Abstract: According to one embodiment, a system includes a processing circuit and logic integrated with and/or executable by the processing circuit. The logic is configured to cause the processing circuit to generate a multi-context ADPL tag unique to a pair of data socket descriptors on which data is to be received and/or transmitted by a first application instance operating on the system and a second application instance operating on a second host. The logic is also configured to cause the processing circuit to embed the ADPL tag as part of an application payload in response to the first application instance calling an API configured to transmit the application payload out from the system via a sender data socket descriptor. More systems, methods, and computer program products are described in accordance with other embodiments.

Abstract: A system and method for providing a secured connection between servers on a local area network (LAN) and clients on a wide area network (WAN) via a de-militarized zone (DMZ). The system includes a Service, a LAN Server, a LAN Controller, a DMZ Server and a DMZ Stack Pool Service. The method includes establishing an outbound TCP-based connection to the DMZ Stack Pool Service based on a request; passing Client Connection Information to the LAN Server; generating a first connection to the Service and a second connection to the DMZ Server, wherein the LAN server creates a Connection Binder between the Service and the outbound connections; creating a Connection Binder that binds the incoming Request and the outbound connection to complete the route of the Request; streaming the Request through the DMZ Server and the LAN Server; and streaming the request data from the Service to the Client.

Abstract: A system for verifying applications for Real-Time Execution (RTE) devices is provided. The system includes a memory, at least one processor coupled to the memory, and a simulation component executable by the at least one processor. The simulation component may be configured to receive device simulation information for an RTE device, the device simulation information including device configuration information, application information, and targeted performance information, configure a virtual device simulator to simulate performance of the RTE device, run the virtual device simulator to process one or more simulated events, and output simulation results.

Abstract: Network access control systems and methods are provided herein. A method includes receiving at a network device a SYN packet from a client device over a network, determining if the client device is a trusted source for the network using the SYN packet, if the client device is a trusted resource, receiving an acknowledgement (ACK) packet from the client device that includes identifying information for the client device plus an additional value, and identifying information for the network device, and establishing a connection with the network for the client device.

Abstract: A method in a wireless sensing device for authenticating a gateway device of a sensor network is described. The method includes receiving a certificate where the certificate was generated by the management server upon a determination that the gateway device and the wireless sensing device are associated and is a digital document including data and a digital signature, where the digital signature was generated by the management server based on the data and a private key of the management server, and where the data includes a first identifier and a second identifier; confirming that the wireless sensing device is authorized to upload data to the gateway device; in response to the confirming that the wireless sensing device is authorized to upload data to the gateway device, uploading to the gateway device data indicative of a plurality of sensor measurements taken over time to be transmitted to the management server.

Abstract: Examples of techniques for authenticating mobile applications are described herein. A method can include receiving, by a processor, a key pair and a policy file associated with a mobile service. The processor can receive a service request from a mobile application at a security gateway. The processor can detect that the service request includes an invalid or missing access token. The processor can redirect the mobile application to request a grant token from an authorization end point on a server. The processor can receive a grant token request from the mobile application and forward the grant token request to the server based on a policy file, the policy file including a list of: a plurality of security objects to be authenticated, a plurality of computing devices to authenticate the security objects, and an order of authentication.

Abstract: A computer device includes hardware with a connected peripheral device such as a camera or a microphone. An operating system is configured to operate the peripheral device using a device driver and a representative device object. An agent is configured to apply security attributes to the device object which permit access from a primary user account while preventing direct access to the device object by a secondary user account in a sandbox. The agent may intercept requests made toward the device object, examine each request, and then satisfy the request, when the request is allowed, by selectively arranging access to the device object from the sandboxed secondary user account.

Abstract: A method, computer program product, and system for authenticating a computing device by geographic attestation includes a processor utilizing executing an authentication application utilizing location services executing on the computing device to obtain location data from the location services. The processor obtains the location data and creates and encodes a data structure in a secured area of a memory; the data structure is only accessible to the authentication application. The processor transmits to an authentication server, an authentication request that includes the encoded location data, requesting access to secure content. The processor obtains a request to query identifiers proximate to the computing device for additional location information and queries the identifiers and transmits this additional location information to the authentication server.

Abstract: Methods and apparatus for ensuring protection of transferred content. In one embodiment, content is transferred while enabling a network operator (e.g., MSO) to control and change rights and restrictions at any time, and irrespective of subsequent transfers. This is accomplished in one implementation by providing a premises device configured to receive content in a first encryption format and encodes using a first codec, with an ability to transcrypt and/or transcode the content into an encryption format and encoding format compatible with a device which requests the content therefrom (e.g., from PowerKey/MPEG-2 content to DRM/MPEG-4 content). The premises device uses the same content key to encrypt the content as is used by the requesting device to decrypt the content.

Abstract: A JBoss application may allow for a distributed application hosted on a JBoss application server to connect to a hierarchical type database. Additionally, the JBoss application may communicate via IMS Connect and Open Database Manager Common Service Layers in order to retrieve the data from the IMS databases. A Java framework may be installed on the JBoss application server.

Abstract: The present invention provides a method for scanning information to be scanned in a computer device, the information to be scanned needing multiple scans, and the method comprising the steps of: a. determining a delay duration from the end of a scan for the information to be scanned to the start of a next scan according to current performance information about the CPU of the computer device; and b. scanning the information to be scanned according to the delay duration. According to the solution of the present invention, by determining a delay duration from the end of a scan for the information to be scanned to the start of a next scan according to current performance information about the CPU of a computer device, and scanning according to the delay duration, problems such as slow running due to high occupancy ratio of CPU resources during scanning can be avoided.

Abstract: Provided is a process of operating a zero-knowledge encrypted database, the process including: obtaining a request for data in a database stored by an untrusted computing system, wherein the database is stored in a graph that includes a plurality of connected nodes, each of the nodes including: an identifier, accessible to the untrusted computing system, that distinguishes the respective node from other nodes in the graph; and an encrypted collection of data stored in encrypted form, wherein: the untrusted computing system does not have access to an encryption key to decrypt the collections of data, the encrypted collections of data in at least some of the plurality of nodes each include a plurality of keys indicating subsets of records in the database accessible via other nodes in the graph and corresponding pointers to identifiers of the other nodes.

Abstract: Context information associated with a mobile communications device and a network connection for the mobile communications device is collected. A security policy is applied to determine whether the security offered by the network connection is appropriate for the context. If the security offered by the network connection is not appropriate for the context, the network connection may be made more secure, less secure, or a different network connection having an appropriate level of security may be used for the data associated with the context.

Abstract: A computer-implemented method, a computer system, and a computer program product are provided for enforcing multi-level security (MLS) on a message transmitted over a network that may be insecure. The method includes the processor obtaining a request from a source to send a message to a target, where the request includes the message and a context indicating a requested security level for the message. The processor encrypts the message based on ascertaining the message received in the request is a plaintext. The processor authenticates the encrypted message based on ascertaining the encrypted message is a ciphertext, where the target is enabled to trace the authenticated ciphertext back to the source. The processor transmits the authenticated encrypted message to the target across the network.

Abstract: A system that incorporates the subject disclosure may perform, for example, receiving an over-the-air programming message that is utilizing a hypertext transfer protocol where the over-the-air programming message including programming data for use by the mobile communication device, converting the over-the-air programming message to a short message service transport protocol to generate an adjusted message that includes the programming data, and providing the adjusted message to a universal integrated circuit card of the mobile communication device via a baseband proxy operating in a device processor of the mobile communication device. Other embodiments are disclosed.

Abstract: Disclosed herein is a technique for selecting a bootstrap electronic Subscriber Identity Module (eSIM) from among multiple bootstrap eSIMs stored in a secure element of a mobile device. Specifically, the technique involves selecting the bootstrap eSIM based on location information associated with the mobile device. When the mobile device is located at a first location (for example, a first country) a first bootstrap eSIM associated with a Mobile Network Operator (MNO) local to the first country is selected. Similarly, when the mobile device is located at a second location (for example, a second country), a second bootstrap eSIM associated with an MNO local to the second country is selected.

Abstract: Systems and methods are provided for monitoring access of computing resources. Usage rules may be created and stored that define a usage constraint based on actions available to be performed at the computing resources. An authenticator may verify login credentials received from a user and authorize the user to access a computing resource. A request to perform an action at the computing resource may be received, and a usage monitor may apply a usage rule to the requested action. If the requested action violates the usage constraint of the usage rule, the usage monitor may halt performance of the requested action and notify another user of the usage constraint violation. The authenticator may receive and verify another set of login credentials from that other user. In response to successful verification of the additional set of login credentials, the usage monitor may resume performance of the requested action.

Abstract: Authenticating devices utilizing Transport Layer Security (TLS) protocol to facilitate exchange of authentication information or other data to permit or otherwise enable access to services requiring authentication credentials, certificates, tokens or other information. The authentication may utilize Digital Transmission Content Protection (DTCP) certificates, Diffie-Hellman (DH) parameters or other information available to the authenticating devices, optionally without requiring device requesting authentication to obtain an X.509 certificate.

Abstract: Methods of fabricating tamper-respondent assemblies are provided which include a tamper-respondent electronic circuit structure. The tamper-respondent electronic circuit structure includes a tamper-respondent sensor. The tamper-respondent sensor includes, for instance, at least one flexible layer having opposite first and second sides, and circuit lines forming at least one resistive network. The circuit lines are disposed on at least one of the first or second side of the at least one flexible layer, and have a line width Wl?200 ?m, as well as a line-to-line spacing width Ws?200 ?m. In certain enhanced embodiments, the tamper-respondent sensor includes multiple flexible layers, with a first flexible layer having first circuit lines, and a second flexible layer having second circuit lines, where the first and second circuit lines may have different line widths, different line-to-line spacings, and/or be formed of different materials.

Abstract: The present disclosure describes systems and methods for detection and mitigation of malicious activity regarding user data by a network backup system. In a first aspect, a backup system receiving and deduplicating backup data from a plurality of computing devices may detect, based on changes in uniqueness or shared rates for files, atypical modifications to common files, and may take steps to mitigate any potential attack by maintaining versions of the common files prior to the modifications or locking backup snapshots. In a second aspect, the backup system may monitor file modification behaviors on a single device, relative to practices of an aggregated plurality of devices. Upon detection of potentially malicious modification activity, a previously backed up or synchronized store of data may be locked and/or duplicated, preventing any of the malicious modifications from being transferred to the backup system.