Abstract: A method of authenticating a user to a computer in an adverse environment includes receiving the user's password in a trusted user device, such as by the user typing the password, and encoding a keyword with a hash of the entered password to create an encoded keyword. The encoded keyword is sent from the trusted user device to the computer using a physical communication channel perceivable by the user; and the encoded keyword is compared in the computer with a keyword encoded with a known hash of the user's password in the computer to authenticate the user.

Abstract: Aspects of the present disclosure address systems, methods, and devices for enabling secure communication between electronic control units (ECUs) in a vehicle. The system may include a first and second ECU from a plurality of ECUs in the vehicle. The first ECU is to enable secure communication between the plurality of ECUs by performing operations that include provisioning the second ECU with authentication data for authenticating messages exchanged with a third ECU and provisioning the third ECU with a set of security keys to enable the third ECU to securely exchange messages with the second ECU. The second ECU receives, from the third ECU, a secure message that is cryptographically signed using a security key from the set of security keys provisioned to the third ECU, and the second ECU authenticates the secure message by comparing the authentication data with an authentication signal.

Abstract: Disclosed are various examples for enrollment of gateways using a client device. In one example, a request is transmitted from a client device to a management service. The request comprises the gateway identifier. Gateway credentials are relayed through the client device from the management service to the gateway device. The gateway credentials are unexposed to users of the client device.

Abstract: Systems and methods for preventing the fraudulent sending of data from a computer application to a malicious third party are disclosed. In one embodiment, a method for preventing a computer application from sending data to an unauthorized website may include: (1) receiving, at a computer application executed by an electronic device and from a first website, an identification of a second website for receiving data from the computer application; (2) providing, by the computer application and to a certificate authority, the identification of the second website, wherein the certificate authority validates that the second website is on a list of allowed websites for the first website; (3) receiving, by the computer application and from the certificate authority, validation; and (4) communicating, by the computer application, the data to the second website.

Abstract: Systems and methods are described for enabling users to model security resources and user access keys as resources in a template language. The template can be used to create and update a stack of resources that will provide a network-accessible service. The security resources and access keys can be referred to in the template during both stack creation process and the stack update process. The security resources can include users, groups and policies. Additionally, users can refer to access keys in the template as dynamic parameters without any need to refer to the access keys in plaintext. The system securely stores access keys within the system and allows for templates to refer to them once defined. These key references can then be passed within a template to resources that need them as well as passing them on securely to resources like server instances through the use of the user-data field.

Abstract: Systems and methods for backing up data are provided. Data objects or blocks of data can be encrypted with individualized keys. The keys are generated from the unencrypted data objects or blocks. The encrypted data objects or blocks and fingerprints of the encrypted data objects or blocks can be uploaded to a datacenter. Even though the data objects or blocks are encrypted, deduplication can be performed by the datacenter or before the data object is uploaded to the datacenter. In addition, access can be controlled by encrypting the key used to encrypt the data object with access keys to generate one or more access codes. The key to decrypt the encrypted data object is obtained by decrypting the access code.

Abstract: A wireless system can be used to authenticate a user device via proximity information of wireless network devices. The system can include the user device, the wireless network devices, and a server. At least some of the wireless network devices can be wirelessly connected to the user device and at least some other wireless network devices can be wirelessly unconnected to the user device. The server can use proximity information about the user device with respect to the wireless network devices to authenticate a user.

Abstract: A digital certificate processing method includes: receiving a distribution request for a digital certificate, wherein the digital certificate does not contain validity period information; acquiring a verification result for the digital certificate; and according to the verification result, recording the digital certificate which has passed verification to a blockchain.

Abstract: A computer program product configured to execute a method for exchanging electronic data. The method includes receiving, using an API, a request to transmit data from a source trading partner to a destination trading partner; querying a name server, using a domain name system protocol, the name server comprising a subdomain of the destination trading partner to send the data to, wherein the subdomain is mapped to a destination access point, wherein a name of the subdomain conforms to a common format, wherein an address of the subdomain conforms to another common format; determining the address of the subdomain based on the querying of the name server; addressing the data, using another API, to be sent to the address of the subdomain; and transmitting the data, using the another API, to the destination access point by virtue of the subdomain's mapping to the destination access point.

Abstract: Disclosed are various embodiments for chaining of authorizations in an authorization framework. In one embodiment, a service receives an authorization request for access by a relying party service operated by a first entity to obtain information associated with a user account. The service determines that the authorization request requires a consent of a second entity. The service then obtains a first authorization token representing the consent of the second entity. The service generates a second authorization token based at least in part on the first authorization token. The service sends the second authorization token to the relying party service.

Abstract: The disclosed systems and methods may receive a first salted password having a first password, a first user device identifier, and a first browser identifier, extract the first password, the first user device identifier, and the first browser identifier from the first salted password, and determine whether the first password, the first user device identifier, and the first browser identifier respectively match a stored first password, a stored first user device identifier, and a stored first browser identifier. The systems may grant the request to access the one or more resources for the first user device or perform other actions depending on whether the first password, the first user device identifier, and the first browser identifier respectively match the stored first password, the stored first user device identifier, and the stored first browser identifier.

Abstract: A method for disabling a device associated with a virtual identity may include receiving, from the device, a request to use the virtual identity, where the request that may include a passcode guess and a device identifier. The method may also include determining that the passcode guess does not authorize use of the virtual identity and incrementing a number of incorrect passcode guesses received within a time interval. The method may additionally include determining that the number of incorrect passcode guesses received within the time interval is greater than or equal to a threshold. The method may further include storing an indication that subsequent requests associated with the device identifier should not authorize use of the virtual identity.

Abstract: The subject matter of this specification can be implemented in, among other things, a method that includes storing, in a collaboration platform, a first geographic location and a first time of a first authentication request for an account at the collaboration platform responsive to successful authentication of the first authentication request. The method includes receiving a second authentication request for the account at the collaboration platform. The method includes identifying a second geographic location and a second time of the second authentication request. The method includes providing access to the account responsive to a determination that a difference in time between the first time and the second time is large enough that a user of the account is able to travel a difference in distance between the first geographic location and the second geographic location within the difference in time.

Abstract: A network device may receive a request to access a network from a client device. The network device may determine that the client device is authenticated based on a set of authentication credentials obtained for the client device. The network device may determine, based on the client device being authenticated, that a quantity of devices currently accessing the network using the set of authentication credentials is equal to a maximum quantity of devices permitted to access the network using the set of authentication credentials. The network device may deny the client device access to the network based on the quantity of devices being equal to the maximum quantity of device.

Abstract: One or more medical devices are configured to connect to a predetermined temporary provisioning network of a healthcare organization, the temporary provisioning network being different than a healthcare network of the healthcare organization. After the devices are received by the healthcare organization, and powered up for the first time, device identifiers corresponding to the medical devices are received at a server remote from the healthcare organization, from the temporary provisioning network, together with an indication that the medical devices are requesting access to a management server within a healthcare network of the healthcare organization.

Abstract: Examples described herein include systems and methods for providing push notifications to a third-party application executing on a client device. An example can include encrypting user credentials, generating a callback Uniform Resource Locator (“URL”) with at least a portion of the encrypted credentials embedded into the URL, and requesting notifications from an email service to be provided at the callback URL. Upon receiving a notification at the callback URL, a system component can decrypt the credentials within the URL using a private key and log into the email account using those decrypted credentials. The system component can then generate a push notification based on any changes found in the email account and cause the notification to be delivered to the third-party application on the client device.

Abstract: A method of providing cyber security to an industrial control system is described. The method includes detecting an anomaly and recording and reporting the detected anomaly to a control system within a network associated with the industrial control system.

Abstract: One embodiment of the present invention provides an enhanced authentication system. During operation, the system can obtain, from a remote device of a client, an authentication request prior to the exchange of application layer web traffic associated with a piece of resource protected by the system. The system can then determine, in the authentication request, an indicator indicating whether certificate-based authentication is enforced for the client. If certificate-based authentication is enforced for the client, the system can initiate certificate-based authentication for the client. On the other hand, if certificate-based authentication is not enforced for the client, the system can send information associated with a user interface to the client. The user interface can allow the client to select an authentication method from a set of authentication methods supported by the system.

Abstract: A networked infrastructure is described that includes a set of programmed computing nodes, each node being configured with a processor and non-transitory computer readable media including computer-executable instructions that, when executed by the processor, facilitate a social security number registry server carrying out a method that provides an individual with the ability to remotely approve or disapprove, in real-time, the use of his/her social security number (SSN) by a relying party server.

Abstract: A method for symmetric authentication is provided. This method includes generating a first challenge message containing a first string; encrypting the first challenge message; transmitting the encrypted first challenge message to a second device; receiving a first answer message from the second device; decrypting the first answer message; and authenticating the second device based on determining the decrypted first answer message contains the first string. Upon successful authentication of the second device, the method further includes receiving an encrypted second challenge message from the second device; decrypting the encrypted second challenge message; generating a second answer message containing a second string; encrypting the second answer message; and transmitting the encrypted second answer message to the second device.