Abstract: Methods are provided for authenticating user authentication data, associated with a user ID, at an authentication system. The authentication system comprises an authentication server connected to a network, and a secure cryptoprocessor operatively coupled to the authentication server. A first token for the user ID is provided in data storage operatively coupled to the authentication server. The first token is produced by the secure cryptoprocessor by encoding the user authentication data associated with the user ID via an encoding process dependent on a secret key of the secure cryptoprocessor. The authentication server receives an authentication request for the user ID from a remote computer via the network. The authentication request comprises a ciphertext encrypting user authentication data under a public key of a first public-private key pair, the private key of which is secret to the secure cryptoprocessor.

Abstract: A system and method for domain control validation is presented. At a certificate authority a request is received. The request includes a certificate signing request and a first Internet protocol address. The certificate signing request identifies a domain and a certificate. A second Internet protocol address for the domain is retrieved from a domain name system. When the first Internet protocol address is the same as the second Internet protocol address, the certificate is signed, and the signed certificate is transmitted to a requester of the request. When the first Internet protocol address is not the same as the second Internet protocol address, the certificate signing request is rejected.

Abstract: In a computer-implemented authentication method, a first authentication request from a first machine is received at an authentication server. The first authentication request includes an identification of a second machine that is to provide a requested service. An authentication token including client-specific and server-specific portions is generated at the authentication server, responsive to receiving the first authentication request from the first machine. An authentication identifier and the server-specific portion of the authentication token are transmitted from the authentication server to the second machine, responsive to receiving the first authentication request from the first machine. A second authentication request, including the authentication identifier and both the server-specific and the client-specific portions of the authentication token, is received at the authentication server from the second machine.

Abstract: Authenticating users comprises a computing device that receives a manual authentication input of a user and initiates a first user session between the user and the user computing device. The device communicates a request for a first user authorization data from an authentication technology associated with the one or more computing devices and receives the first user authentication data. The user or the device terminates the first user session and subsequently receives an input of the user to initiate a second user session. The device communicates a request for second user authentication data from the authentication technology and compares the first user authentication data and the second user authentication data. The device identifies a match of one or more features of the first user authentication data and one or more features of the second user authentication data and authorizes the user to conduct the second user session.

Abstract: Authenticating users comprises a computing device that receives a manual authentication input of a user and initiates a first user session between the user and the user computing device. The device communicates a request for a first user authorization data from an authentication technology associated with the one or more computing devices and receives the first user authentication data. The user or the device terminates the first user session and subsequently receives an input of the user to initiate a second user session. The device communicates a request for second user authentication data from the authentication technology and compares the first user authentication data and the second user authentication data. The device identifies a match of one or more features of the first user authentication data and one or more features of the second user authentication data and authorizes the user to conduct the second user session.

Abstract: A method and apparatus for weighted leveling license unit based digital content access control are disclosed. Weighted leveling license unit based digital content access control may include enabling access to a first digital content object by a first user device associated with a first unique user identifier, receiving a request for access to a second digital content object, wherein the request indicates the first unique user identifier, identifying a weighted leveling licensing weight, and, on a condition that a product of the weighted leveling licensing weight and a sum of an assigned unit count for the first digital content object and an assigned unit count for the second digital content object is within a cardinality of a plurality of available license units, enabling access to the second digital content object by the first user device.

Abstract: An approach for authenticating a device is provided. The approach includes a computer implemented method for receiving a first stage biometric variable verification data for accessing the device. The approach further includes a computer-implemented method for computing a second stage binary authentication data for accessing the device. The approach further includes analyzing the received first stage biometric variable verification data and the second stage binary authentication data. The approach further includes receiving the second binary authentication data for accessing the device.

Abstract: A method and arrangement is disclosed for managing session keys for secure communication between a first and at least a second user device in a communications network. The method is characterized being independent of what type of credential each user device implements for security operations. A first user receives from a first key management server keying information and a voucher and generates a first session key. The voucher is forwarded to at least a responding user device that, with support from a second key management server communicating with the first key management server, resolves the voucher and determines a second session keys. First and second session keys are, thereafter, used for secure communication. In one embodiment the communication traverses an intermediary whereby first and second session keys protect communication with respective leg to intermediary.

Abstract: In embodiments of load balanced and prioritized data connections, a first connection is established to communicate first data from a first server to a second server over a public network, where the first data is communicated from a private network to a first device or subnet that is connected to the second server. A second connection is established to communicate second data from the first server to the second server over the public network, where the second data is communicated from the private network to a second device or subnet that is connected to the second server. The second server can distinguish the first data from the second data according to an authentication certificate field that identifies one of a first communication interface of the first connection or a second communication interface of the second connection.

Abstract: Disclosed are various embodiments for providing a native authentication experience with failover. If a particular authentication approach is supported by a network service, an application authenticates with the network service according to the authentication approach using an authentication factor received via a platform-specific interface. If the particular authentication approach is not supported, code-based linking may be employed to authenticate via another application that is authenticated with the network service.

Abstract: A cloud-based method, a behavioral analysis system, and a cloud-based security system can include a plurality of nodes communicatively coupled to one or more users, wherein the plurality of nodes each perform inline monitoring for one of the one or more users for security comprising malware detection and preclusion; and a behavioral analysis system communicatively coupled to the plurality of nodes, wherein the behavioral analysis system performs offline analysis for any suspicious content from the one or more users which is flagged by the plurality of nodes; wherein the plurality of nodes each comprise a set of known malware signatures for the inline monitoring that is periodically updated by the behavioral analysis system based on the offline analysis for the suspicious content.

Abstract: A method, system and computer program product for ensuring PKI key pairs are operatively installed within a secure domain of a security token prior to generating a digital certificate. The public key component of the PKI key pair is incorporated into a digital certificate which is returned to the security token for storage. The arrangement included herein incorporates the use of a critical security parameter to ensure a chain of trust with an issuing entity such as a registration authority. Furthermore, the arrangement does not require security officer or system administrator oversight during digital certificate generation as the critical security parameter provides a sufficient level of trust to ensure that digital certificate generation is being performed in conjunction with a designated security token rather than a rogue application. Lastly, separate inventive embodiments allow alternate communications and verification arrangements to be implemented.

Abstract: A user workstation stores a vendor identifier and encrypted data comprising a first string of randomized data, a second string of randomized data, and encrypted text, the encrypted text further comprising a first security answer. The user workstation receives credentials information and a second security answer. The user workstation then generates an encryption key. Further, the user workstation uses the encryption key to decrypt the encrypted text and extract the first security answer. Then, the user workstation compares the second security answer with the first security answer and authenticates the second username if the second security answer is the same as the first security answer.

Abstract: A biometric recognition system for providing security for an electronic device includes a digital camera for providing a biometric image from a user of the electronic device and a touch screen for entering a user selected screen gesture. A processor is configured for use with the electronic device for comparing the biometric image to biometric image data and the user selected screen gesture with a screen gesture stored in a database. The digital camera can be enabled by providing a definitive movement of the electronic device by the user in a unique motion so to provide secure access to the electronic device when either the biometric image data or screen gesture are authenticated.

Abstract: Carrier-side security services for fielded devices is disclosed. In contrast to conventional authentication systems for fielded devices, wherein an end-to-end communications pathway is typically established for authentication of a fielded device by a back-end service provider, authentication and security services can be moved into devices associated with a carrier network. A device associated with the carrier network can authenticate field components to service components without first establishing a communications pathway to a back-end service provider. Further, the device can provide for secured communications with an authenticated field component and are not readable by carrier devices. In an aspect, this can allow for centralization of security elements from the periphery of back-end service providers into a device associated with the carrier network. In a further aspect, the device can host a security services platform for back-end service providers.

Abstract: A system and method for configuring authentication of a mobile communications device entail detecting user context and device context factors and determining whether a current authentication mode is impractical or unfeasible in view of such factors. User context information of interest includes any indication that the user is driving or in a meeting for example. Context factors of interest include for example such factors as light, noise, or user activities such as driving. Based on this user context and device context, if the currently set authentication mode is impractical or unfeasible, then the device may select an available alternative authentication mode and reconfigure the device for that mode.

Abstract: An information processing method for a server apparatus controlling access based on a role of a user and a scope as authority held by an authorization token for realizing a unified license management structure that does not reduce an overall performance of a cloud service even if a plurality of services collaborate with the cloud service.

Abstract: A method for obtaining peripheral information method is disclosed herein and includes steps of: receiving a request for obtaining peripheral information, and the request for obtaining peripheral information includes a connection request for access to a third-party website; obtaining the current location information of a mobile terminal according to the connection request; obtaining a link of the third-party website; obtaining the current location information of a mobile terminal according to the connection request; obtaining a link of the third-party website according to domain name information of the third-party website and the current location information of the mobile terminal; making the mobile terminal jump to a page of the third-party website, so as to obtain peripheral information based on the current location of the mobile terminal and the information is provided by the third-party website.

Abstract: Disclosed are a method and apparatus for a data storage library comprising a first and second drive, a first and second mobile medium, a first and second partition wherein the first partition comprises the first drive and the first mobile medium and the second partition comprises the second drive and the second mobile medium, and a combination bridge controller device. The combination bridge controller device is configurable to control first communication traffic between at least a first client and the first partition wherein the first communication traffic can comprise a first data package. The combination bridge controller device is further configurable to optionally encrypt the first data package for storage on the first mobile medium when the first mobile medium is in cooperation with the first drive.

Abstract: A method and system for confidentially providing a software component which is encrypted using a secret cryptographic key of a software component manufacturer, and the key is then encrypted using a first cryptographic system key, wherein the encrypted software component and the encrypted key are transported by the software component manufacturer to a destination system device. After decrypting the transported encrypted key using a second cryptographic system key, the transported encrypted software component is decrypted using the decrypted key, wherein the decrypted software component is provided for execution on the destination system device. The method can be used to protect source codes or object codes of a developed software component from access by a third party and still allows for processing using standard tools.