Abstract: A method of securing transmission of streaming media by encrypting each packet in the stream with a packet key using a fast encryption algorithm. The packet key is a hash of the packet tag value and a closed key which is unique for each stream. The closed key is itself encrypted by the sender and passed to the recipient using a public key encryption system. The encrypted closed key (open key) may conveniently be inserted into the stream header. All of the packets in the stream are encrypted, but only the data pay load of each packet is encrypted. It is computationally infeasible, without knowing the recipient's private key to calculate the closed key based upon knowledge of publicly accessible information such as the recipient's public key, the open key, the encrypted stream data or the packet tag values.

Abstract: A trusted service which publishes information describing security attributes of computing platforms in a defined physical area, for use by a visitor to a building, for example, who is unfamiliar with the computing platforms available for use therein. In a preferred embodiment, the system provides only details and/or a list of public keys of genuine trusted computing platforms within the area. In another embodiment of the invention, the information system comprises a trusted computing platform for providing selected information to a user's portable computing apparatus.

Abstract: An authentication agent may cryptographically identify a remote endpoint that sent a media initialization message even though intermediate devices may modify certain fields in the message after a signature is inserted. The originating endpoint's agent may create the signature over some fields of the message using an enterprise network's private key. The agent may insert the signature into the message and send the message to a recipient endpoint's authentication agent. The recipient agent may verify the signature, receive a certificate including a second public key, and challenge the identity of the originating endpoint in order to confirm that identity. This challenge may request a confirmation that the originating endpoint knows the private key corresponding to the second public key and may occur while running encrypted media at the endpoints. After the originating endpoint is authenticated, the endpoints may exchange encrypted and/or unencrypted media.

Abstract: A method and apparatus is provided that allows code signed by a master key to grant trust to an arbitrary second key, and also allows code, referred to as an antidote and also signed by the master key to revoke permanently the trust given to the second key.

Abstract: Systems and/or methods that facilitate secure electronic communication of data are presented. A cryptographic component facilitates data encryption, data decryption, and/or generation of digital signatures, associated with messages. The cryptographic component includes a randomized exponentiation component that facilitates decryption of data and/or generation of digital signatures by exponentiating exponents associated with messages. A random number is generated and utilized to randomize the value of a message. After an exponentiation is performed on the randomized message value, intermediate results can be analyzed to determine if there was error in the exponentiation. If there was no error in the exponentiation, a final value of the exponentiation is determined and provided as output as decrypted data or a digital signature; if there is error, an “error” output can be provided.

Abstract: An OTP token for facilitating the authorizing of a client workstation to conduct a session with a server over the Internet is disclosed. Information at least partially identifying the server is provided to the OTP token and/or the client workstation, and a determination is made, using this identifying information, if the server is a legitimate server. In accordance with this determination, it is decided whether or not to transmit data indicative of a session OTP from the OTP token to the client workstation. In some embodiments, if the identifying information is indicative of a legitimate server, the data indicative of the session OTP is transmitted from the OTP token to the client workstation, and otherwise, the data indicative of the session OTP is withheld from the client workstation. Data indicative of the session OTP may include, in various embodiments, either multi-factor authentication data derived from user authorization data, or session OTP data that is independent of user authentication data.

Abstract: A network security system and method performs quantifying and billing for network security consumed during a period of time. Implementations may include billing server configured to calculate the security protection consumed by calculating damages avoided from attacks that were blocked. The network security system also may include a scanner inside the customer network configured to scan devices for vulnerabilities and to quantify assets at risk. The system may further include an intrusion suppression module outside the customer network configured to maintain a list of attacks sustained and blocked during a period of time. The network security system may also include a blocker inside the customer network configured to detect unauthorized disclosures of confidential information and block the disclosures in real time.

Abstract: A system and method for protecting a user against a cross-site scripting attack or other network attack that relies on scripting code embedded within a uniform resource locator (URL) are described. Validation software executing on a client computer system may intercept a URL in response to a user providing the URL to a web browser or other client application. The validation software may analyze the URL to determine whether the URL includes scripting code. If the URL includes scripting code then the validation software may block the client application from accessing the URL or may otherwise inhibit access to the URL.

Abstract: A method for dealing with attacks of malicious BOTs in a network security system includes detecting and analyzing a domain name receiving excessive DNS queries to judge the infection of a malicious BOT, registering the corresponding domain name as normal or abnormal management target, and redirecting an abnormal DNS query for the abnormal management target to a redirection processing & response system. Thereby, the automatic detection of malicious BOT attacks and the mechanism which performs the measures and the analysis simultaneously can protect the DNS servers and prevent the security accidents by malicious BOT attacks previously.

Abstract: A data communication device that communicates with a storage device via a network includes an input unit for inputting user identification information, a log-in processing unit configured to enable a user to log in to access a storage area of the storage device associated with the user identification information, an accessing unit configured to access the storage area if the user logs in, a determining unit configured to determine whether data processing involving the accessed storage area is ongoing when an instruction is sent to cause the user to log out, and a controller unit configured to enable the user to log out and disable access to the storage area when the data processing is not ongoing, and, when the data processing is ongoing, enable access to the storage area even after the user has logged out until the data processing has been completed.

Abstract: A network system can have a plurality of distributed software agents configured to collect events from network devices. In one embodiment, the agents are configured to aggregate the events. In one embodiment of the present invention, an agent includes a device interface to receive an event from a network device, a plurality of aggregation profiles, and an agent aggregate module to select one of the plurality of aggregation profiles, and increment an event count of an aggregate event representing the received event using the selected aggregation profile.

Abstract: Analysis of audit information that takes into account a wide context allows for a rich picture from which system conditions may be assessed. Event information about various events that have occurred or are occurring, on various sources in the computing arrangement, is maintained. Each entity has an “activity identifier”, which remains the same across various events performed by that entity at the various sources. Event information associated with the various sources is contextually analyzed on the basis of the activity identifier, to assess whether a condition exists that impacts the performance and/or security of the computing arrangement. In case it is determined that such a condition exists, an action is performed to remediate the condition.

Abstract: Embodiments of the present invention provide a method, system and computer program product for the heuristic malware detection. In one embodiment of the invention, a heuristic malware detection method can include merging a baseline inventory of file attributes for respective files from each client computing system in a community of client computing systems into a merged inventory. The method further can include receiving an updated inventory of file attributes in a current inventory survey from different ones of the client computing systems. Each received survey can be compared to the merged inventory, and in response to the comparison, a deviant pattern of file attribute changes can be detected in at least one survey for a corresponding client computing system. Thereafter, the deviant pattern can be classified as one of a benign event or a malware attack. Finally, malware removal can be requested in the corresponding client computing system if the deviant pattern is classified as a malware attack.

Abstract: A generator uses a robust programming framework to create an electronic signature in association with a data item, wherein the electronic signature includes time stamps and/or countersignatures. The generator can create a signature object that computes a signature value of the electronic signature based on the data item. The generator also creates a signature timestamp object to obtain a timestamp of the signature value, wherein the timestamp is associated with the electronic signature. The generator can also invoke a countersignature service on the signature object to obtain a countersignature based on the signature value of the signature object, wherein the countersignature is associated with the electronic signature.

Abstract: A computer enabled method and apparatus for encrypting and decrypting data using a keyless transformation cryptographic technique. Data is protected using a keyless (unkeyed) complex mathematical transformation, in contrast to a traditional cryptographic algorithm using a secret key. This approach is resistant to both static analysis (hacking) performed on executable encryption/decryption code, as well as dynamic analysis performed during execution (runtime) of ciphering or deciphering. The method uses a family of asymmetric data transformations based on Galois field polynomials.

Abstract: A method, apparatus, and computer instructions for managing operating systems. A request from an operating system is received in the multi-partitioned data processing system to register for access to hardware in the multi-partitioned data processing system. The request includes a key code for the operating system. A determination is made as to whether the operating system is an authorized operating system using the key code in response to receiving the request. The operating system is registered if the operating system is the authorized operating system. Otherwise, the operating system is terminated.

Abstract: Systems and methods that mitigate affects of malware and facilitate remediation processes. An analysis engine generates a list of actions for resources associated with the malware, and prioritizes/sorts the actions for execution. Such list of actions can be generated automatically via an action list generation component associated with the analysis engine. Likewise, a sorting component as part of the analysis engine can prioritize operations between detected malware to typically ensure a smooth operation during remediation processes (e.g., avoid conflicts).

Abstract: A pay-per-use or pay-as-you-go computer uses a secure memory to store individual unique program identifiers. Each unique program identifier is associated with a particular hardware or software component, or service, or the entire computer available to a user. By combining the unique program identifier with a computer hardware identifier uniquely identified transactions may be tracked for both billing and reconciliation. Certificates associated with each unique program identifier, and coupled to the hardware identifier, provide a cryptographic basis for mutual verification of messages, requests, configuration instructions, and provisioning.

Abstract: In one embodiment, the present invention includes a method for receiving a request from a user-level agent for programming of a user-level privilege for at least one architectural resource of an application-managed sequencer (AMS) and programming the user-level privilege for the at least one architectural resource using an operating system-managed sequencer (OMS) coupled to the AMS. Other embodiments are described and claimed.

Abstract: Systems and methods for allowing authorized code to execute on a computer system are provided. According to one embodiment, an in-memory cache is maintained having entries containing execution authorization information regarding recently used modules. After authenticating a module, its execution authorization information is added to the cache. Activity relating to a module is intercepted. A hash value of the module is generated. The module is authenticated with reference to a multi-level whitelist including a global whitelist, a local whitelist and the cache. The authentication includes first consulting the cache and if the module is not found, then looking up its hash value in the local whitelist and if it is not found, then looking it up in the global whitelist. Finally, the module is allowed to be loaded and executed if its hash value matches a hash value of an approved code modules within the global whitelist.