Abstract: A method includes generating a chain of trust for a virtual endpoint. The virtual endpoint is associated with a layered architecture that includes layers, which include a physical layer. For each layer, a code image of a process of the layer is measured before the process is loaded to form a node of the chain of trust.

Abstract: A digital archive for storing encrypted content includes a header section and a body. The header section includes real headers, wherein at least a portion of each real headers is encrypted, and fake headers, wherein each of the fake headers is filled with cryptographically random bytes, wherein the fake headers are substantially more than the real headers. The body includes real contents, wherein at least a portion of each real content is encrypted, and fake contents in the rest of the body, wherein the fake content contains additional cryptographically random bytes, wherein the amount of the fake content is substantially greater than the amount of the real contents, wherein each of the real headers refers to a corresponding real content in the body and contains decryption information for the corresponding real content.

Abstract: A secret (e.g. a password, key, certificate) is automatically generated by a system. For example, at the time of deployment of a computing machine, a password may be generated and securely stored by the system with other secrets. The password may be used by the system to perform various operations (e.g. configuring the machine, . . . ). When a secret is requested by a user to access a resource, a secret is provided to the user. Once the secret has been utilized by the user, the secret is reset and replaced with a newly generated secret. All/portion of the secrets may also be automatically regenerated. For example, when a breach occurs and/or is suspected, each of the secrets may be replaced with newly generated secrets and securely stored. Auditing and reporting may also be provided (e.g. each request/access to a secret is logged).

Abstract: A light-weight resilient mechanism is used to synchronize server secure keying data with member devices in a highly-scalable distributed group virtual private network (VPN). A server device generates an initial secure keying data set, for the VPN, that includes a first version identifier, and sends, to member devices and via point-to-point messages, the secure keying data set. The server device sends, to the member devices, heartbeat push messages including the first version identifier. The server device generates an updated secure keying data set with a second version identifier and sends, to the member devices, a key push message that includes the updated data set. The server device sends, to the member devices, heartbeat push messages including the second version identifier. Member devices may use the first and second version identifiers to confirm that secure keying data sets are current and quickly identify if updates are missed.

Abstract: A method includes receiving a plurality of trusted assets, generating a first signature set for a known software application, and generating a second signature set for a subject software application. Each trusted asset is associated with at least a threshold number of trusted authors. Each signature in the first signature set corresponds to a known asset that is associated with the known software application. Each signature in the second signature set corresponds to a subject asset that is associated with the subject software application. The method further includes generating first and second filtered signature set based on the first and second signature sets, respectively, by excluding signatures corresponding to the trusted assets. The method also includes generating a similarity rating for the subject application based on a comparison of the first filtered signature set and the second filtered signature set.

Abstract: Provided is an off-line two-factor user authentication system. The off-line two-factor user authentication system is designed to use, as a password, a one-time-password derivation rule to be applied to certain pattern elements included in a presentation pattern at specific positions so as to create a one-time password, and further use, as a second authentication factor, information identifying a client to be used by a user. A plurality of pattern seed values each adapted to uniquely specify a presentation pattern in combination with a client ID, and a plurality of verification codes corresponding to respective ones of the pattern seed values, are stored in an off-line two-factor authentication client. A presentation pattern is created based on a selected one of the pattern seed values and a client ID, and an entered one-time password is verified based on a verification code corresponding to the selected pattern seed value.

Abstract: A secure wireless communication link (pairing) between two devices can be established using cleartext wireless transmissions between devices not joined to a network (“probes”). One device can broadcast a first probe indicating that it is seeking to establish a pairing. The other device can respond with a second probe, and the two devices can establish a shared secret, e.g., by exchanging further information using additional probes. Thereafter, either device can send a message to the other by encrypting the message using a cryptographic key derived from the shared secret; encrypted messages can also be sent within probes. The receiving device can extract an encrypted message from a probe and decrypt it using the cryptographic key. The encrypted message can include credentials usable by the receiving device to join a wireless network.

Abstract: In various example embodiments, a system and method for providing policy-based authentication is provided. In example embodiments, a request to access and sign a document is received from a device of an intended signer. A policy assigned to the intended signer is determined. Based on the policy, a determination is made whether an authentication mechanism is applicable to the intended signer. In response to the determining that the authentication mechanism is applicable to the intended signer, the intended user is required to perform the authentication mechanism. The intended user is provided access to view and sign the document based on the intended user satisfying the authentication mechanism.

Abstract: Provided is a method of controlling a security level of a device. The method includes: requesting a server to authenticate a device, wherein the requesting is performed by a second application installed in the device; generating a device-server session for communication between the server and the device, based on the authentication of the device by the server; requesting access to the server by using the generated device-server session, wherein the requesting is performed by a first application installed in the device; and receiving content from the server due to the first application accessing the server.

Abstract: Novel methods, components, and systems for detecting malicious software in a proactive manner are presented. More specifically, we describe methods, components, and systems that leverage machine learning techniques to detect malicious software. The disclosed invention provides a significant improvement with regard to detection capabilities compared to previous approaches.

Abstract: A method and apparatus for secure information input and output is described. The method may include initiating a secure data input mode at a user input device coupled with a computing system, wherein the computing system has a processor for executing an operating system, and the user input device is a peripheral input device for receiving input into the computing system. The method may also include receiving user inputted data at the user input device. The method may also include encrypting the user inputted data within the physical bounds of the user input device prior to transmission of the user inputted data from the user input device to the computing system. The method may also include transmitting the encrypted user inputted data to the computing system for routing to a trusted application, the encrypted user inputted data to remain hidden from an operating system of the computing system.

Abstract: Technologies are described herein for anti-malware support within firmware. Through the utilization of the technologies and concepts presented herein, malicious software protection may be extended down to the firmware level. Detecting malicious firmware or software, removing it from firmware, and actively preventing it from exploiting known security vulnerabilities may be supported. Application level anti-malware software may interface with, and be supported by, one or more firmware level anti-malware modules. Firmware level anti-malware modules can actively prevent malicious software from affecting the system firmware. For example, the anti-malware modules may monitor or block access to the firmware. Anti-malware modules may be available at both boot-time and run-time. Thus, a wider range of malicious software attacks or infiltrations may be mitigated.

Abstract: A user authentication apparatus, a user authentication method, and a computer readable recording medium are provided. The user authentication apparatus includes: an information collection unit which collects authentication information on a plurality of portable devices of a user through a communication network; and a control unit which identifies whether each of the plurality of portable devices is registered for the user or not based on the collected authentication information, determines whether an amount of information collected from the plurality of portable devices that are identified is greater than a threshold value, and authenticates the user.

Abstract: An embodiment of the invention includes a processing system to provide protected digital content, the processing system comprising a processor and control logic which, when used by the processor, results in the processing system performing operations comprising determining first and second receivers, which are coupled to the processing system, are within a predetermined acceptable proximity to the processing system. The processing system is upstream to the first receiver and the first receiver is upstream to the second receiver. Other embodiments are provided herein.

Abstract: The present application relates to a technique applied to a system for performing authentication of a user by a one-to-one verification method by using an ID and biometric information of the user. When the user registers the ID and reference biometric information in a service providing system, the information is transmitted from the relevant service providing system to a management server. Then, in the management server, ID management by the reference biometric information is performed, and when the user inputs a wrong ID at the time of verification before the relevant service providing system starts to provide a service, a correct ID of the relevant user is found.

Abstract: A watermarking process is contemplated to facilitate branding and other message communication operations, such as to facilitate notifying a user associated with a home service provider of a watermark or communicating advertisements and/or personal messages to the user while accessing services through a visited service provider. The contemplated watermarking process may be particularly beneficial with devices having capabilities to roam between multiple service providers.

Abstract: A method and apparatus for automatic user authentication are described. The method includes receiving information at a device, the device including a credential container; storing the information at the credential container and performing cryptographic calculations on the received information and providing the encrypted information upon request.

Abstract: A system and method for controlling access to a secure resource in a device are disclosed. In some embodiments, the device may include a processor capable of receiving a first request from a first application of a plurality of applications executable by the processor, where the first request requests access to the secure resource, and the first request identifies the plurality of applications. In response to the first request, the processor is capable of generating a ticket associated with the secure resource and with each of the plurality of applications, and then storing the ticket in a memory. After receiving a second request from a second application requesting access to the secure resource, the processor is capable of granting the second application access to the secure resource, if the ticket associated with the secure resource exists and if the ticket is associated with the second application.

Abstract: There is disclosed a technique for use in assessing the risk of information leakage. The technique receives a set of facts that have references to individuals associated with an organization. Based on the received facts, a link is detected between an individual associated with the organization and an occurrence indicative of risk. A connection is identified between the individual and confidential information within the organization. Based on the detected link and the identified connection, the risk is determined of the confidential information being leaked in an unauthorized manner by the individual.

Abstract: An approach is provided for interdicting malicious file propagation. Packets of a message being transferred to a destination device are received. In response to packet(s) of the message being received, the packet(s) are scanned by determining whether the packet(s) match a corresponding portion of a malicious file. If any of the scanned packet(s) do not match the corresponding portion of the malicious file, a transfer of subsequent packet(s) of the message to the destination device is permitted without performing a scan of the subsequent packet(s). If the scanned packet(s) including a last one or more packets of the message match corresponding portions of the malicious file, a transfer of the scanned packet(s) to the destination device is permitted, except a transfer of the last one or more packets of the message to the destination device is not permitted.