Abstract: Systems, methods, and computer-readable storage media for automatic port identification. The present technology can involve determining that a wireless device has connected to a network device on a network, and determining which of the ports on the network device the wireless device has connected to. The determining the port connected to the wireless device can involve determining respective traffic patterns to be provided to selected ports on the network device, determining a traffic pattern transmitted by the wireless device, determining that the traffic pattern transmitted by the wireless device has a similarity to a traffic pattern from the respective traffic patterns, and based on the similarity, determining that a port associated with the traffic pattern is connected to the wireless device. The present technology can also involve selecting a port policy for the port.

Abstract: Improved systems and methods of authenticating a user using a mobile device to access a secure electronic portal are provided. A user may be enabled to quickly and securely log onto a website or other electronic portal using a handheld electronic device. In certain embodiments, multifactor authentication is utilized to improve the security of the authentication process.

Abstract: Embodiments of the present specification disclose data processing methods, apparatuses, and devices. A method can include: obtaining data use authorization information sent by a data requester; verifying the data use authorization information; in response to successfully verifying the data use authorization information, sending data authorized to be accessed by the data use authorization information to the data requester, wherein the data is obtained from a trusted institution and is stored in trusted hardware; and storing, on a blockchain associated with a blockchain network, a data sending record for the data.

Abstract: Methods and systems for providing configurable feature level controls for data. The data can be associated with data visualization and analysis in a distributed search engine environment. An example method comprises providing a user interface for enabling a selection of a type of access to grant for each feature of a plurality of features, the selection being on a feature-by-feature basis and the selection being assigned to selected roles; and in response to the selection of the type of access, automatically controlling the type of access to each of the features including determining whether a user has any role to which a particular feature has been assigned; and based on the determining, for users having any of the selected roles, permitting the type of access selected for the particular feature assigned to the selected roles. The types of access may comprise read-only, full, no access, or differing levels of access.

Abstract: According to aspects of the inventive concepts, provided is a method for erasing information based on a dual-security mechanism. A storage medium feature database, an information erasure feature database, and a firmware system feature database are built to match cases for to-be-erased electronic scrap. An erasure solution and a native system data package are generated based on the matching results. The information is erased and an erasure result is evaluated; and the information is recovered on the erased electronic scrap, and a recovery result is evaluated, to implement comprehensive double security evaluation. The information erasure validity of the electronic scrap is checked based on the evaluation results. If an erasure result is invalid, erasure solutions are corrected online based on the evaluation result, until the erasure result is valid and the electronic scrap with a native system recovered is obtained.

Abstract: Traffic broadcast to a VLAN is restricted. To do so, a plurality of stations are associated with a BSSID (basic service set identifier). A first VLAN is configured by sending a first group key to each station from the plurality of stations that is a member of the first VLAN, wherein each VLAN is associated with a unique group key. One or more frames addressed to the first VLAN are received. The one or more frames are encrypted with the first group key to prevent stations without the first group key from being able to decrypt the one or more frames. The one or more encrypted VLAN frames are broadcast to the plurality of stations associated with the BSSID.

Abstract: A device may select an individual that is a candidate for authentication by facial recognition. The device may identify a facial area of the individual and an area of exposed skin of the individual. The device may obtain a first temperature associated with the facial area of the individual and a second temperature associated with the area of exposed skin of the individual. The device may determine, based on the first temperature and the second temperature, whether an appearance of the facial area of the individual is likely altered by a face-altering technology. The device may selectively perform facial recognition on the facial area of the individual based on whether the appearance of the facial area of the individual is likely altered by the face-altering technology.

Abstract: Techniques for encrypting keyboard data prior to its being received by an operating system of an endpoint device, reducing the possibility of unencrypted keyboard data being logged by a keylogger application running on the endpoint device. The techniques employ an encryption filter communicably coupled between a keyboard and the endpoint device. The encryption filter receives unencrypted keyboard data from the keyboard, encrypts the keyboard data, and provides the encrypted keyboard data to the operating system of the endpoint device. The techniques can be employed in association with a back-end data processing center of a security standard compliant organization, which can receive the encrypted keyboard data from the endpoint device, and decrypt the keyboard data for use on a host system. In this way, access and/or storage of unencrypted keyboard data at the endpoint device can be avoided.

Abstract: An apparatus, method, system and computer-readable medium are provided for preserving an encryption of data when confronted by an attack, such as a side channel analysis (SCA) attack based on a statistical analysis. In some embodiments, hardware, software, and/or firmware associated with an encryption calculation may be exercised or accessed during a background operation when an actual or real operation is not taking place. During the background operation, dummy values for data and one or more keys may be input to the hardware. A switching between the real operation and the background operation may take place seamlessly such that measurement of a physical characteristic associated with the hardware is indistinguishable in terms of when the real and background operations are active. In this manner, the secrecy of a key used in connection with the real operation may be preserved.

Abstract: A method begins by a processing module of a dispersed storage network (DSN) receiving a signature contribution request and payload, logging the request and determining whether a timestamp for the request compares favorably to a timing template. When the timestamp for the request compares favorably to the timing template the method continues with the processing modules determining whether the request compares favorably to a functionality template and when it compares favorably to a functionality template retrieving a key share based on sharing function parameters and outputting a signature result. When the timestamp for the request does not compare favorably to the timing template or the request does not compare favorably to the functionality template the method continues with the processing module outputting a signature contribution request rejection message.

Abstract: A computer implemented method, device and computer program device are provided including one or more processors and an input to collect credential related content including a first network resource identifier related to a first one of multiple network resources, the credential related content further including a master password that is associated with the first network resource identifier and that is associated with network resource identifiers for a remainder of the multiple network resources. Responsive to execution of the program instructions, the processor converts the master password and the first network resource identifier into a first hash code to receive a temporary credential token from the authentication service in connection with the first hash code.

Abstract: Video coding using a constructed reference frame may include generating, by a processor in response to instructions stored on a non-transitory computer readable medium, an encoded video and outputting an output bitstream. Generating the encoded video includes receiving an input video stream, generating a constructed reference frame, generating an encoded constructed reference frame by encoding the constructed reference frame, including the encoded constructed reference frame in an output bitstream such that the constructed reference frame is a non-showable frame, generating an encoded frame by encoding a current frame from the input video stream using the constructed reference frame as a reference frame, and including the encoded frame in the output bitstream.

Abstract: A content consumption system or device may implement device-enabled identification for automated user detection. An identifying device may be detected at a content consumption device as within proximity of the content consumption device. An identifying device may be a mobile or wearable computing device, in various embodiments. A user account associated with the identification device may be selected for accessing content at the content consumption device. Access to content may be provided according to the selected user account. In some embodiments, content recommendations or content filtering may be performed based on the automatically determined user account.

Abstract: The technology described herein helps improve email security within a multi-tenant email service. In particular, the technology described herein helps make it more difficult for a first tenant of the email service to impersonate a second tenant of the email service by validating the sending domain before the email leaves the multi-tenant email service. In particular, the technology runs a sending-side source validation on an email. If the source validation fails, the email is still sent, but using a source IP address that will cause the email to fail a receiving-side email authentication tests, such as the sender policy framework (SPF) email authentication test. In contrast, if the source validation passes, the email is sent using a source IP address that will cause the email to pass the receiving-side email authentication tests.

Abstract: A method for managing access privileges is disclosed. The method includes: obtaining, based on employee data received from a first client server having access to a human resources database of an organization, a first indication identifying a change in a first employee structure of the organization, the first employee structure indicating an employee status associated with each of one or more of the employees; retrieving permissions data defining access privileges associated with one or more employee statuses within the first employee structure for accessing a protected resource; and updating a user permissions database associated with the protected resource to indicate a change in access privileges for at least one employee of the organization based on the first indication and the permissions data, the user permissions database indicating access privileges for employees of the organization that are authorized to access the protected resource.

Abstract: Disclosed herein includes a system, a method, and a device for preventing replay attacks in a cluster. A first node in the cluster having a plurality of nodes can receive an indication of a node event. The first node can access a first sequence number from a storage corresponding to a previous communication between the plurality of nodes. The first node can adjust the first sequence number by a delta indicative of an average number of communications between the plurality of nodes in the cluster in a determined time period to generate a second sequence number. The first node can transmit a packet including the second sequence number to the plurality of nodes in the cluster. The second sequence number can be used by the plurality of nodes to reset a starting sequence number for communications between the plurality of nodes to prevent replay attacks in the cluster.

Abstract: A system and method uses different authentication techniques, including weak passive authentication techniques, to authenticate users by generating a score and comparing it to a threshold selected according to the feature the user is requesting.

Abstract: A method of authenticating a user of a multifunction device to a server, the method comprising associating a user-supplied image with user login credentials, using a server; receiving, at the server, an image uploaded from the multifunction device; and comparing the uploaded image to the user-supplied image, using the server, and, only if the uploaded image is identical to the user-supplied image, allowing the user of the multifunction device to authenticate to the server by providing additional login credentials to the server using the multifunction device.

Abstract: In general, techniques are described for enhancing operations of virtual networks. In some examples, a network system includes a plurality of servers interconnected by a switch fabric comprising a plurality of switches interconnected to form a physical network. Each of the servers comprises an operating environment executing one or more virtual machines in communication via one or more virtual networks. The servers comprise a set of virtual routers configured to extend the virtual networks to the operating environments of the virtual machines. A virtual router of the set of virtual routers is configured to prepare tunnel packets by forwarding packets received from virtual machines to an IPSec kernel executing in a host operating network stack, receiving the ESP packets back from the IPSec kernel and forwarding the ESP packets across the virtual networks.

Abstract: In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code that provides operations when executed by the at least one processor. The operations may include: reducing a dimensionality of a plurality of features representative of a file set; determining, based at least on a reduced dimensional representation of the file set, a distance between a file and the file set; and determining, based at least on the distance between the file and the file set, a classification for the file. Related methods and articles of manufacture, including computer program products, are also provided.