Abstract: A system and method for securing documents attached to emails is disclosed. The system and method apply security rules to an email as it is being composed to ensure that the security policies have been expressed prior to the email being sent. The security program hooks in to the message object model so that as the message is modified, the security rules are applied to each modification.

Abstract: Secured debug of an integrated circuit having a test operation mode and a secure mission operation mode. The integrated circuit has a processing unit, a test interface through which the test operation mode is controllable, an on-chip memory which is accessible in the test operation mode and in the secure mission operation mode, and one or more protected resources inaccessible in the test operation mode. The processing unit is configured, in the test operation mode, to receive an authenticated object through the test interface, and store the received authenticated object in the on-chip memory. The processing unit is moreover configured, upon reset into the secure mission operation mode, to execute a boot procedure to determine that the authenticated object is available in the on-chip memory, authenticate the authenticated object, and—upon successful authentication—render the more protected resources accessible to a debug host external to the integrated circuit.

Abstract: Securely authenticating a user of a device for a service during a session including a transaction between a client and a connected server connected to a Behaviometric-server.

Abstract: An authenticating computing device for authenticating a user of a user computing device as a human being. The authenticating computing device comprises a processor configured to receive a request to authenticate a user as human and an identifier associated with at least one of the user and the user computing device. The processor is further configured to retrieve transaction data associated with a payment card account of the user based on the identifier, generate a challenge question based on the transaction data, and generate a plurality of images based on the transaction data. At least one of the plurality of images is a correct image and at least one of the plurality of images is an incorrect image. The processor is further configured to transmit the challenge question and the plurality of images for display on the user computing device.

Abstract: Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user's premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported.

Abstract: Systems and methods are disclosed for authenticating an identity of an online user. One method includes receiving from the user, through a first device, a request to access a web page associated with the user's online account; transmitting to the user an image that contains a unique ID and a URL of an authentication server; and receiving from the user, through the first device, an authentication request containing the unique ID. The method also includes receiving from the user, through a second device, a log-in ID associated with the user and the unique ID; and authenticating the identity of the user to grant the user access, through the first device, to the web page associated with the user's online account.

Abstract: The disclosed computer-implemented method may include (1) detecting an online communication session established between a plurality of computing devices, (2) identifying at least one application involved in the online communication session established between the plurality of computing devices, (3) determining a security mode for a security proxy that inspects the online communication session based at least in part on the application involved in the online communication session, and then (4) configuring the security proxy to inspect the online communication session in accordance with the determined security mode. Various other systems, methods, and apparatuses are also disclosed.

Abstract: Various systems and methods are provided that retrieve raw data from issuers, reorganize the raw data, analyze the reorganized data to determine whether the risky or malicious activity is occurring, and generate alerts to notify users of possible malicious activity. For example, the raw data is included in a plurality of tables. The system joins one or more tables to reorganize the data using several filtering techniques to reduce the processor load required to perform the join operation. Once the data is reorganized, the system executes one or more rules to analyze the reorganized data. Each rule is associated with a malicious activity. If any of the rules indicate that malicious activity is occurring, the system generates an alert for display to a user in an interactive user interface.

Abstract: A configuration scanning system is described herein that scans a system configuration database for malware-related information with less impact on other operations that access the system configuration database. The system employs techniques to reduce the impact on other operations that access the configuration database, including parsing a file-based stored version of the configuration database, accessing the configuration database using opportunistic locking, and caching configuration information obtained by scanning the configuration database. In this way, the system is able to respond to requests antimalware programs using cached information without impacting other programs using the configuration database. Thus, the configuration scanning system protects a computer system against malware while reducing the burden on the configuration database and on other programs that access the configuration database.

Abstract: The present invention provides improved techniques that can be used to verify illegitimate non-human users that are accessing content. For example, a method of verifying a non-human user of a computerized device may comprise receiving information identifying a potential non-human user of a computerized device, altering a browser page to be used by the potential non-human user, and verifying whether or not the potential non-human user is an actual non-human user based on a behavior of the potential non-human user with the altered browser page.

Abstract: Machine generated event log data which includes events occurring over a window of time is received where each event includes a first node, a second node, and a timestamp. The events are aggregated into a plurality of aggregated graph snapshots. Communities within the plurality of aggregated graph snapshots are identified and community tracking links are determined between communities in the plurality of aggregated graph snapshots. A community that has an anomalous evolution in the plurality of aggregated graph snapshots compared to the evolution of other communities is identified based at least in part on the community tracking links. The communities are displayed where the display includes the community tracking links and identifies the community that has the anomalous evolution.

Abstract: The risk of leakage of secret information caused by leakage of a secret key is reduced. A segmented secret-key storage system segments a secret key SK into segments that can be combined at the time of decryption or at the time of generation of a signature and records the secret-key segments sk1, . . . , skN in segment storage apparatuses. The secret-key segments are changed, periodically or under a predetermined condition, to another set of secret-key segments that satisfies a condition for combination. In the segmented secret-key storage system, the secret key SK is not revealed unless the secret-key segments are stolen from all the segment storage apparatuses in an interval between changes made to the secret-key segments. Accordingly, the risk of leakage can be greatly reduced in comparison with the risk of leakage of the secret key from a single apparatus.

Abstract: A device, system and method for aggregating resources, services or data across a network in which data and services from various source networks can be converted into an internal, aggregatable form (or vice versa) that can be sent to relevant properties or systems on request or through scheduling. The framework of the device, system and method permits scalability and potentially support any number of users, applications and services.

Abstract: A method and an apparatus for executing applications in a highest-priority-first order in the processor divided into a secure mode area and a non-secure mode area are provided. The method includes receiving a request to be processed in the non-secure mode domain from the application, determining an access permission level configured to a resource used for processing the request, determining, when the access permission level allows for access from the secure mode domain, a priority of the application, changing the access permission level to allow for access by the non-secure mode domain according to the priority of the application, and processing the request of the application using the resource in the non-secure mode domain.

Abstract: A method, device and machine-readable storage device for transferring data between identity modules is disclosed. Data is stored in one of a first removable storage module coupled to a donor communication device and a memory of the donor communication device, or both. A first portion of the data is provided to a server. The server provides the first portion of the data to a second removable storage module coupled to a recipient communication device responsive to a determination that a recipient communication device has a right to the data. Additional embodiments are disclosed.

Abstract: A system is provided for inside-to-outside or outside-to-inside cryptographic coding that facilitates product authentication along a distribution channel. An association of authenticated, secured codes is generated between inner items (e.g., pharmaceutical doses such as pills, capsules, tablets) and outer items (e.g., packaging containing inner items). For instance, an inner code associated with a first item is used to generate (at least partially) an outer code associated with a second item that contains one or more first items. This process may be repeated multiple times with codes for outer items being a function of codes for inner items. The sequence of items may be authenticated by the dependent relationship between their codes.

Abstract: An object of the present invention is to provide a method, a device, programs, and storage media for solving a problem that it is impossible to losslessly compress a digital image while being encrypted, to transmit the digital image, and to expand the digital image at a receiving side to restore the digital image with no artifact. An image or video is subjected to discrete convolution with an encryption key image, to be defocused beyond recognition, thus being encrypted, is further subjected to entropy-coding lossless compression, and is transmitted over the Internet. The compressed image or video is expanded at a receiving side, and iterative operations are performed on the basis of a Bayse probabilistic formula by using the separately-delivered encryption key image, to restore the image or video before encryption.

Abstract: A method and apparatus are provided for initial certification enrollment in a wireless communication system. A first mobile device establishes a first wireless connection with an infrastructure and a second wireless connection with a second mobile device. The first mobile device receives, from the second mobile device, a first certification request that includes a request for a digital certificate for the second mobile device and first biometric data associated with a user of the first mobile device. The first mobile device obtains second biometric data associated with a user of the second mobile device and conveys a second certification request to the infrastructure that includes the request for the digital certificate for the second mobile device and the first and second biometric data. The first mobile device then receives, from the infrastructure, the digital certificate for the second mobile device and forwards, to the second mobile device, the digital certificate.

Abstract: A technique for key sharing among multiple key servers connected to one another over a communication network is provided herein. Each key sever of the multiple key servers stores respective cryptographic keys, and provides the keys to a local device group connected with the key server, to enable the device group to encrypt messages with the keys. Each key server acts as a proxy for the other key servers in order to receive other keys from the other key servers over the network, and provide the other keys to the device group for use to decrypt messages received from other local device groups respectively connected with the other key servers that were encrypted with the other keys and to check message integrity. The multiple key servers may share keys with each other directly, or alternatively, indirectly through a central key server, as needed to support secure communications between their respective device groups.

Abstract: Methods and apparatus are disclosed for securely sharing user-generated content using DRM principles, and for tracking statistics of content viewing. In this way, a user can generate protected content that can still be shared among friends on, e.g., a social network.