Abstract: The invention relates to a sparse LMS method combining zero attraction penalty and attraction compensation which belongs to the field of signal processing.

Abstract: Method, device and computer program product for providing quarantined workspaces. A virtualization application operates on a host to simulate a virtual guest. A management application operates within the virtual guest. The management application controls transmission between guest applications and locations external to the virtual guest. The management application stores encryption keys inaccessible to the host. The management application intercepts attempted transmissions from guest applications to locations outside the virtual guest. Secure data files are identified in the attempted transmissions and encrypted before leaving the virtual guest using the encryption keys. The management application also prevents any unencrypted data from being provided to non-kernel host processes that have not been previously identified as permitted host processes while allowing unencrypted data transmission from the non-kernel host processes to any of the guest application processes.

Abstract: Systems and method are provided for data self-protection. The systems and methods may involve installing a sentry on a computer system, the sentry including a file system filter installed on a kernel of that computer system; providing a central sentry platform in communication with the sentry, operating the central sentry platform to send a data self-protection policy to the sentry, the data self-protection policy being encrypted so that it can only be modified by the central sentry platform; operating the file system filter to control access to encrypted data stored on the computer system, by, for each process making a file access request to the encrypted data, the file system filter receiving and handling that file access request according to the data self-protection policy; and, operating the central sentry platform to monitor the sentry and to receive information from the sentry regarding access to the encrypted data.

Abstract: The described embodiments relate to data protection methods, systems, and computer program products. A process-based encrypted data access policing system is proposed based on methods of encrypted data file management, process authentication and authorization, Trojan detection for authorized processes, encryption key generation and caching, and encrypted-file cache management. The process-based encrypted data access policing system may be implemented as a kernel level file system filter and a user-mode filter companion application, which polices the reading/writing of encrypted data in either a server system or an endpoint computer and protects data from data breaches and known or unknown attacks including ransomware and/or phishing attacks.

Abstract: An access control system includes a processor configured to provide a trusted execution environment isolated from a rich execution environment. A rich OS operates in the rich execution environment while a trusted OS operates in the trusted execution environment. A plurality of protected data files are stored in non-volatile memory. When a process requests access to a protected data file, the computer system can permit the requesting process to access the requested data file only if a validated application token is present that corresponds to the requesting process. An application token is generated for the associated application by: detecting initiation of a first process associated with the associated application; determining that a valid user code is available within the trusted execution environment; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment.

Abstract: An access control system includes a processor configured to provide a trusted execution environment isolated from a rich execution environment. A rich OS operates in the rich execution environment while a trusted OS operates in the trusted execution environment. An access monitoring module operates within the kernel of the rich OS and a trusted application operates in the trusted OS. The access monitoring module intercepts file requests directed at the file systems of the rich OS, and forwards the file requests to the trusted application. The trusted application then evaluates whether the file request is permitted and provides the access monitoring module with a response. The access monitoring module forwards the request to the file system only if the trusted application approves the request.

Abstract: Method, device and computer program product for providing quarantined workspaces. A virtualization application operates on a host to simulate a virtual guest. A management application operates within the virtual guest. The management application controls transmission between guest applications and locations external to the virtual guest. The management application stores encryption keys inaccessible to the host. The management application intercepts attempted transmissions from guest applications to locations outside the virtual guest. Secure data files are identified in the attempted transmissions and encrypted before leaving the virtual guest using the encryption keys. The management application also prevents any unencrypted data from being provided to non-kernel host processes that have not been previously identified as permitted host processes while allowing unencrypted data transmission from the non-kernel host processes to any of the guest application processes.

Abstract: Systems and method are provided for data self-protection. The systems and methods may involve installing a sentry on a computer system, the sentry including a file system filter installed on a kernel of that computer system; providing a central sentry platform in communication with the sentry, operating the central sentry platform to send a data self-protection policy to the sentry, the data self-protection policy being encrypted so that it can only be modified by the central sentry platform; operating the file system filter to control access to encrypted data stored on the computer system, by, for each process making a file access request to the encrypted data, the file system filter receiving and handling that file access request according to the data self-protection policy; and, operating the central sentry platform to monitor the sentry and to receive information from the sentry regarding access to the encrypted data.

Abstract: An access control system includes a processor configured to provide a trusted execution environment isolated from a rich execution environment. A rich OS operates in the rich execution environment while a trusted OS operates in the trusted execution environment. A plurality of protected data files are stored in non-volatile memory. When a process requests access to a protected data file, the computer system can permit the requesting process to access the requested data file only if a validated application token is present that corresponds to the requesting process. An application token is generated for the associated application by: detecting initiation of a first process associated with the associated application; determining that a valid user code is available within the trusted execution environment; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment.

Abstract: An access control system includes a processor configured to provide a trusted execution environment isolated from a rich execution environment. A rich OS operates in the rich execution environment while a trusted OS operates in the trusted execution environment. An access monitoring module operates within the kernel of the rich OS and a trusted application operates in the trusted OS. The access monitoring module intercepts file requests directed at the file systems of the rich OS, and forwards the file requests to the trusted application. The trusted application then evaluates whether the file request is permitted and provides the access monitoring module with a response. The access monitoring module forwards the request to the file system only if the trusted application approves the request.

Abstract: The described embodiments relate to method and products for organizing a plurality of images. Specifically, the methods and products can automatically organize a plurality of images into a plurality of groups of images using allocation criteria. The allocation criteria for each image include a similarity distance between that image and at least one other image that measures how similar those images are. Each image can be allocated to at least one similar image group based on the similarity distance. The methods and products can also be used to visualize and display representative images for each of the groups of images.

Abstract: The described embodiments relate to method and products for organizing a plurality of images. Specifically, the methods and products can automatically organize a plurality of images into a plurality of groups of images using allocation criteria. The allocation criteria for each image include a similarity distance between that image and at least one other image that measures how similar those images are. Each image can be allocated to at least one similar image group based on the similarity distance. The methods and products can also be used to visualize and display representative images for each of the groups of images.

Abstract: Systems, methods and computer program products for determining perceptual similarity between independent images are described. The described systems, methods and computer program products use a similarity distance to determine the perceptual similarity between a first image having a first arrangement of pixels and a second image having a second arrangement of pixels. A processor can determine a first image array corresponding to the first arrangement of pixels and a second image array corresponding of the second arrangement of pixels. The processor can generate a first pixel group set based on the first image array and a second pixel group set based on the second image array. A plurality of pixel group pairs can be generated, and each pixel group pair can be associated with a corresponding pixel group pair distortion. The similarity distance between the first image and the second image can be determined based on the plurality of pixel group pair distortions.

Abstract: The described embodiments relate to data protection methods, systems, and computer program products. A process-based encrypted data access policing system is proposed based on methods of encrypted data file management, process authentication and authorization, Trojan detection for authorized processes, encryption key generation and caching, and encrypted-file cache management. The process-based encrypted data access policing system may be implemented as a kernel level file system filter and a user-mode filter companion application, which polices the reading/writing of encrypted data in either a server system or an endpoint computer and protects data from data breaches and known or unknown attacks including ransomware and/or phishing attacks.

Abstract: The described embodiments relate to methods, systems, and products for providing verification code recovery and remote authentication for a plurality of devices configured for electronic communication with a server. Specifically, in the methods, systems, and products, the user entrusts information about the user's verification code to the service provider, and only with cooperation between the user and the service provider can a lost verification code be recovered. The service provider can further authenticate the user before cooperating in the recovery process by way of a time-sensitive authentication sequence that involves the user device.

Abstract: The described embodiments relate to methods, systems, and products for providing verification code recovery and remote authentication for a plurality of devices configured for electronic communication with a server. Specifically, in the methods, systems, and products, the user entrusts information about the user's verification code to the service provider, and only with cooperation between the user and the service provider can a lost verification code be recovered. The service provider can further authenticate the user before cooperating in the recovery process by way of a time-sensitive authentication sequence that involves the user device.

Abstract: The described embodiments relate to methods, systems, and products for providing data protection and encryption on a plurality of devices configured for electronic communication with a server. Specifically, the methods, systems, and products can automatically and securely synchronize a user's file encryption/decryption keys across a plurality of devices, authenticating the user on each device before receiving and processing information from the server necessary to recreate the user's file encryption/decryption keys.

Abstract: The described embodiments relate to methods, systems, and products for providing verification code recovery and remote authentication for a plurality of devices configured for electronic communication with a server. Specifically, in the methods, systems, and products, the user entrusts information about the user's verification code to the service provider, and only with cooperation between the user and the service provider can a lost verification code be recovered. The service provider can further authenticate the user before cooperating in the recovery process by way of a time-sensitive authentication sequence that involves the user device.

Abstract: Encoding input data including one or more frames includes: generating a residual block based on a difference between a first block of data for multiple pixels in a first frame and a second block of data derived from information in the input data; generating a first block of coefficients based on a transform performed on the residual block; generating reference information based on the second block of data; and determining portions of a code value representing respective portions of the first block of coefficients based on at least one value derived from at least a portion of the reference information.

Abstract: Systems, methods and computer program products for determining perceptual similarity between independent images are described. The described systems, methods and computer program products use a similarity distance to determine the perceptual similarity between a first image having a first arrangement of pixels and a second image having a second arrangement of pixels. A processor can determine a first image array corresponding to the first arrangement of pixels and a second image array corresponding of the second arrangement of pixels. The processor can generate a first pixel group set based on the first image array and a second pixel group set based on the second image array. A plurality of pixel group pairs can be generated, and each pixel group pair can be associated with a corresponding pixel group pair distortion. The similarity distance between the first image and the second image can be determined based on the plurality of pixel group pair distortions.