Abstract: A method including receiving, by a server computer, a request message from a token requestor computer on behalf of a user device. The request message comprising a first current token tracking value and a first function index value. The server computer can determine a second function index value. The server computer can then compare the first function index value to the second function index value. If the first function index value and the second function index value match, the server computer can determine a function based on the first function index value and a stored function table associated with the user device. The server computer can then determine a second current token tracking value based on the function, then compare the first current token tracking value to the second current token tracking value. The server computer can generate a response message in response to the comparing.

Abstract: A biometric authentication system may include a centralized database including stored biometric signature information for authenticating a user of one or more external systems. The biometric authentication system may extract data attributes from a biometric signature of the user and compare them to the stored biometric signature information in the database. The biometric authentication system may identify user identifier information associated with a signature key stored of the stored biometric signature information that matches the data attributes to authenticate the user to access secure information.

Abstract: Systems, apparatuses, methods, and computer program products are disclosed for post-quantum cryptography (PQC). An example method includes receiving data, a set of data attributes about the data, and a risk profile data structure indicative of a vulnerability of the data in a PQC data environment. The example method further includes retrieving PQC cryptographic performance information associated with a set of PQC cryptographic techniques. The PQC cryptographic performance information may comprise a set of PQC cryptographic performance attributes for each PQC cryptographic technique in the set of PQC cryptographic techniques. The example method further includes generating a set of PQC encryption attributes for encrypting the data based on the set of data attributes, the risk profile data structure, and the PQC cryptographic performance information. Subsequently, the example method includes encrypting the data based on the set of PQC encryption attributes.

Abstract: Systems and methods for authenticating users in three-dimensional environments are described. In some embodiments, a virtual object and three-dimensional environment are transmitted. Virtual motion data of the virtual object is received. The received virtual motion data is compared against a pattern. Based on the comparison of the patterns, a device is authorized to access a resource. In some embodiments, a pattern may be extracted from the received virtual motion data.

Abstract: In certain embodiments, resource allocation related to records may be facilitated by generating and using modified instances of such records. In some embodiments, a set of records associated with a user may be stored in a memory area, where each such record includes a record identifier. In response to obtaining one or more commands related to a resource transfer from a user device associated with the user, a new set of records associated with the user may be generated such that each record of the new set is (i) a modified instance of a corresponding record of the record set and (ii) includes a record identifier different from the record identifier of the corresponding record. In one use case, the new records and its data may then be utilized to perform operations related to the user commands. In another use case, the new records may replace its older corresponding records.

Abstract: Row-level security (RLS) may provide fine-grained access control based on flexible, user-defined access policies to databases, tables, objects, and other data structures. A RLS policy may be an entity or object that defines rules for row access. A RLS policy may be decoupled or independent from any specific table. This allows more robust and flexible control. A RLS policy may then be attached to one or more tables. The RLS policy may include a Boolean-valued expression.

Abstract: A networked infrastructure is described that includes a set of programmed computing nodes, each node being configured with a processor and non-transitory computer readable media including computer-executable instructions that, when executed by the processor, facilitate a social security number registry server carrying out a method that provides an individual with the ability to remotely approve or disapprove, in real-time, the use of his/her social security number (SSN) by a relying party server.

Abstract: A method for symmetric authentication is provided. This method includes generating a first challenge message containing a first string; encrypting the first challenge message; transmitting the encrypted first challenge message to a second device; receiving a first answer message from the second device; decrypting the first answer message; and authenticating the second device based on determining the decrypted first answer message contains the first string. Upon successful authentication of the second device, the method further includes receiving an encrypted second challenge message from the second device; decrypting the encrypted second challenge message; generating a second answer message containing a second string; encrypting the second answer message; and transmitting the encrypted second answer message to the second device.

Abstract: A honeypot file is cryptographically secured with a cryptographic key. The key, or related key material, is then placed on a central keystore and the file is placed on a data store within the enterprise network. Unauthorized access to the honeypot file can then be detecting by monitoring use of the associated key material, which usefully facilitates detection of file access at any time when, and from any location where, cryptographic access to the file is initiated.

Abstract: A method and system for detecting illegitimate messages injected into legitimate messages of a bus, such as a Controller Area Network (CAN) bus, are provided. Legitimate messages are broadcasted over the bus with a period whereby the legitimate messages are periodic legitimate messages. A controller connected to the bus receives at a first time instant a first message from the bus and receives at a second time instant a second message from the bus. The controller compares a first difference in time between the second time instant and the first time instant with a limit. The limit is two-thirds of the period. An anomaly is detected when the first difference in time is less than the limit.

Abstract: Aspects of the disclosure relate to simplified and expedited processing of access requests to network resources. Authorized individuals can set rules for accessing network resources. The rules can be implemented as a series of macro steps assigned to various access rights and can be consolidated in a single button or widget for a particular user group. In response to a user's one-click selection of the button or widget, all applicable access rights can be requested sequentially from appropriate services or individuals without requiring complex instructions or myriad user actions. User interfaces and API(s) are provided to enable users to request access and managers to setup access requirements and button configurations. Novel logical systems, architectures, platforms, graphical user interfaces, and methods are disclosed.

Abstract: A system and method can provide charter-based access to resources using an object model. Charters are defined by an administrator to have certain markings, each marking indicating a control (e.g., permission, credential, qualification, constraint, requirement, etc.) that regulates work under the charter. Users are also associated with markings. A user starts a session to access the system and is authenticated. The system determines charters having markings that the user has, and these charters are provided to the user to select from. Selecting a charter allows the user access to resources associated with the charter, under the controls indicated by the markings. Charters, controls, qualifications, resources, authorizations and links between them can be implemented using an object model. Markings can control session parameters (e.g.

Abstract: An industrial control system module and methods are described for self-destruction or the destruction and/or erasure of sensitive data within the industrial control system module upon an indication of an unauthorized module access event. In an implementation, a secure industrial control system module includes a circuit board including electrical circuitry; a sealed encasement that houses the circuit board, where the sealed encasement includes a housing having a first housing side and a second housing side, where the housing is configured to house the circuit board when the first housing side and the second housing side are coupled together; and a first sensor component integrated with the sealed encasement, where the first sensor component is communicably coupled to the circuit board and electrical circuitry and is configured to provide an indication of an unauthorized access event.

Abstract: Presented herein are techniques to facilitate fast roaming between a mobile network operator-public (MNO-public) wireless wide area (WWA) access network and an enterprise private WWA access network. In one example, a method is provided that may include generating, by an authentication node, authentication material for a user equipment (UE) based on the UE being connected to a public WWA access network, wherein the public WWA access network is associated with a mobile network operator, and the authentication node and the UE are associated with an enterprise entity; obtaining, by the authentication node, an indication that the UE is attempting to access a private WWA access network associated with the enterprise entity; and providing, by the authentication node, the authentication material for the UE, wherein the authentication material facilitates connection establishment between the UE and the private WWA access network.

Abstract: A data packet verification method and a device improve network security. The method includes: receiving a data packet of a terminal device, where the data packet carries a first token and a service identifier, and the service identifier is used to indicate a type of a service to which the data packet belongs; obtaining first input information based on the data packet, and generating a second token based on the first input information, where the first input information includes an identifier of the terminal device and the service identifier carried in the data packet; and sending the data packet when the first token is the same as the second token.

Abstract: Methods and systems for faster and more efficient smart card logon in a remote computing environment are described herein. Fast smart card logon may be used to reduce latency and improve security. For example, the system may reduce the number of operations (e.g., interactions) between a server used for authentication and the client device. A virtual channel may be established between the server and the client device. The server may receive, from the client device a message including answer to reset (ATR) data of a smart card associated with the client device. The server may substitute the ATR data of the smart card with proxy ATR data of a proxy smart card. The server may determine, based on the proxy ATR data, a cryptographic service provider. The server may transmit, via the cryptographic service provider, via the virtual channel, and to the client device, one or more requests for a cryptographic operation involving the smart card.

Abstract: A method for associating and authenticating a station (STA) with a coordinated access point (AP) group may include generating a pairwise master key (PMK) between the STA and a coordinator of the coordinated AP group, and maintaining an association and authentication state between the STA and the coordinated AP group based on the PMK. The method may further include generating one or more temporal keys between the STA and the coordinator based on the PMK. The method may further include distributing the PMK from the coordinator to a first member AP and a second member AP of the coordinated AP group. The method may further include generating a first temporal key between the STA and the first member AP, and generating a second temporal key between the STA and the second member AP.

Abstract: A method, non-transitory computer readable medium and apparatus for controlling access of a custom browser function are disclosed. For example, the method includes a processor that sends a request to a third party website, receives a hypertext markup language code and a browser script, renders the hypertext markup language code, detects that the browser script is trying to access a custom browser function, compares one or more parameters associated with the custom browser function to an access control list to control an access of the custom browser function, and executes the custom browser function when a match of the one or more parameters is found in the access control list.

Abstract: The present disclosure is directed to protecting data stored at a database in a manner that increases data protection minimizing performance reductions. Apparatus and methods consistent with the present disclosure may collect information from user devices from which user inputs are received when collecting data that may be used to protect database data. Methods consistent with the present disclosure may identify code paths traversed, pages of program code where actions were initiated, and functions associated with those actions. This information may be cross-referenced with a set of data, constraints, rules, or command parameters when data associated with a database query is initially associated with an “allow” action or a “deny” action. This information may also be used to evaluate whether newly generated database queries should be allowed to be sent to a database server or to identify whether a database request should be blocked.

Abstract: Systems and methods for improved security authentication are disclosed. In some embodiments, an improved system for security authentication may include a plurality of computing devices, and a server system communicatively coupled to the plurality of computing devices. The server system may be configured to receive a request for security authentication, determine an authorization providing computing device from among the plurality of computer devices based on authentication preferences stored in a database communicatively coupled to the server system, generate and transmit authentication information to the determined authorization providing computing device, receive, from an initiating computing device an authentication input, determine whether the received authentication input matches the transmitted authentication information, and complete the request for security authentication when the received authentication input matches the generated and transmitted authentication information.