniques are described for enabling administrators of teams that use a particular service to specify which sign-on options, of multiple possible sign-on options, are assigned to the members of the teams to which the administrators belong. For example, an administrator may assign a first sign-on option, which only allows users to use native authentication, to one set of members of the team. At the same time, the administrator may assign a second sign-on option, which only allows users to use third-party single-sign-on authentication, to another set of members of the same team.

Abstract: The present disclosure relates to an advantageous system and related methods for distributed deduplication of encrypted chunks. One embodiment relates to a method for storing encrypted chunks in which an encryption key is generated independently from a chunk payload. With this method, two encrypted chunks are identifiable as having identical chunk payloads even when the chunk payloads are encrypted with different encryption keys. Other embodiments, aspects and features are also disclosed.

Abstract: A system and method for tracking sensitive data uses dynamic taint analysis to track sensitive data as the data flows through a target application running on a computer system. In general, the system and method for tracking sensitive data marks data as tainted when the data input to the target application is indicated as sensitive. The system and method may then track the propagation of the tainted data as the data is read from and written to memory by the target application to detect if the tainted data is output from the application (e.g., leaked). Dynamic binary translation may be used to provide binary instrumentation of the target application for dynamic taint analysis to track propagation of the tainted data at the instruction level and/or the function level. Of course, many alternatives, variations, and modifications are possible without departing from this embodiment.

Abstract: A method for transmitting digital data to a recipient via a communications network includes providing digital data and digitally signing the digital data using N cryptographic keys. Each of the N cryptographic keys is associated with a same sender of the digital data, and N>1. The recipient receives the digital data and verifies the digital signature using N cryptographic keys associated with the N cryptographic keys used to sign the digital data. In dependence upon verifying the digital signature, the recipient accepts the digital data as being authentic.

Abstract: A method for controlling access to data being processed by a remote computing resource includes issuing a public encryption key for a data creator from a public certificate authority, detecting an encounter with a data owner, creating private encryption keys for the data creator and the data owner in response to detecting the encounter, encrypting data being sent to the remote computing resource with the public encryption key, the data creator's private encryption key, and the data owner's private encryption key, decrypting the data based on public verification of the public encryption key and local verification of the data creator's private encryption key and the data owner's private encryption key at the remote computing resource, and controlling the data creator's access to the data by altering the permission of at least one of the public encryption key and data creator's private encryption key.

Abstract: Provided is a method for configuring wireless connection settings, a wireless communications apparatus, and a display method, the method being executed by the wireless communications apparatus and including: (a) receiving a first radio signal which includes second configuration information; (b) receiving authentication information for use in authenticating a first device from a second device, the authentication information being uniquely associated with the first device; (c) retaining the authentication information; (d) establishing the wireless connection with the first device, using the second configuration information; (e) transmitting a second radio signal which includes the authentication information, to the first device through the wireless connection established; (f) receiving a third radio signal which includes response information to the authentication information; and (g) transmitting the first configuration information to the first device if the response information indicates that the first device

Abstract: The present invention is to ensure information safety of a user of service using API. An information processing device issues a service code in response to an API use request. The API use request relates to service using an application program that uses API and is transmitted from an application provider device. The information processing device makes service identification information and use API information correspond to the service code and registers the service identification information, the use API information, and the service code. According to user-specific information from the application provider, unapproved license information is issued for each application user. Approval of this license information by the application user side registers the license approval information. At service execution, authentication is performed based on the service code and the license information. When the authentication is passed, API use is permitted.

Abstract: A remote manipulation apparatus includes a touch sensor and a manipulation control circuit to detect manipulation on a manipulation surface using a manipulator's finger. The touch sensor and the manipulation control circuit can acquire a manipulation entity distance between the manipulation surface and the finger. When the manipulation entity distance is shorter than a first threshold distance, the manipulation control circuit associates the finger manipulation with a pointer control to move a pointer on a display screen. When the distance exceeds the first threshold distance, the manipulation control circuit associates the finger manipulation with a map control to move a map on the display screen. The manipulation control circuit stores a specified finger manipulation as an authorization manipulation. The association between the finger manipulation and the map control is inhibited until the authorization manipulation using the finger is performed.

Abstract: Methods, apparatuses, computer program products, devices and systems are described that carry out accepting at least one telephone communication from at least one member of a network; disambiguating the at least one search term including associating the at least one search term with at least one of network-participation identifier data or device-identifier data; and presenting the sender profile in association with the at least one telephone communication.

Abstract: Described are systems and methods for managing network packet traffic between a client device and an enterprise server. A list of enterprise-authorized applications is maintained. Data packets, such as TCP and UDP data packets, communicated from applications running on the device are analyzed to determine an originating application corresponding to each packet. The originating application is compared to the list of authorized applications, and a VPN tunnel is created for the packet to access the enterprise server if the corresponding originating application is an authorized application.

Abstract: Methods and devices for detecting suspicious or performance-degrading mobile device behaviors may include performing behavior monitoring and analysis operations to intelligently, dynamically, and/or adaptively determine the mobile device behaviors that are to be observed, the number of behaviors that are to be observed, and the level of detail or granularity at which the behaviors are to be observed. Such behavior monitoring and analysis operations may be performed continuously (or near continuously) in a mobile device without consuming an excessive amount of processing, memory, or energy resources of the mobile device by identifying hot application programming interfaces (APIs) and hot action patterns that are invoked or used most frequently by software applications of the mobile device and storing information regarding these hot APIs and hot action patterns separately and more efficiently.