Abstract: Methods, apparatuses, and computer program products are disclosed for generating and/or using a mobile legal identification data object. An example method includes receiving a request for a mobile legal identification data object and generating the mobile legal identification data object based at least in part on the request for the mobile legal identification data object. The method further includes associating the mobile legal identification data object with a user profile. The method further includes providing the mobile legal identification data object to a user device associated with the user profile.

Abstract: A method, apparatus, and computer-readable medium are described that enable agent instances to be instantiated in secure, containerized environments. When a new container is detected, a list of agent instances expected to be running in a compute instance or in a container may be obtained and compared with status information regarding which agent instances are active. For a non-active agent instance, an agent object and configuration information for the agent instance may be obtained from a storage. Based on the available name, the agent object, and the configuration information, the agent instance may be instantiated and connected to an agent status server. An application related to the new agent instance may be deployed in the secure containerized environment.

Abstract: An anti-spoofing attack check method, including: receiving, by a first network device, a packet via a first interface; determining, by the first network device based on a source IP address of the packet, a first identifier corresponding to the source IP address; determining, by the first network device based on the first interface, a second identifier corresponding to the first interface; and determining, by the first network device, security of the packet based on the first identifier and the second identifier. The method helps prevent misjudgment of the anti-spoofing attack check.

Abstract: The present invention provides a method and apparatus for a highly secure Air-Gapped storage or repository (Transportable Storage). The apparatus has a storage stack that can be completely isolated and not accessible to outside of the system except through an internal virtual network connected to the main or primary storage stack with special protocols and authentications trusted by both parties (primary and Transportable Storage Stack(s)) and hosted on the virtual layer. The storage stacks could be either virtual or physical. The system uses a consensus algorithm to achieve consensus in order to authorize/validate any user, action or function. The system using this method might also be environment-aware or policy enabled and can take proper actions in case of malicious network attacks or problems detected by antivirus software. In addition, it can make itself offline or invisible.

Abstract: The present disclosure provides a method of watermarking digital media for subsequent decoding. The method includes receiving a secure content package comprising digital audiovisual content, source entity information, content annotations, and digital signatures. The package is validated using public-key cryptography. A content identifier is generated and embedded as a watermark into the digital audiovisual content. The watermark is configured to be machine readable and visually inconspicuous. A content database entry is recorded in a remote database, retrievable using the content identifier and comprising the content annotations and source information. The watermarked digital audiovisual content is stored and transmitted to the media source. The method may further include generating and storing content hashes for future authentication comparisons.

Abstract: Tamper-proof gateways are described. A gateway comprises a date intake module, a data transmission module, a tamper switch and a controller. The data intake module couples to one or more data generation devices. The data transmission module is configured to transmit sense information generated by the one or more data generation devices to a network. The tamper switch is configured to generate an alert signal in response to sensing tampering of the tamper-proof gateway. The controller is configured to: 1) place the tamper-proof gateway in a secure state in response to receiving the alert signal from the tamper switch, and 2) withdraw the tamper-proof gateway from the secure state in response to receiving authentication information. Withdrawing the gateway from the secure state may comprise placing the tamper-proof gateway in a first privileged state or a second privileged state.

Abstract: Provisioning of resources to service consumers using flexible credentials scoped to enable the permissible uses of the resources. The credentials are not tied to a specific user, and can be shared among users, e.g., the credentials can be transferred, moved, pointed, or allocated to users collaborating on a particular project.

Abstract: Various embodiments include implementing an interceptor for application security testing. The interceptor may intercept traffic, including one or more traffic items, between a scan engine and a target application. The traffic item(s) may include a request directed to the target application from a scan engine implementing application security testing or a response from the target application responsive to request(s) from the scan engine. The interceptor may determine that a particular traffic item satisfies a particular traffic trigger associated with a particular traffic action comprising a manipulation to the traffic between the scan engine and the target application. The particular traffic action is one of a plurality of predefined traffic actions that the interceptor is configured to perform across different scan engine versions, different scan configurations, or both.

Abstract: Virtual machines in a network may be isolated by encrypting transmissions between the virtual machines with keys possessed only by an intended recipient. Within a network, the virtual machines may be logically organized into a number of community-of-interest (COI) groups. Each COI may use an encryption key to secure communications within the COI, such that only other virtual machines in the COI may decrypt the message. Remote devices may gain access to virtual machines in a network through a virtual device relay. The virtual device relay receives data from the remote device, such as a tablet or cellular phone, and forwards the data to one of the virtual machines, when the virtual device relay shares a COI with the destination virtual machine.

Abstract: This application describes a security framework that allows a data payload transmitted on a network to be validated locally by any node on the network. A node that first receives the data payload may validate the information included in the data payload and generate a digital certificate based on the information. Each node that receives the data payload from the originating node may validate the digital signature using a locally accessible cryptographic key. The framework may support multiple security tiers by configuring nodes to mask information included in a data payload before transmitting the requested data payload to another node.

Abstract: Data processing systems and methods, according to various embodiments, are adapted for mapping various questions regarding a data breach from a master questionnaire to a plurality of territory-specific data breach disclosure questionnaires. The answers to the questions in the master questionnaire are used to populate the territory-specific data breach disclosure questionnaires and determine whether disclosure is required in territory. The system can automatically notify the appropriate regulatory bodies for each territory where it is determined that data breach disclosure is required.

Abstract: A method and system are disclosed for automated utilization of vulnerability databases for consumer electronic (CE) devices. The method includes deploying one or more customer-premise equipment or customer-provided equipment (CPE) broadband devices, each of the one or more broadband devices having one or more software components; loading a database of software component on each of the one or more broadband devices, the database of software components having a functional use case associated with each software component; periodically performing an automated reading of one or more published vulnerability databases; and comparing a list of vulnerabilities from the one or more published vulnerability databases against the database of software components for each of the one or more broadband devices.

Abstract: Systems and methods are provided for sharing authentication information. The systems and methods include retrieving, with a messaging application, a list of applications that are installed on a user device; searching the list of applications to identify a given application within the list of applications that is configured to share authentication information with the messaging application; and in response to identifying the given application within the list of applications, generating for display within a graphical user interface of the messaging application an option to authorize the messaging application to share authentication information with the given application.

Abstract: A first server apparatus is communicably connected to each of a second server apparatus having a server-less function and a vehicle and includes an obtaining unit obtaining, from the vehicle, start position information indicating a start position of the vehicle, start date-and-time information indicating a start date and time of the vehicle, parking position information indicating a parking position of the vehicle, and parking date-and-time information indicating a parking date and time of the vehicle, an estimating unit estimating a date and time at which the vehicle is started based on the start position, the start date and time, the parking position and the parking date and time, and an instructing unit instructing the second server apparatus to activate a personal authentication program in accordance with an estimation result by the estimating unit.

Abstract: A system which performs both identification and authentication of a user ID at the same time with only one step of inputting a one-time password without the need of step of inputting a user ID is provided. A one-time password deriving rule for generating a one-time password by being applied to pattern elements at specific positions in a case where a plurality of pattern elements arranged in a predetermined pattern are presented to a user who is to be authenticated as a presentation pattern is set as a password of the user, and the user is authenticated on the basis of a character string for authentication in which a user ID is embedded at a predetermined embedding position within the one-time password.

Abstract: A system for managing firewall rules between different services. In certain instances, the method includes receiving a discovery graph comprising a plurality of services and at least one application programming interface (API) dependency, wherein the plurality of services comprises a first service and a second service. In some instances, the method further includes determining whether the second service is permitted to receive an initial communication from the first service based upon the at least one API dependency included in the discovery graph. And, in response to determining the second service is permitted to receive the initial communication from the first service, the method can include establishing a first rule for a firewall between the first service and the second service, the first rule allowing the second service to receive the initial communication from the first service.

Abstract: A method of updating a first device (e.g., one or more locking devices) to reflect information located on a second device (e.g., a server) is provided, where the first device and the second device cannot communicate directly with one another. The method may include employing a third untrusted device (e.g., a mobile device) temporarily as an intermediary between the first device and second device. The method may include receiving, at the first device and from a third device, a request for the first device to communicate with the third device. In response to determining that the third device is authorized to communicate with the first device, the first device may receive information from the third device that was provided by the second device. The first device may transmit at least one message to the third device that is to be provided to second device.

Abstract: This disclosure is related to methods and apparatus used to for preventing malicious content from reaching a destination via a dynamic analysis engine may operate in real-time when packetized data is received. Data packets sent from a source computer may be received and be forwarded to an analysis computer that may monitor actions performed by executable program code included within the set of data packets when making determinations regarding whether the data packet set should be classified as malware. In certain instances all but a last data packet of the data packet set may also be sent to the destination computer while the analysis computer executes and monitors the program code included in the data packet set. In instances when the analysis computer identifies that the data packet set does include malware, the malware may be blocked from reaching the destination computer by not sending the last data packet to the destination computer.

Abstract: Implementations of the disclosure provide for binding data to a network in the presence of an entity. In one implementation, a cryptographic system is provided. The cryptographic system includes a memory to store encrypted data, and a processing device, operatively coupled to the memory, to identify a public key for a communications device in response to an indication of a presence of the communications device on a network. A first intermediate is determined in view of the public key for the communications device and in view of an acquisitioning public key. The acquisitioning public key is associated with the encrypted data. A second intermediate public key is received from the communications device in view of the first intermediate public key. Thereupon, the encrypted data is decrypted using an encryption key derived at least from the second intermediate public key.

Abstract: A method of investigating a host computer uses an investigation system remote to the host computer. The investigation system includes at least one computer system. The method includes establishing a connection with the remote host computer, and sending at least one investigative module to the host computer. The at least one investigative module is configured to run on the host computer to perform at least one investigative function on the host computer. The at least one investigative module includes an agentless computer program configured to run on the host computer to perform at least one investigative function on the host computer to investigate the host computer to ascertain if the host computer has any data or process (hereinafter collectively referred to as data forms) with suspicious attributes.