Abstract: A resource request that is directed to a first online resource of a resource provider is detect by a computing device. A first user that initiated the resource request is identified based on the resource request. A set of challenge questions is determined in response to the resource request and based on the first user. A first challenge question of the set of challenge questions is present, to a first client device of the first user.

Abstract: A communications device for managing an authentication event is provided, which is configured to generate location data indicative of a geolocation associated with the communications device, retrieve, from a key that is obfuscated and stored in the communications device, the key, sign the location data with the retrieved key, and transmit request data to a communications server apparatus for requesting the authentication event, the request data comprising the signed location data. A method and a communications system for managing an authentication event are also provided.

Abstract: A method consistent with embodiments of the present disclosure may begin with retrieving a message to be electronically transmitted. The method may proceed with digitally securing the message by generating a first digital signature for the message. The first digital signature may be added to a list of digital signatures for inclusion in the message. A list of allowed anticipated changes may be retrieved. In accordance to embodiments disclosed herein, the message may be pre-signed for the allowed anticipated changes. Pre-signing the message may comprise editing the message with each allowed anticipated change, generating a subsequent digital signature for the message edited with the allowed anticipated change, and adding the subsequent digital signature to the list of digital signatures for inclusion in the electronic message. This process may be repeated for each allowed anticipated change in the allowed anticipated changes.

Abstract: The present disclosure describes an architecture and design of Unauthorized-Blocking-Role (UAB). UAB is a mechanism which prevents higher privileged users of cloud-hosted software from performing unauthorized activities on protected objects, such as management objects. UAB works by periodically monitoring the permissions of customer users on key management objects in an object hierarchy in management software. If a customer user is detected to have privileges higher than the user should have on those objects, UAB applies restrictive role-based access controls (RBACs) on the user. Similarly, UAB also monitors protected principals and protected roles to ensure that their privileges are not modified by a customer user.

Abstract: A messaging system includes a sending device and a recipient device communicating through a central unit, a first software module loaded and executed in the sending and recipient devices, and a second software module loaded and executed in the central unit, the first and second software modules creating, managing, and exchanging: items of a first open type that include a chat, a message, or a digital element that are always visible on a screen of a device display, and items of a second reserved type that include a chat, a message, or a digital element that switch between a visible state in which they displayed, entirely or as a preview, on a specific area of the screen, and a hidden state in which they are not displayed on the screen and also do not occupy the specific area of the screen, which they occupy instead when in the visible state.

Abstract: A device described herein may maintain a distributed ledger that is also maintained by at least one other device. The device may receive a record for recordation to the distributed ledger, and may add the record to the distributed ledger without communicating with the at least one other device to validate (e.g., cross-validate) the record. The device may receive a request for information included in the record and, after receiving the request for the information included in the record, communicate with one or more devices, of the at least one other device, to validate the record. The device may determine, based on communicating with the one or more devices, that the record is valid; and may output, in response to the request and based on determining that the record is valid, the requested information included in the record.

Abstract: A data deletion notification service registers data repositories that store personal data. The service receives requests from users to delete personal data, sends notifications of the deletion requests to the registered data repositories, and stores deletion records recording the deletions and a timestamp associated with the deletion request. The service may wait for confirmation of the deletions from the data repositories, resending the deletion requests if a confirmation is not received, and recording confirmation in an audit record. Data repositories performing a restoration may request, from the service, a list of users that have requested deletion of personal data since the time of the creation of the backup used for restoration. The service may generate, based on deletion records with corresponding timestamps, the list of users and respond to the request with the list. Confirmations of the deletions may be tracked, stored and made available via an audit interface.

Abstract: Disclosed herein are systems and method for securely providing access to data. In one exemplary aspect, a method may comprise receiving a request to access data on a computing device of a user and identifying a location of the computing device. The method may comprise determining whether access to the data is allowed in the location based on a location-based rule of a plurality of location-based rule. The method may comprise, in response to determining that access to the data is allowed in the location, detecting, via sensors of the computing device, (1) at least one other person different from the user or (2) a surveillance device in the location, and determining whether the at least one other person or the surveillance device can view the data without direct access to the computing device. If not, the method may comprise providing access to the data on the computing device.

Abstract: Using entropy to prevent inclusion of pay load data in code execution log data. Embodiments determine that a payload data item associated with code execution log data has entropy exceeding a defined entropy threshold and identify a particular executable code that interacted with the payload data item. Embodiments then take a preventative action that excludes the pay load data item from inclusion with a record of execution of the particular executable code. Examples of preventative actions include preventing the pay load data item from being exported from the computer system, preventing the pay load data item from being included in the code execution log data, and adding the payload data item to a block list in reference to the particular executable code.

Abstract: A system is described for controlling access to resources using an object model. Users can specify use cases for accessing resources. The user may be granted access if the user satisfies qualifications required for accessing the resource, selected a use case permissible for accessing the resource, and satisfies qualifications required for the use case. Use cases, qualifications, resources, and/or links between them can be implemented using an object model. The system can be used in addition to authentication and authorization.

Abstract: An embodiment of a feedback-based system and methods are disclosed for real-time mitigation of fraud and otherwise invalid traffic in a mobile ad environment. The system of three complementary facets of one embodiment comprises four major sub-systems: prevention, detection, control and reporting, which work in cohesion with one another to achieve the common goal of the system. In the embodiment, deterministic and probabilistic methods are applied across all levels of user engagement (impressions, clicks, installs, post-install events, and conversions) to detect the likely sources of invalid traffic and block them in real time. A distinctive and unifying feature of the embodiment of the system is the feedback loop that connects advanced analytics and machine learning techniques that the detection subsystem employs at all levels of user engagement to the real-time blocking mechanism of the prevention subsystem that operates at the initial levels of user engagements, such as clicks and impressions.

Abstract: Methods and systems for a processing architecture that maintains a separate logic pathway corresponding to a first operation type and a second operation type, until a blockchain operation is submitted to the blockchain network using either the first operation type or a second operation type. Following submission of the blockchain operation to the blockchain network, the architecture collapses the parallel logic pathways to a single logical pathway for both types.

Abstract: A new transactional, constraint-based system is provided to define and maintain authorization policies. Constraints are expressed as user-defined, domain-specific programs that operate on authoritative representations of entities and administrative hierarchies.

Abstract: A system includes one or more privacy vaults. At least one of the one or more privacy vaults is associated with at least one individual user, stores contents associated with the associated at least one individual user, and stores specific identification of a plurality of third-party entities, authorized to access at least a portion of the contents stored by the one or more privacy vaults, along with access permissions, one or more of the access permissions defined for each of the plurality of third-party entities. At least one of the access permissions defines accessibility of the contents for at least one of the plurality of third-party entities for which the at least one access permission is defined.

Abstract: A method includes obtaining, by an application executing on a processor of an electronic device, user data of a user, generating a representation of the user data, applying local differential privacy to the representation of the user data, to generate a transform of the representation of the user data, sending the transform of the representation of the user data, to a service provider via a network and receiving, from the service provider, via the network, service data based on the transform of the user data. The service data includes a user-specific output based on the transform of the user data. The application executes outside of a trusted execution environment (TEE) of the electronic device. The transform of the representation of the user data is generated in the TEE of the electronic device.

Abstract: A processor may identify that one or more client-side applications have been initiated. The processor may identify a browser container. The processor may securely run the one or more client-side applications in the browser container. A website server may collect data that is to be transferred to a browser and sent back from the browser, and the browser container may be associated with the browser. The processor may permit a transfer and sending of the data between the website server and the browser. The transfer and sending of the data may include session specific information that is to be cached on a client-side.

Abstract: A method of authenticating and authorizing a wireless communication device for access to a communication service. The method comprises receiving a service request from a wireless communication device by a access node, parsing the service request by the access node, based on parsing the service request, determining by the access node that the wireless communication device is seeking combined authentication and service authorization, sending the service request by the access node to a hyperledger gateway, receiving an authentication success response associated with the wireless communication device and a service authorization success response by the access node from the hyperledger gateway, and sending the service request by the access node to a communication service computer system, whereby the service request is both authenticated and authorized by the hyperledger gateway in a combined transaction and a requested communication service is provided to the wireless communication device.

Abstract: Methods, systems, and apparatuses are described herein for improving computer authentication processes by analyzing user response times to authentication questions. A request for access to an account may be received. Transaction data associated with a user of that account may be retrieved, and a list of merchants may be generated based on the transaction data. A blocklist may be retrieved, and the list of merchants may be filtered based on the blocklist. An authentication question may be presented. The authentication question may relate to the list of merchants. User responses may be received, and response times for the user responses may be measured. Based on the response times and the response times for other users, an average response time for the merchants may be determined. Based on the average response time for a particular merchant exceeding a threshold, the particular merchant may be added to the blocklist.

Abstract: According to one embodiment, a data management method performed by a computer, includes: receiving first request information for requesting to execute a first process on first data, the first data being data regarding a person; and determining whether the first process is executable, based on the first request information and consent information, the consent information including a first condition that the person consents to perform the first process.

Abstract: An approach for real time, round trip pseudonymization (a.k.a. anonymization or tokenization) of data on the fly, in real time, enabling remote secure processing of sensitive data such as by a cloud service. Sensitive data remains on premises with the client at all times. A user may thus run extensive queries that return sensitive data without noticing that such data was pseudonymized in transit.