Abstract: Automated locating and disconnection of undesired devices may include receiving a unique address of a candidate device, determining the address of the switch coupled to the candidate device based on the address of the candidate device, accessing the switch using the switch address, receiving switch information from the switch, receiving credentials from the user and commands to transform the candidate device into a disconnected state, and determining whether the user is permitted to execute the commands based on the credentials from the user. If it is determined that the user is permitted to execute the commands, the candidate device may be transformed into a disconnected state on the network and its address may be added to a blacklist. A device may be deemed to be undesired on the network due to intrusion events, violation of network policies, or other appropriate criteria.

Abstract: A request to provide mail to a mobile device is received at a proxy server associated with an email server. The proxy server generates a virtual mailbox for the mobile device based at least in part on the request. The virtual mailbox is stored in a location separate from the email server. The mobile device is provided access to the virtual mailbox. The virtual mailbox as presented on the mobile device includes attributes that are substantially similar to attributes of a mailbox associated with the email server.

Abstract: A method and system for verification of a pattern based passcode. User input of a series of key inputs to a keyboard is received from a user. A registered pattern for the user of a sequence of keyboard direction movements is retrieved, wherein the pattern based passcode is the registered pattern. A first character in a first key input of the series of key inputs is identified, wherein the first key input is the first key, of the series of key inputs, that was inputted by the user. It is determined is made that that the identified first character is not in an excluded group of characters and in response, it is verified that a pattern of directional movements from the first character to the remaining characters after the first character in the series of key inputs matches the registered pattern for the user.

Abstract: A method for providing an online reputation is disclosed. An online credential service assigns a unique client identifier to each user and a unique forum identifier to each forum that users participate. A user participating in one or more online forums registers for establishing a reputation profile at the online credential service. A unique verification code associated with each forum is generated for the user to include in the user's profile at the corresponding forum. A user's reputation is determined based on whether a verification code is included in the user's profile at the form.

Abstract: An anomaly detection system includes appliances connected to a network and circuitry configured to receive statuses of the appliances. Patterns of use are determined for the appliances including time periods in which the appliances are most likely to be used. The circuitry is also configured to determine that anomalous events have occurred when an amount of deviation from a normal baseline status for the appliances is greater than a predetermined threshold. Cyber-attack events are detected based on changes to network configuration settings of the appliances. Alerts are output to an external device based on the one or more anomalous events and/or cyber-attack events related to the appliances. The patterns of use are updated based on the status of the appliances and a response from the external device related to the anomalous events or cyber-attack events.

Abstract: A device administration apparatus includes an apparatus information obtainer that obtains via a network, apparatus information stored in a device, a judger that judges whether or not the device is an administration object based on the obtained apparatus information, and an administrator that administers use of the device, if the judger judges that the device is an administration object.

Abstract: A method for detecting memory modifications includes allocating a contiguous block of a memory of an electronic device, and loading instructions for detecting memory modifications into the contiguous block of memory. The electronic device includes a plurality of processing entities. The method also includes disabling all but one of a plurality of processing entities of the electronic device, scanning the memory of the electronic device for modifications performed by malware, and, if a memory modification is detected, repairing the memory modification. The method also includes enabling the processing entities that were disabled. The remaining processing entity executes the instructions for detecting memory modifications.

Abstract: For mitigating unauthorized content claims, an identification module ranks a plurality of content according to a value policy. The plurality of content is provided through a content host. Each content item of the plurality of content is associated with at least one authorized claimant. The identification module further identifies an unauthorized claim for a content item of the plurality of content by an unauthorized claimant. A mitigation module mitigates the unauthorized claim.

Abstract: Systems and methods to manage a network include a security blade server configured to perform a security operation on network traffic, and a controller configured to virtualize a plurality of network devices. The controller is further configured to program the network traffic to flow through the security blade server to create a secure network channel. A software defined environment may includes an application program interface (API) used to program the flow of the network traffic. The controller may use the API to virtually and selectively position the security blade server as waypoint for the network traffic.

Abstract: Techniques for handling ciphering keys in a mobile station comprising a mobile equipment (ME) and a Universal Subscriber Identity Module (USIM) are disclosed. An example method includes obtaining a UMTS cipher key (CK), integrity key (IK), and ciphering key sequence number (CKSN) from the USIM, deriving a 128-bit ciphering key (Kc-128) from the CK and the IK, and storing the Kc-128 and the CKSN on the mobile equipment, separate from the USIM. The stored CKSN is associated with the stored Kc-128, so that the Kc-128's correspondence to the most current UMTS security context can be tracked. This example method applies to the generation and storage of a 128-bit ciphering key for either the packet-switched or circuit-switched domains. A corresponding user equipment apparatus is also disclosed.

Abstract: According to some embodiments, a list of files comprising each file in a data repository that is associated with the website is determined. A list of user roles comprising each user role in the data repository that is associated with the website is determined. Each file in the list of files based on each user role in the list of user roles is attempted to be accessed and a report indicating the success or failure of the attempt to access each file in the list of files based on each user role in the list of user roles is created.

Abstract: In one embodiment, a device in a network identifies a set of traffic flow records that triggered an attack detector. The device selects a subset of the traffic flow records and calculates aggregated metrics for the subset. The device provides the aggregated metrics for the subset to the attack detector to generate an attack detection determination for the subset of traffic flow records. The device identifies one or more attack traffic flows from the set of traffic flow records based on the attack detection determination for the subset of traffic flow records.

Abstract: Various embodiments are generally directed to implementing a secure mailbox in resource-constrained embedded systems. An apparatus to establish communication with a trusted execution environment includes a processor component, a co-processor component for executing the trusted execution environment, a host operating system component for execution by the processor component and including one or more application components, a mailbox array component for execution by the co-processor to store one or more mailbox components, each mailbox component being associated with a mailbox identification number, and a mailbox firewall component for execution by the co-processor component to facilitate communication between the one or more application components and the one or more mailbox components. Other embodiments are described and claimed.

Abstract: An electronic transmission system and method for converting and transmitting transmissions to provide secure communication between a plurality of users and protect or secure content of each transmission by preventing unauthorized individuals from capturing and viewing or hearing the transmitted content in its entirety. The electronic transmission system breaks a transmission apart into a random plurality of pieces and randomly transmits each piece separately to a plurality of remote servers. If an unauthorized party tries to intercept and access an electronic transmission, they will not be able to capture the entire transmission and will not be able to recompile its actual content, but rather misleading content. A password or other suitable authentication requirement(s) authenticates the intended recipient and allows the original pieces to be retrieved and re-compiled for viewing or hearing.

Abstract: In one kind of DoS attack, malicious customers may try to send a large number of filter requests against an innocent customer. In one implementation, a Filter Request Server (FRS) may allow a customer against who a filter request is made to dispute the implicit accusation of the filter request or stop sending malicious traffic. If the customer claims innocence, the FRS may log destination addresses of data packets sent by the customer and identify and ignore false filter requests if these filter requests come from customers who do not correspond to one or more of the destination addresses that have previously been logged by the FRS.

Abstract: A protected memory source device including removable non-volatile memory durably stores a signature such as a serial number or identifier, which is used to mark protected multimedia content legally stored on the protected memory device. The protected multimedia content is moved from the source device to another device, such as a target device used to aggregated protected content in a library. Moving the protected multimedia content involves replacing a source-specific header, comprising digital rights management metadata and/or other security metadata allowing only a device having the source device signature access to the content, with a target-specific header comprising digital rights management metadata and/or other security metadata allowing only a device having the target device signature access to the content. The transfer is done using one of a variety of transfer methods with either a trusted or un-trusted host system connecting the source device to the target device.

Abstract: Various techniques are described to protect secrets held by closed computing devices. In an ecosystem where devices operate and are offered a wide range of services from a service provider, the service provider may want to prevent users from sharing services between devices. In order to guarantee that services are not shared between devices, each device can be manufactured with a different set of secrets such as per device identifiers. Unscrupulous individuals may try to gain access to the secrets and transfer secrets from one device to another. In order to prevent this type of attack, each closed computing system can be manufactured to include a protected memory location that is tied to the device.

Abstract: A method implemented in a system including a copier or scanner connected to a digital rights management (DRM) server, which can prevent unauthorized copy or scan while allowing authorized users to obtain high quality hardcopies or scans. After the copier or scanner scans an input hardcopy document, the server determines whether the scanned document image matches any protected document in the DRM system. If a match is found, and the server determines that the user is permitted to copy or distribute the document, the server transmits an electronic version of the matched document from the DRM system to the copier or user-selected email recipients, so that the user or the email recipients can receive a high quality document. If a matched document is found but the user is not permitted to copy or distribute it, the copier or scanner deletes the scanned document image without printing or saving it.

Abstract: Provided are a computer program product, system, and method for using a declaration of security requirements to determine whether to permit application operations. A declaration of security requirements indicates actions the application designates to perform with respect to resources in a computer system, wherein a plurality of the indicated actions are indicated for at least two operation modes of the application. A detection is made of whether the application is requesting to perform a requested action with respect to a requested resource in the computer system. A determination is made of a current operation mode of the application comprising one of the at least two operation modes in response to detecting that the application is requesting the requested action. A determination is made as to whether the declaration of security requirements indicates the requested action with the current operation mode.

Abstract: The described embodiments relate generally to methods and systems for user authentication for a computing device. In one embodiment, the method comprises: enabling receipt of input in relation to selection of a plurality of authenticators for consecutive use by the computing device to authenticate a user; and storing reference information identifying the selected plurality of authenticators in a memory of the computing device. The computing device may comprise a mobile device.