Abstract: A building management system includes a communications bus, subordinate devices connected to the communications bus, and a controller connected to the communications bus. The controller includes an active node table including a plurality of nodes, each node representing one of the subordinate devices connected to the communications bus. The controller is configured to monitor the active node table for a newly connected subordinate device, use a set of rules to determine whether the newly connected subordinate device is supported by the controller for performing an identified function in combination with the controller, and, in response to a determination that the newly connected subordinate device is supported, extend the identified function of the controller to the newly connected subordinate device. Extending the identified function includes enabling the newly connected subordinate device to perform the identified function.

Abstract: To protect confidential data, a mobile device determines whether the mobile device is at a location susceptible to visual capture of confidential data entered into the phone by external cameras. The mobile device determines whether focus of a display is on a field in which confidential data is entered. If the mobile device determines that it is at a location susceptible to an external imaging device visually capturing confidential data input into the input field, then the mobile device activate a light source on a same side as the screen presenting the display.

Abstract: An equipment controller in a building management system (BMS) includes a feature detector and a dynamic point list generator. The feature detector is configured to receive sensor input from a sensor and determine a set of features available to the equipment controller based on the sensor input. The dynamic point list generator is configured to determine unavailable features based on the set of available features and identify one or more points in a complete point list associated with the set of unavailable features. The dynamic point list generator is configured to generate a dynamic point list by removing the identified points from the complete point list and expose the dynamic point list to a BMS controller communicably connected to the equipment controller.

Abstract: A display is presented on a screen of a mobile device having an electromagnetic radiation source. The electromagnetic radiation source is activated while confidential data is being input in an input field of the display. The electromagnetic radiation source is deactivated after completion of the confidential data in the input field of the display.

Abstract: Techniques are disclosed relating to tokenized account information with integrated authentication. In some embodiments, a shared secret key is used for tokenization and authentication. In some embodiments, a payment device stores an encrypted version of the secret key and decrypts the secret key based on a user-provided password. In some embodiments, the payment device uses the secret key and a moving factor to generate a limited-use password. In some embodiments, the payment device uses the limited-use password to modify a first identifier of an account of the user. In some embodiments, the authentication system retrieves a stored version of the secret key and a copy of the account number using a second identifier. In some embodiments, the authentication system generates the limited-use password based on the stored secret key and a moving factor, de-tokenizes the modified first identifier, and compares the result with the retrieved copy of the account number.

Abstract: A processor of a user terminal performs operations that include obtaining a user identifier for a user operating the user terminal, measuring an initial operational performance metric of the user terminal, generating an initial terminal metric identifier from the initial operational performance metric, and communicating with a content server to register a combination of the initial terminal metric identifier and the user identifier for authorized access to content identified by a content identifier through the content server. Responsive to a request to access the content, a present operational performance metric of the user terminal is measured. A present terminal metric identifier is generated based on the present operational performance metric, and a combination of the user identifier and the present terminal metric identifier are communicated to the content server to request that the user using the user terminal be granted access through the content server to the content.

Abstract: A method includes performing, by a processor of a network controller of a network: storing device identifications corresponding to respective ones of a plurality of devices connected via the network, respectively, storing an association between a first one and a second one of the plurality of devices, the association being represented as a pairing identification code corresponding to the first and second ones of the plurality of devices, receiving a communication from an intruder device, the communication comprising the device identification corresponding to one of the first and the second ones of the plurality of devices, sending a request to the intruder device to communicate the pairing identification code, and denying access to the network to the intruder device responsive to the intruder device failing to communicate the pairing identification code.

Abstract: In accordance with the teachings of the present disclosure, a method is provided for reducing the chances of shoulder surfing. The method may include determining an approximate angle of orientation of a mobile device and selecting one of first or second input key layouts, based upon the approximate angle of orientation. The first input key layout may be a standard layout of alphanumeric characters and the second input key layout may be a disordered layout of the alphanumeric characters. The method may also include displaying the selected one of the first or second input key layouts at a graphical user interface of the mobile device and receiving an input of sensitive information at the graphical user interface.

Abstract: A method includes performing, by a processor of a network controller of a network: storing device identifications corresponding to respective ones of a plurality of devices connected via the network, respectively, storing an association between a first one and a second one of the plurality of devices, the association being represented as a pairing identification code corresponding to the first and second ones of the plurality of devices, receiving a communication from an intruder device, the communication comprising the device identification corresponding to one of the first and the second ones of the plurality of devices, sending a request to the intruder device to communicate the pairing identification code, and denying access to the network to the intruder device responsive to the intruder device failing to communicate the pairing identification code.

Abstract: A system for self-provisioning building equipment includes a main control unit having a processing circuit and a data communications interface and an auxiliary control unit connected with the main control unit via a communications network. The system includes a memory device having an update file stored therein. The update file includes a plurality of partitions, each partition containing provisioning data for a programmable component of the main control unit or the auxiliary control unit. The processing circuit includes a provisioning manager configured to monitor the main control unit and the auxiliary control unit for a predetermined trigger and automatically initiate a provisioning process in response to detecting the predetermined trigger. The provisioning process includes providing the provisioning data from the update file to the programmable component of the main control unit or the auxiliary control unit.

Abstract: A display is presented on a screen of a mobile device having an electromagnetic radiation source. The electromagnetic radiation source is activated while confidential data is being input in an input field of the display. The electromagnetic radiation source is deactivated after completion of the confidential data in the input field of the display.

Abstract: A method, performed by an authentication processor of a first network device, includes receiving a first message through a network interface circuit from a second network device. The first message contains a first data unit to be operated upon by the first network device. A second message is received through the network interface circuit from the second network device. The second message contains a reported authentication token for the second network device and a second data unit to be operated upon by the first network device. The first message is received before receipt of the second message. A check authentication token is generated based on hashing the first data unit. A command that controls operation of the first network device is selectively performed on the second data unit based on whether the check authentication token matches the reported authentication token.

Abstract: A device unlock pattern (“pattern password”) is static in that the same pattern is entered each time to unlock a device. Due to this repetition, a pattern password may be discovered by an application that captures touchscreen gestures, by inspection of fingerprints or smudges on a screen, or simply by an onlooker that views the pattern password being entered. A variable hint pattern can be used to impede discovery. A hint pattern is a sub-pattern (“hint”) of the pattern password to be completed for device unlock. A variable hint pattern can impede discovery by changing the sub-pattern at a defined change threshold related to unlock attempts. The device can randomly change the sub-pattern or randomly change the missing portions of the pattern password at each change threshold. As a result, different inputs complete the pattern password. This variance stymies the methods typically used to discover pattern passwords.

Abstract: A first mobile terminal processes video data from a camera of the first mobile terminal to identify occurrence of a second mobile terminal being aligned to electronically image a display device of the first mobile terminal. Responsive to identifying occurrence of the second mobile terminal being aligned to electronically image the display device, the first mobile terminal controls operation of the display device of the first mobile terminal to interfere with an ability of the second mobile terminal to be operated to electronically image the display device. Related mobile terminals and computer program products are disclosed.

Abstract: A method includes performing operations as follows on a processor: receiving a request for a content item from a mobile device, determining that the content item is protected by a security policy, the security policy comprising an environmental factor associated with the use of the mobile device, ghosting a portion of the content item based on the security policy, and sending the content item and the security policy to the mobile device.

Abstract: A method for receiving a first access request from a client computer is described. The method comprises, in response to receiving the first access request, generating a query string comprising a predetermined number of characters, designating, via a unique indicator, a first randomized subset of the predetermined number of characters, wherein the first randomized subset comprises a plurality of the predetermined number of characters, and requesting a first predefined response comprising the first randomized subset of the predetermined number of characters. The method further comprises receiving a first client input from the client computer, determining whether the first client input matches the first predefined response, and accepting the first access request if the first client input matches the first predefined response.