Abstract: Method and systems for accessing and providing protected content are disclosed herein. An example system includes a client configured to access a third-party application to receive at least one piece of content associated with a first identifier; wherein the client comprises a token generator configured to generate a token requesting the at least one piece of content, the token comprising at least one private encryption key and the first identifier. The system further includes an embedded module system comprising a database of content, the content separated into a plurality of modules, the embedded module system configured to receive the token and decrypt the at least one private encryption key. The embedded module system may further authorize the client by comparing the first identifier with a second identifier stored in the database.

Abstract: A secure active network includes a plurality of secure elements which communicate with one another to share and log information such as identification, location, and user activity associated with each secure element. Secure elements exchange data with one another, and log data received. The periodicity of communication between secure elements, encryption of the information, and the operating frequency in which the information is transmitted and received may be changed if communication is lost between any of the secure elements or if a determination is made that a secure element has traveled outside a predetermined zone. The integrity of the secure network may be verified at any time by comparing the logged information to a reference network.

Abstract: An image processing apparatus which is capable of restraining operation that does not comply with security policies even in a case where security policies are changed through setting of user modes. The security policies are set in advance in the image processing apparatus. The image processing apparatus has a UI operation unit that enables operation on the image processing apparatus. When settings of the image processing apparatus are changed via the UI operation unit, it is verified whether or not the changed settings match the security policies. Operation of the image processing apparatus is restrained until it is verified that the changed settings match the security policies.

Abstract: Technologies are described herein for anti-malware support within firmware. Through the utilization of the technologies and concepts presented herein, malicious software protection may be extended down to the firmware level. Detecting malicious firmware or software, removing it from firmware, and actively preventing it from exploiting known security vulnerabilities may be supported. Application level anti-malware software may interface with, and be supported by, one or more firmware level anti-malware modules. Firmware level anti-malware modules can actively prevent malicious software from affecting the system firmware. For example, the anti-malware modules may monitor or block access to the firmware. Anti-malware modules may be available at both boot-time and run-time. Thus, a wider range of malicious software attacks or infiltrations may be mitigated.

Abstract: A machine-implemented method for evaluating a context-based (e.g., XACML) policy having a set of attributes formulates a search against one or more existing external repositories using a query that is dynamically-generated based on the security policy being evaluated. The approach shifts the building of a candidate set of potentially-allowable resources to the authorization engine (e.g., a Policy Decision Point (PDP)). In operation, an application calls the PDP using an entitlement request and, in response, the PDP builds the candidate set of values based on the defined security policy by generating a query to an external data repository and receiving the results of that query. This approach enables a policy-driven entitlement query at runtime.

Abstract: Authenticated requests can be sent without requiring the requests to include or potentially expose secret information used for the authentication process. A client device use a security credential such as a key to sign a request to be sent to a recipient. When the request is received, the recipient determines whether the request was signed using the correct key for the sender. In some embodiments a client token is included with the request that statelessly encodes the key, enabling a recipient capable of decoding the client token to determine the key and compare that key to the signature of the request. The sender can store the secret information in a secure location, such as a browser security module, such that the secret information is not exposed to the browser or script executing on the client device.

Abstract: Content access may be provided and processed by assigning responsibility for obtaining entitlement data to the client's browser. Thus, in one example, the client may be configured to synchronize and coordinate data lookups associated with a content request, rather than relying on the server to do so. The network architecture may use a mediator design pattern, in which the client's browser acts as the mediator (i.e., middleman) between a content server and an entitlement data server. Accordingly, synchronous calls between server-side services might not be required. Instead, data necessary for the content server to process a client request for access to protected content may be received in the incoming request from the client's browser.

Abstract: A method for automatically detecting media and implementing interaction control thereon. The present method receives a media change notification (MCN) from a non-defeatable autorun. After receiving the MCN of a media event an operation is automatically executed. The operation then initiates a controller for controlling interaction of deliverable electronic media from a media file corresponding to the media event, wherein the receiving, executing, and controlling are automatically implemented and cannot be defeated by a user.

Abstract: A method of handling cryptographic information in a communication comprising body elements and attachment elements to a mobile device includes the steps of determining if the communication includes an attachment element comprising cryptographic information and converting the attachment element into a body element upon determining that the communication includes an attachment element comprising cryptographic information.

Abstract: Described herein are systems and methods for controlling access by a user to content across a plurality of media devices. Access content limits may be set and enforced across the plurality of media devices. A user exceeding the limits may be disallowed from access to the content. The content access limits for a user may be specified by one or more of time, cost, content category, and so forth.

Abstract: A network security system that employs space-time separated and jointly-evolving relationships to provide fast network access control, efficient real-time forensics capabilities, and enhanced protection for at-rest data in the event of a network breach. The network security system allows, in part, functionality by which the system accepts a request by a user to access the data stored in the database, identifies a sequence of security agents to participate in authenticating and protecting the access of the data by the user, generates a sequence of pseudorandom IDs and space-time varying credentials, checks at each one of the security agents a corresponding one of the credentials, determines that the user is permitted to access the data using access control logs if all the security agents accept the corresponding credentials, and varies the credentials based on a space-time relationship.

Abstract: Novel methods, components, and systems for detecting malicious software in a proactive manner are presented. More specifically, we describe methods, components, and systems that leverage machine learning techniques to detect malicious software. The disclosed invention provides a significant improvement with regard to detection capabilities compared to previous approaches.

Abstract: An embodiment of the invention includes determining a first security status for first information and a second security status for second information, the second security status being more secure than the first security status; establishing a first communication path between the system and a first local computing node via a first wireless path; conveying the first information to the first local computing node via the first wireless path based on the first security status; and withholding the second information from the first local computing node based on the second security status; wherein the first and second information are stored on at least one of the system and a remotely located computing node. Other embodiments are described herein.

Abstract: Embodiments of the present invention relate to a system and method of document retention with policy-controlled deletion. Embodiments of the present invention comprise committing to a plurality of documents, deleting one of the plurality of documents, and providing a proof of authorized deletion of the one of the plurality of documents in response to an audit request.

Abstract: Disclosed are various embodiments for a trust establishment application. Machine instances executed in the same computing environment generate side channel patterns embodying data identifying themselves as trusted machine instances. The side channel patterns are detected to determine which machine instances are trusted. An operational mode of a machine instance is configured as a function of whether a quorum of trusted machine instances are executed in the computing environment.

Abstract: This disclosure is directed to software modification that may be used to prevent software piracy and prevent unauthorized modification of applications. In some embodiments, a software vendor may modify software prior to distribution to a user. The software vendor may extract cutouts from an application to create a modified application. The modified application and the cutouts may be downloaded by a user device. The user device may run the application using the modified application and by executing the cutouts in a secure execution environment that conceals the underlying code in the cutouts.

Abstract: In one implementation, a client device receives a request from a user to output a representation for a credential of the user. In response to receiving the request from the user to output the representation for the credential of the user, the client device obtains data identifying a third-party having authority to grant the user access to the credential of the user. The client device then obtains a representation of a credential associated with the third-party and validates the representation of the credential associated with the third-party. In response to validating the representation of the credential associated with the third-party, the client device outputs the representation for the credential of the user.

Abstract: A system authenticates a first session for a first application running on a workstation and a second session for a second application running on a second screen device. The system links the first application to the second application when the first session matches the second session. The system receives data indicating the linked first application was changed at the workstation and provides update data to the second application corresponding to the change in the linked workstation application, causing a display of the second screen device to update based on the update data.

Abstract: A Headend system including a encoder to encode input data yielding a plurality of data packets, each of the packets having a header and a payload, a post encoding processor to identify ones of the data packets having a payload with a suspected known plaintext, and modify at least some of the identified packets, and an encryption processor to encrypt at least some of the data packets yielding encrypted data packets. Related apparatus and methods are also described.

Abstract: The embodiments relate to tamper protection of a field device. The method includes: checking whether manipulation of the field device has taken place; outputting a non-manipulation certificate in case a negative inspection result is determined; transferring the non-manipulation certificate; a registration device checking the non-manipulation certificate; determining an active status of the field device in case the non-manipulation certificate is valid; checking the field device by querying the status of the field device; transferring field device data to the monitoring device; and accepting the field device data if the field device has an active status. The invention further relates to a monitoring system for a field device and a use.