Abstract: An embodiment may include circuitry to be included, at least in part, in a host. The host may include at least one host central processing unit (CPU) to execute, at least in part, at least one host operating system (OS). The circuitry may perform, at least in part, at least one operation in isolation both from interference from and control by the at least one host CPU and the at least one host OS. The at least one operation may include user authorization determination and user presence determination. The authorization determination may be in response, at least in part, to indication of physical presence of at least one user in proximity to the host. The user presence determination may determine, at least in part, whether, after the indication has been provided, the physical presence of the at least one user in the proximity to the host has ceased.

Abstract: A method and system for processing information. An apparatus divides target information into N pieces of divided data using a secret sharing scheme in which a predetermined number (K) of pieces of the N pieces of divided data is required to restore the target information, wherein N>K, and wherein the apparatus is an information processing device or an external storage device. The apparatus selects M pieces from the N pieces, wherein K<M<N. After selecting the M pieces, the M pieces are stored in the external storage device which limits a totality of pieces of the N pieces being stored on the external storage device to the M pieces. After storing the M pieces, the target information is restored from at least K pieces of the N pieces after which D pieces of the M pieces in the external storage device are destroyed, wherein D>M?K.

Abstract: Various embodiments are generally directed to use of a keyboard as a biometric authentication device. In one embodiment, for example, an apparatus comprises a processor circuit executing a sequence of instructions causing the processor circuit to receive a signal indicative of a keypress of at least one key of a keyboard communicatively coupled to the apparatus, and indicative of at least one physical characteristic associated with the keypress; compare the at least one physical characteristic to at least one stored physical characteristic associated with at least one authorized user of the apparatus; and determine if the keypress is associated with at least one authorized user of the apparatus based on the comparison. Other embodiments are described and claimed herein.

Abstract: An approach is provided in which a server receives a first request from a client over a command port connection. The server, in turn, sends a first phase authentication token to the client over the command port and receives a second request from the client over a management port connection. In response, the server sends a second phase authentication token to the client over the management port connection, which the server receives back from the client over the command port connection. In turn, the server authenticates the client to utilize the command port connection accordingly.

Abstract: A system and method for adaptively verifying data in resource constrain systems. The adaptive data verification mechanism employs the proper mode of verification adaptively to balance cost/performance requirements plus security requirements. The algorithm uses a belief level for the validity of a received message, and assigns the belief level to a scale between a bona fide message at one end of the scale and a malicious message at an opposite end of the scale. Depending where on the scale the belief level falls determines which validation mode will be used to authenticate the message. In an alternate embodiment, the belief level relative to a scale and the amount of data waiting to be processed in a buffer are both used to determine which mode will be used to validate the message.

Abstract: A system and method is provided for managing one or more docking applications running on a wireless device. The method displays to a user at least one docking application while the wireless device is coupled to another device. The method comprising the steps of: executing a docking application control module when the wireless device is first coupled with the other device; retrieving user preferences associated with the docking application control module; executing, based on the retrieved user preferences, at least one docking application for use on the wireless device while the wireless device remains coupled to the other device; and terminating the docking application when the wireless device ceases to be coupled to the other device.

Abstract: Digital Cameras configured to verify authenticity of digital photos taken with the digital camera and related methods and computer program products are provided. GPS information associated with a photograph taken with the digital camera is obtained. A checksum of pixels that make up the photograph and the obtained GPS information is generated. The generated checksum is encrypted using a private key associated with the digital camera so as to allow verification that the photograph has not been modified.

Abstract: The disclosed computer-implemented method for secure hybrid third-party data storage may include (1) identifying, at a trusted proxy system, an access request from a client system to access an encrypted file stored under a user account at a third-party storage system, where the requested access requires decryption of the encrypted file, (2) retrieving, from the third-party storage system, (i) the encrypted file and (ii) a decryption key that has been encrypted with a client-side key, where an asymmetric key pair designated for the user account includes an encryption key and the encrypted decryption key, (3) receiving, at the trusted proxy system, the client-side key, (4) decrypting, at the trusted proxy system, the decryption key with the client-side key, and (5) using the decryption key to access an unencrypted version of the encrypted file at the trusted proxy system. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A network adapter system and associated method are provided. The network adapter system includes a processor positioned on a network adapter coupled between a computer and a network. Such processor is configured for scanning network traffic transmitted between the computer and the network.

Abstract: A portable electronic device includes a first interface adapted for establishing a communication with a first external electronic entity. A first security element is adapted for detecting at least one type of attack and forbidding at least one data communication using the first interface after the detection of an attack. A second interface is different from the first interface and is adapted for establishing a communication with a second external electronic entity. A management element of the first security element uses the second interface for managing the first security element.

Abstract: A system and method are provided for segregating access to dynamic content on multiple websites hosted by a web server. When a request is received for dynamic content from a website, a UserRetriever module identifies a path to the content and retrieves a username and password corresponding to the website, from a database that is separate from the web server and used for other purposes (e.g., billing). A UserImpersonator module requests a logon handle for that username from a logon cache manager. The logon handle is used to associate the request with the impersonated user account instead of the default anonymous user account with which the request was initially associated. The dynamic content is retrieved and served under the context of the restricted impersonated user account session, after which the applied logon handle is stripped off and the request is re-associated with the default anonymous user account.

Abstract: Systems and methods for an implementation of block cipher algorithms (e.g., AES) use lookup tables to obscure key information, increasing difficulty of reverse engineering efforts. The implementation encodes round key information into a first plurality of tables (T1), which when used for lookup operations also complete SubBytes operations, and output state in an encoded format. A Shiftrows operation is performed arithmetically on the output state. A second plurality of tables (T2) are used to perform a polynomial multiplication portion of MixColumns operation, and an XOR portion of MixColumns is performed arithmetically on the columns. Encoding from the T1 tables is made to match a decoding built into the T2 tables. Subsets of the T1 tables use the same T2 tables, reducing a memory footprint for the T2 tables. Multiple AES keys can be embedded in different sets of T1 tables that encode for the same set of T2 tables.

Abstract: In one embodiment, the present invention includes a method to establish a secure pre-boot environment in a computer system; and perform at least one secure operation in the secure environment. In one embodiment, the secure operation may be storage of a secret in the secure pre-boot environment.

Abstract: Apparatus and methods are provided that prevent cross-site request forgery at one or more web servers. A proxy dynamically monitors web server responses to client requests for content having a selected characteristic, adds a hidden token to content identified as having the selected characteristic prior to serving the content to a requesting client, and stores a copy of the hidden token for later verification that client request content sent to a web server is authentic. The proxy monitors client request content sent to the one or more web servers for a selected characteristic, and allows client request content having the selected characteristic to be processed by a web server application only if the client request content includes a token previously provided by the proxy and only if the token has a value matching a stored token value for the respective client.

Abstract: An agent on a device within a network receives a request to access a resource outside the network. A first encrypted connection is established between the device and the agent, and a second encrypted connection is established between the agent and the resource, to facilitate encrypted communication traffic between the device and the resource. The agent sends a policy request to a network appliance within the network, the request specifying the resource. The agent receives a policy response indicating that the resource is associated with one or more security policies of the network. Traffic passing between the device and the resource is selectively decrypted and inspected depending on the security policies.

Abstract: Devices and methods are disclosed which relate to managing multiple public user identifiers (PUIDs) in a database by setting customizable access rules and requiring authorization from applications for access. These PUIDs can be virtually any electronic identifier such as a telephone number, email address, FACEBOOK name, etc. The PUID database is on the memory of a mobile communication device. Applications on the mobile communication device or on the network request access to the PUID database. Access logic on the mobile communication device checks another database of PUID Access Policies and Preferences (PAPP) for authorization. The PAPP database may allow the application immediate access, deny access, or query the user for allowance. The PUID database and PAPP database are on a server on a network.

Abstract: Systems and methods of authentication and authorization between a client, a server, and a gateway to facilitate communicating a message between a client and a server through a gateway. The client has a trusted relationship with each of the gateway and the server. A method includes registering the client with the gateway. The client also constructs the address space identifying the gateway and the client. The client communicates the address space to the server. The client receives an identity identifying the server. If the client authorizes to receive a message from the server through the gateway, the client informs the authorization to the gateway. The client puts the identity identifying the server on a list of servers which are authorized to send messages to the client. In addition, the client communicates the list of servers to the gateway.

Abstract: A cryptographic device may include a cryptographic module and a communications module removably coupled thereto. The cryptographic module may include a first housing, a user Local Area Network (LAN) interface carried by the first housing, and a cryptographic processor carried by the first housing and coupled to the user LAN interface. The communications module may include a second housing and a network wireless LAN interface carried by the second housing. The network wireless LAN interface may be coupled to the cryptographic processor, and it may be switchable between wireless LAN modes.

Abstract: A secure processor such as a TPM generates one-time-passwords used to authenticate a communication device to a service provider. In some embodiments the TPM maintains one-time-password data and performs the one-time-password algorithm within a secure boundary associated with the TPM. In some embodiments the TPM generates one-time-password data structures and associated parent keys and manages the parent keys in the same manner it manages standard TPM keys.

Abstract: Systems and methods for authenticating key rotation communications. Key rotation communications can include a key counter known to both a headend device and a station. Comparison between a local key counter and the key counter included in the key rotation communication can be used to authenticate the key rotation communication.