Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: A tool and method examine error report information from a computer to determine not only whether a virus or other malware may be present on the computer but also may determine what vulnerability a particular exploit was attempting to use to subvert security mechanism to install the virus. A system monitor may collect both error reports and information about the error report, such as geographic location, hardware configuration, and software/operating system version information to build a profile of the spread of an attack and to be able to issue notifications related to increased data collection for errors, including crashes related to suspected services under attack.

Abstract: A tool and method examine error report information from a computer to determine not only whether a virus or other malware may be present on the computer but also may determine what vulnerability a particular exploit was attempting to use to subvert security mechanism to install the virus. A system monitor may collect both error reports and information about the error report, such as geographic location, hardware configuration, and software/operating system version information to build a profile of the spread of an attack and to be able to issue notifications related to increased data collection for errors, including crashes related to suspected services under attack.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: Techniques are described herein for securely prompting a user to confirm sensitive operations, input sensitive information or the like. The techniques include receiving or intercepting calls from applications to prompting routines. When a call to a prompting routine is received or intercepted a hint may be provided to the user to switch to a secure desktop. When the user switches from the user desktop to the secure desktop the particular prompt is displayed. The input to the prompt is received on the secure desktop and verified to have been provided by the user. The user input or a representation of the input is then returned to the application running on the user desktop. Using these techniques, interception of prompting messages by malware does not result in sensitive information being revealed. Furthermore, spoofing of new messages by malware does not lead to the dismissal of critical prompting.

Abstract: A system for providing a client's credentials to a computer program comprises a database remote from the client and a single signon server module. The single signon server module can receive a request for the client's credentials from the computer program, determine whether the client's credentials are stored in the database, and send the client's credentials from the database to the computer program in response to a determination that the client's credentials are stored in the database. The single signon server module can store the client's credentials in the database in response to a determination that the client's credentials are not stored in the database. The single signon server module can encrypt the client's credentials prior to storing the client's credentials in the database and can decrypt the client's credentials prior to sending the client's credentials to the computer program.

Abstract: Software updates remedy vulnerabilities in a computer program that has been distributed and installed on a plurality of computers. The software updates are distributed in encrypted form, and then, after the encrypted update has been delivered to a sufficient number of machines, the decryption key for the update is delivered. Since the key is relatively small, it can be distributed to a large number of machines very quickly, thereby reducing the amount of time between when the update is first known to the public, and the time at which all or most machines have installed the update to protect against the vulnerability.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: A tool and method examine error report information from a computer to determine not only whether a virus or other malware may be present on the computer but also may determine what vulnerability a particular exploit was attempting to use to subvert security mechanism to install the virus. A system monitor may collect both error reports and information about the error report, such as geographic location, hardware configuration, and software/operating system version information to build a profile of the spread of an attack and to be able to issue notifications related to increased data collection for errors, including crashes related to suspected services under attack.

Abstract: Architecture for distributing rules-based, targeted vulnerability signatures to an application (e.g., a browser) in order to block exploitation of vulnerable objects (e.g., ActiveX controls) or protocols. The architecture provides a significant reduction in the window of vulnerability, thereby improving the user experience in the software products. The solution employs text in a configuration file (a realtime rule), which is fine-grained, works on both vendor-created and third-party controls, and is completely compatible except under attack conditions (and thus quick to deploy with minimal testing). Publication of the rule does not block legal uses of the vulnerable control and would not require a full testing procedure. Further, a vulnerable control with a proper vulnerability signature is as safe as running a fully-fixed control. The architecture can be extended to arbitrary binary behaviors, and shell protocols.

Abstract: Systems and methods are described for use in evaluating an application for security risks related to integer overflow conditions in conjunction with memory allocations. The evaluation includes finding a relationship between data input to the application and memory allocation requests made by the application. Having established the relationship, a memory allocation-requesting module within the application is tested, using input data selected using the relationship.

Abstract: Software updates remedy vulnerabilities in a computer program that has been distributed and installed on a plurality of computers. The software updates are distributed in encrypted form, and then, after the encrypted update has been delivered to a sufficient number of machines, the decryption key for the update is delivered. Since the key is relatively small, it can be distributed to a large number of machines very quickly, thereby reducing the amount of time between when the update is first known to the public, and the time at which all or most machines have installed the update to protect against the vulnerability.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: An electronic commerce system facilitates secure electronic commerce transactions among multiple participants. Each electronic commerce transaction involves at least one commerce document defining the transaction and at least one commerce instrument defining a payment for the transaction. The electronic commerce system has a credential binding server at a trusted credential authority, multiple computing units at associated participants, and a communication system interconnecting the credential binding server and the multiple computing units. The electronic commerce system operates in two phases: a registration phase and a transaction phase. During the registration phase, each of the computing units generate and send a registration packet over the communication system to the credential binding server. Unique credentials are produced by the credential binding server based upon the registration packets sent back to the computing units.

Abstract: The invention provides central storage for core data secrets, referred to as data items. The architecture includes a storage server, a plurality of installable storage providers, and one or more authentication providers. Programming interfaces are exposed so that application programs can utilize the services provided by the invention without having to actually implement the features. When storing a data item using the protected storage services, an application program can specify rules that determine when to allow access to the data item. Access can be limited to specified application programs, to certain classes of application programs, or to application program having certain properties. Such properties for a particular application might include, for example, the publisher of the application and/or the name of the application. These properties might also include properties specified by an authentication certificate associated with the application program.