Abstract: A decentralized and distributed secure home subscriber server is provided. First data can be sent representing a first nonce string to a mobile device; and in response to receiving second data representing the first nonce string and a second nonce string, a communication channel can be established with the mobile device as a function of the first nonce string.

Abstract: A cryptographic system (10) performs a cryptographic process using a basis. B and a basis B*. An encryption device (200) generates a ciphertext including a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj of a polynomial having xi as roots and a second vector consisting of v1i being a power of v1. A decryption device (300) decrypts the ciphertext generated by the encryption device (200) with a decryption key including a reception-side vector being a vector in the basis B* and being generated using the other vector of the first vector and the second vector.

Abstract: Techniques for automated insider threat prevention are disclosed. In some embodiments, a system, process, and/or computer program product for automated insider threat prevention includes monitoring network communications at a network device; detecting an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user; and performing an action in response to the detected anomalous activity based on a policy.

Abstract: The present invention provides a method and system for verifying integrity of cloud data using unconnected trusted device. The method involves requesting encrypted data though a terminal from a metadata offsite location on a cloud storage then entering encrypted data into an unconnected trusted device thereafter obtaining sentinel data from one or more predefined sentinel locations in encrypted data then requesting original data from the cloud storage through the terminal from the unconnected trusted device thereafter comparing sentinel data and original data for integrity and finally displaying the results.

Abstract: Systems and methods for fraud containment are provided in accordance with an embodiment of the invention. A fraud event may be detected. One or more devices that may be used in perpetrating the fraud event may be detected. Additionally one or more potential fraud victims, who may be grouped into victim circles may be detected. The threat level to the victims and/or victim circles may be assessed. In some instances, behavioral profiles may be utilized to make fraud assessments. Based on the threat level, recommendations for fraud containment responses may be provided.

Abstract: Accessing a security enabled application may require certain access privileges that are not readily available or associated with the application at the time a user is seeking access via a login operation. In operation, an access attempt to a security enabled application may include identifying user credentials associated with the access attempt, generating a query based on the user credentials to identify whether the user credentials are associated with a predetermined group membership. A response to the query may be received that includes group information corresponding to the user and the group information may be compared to a set of predetermined rules to determine whether the group information includes privilege rules used to grant access to the access attempt.

Abstract: Apparatus, systems, and methods are provided for substantially continuous biometric identification (CBID) of an individual using eye signals in real time. The apparatus is included within a wearable computing device with identification of the device wearer based on iris recognition within one or more cameras directed at one or both eyes, and/or other physiological, anatomical and/or behavioral measures. Verification of device user identity can be used to enable or disable the display of secure information. Identity verification can also be included within information that is transmitted from the device in order to determine appropriate security measures by remote processing units. The apparatus may be incorporated within wearable computing that performs other functions including vision correction, head-mounted display, viewing the surrounding environment using scene camera(s), recording audio data via a microphone, and/or other sensing equipment.

Abstract: A process capable of automatically establishing a secure overlay network (“SON”) across different clouds is disclosed. The process, in one aspect, receives a first request from a first node in a first cloud for establishing a SON. After receiving a second request for connecting to the SON from a second node in a second cloud, a first connection is established connecting between the first node and the second node utilizing a network security protocol such as Internet Protocol Security (“IPSec”). After receiving a third request for connecting to the SON from a third node in a third cloud, a second connection is used to connect between the first node and the third node. A third connection is used to connect between the second node and the third node. Each subsequent request for connecting to the SON from a new node results in new connections between the new node and each existing node in the SON forming a full-mesh.

Abstract: A memory circuit using resistive random access memory (ReRAM) arrays in a secure element. The ReRAM arrays can be configured as content addressable memories (CAMs) or random access memories (RAMs) on the same die, with the control circuitry for performing comparisons of reference patterns and input patterns located outside of the ReRAM arrays. By having ReRAM arrays configured as CAMs and RAMs on the same die, certain reference patterns can be stored in CAMs and others in RAMs depending on security needs. For additional security, a heater can be used to erase reference patterns in the ReRAM arrays when desired.

Abstract: A method for obfuscating an electronic password can include receiving at least a first symbol of a first password, wherein the first password has a plurality of symbols. Next, a second password (the obfuscated password) can be generated, the second password being derived from the first password using an obfuscation rule, wherein the second password includes the symbols of the first password and at least one obfuscating symbol generated from a first symbol of the first password (generating symbol) and the obfuscation rule. It can then be determined whether to provide a feedback indicator. A feedback indicator can be provided, in response to determining to provide the feedback indicator, wherein the feedback indicator corresponds with an instruction to enter an obfuscating symbol according to the obfuscating rule, the obfuscating symbol being from the second password. Finally, access can be granted to a session in response to receiving the second password.

Abstract: An electronic device having a lockscreen and a method implementing said lockscreen are disclosed herein, the electronic device including a display, a memory, and one or more processors configured to execute the method, the method including displaying a lockscreen pattern on the display including movable points repositionable in response to a drag input, and fixed points that are stationary, detecting drag inputs moving the movable points within the lockscreen pattern, and unlocking the electronic device if the detected drag inputs moving the movable points matches a pre-specified unlock condition stored in the memory.

Abstract: A computer-implemented method performed in a system comprising a first endpoint, the first endpoint comprising at least one central processing unit, a memory, a storage system and a network interface unit, the system being accessible by a user, the method involving: generating a message at the first endpoint for sending to a second endpoint, the message incorporating a message body and a message metadata, the message metadata comprising a secure channel invitation for the second endpoint to securely communicate with the first endpoint, the secure channel invitation being hidden within the message metadata; communicating the message from the first endpoint to the second endpoint; receiving a response message, at a first endpoint, from the second endpoint; and establishing the secure communication channel between the first endpoint and the second endpoint based on the received response message.

Abstract: Methods and apparatus for authenticating a user equipment device (UE) requesting services through a session border controller (SBC) are described. In some embodiments the SBC stores the challenge and response for a successfully authenticated UE and uses this information to authenticate the UE when the UE seeks access to a service, e.g., establishing a new TCP connection. In some other embodiments, in response to receiving an Invite request from a UE requesting service the SBC generates and sends a Registration request to an authentication entity on behalf of the UE to trigger an authentication process. If the UE is authenticated the SBC allows service access, e.g., allows a call to proceed, otherwise denies service to the UE.

Abstract: The disclosed embodiments provide a system that processes data. During operation, the system uses a first key to protect a write operation on the data. Next, the system uses a second key to protect a read operation on the data.

Abstract: A method for managing unlinkable database user identifiers includes distributing to a first database a first encrypted user identifier, a first database identifier, and a first database user identifier; distributing to a second database a second encrypted user identifier, a second database identifier, and a second database user identifier; receiving from the first database a third encryption and a fourth encryption, the third encryption being formed from the first encrypted user identifier, the second database identifier, and a message comprised in the fourth encryption; decrypting the third encryption thereby obtaining a decrypted value; deriving a blinded user identifier from the decrypted value; and sending the encrypted blinded user identifier and the fourth encrypted value to the second server thereby enabling the second server to compute the second database user identifier from the encrypted blinded database user identifier and the decrypted fourth encrypted value.

Abstract: The present disclosure introduces a method, a client, a server and a system of login verification. When a user logins, the client obtains a login request from the user for logging into an under-protected account system, where the login request includes at least an account to be logged in, determines property information of a current related account system corresponding to the account to be logged in from property information stored in a current login host, generates login verification information including at least the property information of the current related account system, and sends the login verification information to a server. The server verifies a login activity of the user based on the pre-stored reliable property information corresponding to the account to be logged in. Thus, the login verification process is simplified and the efficiency of login verification using the server is enhanced.

Abstract: Embodiments described herein may be directed to systems, methods, apparatuses, devices, computer program products, computer-executable instructions, and/or applications for securely and anonymously accessing web resources and customizable attribution of identity. In accordance with the present disclosure, a user may inspect and analyze a webpage as well as the underlying source code from an “arm's length” using a secure analysis application to prevent exposure on the user's local machine. The secure analysis application may provide increased flexibility in masking and/or modifying the user's digital persona to external websites. Additionally, the secure analysis application may be integrated with a translation service to translate textual web content without the web content provider being alerted that a translation is taking place.

Abstract: An apparatus, system, and method are disclosed for secure data transmissions. In one embodiment, a method includes receiving a request for data from a remote client, the request including a public Internet protocol address of the remote client, the request encrypted according to an initial encryption scheme, encrypting the requested data according to a different encryption scheme, and transferring the data to the remote client.

Abstract: A computer-implemented method for providing secure access to local network devices may include (1) identifying a local area network that provides Internet connectivity to at least one device within the local area network, (2) obtaining, from an identity assertion provider, (i) a shared secret for authenticating the identity of a guest user of the device and (ii) a permission for the guest user to access the device from outside the local area network, (3) storing the shared secret and the permission within the local area network, (4) receiving, via the Internet connectivity, a request by the guest user from outside the local area network to access the device, and (5) providing access to the device in response to validating the request based on the shared secret and the permission. Various other methods and systems are also disclosed.

Abstract: Methods and systems for behavioral profiling, and in particular, utilizing crowd-managed data architectures to store and manage that profile, are described. In some embodiments, a method includes observing behavioral characteristics of user interactions during a current session with the user through one of a plurality of channels. Variations between the behavioral characteristics of the user interactions observed during the current session and a behavioral profile previously developed based on prior usage patterns of the user through the plurality of channels are identified, in real-time or near real-time.