Abstract: Provided is a system that includes at least one processor programmed or configured to provision a client device for access to an online source of information, transmit a private encryption key of a public/private encryption key pair to a software agent of the client device, receive a first hash value from the software agent, wherein the first hash value is generated using the private encryption key, receive a second hash value from the software agent, determine whether to allow access to the online source of information by the software agent based on the first hash value and the second hash value received from the software agent, process a request to access the online source of information involving the software agent, and store a data record associated with a data transaction involving the online source of information in a data structure. Methods and computer program products are also provided.

Abstract: Provided is a system that includes at least one processor programmed or configured to provision a client device for access to an online source of information, transmit a private encryption key of a public/private encryption key pair to a software agent of the client device, receive a first hash value from the software agent, wherein the first hash value is generated using the private encryption key, receive a second hash value from the software agent, determine whether to allow access to the online source of information by the software agent based on the first hash value and the second hash value received from the software agent, process a request to access the online source of information involving the software agent, and store a data record associated with a data transaction involving the online source of information in a data structure. Methods and computer program products are also provided.

Abstract: Systems and methods for securing user location data are described. A method includes receiving, by a location server computer, an encrypted location from a mobile device. The encrypted location is a location of the mobile device encrypted with a public key. The method then includes receiving, by the location server computer, a location request message from an interaction processing server and partially decrypting, by the location server computer, the encrypted location with a first private key share to form a partially decrypted location. The method further includes transmitting, by the location server computer to the interaction processing server, a location response message with the encrypted location and the partially decrypted location. The interaction processing server then uses the partially decrypted location and the second private key share to form a decrypted location.

Abstract: Embodiments of the disclosure are directed to methods, systems, and devices for the use of portable devices, such as a vehicle driven by a user, that are distinctive physical objects and can be presented to an authentication system for authentication purposes. More specifically, the portable device may be used as a source of information for the authentication system that can be verified. Images may be captured of the portable devices in order to determine their distinctive features for comparison to other physical objects registered to the user. The portable devices may also be a source of metadata, or additional contextual information associated with those portable devices or their interaction with the authentication system. The image data and/or the metadata associated with a portable device can be verified for fraud or risk analysis.

Abstract: Provided is a system that includes at least one processor programmed or configured to provision a client device for access to an online source of information, transmit a private encryption key of a public/private encryption key pair to a software agent of the client device, receive a first hash value from the software agent, wherein the first hash value is generated using the private encryption key, receive a second hash value from the software agent, determine whether to allow access to the online source of information by the software agent based on the first hash value and the second hash value received from the software agent, process a request to access the online source of information involving the software agent, and store a data record associated with a data transaction involving the online source of information in a data structure. Methods and computer program products are also provided.

Abstract: Systems and methods for securing user location data are described. A method includes receiving, by a location server computer, an encrypted location from a mobile device. The encrypted location is a location of the mobile device encrypted with a public key. The method then includes receiving, by the location server computer, a location request message from an interaction processing server and partially decrypting, by the location server computer, the encrypted location with a first private key share to form a partially decrypted location. The method further includes transmitting, by the location server computer to the interaction processing server, a location response message with the encrypted location and the partially decrypted location. The interaction processing server then uses the partially decrypted location and the second private key share to form a decrypted location.

Abstract: Systems and methods for securing user location data are described. A method includes receiving, by a location server computer, an encrypted location from a mobile device. The encrypted location is a location of the mobile device encrypted with a public key. The method then includes receiving, by the location server computer, a location request message from an interaction processing server and partially decrypting, by the location server computer, the encrypted location with a first private key share to form a partially decrypted location. The method further includes transmitting, by the location server computer to the interaction processing server, a location response message with the encrypted location and the partially decrypted location. The interaction processing server then uses the partially decrypted location and the second private key share to form a decrypted location.

Abstract: A method for detecting fraudulent activity includes: generating a fraud control rule associated with a payment account parameter of a payment account; receiving a request message from a user device, where the request message includes social media data associated with a social media account of a user, where the social media data includes unencrypted social media data and encrypted social media data; analyzing the request message for fraudulent activity by analyzing the social media data with respect to the fraud control rule; automatically generating a response message including at least one of: a processing request message associated with the request message in response to the social media data not satisfying the fraud control rule; and a rejection message in response to the social media data satisfying the fraud control rule; and communicating the response message.

Abstract: Systems and methods for securing user location data are described. A method includes receiving, by a location server computer, an encrypted location from a mobile device. The encrypted location is a location of the mobile device encrypted with a public key. The method then includes receiving, by the location server computer, a location request message from an interaction processing server and partially decrypting, by the location server computer, the encrypted location with a first private key share to form a partially decrypted location. The method further includes transmitting, by the location server computer to the interaction processing server, a location response message with the encrypted location and the partially decrypted location. The interaction processing server then uses the partially decrypted location and the second private key share to form a decrypted location.

Abstract: A data object is parsed into payload data packets so that each data packet is capable of being represented in a matrix barcode, sometimes referred to as a QR code. A matrix barcode is generated for each payload data packet and accompanying metadata used to reconstruct the data object. A matrix barcode movie is assembled from individual matrix barcodes. The resulting movie can be projected to a reader that captures the video sequence, examines each frame to extract payload data and corresponding metadata from each frame. The reader then assembles the separate payload data back into the original data object using the metadata and determines an action to take responsive to the data object. For example, a movie may be played, an image displayed, a file opened, or other action may be taken based on the file type and instructions in the metadata.

Abstract: A user state tracking and anomaly detector for multi-tenant SaaS applications operates in association with a log management solution, such as a SIEM. A given SaaS application has many user STATES, and the applications often have dependencies on one another that arise, for example, when a particular application makes a request (typically on behalf of a user) to take some action with respect to another application. The detector includes a mapper that maps the large number of user STATES to a reduced number of mapped states (e.g., “red” and “green”), and a dependency module that generates user-resource dependency graphs. Using a dependency graph, a SaaS modeler in the detector checks whether a particular dependency-based request associated with a SaaS application is valid. State and dependency information generated by the mapper and dependency module are reported back to the log management solution to facilitate improved logging and anomaly detection.

Abstract: This disclosure provides the ability for a cloud application to specify its security requirements, the ability to have those requirements evaluated, e.g., against a specific cloud deployment environment, and the ability to enable the application to control a cloud-based security assurance service to provision additional security technology in the cloud to support deployment (or re-deployment elsewhere) of the application if the environment does not have the necessary topology and security resources deployed. To this end, the application queries the service by passing a set of application-based security rights. If the security capabilities provided by the security assurance service are sufficient or better than the application's security rights, the application functions normally. If, however, the security environment established by the security assurance service is insufficient for the application, the application is afforded one or more remediation options, e.g.

Abstract: A data object is parsed into payload data packets so that each data packet is capable of being represented in a matrix barcode, sometimes referred to as a QR code. A matrix barcode is generated for each payload data packet and accompanying metadata used to reconstruct the data object. A matrix barcode movie is assembled from individual matrix barcodes. The resulting movie can be projected to a reader that captures the video sequence, examines each frame to extract payload data and corresponding metadata from each frame. The reader then assembles the separate payload data back into the original data object using the metadata and determines an action to take responsive to the data object. For example, a movie may be played, an image displayed, a file opened, or other action may be taken based on the file type and instructions in the metadata.

Abstract: Using mobile devices in a gesture based security system is described. An image based feed is received from a camera incorporated in a first mobile device. The first mobile device is in communication with the gesture based security system. The camera has a view of one of a plurality of secured areas monitored by the gesture based security system. A gesture is recognized within the feed. Non-gesture metadata from the mobile device is associated with the recognized gesture. The non-gesture metadata is used to determine that the image based feed is a view of a first secured area of the plurality of secured areas. The determination whether the recognized gesture is an approved gesture within the first secured area is made according to non-gesture metadata associated with the recognized gesture.

Abstract: Embodiments of the disclosure are directed to methods, systems, and devices for the use of portable devices, such as a vehicle driven by a user, that are distinctive physical objects and can be presented to an authentication system for authentication purposes. More specifically, the portable device may be used as a source of information for the authentication system that can be verified. Images may be captured of the portable devices in order to determine their distinctive features for comparison to other physical objects registered to the user. The portable devices may also be a source of metadata, or additional contextual information associated with those portable devices or their interaction with the authentication system. The image data and/or the metadata associated with a portable device can be verified for fraud or risk analysis.

Abstract: A user state tracking and anomaly detector for multi-tenant SaaS applications operates in association with a log management solution, such as a SIEM. A given SaaS application has many user STATES, and the applications often have dependencies on one another that arise, for example, when a particular application makes a request (typically on behalf of a user) to take some action with respect to another application. The detector includes a mapper that maps the large number of user STATES to a reduced number of mapped states (e.g., “red” and “green”), and a dependency module that generates user-resource dependency graphs. Using a dependency graph, a SaaS modeler in the detector checks whether a particular dependency-based request associated with a SaaS application is valid. State and dependency information generated by the mapper and dependency module are reported back to the log management solution to facilitate improved logging and anomaly detection.

Abstract: A cloud infrastructure security assurance service is enhanced to facilitate bursting of cloud applications into other cloud infrastructures. The security assurance service provides a mechanism to enable creation and management of secure application zones within a cloud infrastructure. When the security assurance service receives an indication that a workload associated with a cloud application triggers a cloud burst, the service is extended into a new cloud infrastructure. Once the security assurance service is instantiated in the new cloud infrastructure, it identifies the broad security requirements of the application, as well as the security capabilities of the new environment. Using this information, the security assurance service computes a minimal security environment needed by the cloud application for the burst operation.

Abstract: This disclosure involves the notion of using physical objects to generate public key-based authenticators and, in particular, to use “everyday” physical objects to create a generator seed for a key generator that will use that seed to generate a key pair comprising a public key, and its associated private key. In a preferred approach, the physical object is used to create a digital representation (of the physical object) that, together with some uniqueness associated to the user, gives rise to a key generator seed value. Without knowledge of (a) the physical object itself, (b) how the physical object characteristic is converted (to a digital representation), and (c) the uniqueness value, an attacker cannot reproduce the key generator seed (or the key(s) generated from that seed).

Abstract: A user state tracking and anomaly detector for multi-tenant SaaS applications operates in association with a log management solution, such as a SIEM. A given SaaS application has many user STATES, and the applications often have dependencies on one another that arise, for example, when a particular application makes a request (typically on behalf of a user) to take some action with respect to another application. The detector includes a mapper that maps the large number of user STATES to a reduced number of mapped states (e.g., “red” and “green”), and a dependency module that generates user-resource dependency graphs. Using a dependency graph, a SaaS modeler in the detector checks whether a particular dependency-based request associated with a SaaS application is valid. State and dependency information generated by the mapper and dependency module are reported back to the log management solution to facilitate improved logging and anomaly detection.

Abstract: A method, apparatus and computer program product manage a plurality of VPN tunnels between a first cloud and a second cloud in a hybrid cloud environment. A method in a first VPN agent manages a first VPN tunnel in a plurality of VPN tunnels between a first cloud and a second cloud in a hybrid cloud environment. The VPN agent receives a request from a VPN manager. The request includes a first set of requirements for the first VPN tunnel in the plurality of VPN tunnels. The VPN agent creates the first VPN tunnel according to the first set of requirements. The VPN agent tunes the first VPN tunnel according to a second set of requirements. The tuning of the first VPN tunnel can include merging the first VPN tunnel with a second VPN tunnel, or splitting the first VPN tunnel into a first and second VPN tunnel.