Abstract: The disclosed technology includes techniques for secure access to data associated with an organization and includes providing a user device access to a user interface that is configurable by a user of the user device to execute function requests. Upon receipt of a function request, a router can randomly select an available computer from a computer cluster to execute the function. The computer can access a predetermined portion of the organization's data, generate an output by executing the requested function based on the predetermined portion of the organization's data, and transmit the output to the user device.

Abstract: Embodiments are directed to sharing secure communication secrets with a network monitoring device (NMD). The NMD may passively monitor network packets communicated between client computers and server computers. If a secure communication session is established between a client computer and a server computer, a key provider may provide the NMD a session key that corresponds to the secure communication session. The NMD may buffer each network packet associated with the secure communication session until the NMD is provided a session key for the secure communication session. The NMD may use the session key to decrypt network packets communicated between the client computer and the server computer. The NMD may then proceed to analyze the secure communication session based on the contents of the decrypted network packets.

Abstract: The present disclosure discloses a message display method and apparatus. The method comprises: receiving unlock information and authenticating the unlock information; and selecting one message from at least one received messages and displaying content of a selected message if it is determined that authentication of the unlock information is passed. That is, in the technical solution as described in the embodiments of the present disclosure, if it is determined that authentication of the unlock information is passed, then one message would be selected directly and its content is displayed, so that flows of displaying the message are simplified and steps of manual operation are reduced, which enables that the message display method as described in the embodiment of the present disclosure become more user-friendly and user experience would be better.

Abstract: A communication to a network location is detected at a computing device. The communication is transmitted to the network location in a manner dependent at least in part on whether the network location is at the computing device or at a different computing device.

Abstract: A method includes detecting, at an interceptor device, a transmission of an encrypted media stream from a first device to a second device. The method also includes intercepting the encrypted media stream, during the transmission, for a simulcast operation associated with the encrypted media stream. The transmission of the encrypted media stream from the first device to the second device is substantially unaffected by the interception. The method further includes simulcasting a version of the encrypted media stream to at least a third device in response to intercepting the encrypted media stream.

Abstract: An access manager manages access to a resource. At a first time, the access manager designates a variable attribute associated with a recurring public event as a shared secret between the access manager and a user. At a second time occurring after the first time, the access manager receives a shared key from the user. As received, the shared key is based on a value of the variable attribute associated with the recurring public event at a most recent recurrence of the recurring public event relative to the second time. The access manager evaluates the shared key. In response to the evaluation, the access manager grants or denies the user access to the resource.

Abstract: A system may include a traffic interception module configured to intercept network traffic of a host device. A traffic virtualization module may be configured to generate a virtual file on the host device containing the intercepted network traffic. A security system interface module may be configured to provide the virtual file to a secure digital security system over a virtualized file interface coupling the host device to the secure digital security system, and to receive instructions to allow or to deny the network traffic from the secure digital security system over the virtualized file interface. A traffic access management module may be configured to allow or to deny the network traffic based on the instructions.

Abstract: Protecting newly restored clients from computer viruses is described. A system identifies a backed-up version of anti-virus software associated with a backup copy of a data set for a client. The system receives a request to restore the data set for the client. The system determines whether the backed-up version of the anti-virus software comprises a most recent version of the anti-virus software. The system restores the data set for the client based on the most recent version of the anti-virus software in response to a determination that the backed-up version of the anti-virus software does not comprise the most recent version of the anti-virus software.

Abstract: According to an embodiment, an information processing device includes a first manager, a second manager, and a generator. The first manager loads a first class of a first object that requests execution of methods contained in a second object and a third class of a limiter configured to limit access from the first object to the methods. The second manager loads a second class of the second object. The generator generates the second object from the second class upon receiving a generation request for generating the second object from the first object, generates the limiter from the second object and the third class, and transmits the limiter to the first object.

Abstract: The present invention provides for streamlined issuance of certificates and other tokens that are contingent on key attestation of keys from a trusted platform module within a computing platform. Various methods are described for wrapping the requested token in a secret, such as an AES key, that is encrypted to a TPM based key in a key challenge. If the requesting platform fails the key challenge, the encrypted certificate or token cannot be decrypted. If requesting platform passes the challenge, the encrypted certificate or token can be decrypted using the AES key recovered from the key challenge.

Abstract: An endpoint security agent facilitates a security policy on an endpoint computing device. The endpoint agent comprises an engine and one or more plugins that each provide a particular security feature. The endpoint agent receives a policy from a cloud server specifying one or more plug-ins used by the policy and configuration of those plug-ins. The endpoint agent retrieves, installs, and configures the one or more plugins. The endpoint agent updates a communication table with command subscription information obtained from each installed plugin indicating command types subscribed to by each plug-in. When a command is received, a lookup of the command type is performed in the table, and the command is sent to the subscribing plugin.

Abstract: A method for providing an administration policy to a user device comprising a plurality of applications, the method comprising centrally generating the administration policy to be implemented in the user device, the administration policy comprising at least one of an application administration policy to be used by at least one of the plurality of applications and a client administration policy for the user device; and providing the generated policy to the user device.

Abstract: Disclosed are a client, a server, an RADIUS capability negotiation method and system, and the method includes: a client transmits to a server a first message carrying RADIUS capability parameters of the client; the server captures the RADIUS capability parameters in the first message, matches the RADIUS capability parameters in the first message with RADIUS capability parameters of the server to obtain a matching result, and transmits the matching result to the client through a second message; and the client determines whether to establish effective communication with the server according to the matching result in the second message. By means of the technical solutions of the disclosure, it is possible to extend the RADIUS protocol, and to solve the problem existing in the current RADIUS protocol that both sides in communication cannot perform RADIUS capability negotiation.

Abstract: A method of providing a client with a privileged access ticket (PAT) to access a target service is performed at a credentials management service (CMS) in communication with a client and an authentication service. The CMS receives a privileged access ticket request from the client. The PAT request uses authentication credentials. The CMS retrieves privileged credentials using the authentication credentials, and sends a PAT request to the authentication service using the privileged credentials. When the PAT is received, the CMS forwards the PAT to the client. Optionally, in order to acquire a PAT the CMS sends a privileged provisioning ticket (PPT) request using the privileged credentials to the authentication service, and, after the PPT is received, requests the PAT from the authentication service using the PPT.

Abstract: A computer implemented system and method of sharing files between a link sharer and a link recipient over a network. The method comprises generating, in response to a request by a link sharer, a file sharing link to a file set, where the link does not provide a link recipient the ability to modify the contents of the linked file set. In response to receiving an indication that the generated link has been activated by a link recipient, displaying a representation of the linked file set with a display element configured to send a request for modification rights to the linked file set when activated by the link recipient. In response to receiving the request for modification rights, either automatically granting modification rights to the linked file set or sending notice to the link sharer indicating that the link recipient is requesting modification rights to the linked file set.

Abstract: One or more embodiments of techniques or systems for intelligent data presentation are provided herein. Data can be presented on similar devices having different characteristics in different manners. For example, data may be rendered in a first manner on a first device having one monitor, the same data may be rendered in a second manner on a second device having two displays or a different display size. Financial information, sales data, banking information, etc. may be presented in a variety of ways based on capabilities or properties of a device accessing the information or data. Similarly, renderings may be selected based on interaction capabilities or interaction options a user may have with different renderings or presentations. In other embodiments, user interaction with an automated teller machine (ATM), call center, vehicle, or other interface can be based on device properties or device capabilities.

Abstract: A data protector is described. In an implementation, the data protector promotes and enforces a data retention policy of a data consumer. In an implementation, the data protector limits access to sensitive data to the data consumers. A key manager provides a time-limited encryption key to the data protector. Responsive to collection of the time-limited encryption key from the key manager and sensitive data from a data provider, the data protector encrypts the sensitive data with the time-limited encryption key effective to produce encrypted sensitive data. In some embodiments, the data protector provides a data consumer with access to the encrypted sensitive data and the key manager provides the data consumer with access to the time-limited encryption key to decrypt the encrypted sensitive data. The key manager deletes the time-limited encryption key in compliance with the data retention policy of the data consumer.

Abstract: A network control apparatus and method is provided. The method includes operations of informing a server of capability information including an encryption/decryption method, wherein the server provides the network control apparatus with control information used to control a network device using a general-purpose control web application, transmitting to the server a control information requesting message that requests the control information, receiving from the server the control information which has been encrypted using the encryption/decryption method, decrypting the encrypted control information according to the encryption/decryption method, and transmitting a control command for controlling the network device according to the decrypted control information.

Abstract: Entity group behavior profiling. An entity group is created that includes multiple entities, where each entity represents one of a user, a machine, and a service. A behavior profile is created for each one of the entities of the entity group. The behavior of each of one of the entities of the entity group is monitored to detect behavior change. An indicator of compromise is detected based on multiple ones of the entities experiencing substantially a same behavior change.

Abstract: In an example, there is disclosed a computing apparatus, comprising: a trusted execution environment (TEE); and a security engine operable to: identify a key negotiation for an encrypted connection between a first device and a second device; request a service appliance key for the key negotiation; receive the service appliance key; and perform a service appliance function on traffic between the first device and the second device. There is also disclosed a method of providing the security engine, and a computer-readable medium having stored thereon executable instructions for providing the security engine.