Abstract: Techniques for determining which resource access requests are handled locally at a remote computer, and which resource access requests are routed or “redirected” through a virtual private network. One or more routing or “redirection” rules are downloaded from a redirection rule server to a remote computer. When the node of the virtual private network running on the remote computer receives a resource access request, it compares the identified resource with the rules. Based upon how the identified resource matches one or more rules, the node will determine whether the resource access request is redirected through the virtual private network or handled locally (e.g., retrieved locally from another network). A single set of redirection rules can be distributed to and employed by a variety of different virtual private network communication techniques.

Abstract: A computer implemented method, computer program product, and computer system is provided for receiving a service request to obtain service from a second application, the service request including a client context and a signed ticket obtained by the first application from a system computer, validating the received signed ticket based on the key associated with the system, determining that the first application has authorization to obtain the requested service via the remote interface of the second application based on a comparison of one or more attributes of the received client context to an access control list associated with the second application, and sending a service reply from the second application to the first application to provide the requested service to the first application in response to determining that the first application has authorization to obtain the requested service via the remote interface of the second application.

Abstract: A communication system includes a client apparatus and a relay apparatus. The client apparatus includes an acquisition unit and a request unit. The acquisition unit acquires permission information indicating permission to access a service provider apparatus, from the service provider apparatus. The request unit transmits the permission information and user identification information which has been input, to the relay apparatus so as to request access to the service provider apparatus. The relay apparatus includes a storage controller and an access unit. The storage controller stores the permission information and the user identification information which are received from the client apparatus, in a storage unit in such a manner that the permission information and the user identification information are associated with each other. The access unit accesses the service provider apparatus by using the permission information stored in the storage unit.

Abstract: Techniques for in-line filtering of insecure or unwanted mobile components or communications (e.g., insecure or unwanted behaviors associated with applications for mobile devices (“apps”), updates for apps, communications to/from apps, operating system components/updates for mobile devices, etc.) for mobile devices are disclosed. In some embodiments, in-line filtering of apps for mobile devices includes intercepting a request for downloading an application to a mobile device; and modifying a response to the request for downloading the application to the mobile device. In some embodiments, the response includes a notification that the application cannot be downloaded due to an application risk policy violation.

Abstract: A trusted device having virtualized registers provides an extensible amount of storage for hash values and other information stored within a trusted device. The trusted device includes a buffer to which registers are virtualized to and from external storage, by encrypting the register values using a private device key. The registers may be platform control registers (PCRs) or other storage of the trusted device, which may be a trusted platform module (TPM). The registers are accessed in accordance with a register number. When the externally stored values are retrieved, they are decrypted and placed in the buffer. The buffer may implement a cache mechanism, such as a most recently used algorithm, so that encryption/decryption and fetch overhead is reduced. A register shadowing technique may be employed at boot time, to ensure that the trusted device is not compromised by tampering with the externally stored virtualized registers.

Abstract: Provisioning and access control for communication nodes involves assigning identifiers to sets of nodes where the identifiers may be used to control access to restricted access nodes that provide certain services only to certain defined sets of nodes. In some aspects provisioning a node may involve providing a unique identifier for sets of one or more nodes such as restricted access points and access terminals that are authorized to receive service from the restricted access points. Access control may be provided by operation of a restricted access point and/or a network node. In some aspects, provisioning a node involves providing a preferred roaming list for the node. In some aspects, a node may be provisioned with a preferred roaming list through the use of a bootstrap beacon.

Abstract: This disclosure provides a network security architecture that permits installation of different software security products as virtual machines (VMs). By relying on a standardized data format and communication structure, a general architecture can be created and used to dynamically build and reconfigure interaction between both similar and dissimilar security products. Use of an integration scheme having defined message types and specified query response framework provides for real-time response and easy adaptation for cross-vendor communication. Examples are provided where an intrusion detection system (IDS) can be used to detect network threats based on distributed threat analytics, passing detected threats to other security products (e.g., products with different capabilities from different vendors) to trigger automatic, dynamically configured communication and reaction.

Abstract: Systems and methods are provided for securing data in virtual machine computing environments. A request is received for a security operation from a first virtual machine operating in a host operating system of a first device. In response to receiving the request, a first security module executes the security operation, the first security module implemented in a kernel of the host operating system. The result of the security operation is provided to the first virtual machine.

Abstract: A system, method and device for real-time compositing of encrypted video streams without having to decrypt each video stream is disclosed herein. A shared encryption key is derived to encrypt multiple incoming video streams to an encrypted master video stream, while retaining full interoperability with popular incumbent video encryption standards. Compositing video is then possible without having to decrypt the master video stream, thereby preserving the security of the copyrighted material. The invention preferably genlocks a digital video source to a master video stream.

Abstract: A data processing apparatus and method are provided for managing access to content within the data processing apparatus. The data processing apparatus has a secure domain and a non-secure domain and comprises at least one device which is operable when seeking to access content stored in memory to issue a memory access request pertaining to either the secure domain or the non-secure domain. Further, writeable memory is provided which can store content required by the at least one device, with the writeable memory having at least one read only region whose content is stored therein under control of a secure task, the secure task being a task executed by one of the devices in the secure domain.

Abstract: In various embodiments, security may be provided for application to application (A2A) and application to database (A2DB) implementations. In some embodiments, a method comprises receiving a registration request at a first digital device for a first application, receiving a first program factor associated with the first application, confirming the first program factor, generating a first password for a second application based, at least, on the confirmation of the first program factor, and providing the first password to a second digital.

Abstract: Embodiments described herein provide a technique for securely responding to an enumeration request of a data container stored at a location referenced by a junction or mount point within a share served by a storage system. To that end, the technique applies access permissions of the data container at the referenced location instead of permissions that may reside at the junction or mount point. Upon determining that the permissions are insufficient to allow access to the data container, the technique ensures that a descriptor of the junction or mount point is not included in a response to the enumeration request.

Abstract: Indicating data currentness includes, on any date of a sequence of dates, issuing a proof indicating the currentness status of the data during a particular time interval. The proof may be a digital signature. The time interval may be in the form of a current date and an amount of time. The proof may include a digital signature of the time interval. The proof may include a digital signature of the time interval and the data. The proof may include a digital signature of the time interval and a compact form of the data, such as a hash. Indicating data currentness may also include distributing the proofs to a plurality of unsecure units that respond to requests by users for the proofs. Indicating data currentness may also include gathering a plurality of separate pieces of data and providing a single proof for the separate pieces of data. The data may be electronic documents.

Abstract: Access to encrypted data on a removable computer media such as a computer tape is controlled via a uniquely-structured header on the medium having a symmetrical key wrapped by asymmetrical encryption plus a public key associated with the asymmetrical encryption. The data on the medium is encrypted using the symmetrical key. Prior to automated reading of the data by a reader, a challenge is issued to a host system including the public key and preferably a nonce value. The host responds by signing the nonce using a private key associated with the public key in order to prove it has rights to decrypt the data. The symmetrical key is unwrapped using the private key, and finally the unwrapped symmetrical key is used to decrypt the data on the medium, thereby allowing automated reading of the tape data without the need or risk of two administrators sharing a symmetrical key value.

Abstract: Apparatuses for peer-to-peer network setup are presented. In one embodiment, an apparatus comprises a wireless processing unit to communicate with a master device. The wireless processing unit is operable to receive encoded data in a two-dimensional (2D) barcode. The encoded data comprise at least user information associated with the master device including a user identifier, a device identifier, or both. The encoded data further comprise network information including a network identifier, a password, and a profile lifetime value. In one embodiment, the apparatus further comprises a display unit to display at least part of the user information and the network information to a user. The wireless processing unit is operable to initiate a peer-to-peer network setup with the master device based at least on a response from the user.

Abstract: This disclosure provides an architecture for sharing information between network security administrators. Events converted to a normalized data format (CCF) are stored in a manner that can be queried by a third party (e.g., an administrator of another, trusted network). Optionally made available as a service, stored event records can be sanitized for third party queries (e.g., by clients of a service maintaining such a repository). In one embodiment, each contributing network encrypts or signs its (sanitized) records using a symmetric key architecture, the key being unique to the contributing network. This key is used (e.g., by the repository) to index a set of permissions or conditions of the contributing network in servicing any query, e.g., by matching a stored hash of the event record or by decrypting the record. The information sharing service can optionally be provided by a hosted information security service or on a peer-to-peer basis.

Abstract: Entitlements to resources can be determined by using access rules that are organized as respective ranges in an entitlement space. An access rule can represent a range between two rational numbers in the entitlement space; the range can be represented by a single rational number. Due to the way the rational numbers are chosen, a child rule is completely covered by its parent, and a parent has remaining room in the entitlement space for unlimited additional children. Entitlement checking for a large batch of resources can be performed quickly based on reusing calculated permitted ranges in the entitlement space. Implied permissions can be supported. Content can easily be added, and the access rules can be modified without unduly impacting the underlying tree structure, if at all.

Abstract: A prevention-based network auditing system includes a central compliance server providing a user interface allowing a user to schedule and configure a network audit. The configured audit is stored in an audit repository until its scheduled time. At such a time, the compliance server automatically invokes one or more audit servers to gather information about the network. The compliance server receives the gathered information and electronically applies a network policy to the information for determining compliance with the policy. A remediation task may be generated if the policy has been violated, and the task monitored until its completion.

Abstract: Some demonstrative embodiments include apparatuses, systems and/or methods of communicating location-enabling information for location estimation. For example, an apparatus may include a location-enabling information (LEI) processor to process a location-enabling message, which is transmitted between first and second location-enabling sources and receivable by a mobile device, the location-enabling message including encrypted LEI configured for enabling estimation of a location of the mobile device at a predefined accuracy based on a cryptographic key corresponding to the first location-enabling source.

Abstract: Disclosed in the present invention are a method and apparatus for checking a process of decompressing an application installation package. The present invention belongs to the technical field of security. The method comprises: decompressing a sub-portion of data in an application installation package to acquire decompressed data, the sub-portion of data being not greater than a threshold size; checking the decompressed data according to the virus samples in a virus feature library; and determining that the application installation package is a virus-infected file or rogue software when the decompressed data includes any of the virus samples. The technical solution of the present invention can effectively save the internal memory, shorten the checking time, and improve the checking efficiency in determining whether an application installation package is a virus-infected file or rogue software.