Abstract: In one aspect, authentication information is received from a first processing device in a second processing device, and a digital signature is generated in the second processing device by signing data that incorporates at least a portion of the received authentication information. The received authentication information is generated at least in part from a secret seed stored in the first processing device. The received authentication information may be combined with the digital signature generated by the second processing device to form a joint signature that is transmitted to an authentication server. In an illustrative embodiment, the received authentication information comprises a tokencode and the digital signature is generated by signing data that incorporates the tokencode. The data that is signed to generate the digital signature may comprise an electronic document having the tokencode appended thereto.

Abstract: In one aspect, authentication information is received from a first processing device in a second processing device, and a digital signature is generated in the second processing device by signing data that incorporates at least a portion of the received authentication information. The received authentication information is generated at least in part from a secret seed stored in the first processing device. The received authentication information may be combined with the digital signature generated by the second processing device to form a joint signature that is transmitted to an authentication server. In an illustrative embodiment, the received authentication information comprises a tokencode and the digital signature is generated by signing data that incorporates the tokencode. The data that is signed to generate the digital signature may comprise an electronic document having the tokencode appended thereto.

Abstract: In one aspect, one or more key-encapsulating ciphertexts are generated and stored in a processing device. The processing device receives authentication information from another processing device, and utilizes the authentication information to decrypt at least one of the key-encapsulating ciphertexts to recover an associated key. The authentication information may comprise, for example, a tokencode. In an illustrative embodiment, the authentication information may comprise a plurality of gradually rotating keys with overlapping refresh intervals. As a more particular example, the authentication information may comprise a plurality of hash chains wherein successive ones of the hash chains overlap one another in a designated number of time steps.

Abstract: Example embodiments of the present invention provide a method, apparatus and computer program product for determining a share of power consumption by an application executing on a server. The method includes obtaining metrics relating to operation of the server and obtaining metrics relating to server resource utilization attributable to the application. A transformation is then performed using the metrics relating to operation of the server and server resource utilization attributable to the application to determine the respective share of power consumption by the application executing on the server. Additionally, greenhouse-gases attributable to the application also may be calculated.

Abstract: A method is used in managing security of source code. Source code characteristics are derived from a source code change. Based on the source code characteristics, risk information associated with the source code change is produced.

Abstract: There is disclosed a method and system for use in authenticating an entity. An authentication request is received from the entity. An input signal is received from a communications device associated with the entity. The input signal comprises the current location of the communications device. The current location of the communications device is derived from the input signal. Based on the current location of the communications device, an event is detected at substantially the same location as the current location of the communications device. An analysis is performed between the current location of the communications device and the event. An authentication result is generated based on the analysis between the current location of the communications device and the event. The authentication result can be used for authenticating the entity.

Abstract: A method, system and computer program product for use in managing policies is disclosed. Policies associated with a communications device are correlated with respective locations. The location of the communications device is determined. The policy correlated with the determined location is applied to the communications device.

Abstract: Improved techniques involve selecting a set of authentication factors from among multiple factors based on a current situation and information about how well the multiple authentication factors have worked in similar situations in the past. Along these lines, when an authentication system performs an authentication operation on a requesting party, the authentication system first assesses a situational environment. Based on the assessment of the situational environment, the authentication system decides that it is necessary to re-authenticate the requesting party. In some arrangements, the authentication system may determine which set of factors has the highest likelihood of successfully verifying the user's identity when compared with other authentication factors. The authentication system then carries out an authentication operation on the selected set of factors and bases a successful authentication result on whether the selected set of factors can be verified.

Abstract: There is disclosed a method, system and a computer program product for use in authenticating an entity. An authentication request is received from the entity. Information in connection with the entity is acquired from an external source. Based on the information, a risk score is set such that the riskiness of the authentication request can be readily deduced therefrom.

Abstract: A technique provides access control on a mobile device (e.g., a smart phone, a tablet, etc.). The technique involves displaying an image on a touch screen of the mobile device. The technique further involves, while the image is displayed on the touch screen, receiving user input from a user. The user input includes user gestures applied to the touch screen over the displayed image. The technique further involves performing an access control operation which provides an access control result based on the user input, the access control result (i) providing access to a set of protected resources when the user input matches expected input and (ii) denying access to the set of protected resources when the user input does not match the expected input.

Abstract: A processing device comprises a processor coupled to a memory and is configured to obtain a credential associated with a particular access control interval, to determine an application programming interface (API) key based at least in part on the credential, and to utilize the API key in an API key enrollment protocol. The obtaining, determining and utilizing are repeated for one or more additional instances of the API key enrollment protocol corresponding to respective ones of one or more additional access control intervals. The processing device illustratively comprises a service requester device configured to carry out at least a portion of a given instance of the API key enrollment protocol with a service provider device. The API key may comprise, for example, the credential itself, or a function of the credential and other information. The credential may comprise, again by way of example, an intermediate value of a hash chain.

Abstract: A processing device comprises a processor coupled to a memory and is configured to obtain a credential associated with a particular access control interval, to insert information derived from the credential into one or more messages of a remote management interface protocol, to transmit the one or more messages to a managed device, and to remotely control the managed device responsive to a successful authentication based at least in part on the inserted information. The one or more messages of the remote management interface protocol are illustratively compliant with a designated Intelligent Platform Management Interface (IPMI) specification. The credential associated with the particular access control interval may be generated based at least in part on a corresponding intermediate value of a hash chain. For example, the credential may be generated based at least in part on a message authentication code and the corresponding intermediate value of a hash chain.

Abstract: A technique provides user authentication using a smart device (e.g., a smart phone, a tablet, etc.). The technique involves displaying, by processing circuitry of a smart device, a password prompt on a touch screen of the smart device. The password prompt includes a motion video of touch screen gestures to prompt a user of the smart device to enter a gesture password. The technique further involves receiving, by the processing circuitry, a trial gesture password entered by the user via the touch screen. The trial gesture password includes a user-entered sequence of touch screen gestures. The technique further involves performing, by the processing circuitry, multiple gesture password confirmation operations to verify that the user is able to re-enter the trial gesture password via the touch screen over time to authenticate the user to the smart device.

Abstract: Methods, apparatus and articles of manufacture for adding entropy to key generation on a mobile device are provided herein. A method includes generating a prompt via a computing device interface in connection with an authentication request to access a protected resource associated with the computing device; processing input cryptographic information entered via the computing device interface in response to the prompt against a pre-determined set of cryptographic information, wherein said pre-determined set of cryptographic information comprises one or more input elements and one or more interface manipulation measures associated with the one or more input elements; and resolving the authentication request based on said processing.

Abstract: There is disclosed a method and system for use in authenticating an entity. An entity location history is stored comprising a historical record of locations visited by the entity. An authentication request is received from the entity. A pattern of recent locations visited by the entity indicative of irregular behavior is detected. An analysis is performed between the pattern of recent locations indicative of irregular behavior and the entity location history for establishing the riskiness of the authentication request. An authentication result is generated based on the analysis between the pattern of recent locations indicative of irregular behavior and the entity location history.

Abstract: A technique transfers soft token authentication capabilities from an old device to a new device. The technique involves receiving a transfer initiation message from the old device while the old device is currently provisioned with the soft token authentication capabilities. The transfer initiation message includes new device binding information obtained by the old device from the new device. The technique further involves providing a reply message to the old device in response to the transfer initiation message. The reply message directs the old device to supply an authentication code to the new device, the authentication code being based on the new device binding information. The technique further involves receiving, from the new device, a provisioning message including the authentication code, and provisioning the new device with the soft token authentication capabilities in response to receipt of the provisioning message from the new device.

Abstract: A technique provides access control. The technique involves prompting a user to enter color-shape pairings, and receiving multiple color-shape pairings from the user. Each color-shape pairing includes (i) a color selection from multiple selectable colors and (ii) a shape selection from multiple selectable shapes. The technique further involves generating an access control result based on the received multiple color-shape pairings, the access control result controlling access to a set of protected resources. For example, color segments can be displayed on a touch screen in the form of a color wheel, and multiple shapes can be rendered within each color segment. Alternatively, (i) a color palette including the multiple selectable colors and (ii) a shape menu including the multiple selectable shapes can be rendered on the touch screen to prompt the user to provide drag and drop gestures over the touch screen. Other configurations are suitable for use as well.

Abstract: A technique controls access to a protected resource. The technique involves providing a tokencode prompt to a user. The tokencode prompt requests a tokencode from an electronic token in possession of the user. The technique further involves receiving, in response to the tokencode prompt, a current tokencode from the electronic token in possession of the user. The technique further involves performing, by a SOHO device having an embedded tokencode authentication server, an authentication operation based on the current tokencode. A result of the authentication operation (i) permits the user to access the protected resource when the authentication operation determines that the user is legitimate and (ii) denies the user access to the protected resource when the authentication operation determines that the user is not legitimate. For example, the SOHO device may be a NAS device or a firewall device which with tokencode authentication capabilities.

Abstract: An improved technique involves combining a random seed with unique identifying information to form an input into a RNG. Along these lines, a key pair generator obtains a primary random seed through an interaction with a random process from a web server on which the key pair generator runs. Before putting the primary random seed into a RNG, however, the key pair generator obtains a web domain name that uniquely identifies the web server. The key pair generator concatenates the web domain name, the primary random seed, and an epoch time to produce a secondary random seed. The key pair generator inputs the secondary random seed into the RNG, obtains a large integer output, and finds a first prime factor of a modulus of the public key near the large integer through a search technique.

Abstract: A method is used in using spatial diversity with secrets. A spatially diverse presentation is presented. A reaction of a user to the spatially diverse presentation is received and analyzed. The analysis is used as a basis for helping to determine whether the user has knowledge of a secret.