Abstract: A visual data transfer channel is established between a mobile device and a computing entity to facilitate a decoupled cryptographic scheme. The mobile device stores a private key. In operation, a first code is received by the mobile device over the channel. The first code encodes a cryptographic value that secures other information that has been received or generated at the computing entity. The mobile device private key is then applied to the cryptographic value to generate a second cryptographic value, which is encoded to generate a second code. The second code is then rendered on the mobile device display, from which it can then be transmitted back over the visual channel to the computing entity. At the computing entity, the second cryptographic value is recovered from the second code.

Abstract: A technique to update URLs is provided in an HTTP-based client upon receipt of an HTTP redirect in response to a request-URI. One or more references to the request-URI are saved in or in association with the client. Upon receipt of an HTTP 301 (permanent) redirect, the client automatically re-links the one or more stored references to the request-URI to one or more new references returned by the server (as identified in the HTTP redirect) when the redirect can be verified to originate from the application to which the client is attempting to connect. Preferably, the automatic re-linking is accomplished using a link editing capability for permanent (e.g., HTTP 301) redirects.

Abstract: The different illustrative embodiments provide a method, computer program product, and apparatus for managing an authentication request. A determination is made whether additional authentication is to be performed responsive to receiving the authentication request to access an application from a mobile device. A phone number to call is sent to the mobile device responsive to a determination that the additional authentication is to be performed. A determination is made whether an incoming call to the phone number is from the mobile device and within a selected period of time. The authentication request to access the application from the mobile device is granted responsive to a determination that the incoming call to the phone number is from the mobile device and within the selected period of time.

Abstract: The different illustrative embodiments provide a method, computer program product, and apparatus for managing an authentication request. A determination is made whether additional authentication is to be performed responsive to receiving the authentication request to access an application from a mobile device. A phone number to call is sent to the mobile device responsive to a determination that the additional authentication is to be performed. A determination is made whether an incoming call to the phone number is from the mobile device and within a selected period of time. The authentication request to access the application from the mobile device is granted responsive to a determination that the incoming call to the phone number is from the mobile device and within the selected period of time.

Abstract: A web application user is authenticated directly upon selecting a link in a notification email. In this approach, the user's web browser stores a first data string provided by the web application (e.g., in a cookie) during a prior session. The first data string encodes first data about the user that can be verified by the application. Later, the user receives the notification email that includes the link. The link encodes a second data string from which second data about the user can be verified by the application. When the end user selects the link, an authentication request is transmitted to the application. The authentication request includes both the first and second data strings. If both the first data and the second data (as obtained from their respective data strings) can be verified, the user is authenticated without having to perform any additional steps (e.g., manual entry of credentials).

Abstract: A visual data transfer channel is established between a mobile device and a computing entity to facilitate a decoupled cryptographic scheme. The mobile device stores a private key. In operation, a first code is received by the mobile device over the channel. The first code encodes a cryptographic value that secures other information that has been received or generated at the computing entity. The mobile device private key is then applied to the cryptographic value to generate a second cryptographic value, which is encoded to generate a second code. The second code is then rendered on the mobile device display, from which it can then be transmitted back over the visual channel to the computing entity. At the computing entity, the second cryptographic value is recovered from the second code.

Abstract: Enabling discretionary data access control in a cloud computing environment can begin with the obtainment of a data request and response message by an access manager service. The response message can be generated by a data storage service in response to the data request. The access manager service can identify owner-specified access rules and/or access exceptions applicable to the data request. An access response can be determined using the applicable owner-specified access rules and/or access exceptions. Both the response message and the access response can indicate the allowance or denial of access to the requested data artifact. The access response can be compared to the response message. If the access response does not match the response message, the response message can be overridden to express the access response. If the access response matches the response message, the response message can be conveyed to the originating entity of the data request.

Abstract: A technique that identifies registered or guest users in web meetings. Registered and guest users are provided different forms of a meeting invite URL. A guest user receives a unique URL for the meeting that is generated with a nonce value associated with the user's contact information. The nonce value does not expose the contact information. To join the web meeting, each registered user follows a common web meeting link and authenticates. Information obtained during authentication is used to identify the registered user, whose identity is then displayed. Each guest user follows his or her unique URL to join the meeting. The web meeting service receives the nonce in the unique URL and maps it to the guest user's contact details. The service displays the guest user's contact details as the guest user's identity.

Abstract: An embodiment of the invention includes initially registering information with a data system, wherein the registered information pertains to a user of a mobile device and includes credential information, and further includes a message address associated with the user. An enrollment request, together with the specified credential information, is sent to a management server. Responsive thereto, the server sends a message of specified type to the message address associated with the user, wherein such message includes a pin code. The pin code is then sent from the device to the server, and responsive to receiving the pin code, the server is operated to deliver a security token, for use in authenticating the mobile device to selectively access the particular data processing system.

Abstract: Providing a challenge response test associated with a computer resource includes generating a challenge response test image including providing a first substantially well-formed image, including a first masked image having a visible portion entirely composed of portions of a first well-formed image, and a first plurality of image elements; and providing at least one ill-formed image, each at least one ill-formed image including a second masked image having at least one first ill-formed portion.

Abstract: Enabling discretionary data access control in a cloud computing environment can begin with the obtainment of a data request and response message by an access manager service. The response message can be generated by a data storage service in response to the data request. The access manager service can identify owner-specified access rules and/or access exceptions applicable to the data request. An access response can be determined using the applicable owner-specified access rules and/or access exceptions. Both the response message and the access response can indicate the allowance or denial of access to the requested data artifact. The access response can be compared to the response message. If the access response does not match the response message, the response message can be overridden to express the access response. If the access response matches the response message, the response message can be conveyed to the originating entity of the data request.

Abstract: Enabling discretionary data access control in a cloud computing environment can begin with the obtainment of a data request and response message by an access manager service. The response message can be generated by a data storage service in response to the data request. The access manager service can identify owner-specified access rules and/or access exceptions applicable to the data request. An access response can be determined using the applicable owner-specified access rules and/or access exceptions. Both the response message and the access response can indicate the allowance or denial of access to the requested data artifact. The access response can be compared to the response message. If the access response does not match the response message, the response message can be overridden to express the access response. If the access response matches the response message, the response message can be conveyed to the originating entity of the data request.