Abstract: A method and system that modularizes a message by separating the message definition data from the message data. The message definition data and message data are transmitted over a secure channel to a target computing device. The message definition data and message data are recombined to form the original message at the target computer using a process corresponding to the modularization process. A key is used to track the associated definitions and message data and determine the corresponding combination process. Separate transmission of the data definitions and message data provides an added level of security. If message data is intercepted and decrypted by a third party, then the data is not easily utilized, because the definition data is absent. Similarly, interception of the message definition is not useful without the message data.

Abstract: A VPN gateway device is able to assign, manage, and terminate a large volume of connections from apps executing on devices, enabling a large scale per-app VPN mobile environment. When a mobile device user opens an app on a mobile device, a VPN gateway transmits a unique IP address to the app. The gateway also transmits an app federation cookie to the app. The app shares the app federation cookie with a second app. The VPN gateway then assigns the second app the same unique IP address. The gateway then transmits a range of ports to the first app. The app uses a port in the range of ports for data transmission from the device to the VPN gateway. The gateway receives a data transmission from the first app via a VPN and determines that the data transmission originated from the first app based on the source port.

Abstract: A memory device includes a plurality of memory chips, including one or more memory chips that store authentication information, and a controller including a first register that stores information indicating a representative memory chip, from among the one or more memory chips that store the authentication information, that stores valid authentication information.

Abstract: A method includes executing microcode in a processing unit of a processor to implement a machine instruction, wherein the microcode is to manipulate the processing unit to access a peripheral device on a public communication bus at a private address not visible to other devices on the public communication bus and not specified in the machine instruction. A processor includes a public communication bus, a peripheral device coupled to the public communication bus, and a processing unit. The processing unit is to execute microcode to implement a machine instruction. The microcode is to manipulate the processing unit to access a peripheral device on a public communication bus at a private address not visible to other devices on the public communication bus and not specified in the machine instruction.

Abstract: A display apparatus includes an input section that inputs input information representing an input operation from an operation means contacting a touch screen, a display section that refers to an authentication table correlating the input operation with a display image so as to display the display image on the touch screen, and an authentication processing section that refers to the authentication table so as to determine whether or not a combination of a display image displayed on the touch screen and an input operation represented by the input information input by the input section in a state where the display image is being displayed is correlated in the authentication table, and authenticates an input action by the input operation when the combination is correlated in the authentication table.

Abstract: An image forming apparatus to execute user authentication includes an input unit through which user information is input, and an account management unit to manage an account information database. The account information database stores user information corresponding to functions of the image forming apparatus. The image forming apparatus further includes a user authentication unit to execute user authentication based on the user information input through the input unit by using the account information database, and a display unit to display a user interface where a function corresponding to the input user information is activated, in response to a result of the authentication.

Abstract: In particular embodiments, a temporary user is able to use another's personal computing device in shared mode for a short period of time while experiencing a personalized user interface. An indication is detected that a personal computing device associated with a primary user is to be shared with a temporary user. Access to local personal information associated with the primary user is disabled if it is stored on the personal computing device. Access to remote personal information of the primary user that is accessible from the personal computing device is disabled. A personalized user interface incorporating personal information associated with the temporary user is presented on the personal computing device for the temporary user. Personal information of the primary user is not accessible by the temporary user, and vice versa. When shared mode is to be terminated, all personal information of the temporary user is deleted.

Abstract: In order to create and access a secure storage account in a non-volatile memory device, an account identification value is calculated. A memory identification value is read from a first non-volatile memory device. The memory identification value and the account identification value are transmitted to a second non-volatile memory device, and a calculated credential is received. A command is transmitted to create a secure storage account in the first non-volatile memory device, where the command contains the credential and the account identification value. To access the account, a sequence is transmitted, containing the account identification value and a value based on the credential. A secure storage system contains a first non-volatile memory device that stores a memory identification value and contains a secure partition accessible using a credential, a second non-volatile memory device that can compute the credential, and a host adapted to create and access the secure partition.

Abstract: The invention provides a method and apparatus for authenticating a user in a touchscreen environment. A first tier may be defined having at least one object, and a destination tier may be defined having at least one bin. An authentication-key may be registered, the authentication-key comprising a length defining a number of nodes and a correct sequence of nodes, each node specifying a movement of one object from the first tier to one bin of the destination tier. A user sequence of at least one touchscreen gestures is received, each gesture specifying that one object from the first tier should be moved to one bin of the destination tier. Access is permitted if the at least one touchscreen gestures corresponds to the length, the correct sequence, and the movement of the authentication-key.

Abstract: A storage unit 601g of a recording medium device 600g stores a content and a revocation list. The revocation list includes a revocation identifier that is associated with the content and identifies a revoked public key certificate allocated to an apparatus related to use of the content. A controller 602g of the recording medium device 600g is provided with an acquisition unit 621g that acquires, from an apparatus 300g, an acquisition request for the content and an apparatus identifier identifying a public key certificate of the apparatus 300g; a judgment unit 622g that judges whether the apparatus identifier matches a revocation identifier; and a control unit 623g that controls to prohibit output of the content to the apparatus when the apparatus identifier and the revocation identifier match.

Abstract: Techniques for processing documents with executable text are disclosed. The techniques, among other things, can effectively address XSS attacks to Internet users when browsing web sites. Content deemed not to be trusted or fully trusted (“untrusted”) can be marked in a document that can include executable text. Remedial action, including not allowing execution of executable text marked as “untrusted” can be taken. In addition, when the document is processed, content deemed not to be trusted or fully trusted (“untrusted”) can be effectively monitored in order to identify executable text that may have been effectively produced by “untrusted” content and/or somehow may have been affected by “untrusted” content.

Abstract: A method and apparatus for detecting a Return-Oriented Programming exploitation. At a computer device, a mechanism to detect a control transfer of a code location in a memory is established. This may be, for example, hooking the control transfer. The code location relates to an electronic file. In the event that a control transfer of the code location is detected, a comparison is made between a destination code location address with values in the freed stack. If the code location address matches any of the values in the freed stack, then it is determined that the control transfer of the code location relates to a Return-Oriented Programming exploitation.

Abstract: Systems and methods for detecting malicious PDF network content are provided herein. According to some embodiments, the methods may include at least the steps of examining received PDF network content to determine if one or more suspicious characteristics indicative of malicious network content are included in the PDF network content, providing PDF network content determined to include at least one suspicious characteristic to one or more virtual machines, and analyzing responses received from the one or more virtual machines to verify the inclusion of malicious network content in the PDF network content determined to include at least one suspicious characteristic.

Abstract: Search result poisoning attacks may be automatically detected by identifying groups of suspicious uniform resource locators (URLs) containing multiple keywords and exhibiting patterns that deviate from other URLs in the same domain without crawling and evaluating the actual contents of each web page. Suspicious websites are identified and lexical features are extracted for each such website. The websites are clustered based on their lexical features, and group analysis is performed on each group to identify at least one suspicious group. Other implementations are directed to detecting a search engine optimization (SEO) attack by processing a large population of URLs to identify suspicious URLs based on the presence of a subset of keywords in each URL and the relative newness of each URL.

Abstract: A system and method for validating an application and for controlling execution of an application. A plurality of parameters may be computed for an authenticated object and for a tested object. A plurality of comparison and other metrics may be computed based on the computed plurality of parameters. Control of an execution of programs may be based on said metrics. Other embodiments are described and claimed.

Abstract: The disclosure provides method for preventing CSRF attacks, in which the method provides: intercepting request sent from a client browser to a server; generating a token; generating a response to the request; inserting the token into the response to the request; and sending the response to the request to the client browser with the token inserted into the response. With the method of the disclosure, it is assured that a token is inserted into all the requests made by a user through a client browser for accessing a resource. And it can be assured that the request is issued by the user himself by verifying whether the token in the request is valid, thereby preventing a CSRF attack.

Abstract: A security device for processing network flows includes packet processing cards with packet processors formed thereon where each packet processing card stores local counter values for one or more events and a packet processing manager including global event counters to maintain event statistics for events in the security device. In one embodiment, the packet processing manager stores a copy of the local counter value of an event for each packet processor reporting the event in the counter memory and the global event counter provides a global counter sum value for the event by summing the copies of local counter values in the local memory. In another embodiment, the global counter sum is compared to a threshold value to put the event in a conforming state or non-conforming state. The packet processing manager sends a multicast message to the interested packet processors indicating an event has transitioned to a non-conforming state.

Abstract: Described is a system for explosive network attack and mitigation analysis. A network structure is received as input. A network attack method that applies an Achlioptas process is selected. Then, an explosive mitigation strategy is selected. An attack-mitigation competing process is simulated for the network structure. A sequence of network structures under competing processes is generated. The effectiveness of the selected explosive mitigation strategy against the selected network attack method is quantified by analyzing the sequence of network structures under competing processes.

Abstract: Methods and apparatus for dynamically adding and deleting new code to previously validated application executing in a secured runtime. New code is written to a portion of secured memory not executable by application. New code is validated to ensure it cannot directly call operating system, address memory outside of secured memory, or modify secured memory state. Indirect branch instructions may only target addresses aligned on fixed size boundaries within the secured memory. Validated code is copied to portion of secured memory executable by application in two stage process that ensures partially copied segments cannot be executed. Validated new code can be deleted once all threads reach safe execution point, provided code was previously inserted as unit or contains no internal targets that can be called by code not also being deleted.

Abstract: A computer-implemented method includes providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices; receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices; classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and providing to the third party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third party.

Abstract: A pattern recognition security system (“PRSS”) generates a packet signature from network traffic, including attack packets. The PRSS can utilize a statistical pattern recognition based approach to generate attack traffic signatures, such as for DDoS or DoS attacks. In some embodiments, the PRSS dynamically creates training sets from actual captured data, allowing the PRSS to adapt to changes in network attacks. For example, more sophisticated DDoS attacks commonly rotate through different attacking computers to vary the packet attributes of attack packets sent to a target system. However, as the PRSS can determine packet signatures based on the actual captured data packets, the PRSS can adapt to the changes in the attack. In some embodiments, the PRSS may determine packet signatures in real-time or near real time during an attack, allowing the PRSS to quickly react to changes in attack traffic.

Abstract: Techniques for detecting infected websites are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting an infected website comprising receiving at least one redirection report from at least one security agent, receiving at least one malware report from the at least one security agent, analyzing correlation between the at least one redirection report and the at least one malware report, aggregating information from the at least one redirection report, the at least one malware report, and the correlation analysis, and detecting an infected website based on the aggregated information.

Abstract: A system for protecting endorsement events against anomalous behaviors is disclosed. The system includes a data collecting module, an activity recording module, an aggregation module, a detection module and an action module. The data collecting module collects event data describing one or more endorsement events. The activity recording module records activity data associated with the one or more endorsement events. The aggregation module aggregates the activity data. The detection module detects, based at least in part on the aggregation of the activity data, one or more anomalies associated with the one or more endorsement events. The action module takes one or more protection actions responsive to the detection of the one or more anomalies. The present disclosure also includes a method for protecting endorsement events against anomalous behaviors.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for determining, at a remote computing device, whether a first security measure has been compromised, wherein the first security measure is executed on a mobile device; and based on a determination that the first security measure has been compromised, performing a corrective measure, wherein the corrective measure is performed after a delay.

Abstract: A method for providing an intrusion prevention system to prevent hacking into files located on enterprise users' endpoint devices functioning as mobile computing platforms. The method includes filtering low-level network packets for each of a plurality of received network packets, offloading the received packets to an inspecting processing module and marking suspicious packets based on at least one of a header and pattern of each of said received packets. The method also includes taking preventive measures by the system to ensure protection of the device and network, taking active steps by the system to block suspicious traffic and disconnecting the current connection by the system, when it detects suspicious traffic.

Abstract: According to one embodiment, a computing device is coupled to a set of web application layer attack detectors (AD), which are coupled between HTTP clients and web application servers. The computing device learns a new set of attribute values for a set of attribute identifiers for each of a sequence of rules through an iterative process having a plurality of iterations. The iterative process begins with an attack specific rule, and the sequence of rules includes an attacker specific rule and another attack specific rule. Each iteration includes receiving a current alert package from one of the ADs sent responsive to a set of packets carrying a web application layer request meeting a condition of a current rule used by the AD, automatically generating a new set of attribute values based upon the current alert package, and transmitting the new set of attribute values to the set of ADs.

Abstract: The subject disclosure is directed towards running script through a malware detection system including an emulator environment to detect any malware within the script. Statistics are collected as part of processing the script, with parameterized heuristic analysis used to determine whether to run the emulation. The processing through the malware detection system may be iterative, to de-obfuscate layers of obfuscated malware. The emulator may be updated via signatures.

Abstract: A system and method in one embodiment includes modules for identifying an asset with a vulnerability risk, identifying a service running on a port on the asset, identifying a connection to the port, calculating an operational dependence role of the asset as a function of the service and the connection, and modifying the vulnerability risk based on the operational dependence role. Other embodiments include identifying a protocol of a data packet at the port, classifying the protocol into a protocol category with a protocol importance score, calculating a connection average for the asset, classifying the connection average into a connection category with a connection score, and calculating a service dependence score. Other embodiments include calculating a host dependence score, assigning a data importance score to data communicated by the asset, and calculating the operational dependence role as a function of the host dependence score and data importance score.

Abstract: Web applications, systems and services, which are prone to cyber-attacks, can utilize an adaptive fuzzing system and methodology to intelligently employ fuzzer technology to test web site pages for vulnerabilities. A breadth first search and minimal fuzzing testing is performed on identified pages of a web site looking for either a vulnerability or the potential for a vulnerability. Heuristics are gathered and/or generated on each tested web page to determine a vulnerability score for the page that is an indication of the page's potential for hosting a vulnerability. When a page is discovered with a vulnerability score that indicates the page has the potential for a vulnerability a depth first search and expanded fuzzing testing is performed on one or more branches of the web site that begin with the page with the potential vulnerability.

Abstract: A method, system and computer program product for evaluating an IDP entity, the method includes evaluating an effect of at least one IDP rule applied by the IDP entity on legitimate traffic, based upon a network model; evaluating an effect of at least one IDP rule applied by the IDP entity based upon a network model and an attack model; determining an effectiveness of the IDP entity in response to the evaluated effects.

Abstract: Provided are a display apparatus and a use restriction method thereof. The display apparatus includes a media interface unit, a memory unit, and a control unit. The media interface unit detects the connection of an external device and receives unique information of the connected external device. The memory unit stores the unique information of the external device received through the media interface unit. The control unit stores/registers the unique information of the connected external device in the memory unit and determines whether to permit the use of the external device connected through the media interface unit on the basis of the unique information registered in the memory unit. Herein, upon detecting the connection of an unregistered external device, the control unit restricts the use of the unregistered external device on the basis of the registered unique information of the external device.

Abstract: A management device for managing states of components. The management device includes a reading unit to read management information from each of plural components; a determining unit to refer to license information associated with management information of each component stored in a license storage unit, and to determine, based on the referred license information, whether each component is usable or not; and an operation control unit to make a component determined to be usable operate but to inhibit an operation of a component determined to be unusable.

Abstract: Code injection is detected based on code digests associated with hashes of selected portions of content supplied to clients by a server. A client receives the content and generates a corresponding code digest, and based upon a comparison with the code digest received from the server, determines if the received content has been corrupted. The code digest can be signed or supplied with a digital certification for verification that the code digest originated from the server providing the content.

Abstract: A system and method for generating user authentication challenges based at least in part on an account owner's social network activity information. A login request including an account owner's correct username and password as well as additional login information is received from a user. The login attempt is detected as a potentially fraudulent based on the additional login information from the user. The account owner's social network activity information is analyzed. An authentication challenge based at least in part on the account owner's social network activity information is generated and sent for display. The login request is allowed or denied based on the completion on the authentication challenge.

Abstract: An information handling system analyzes secondary information captured with an image of a two-dimensional barcode to perform a function. For example, a mobile phone camera captures an image of a QR code at a product plus characters printed next to the QR code, uses optical code recognition to determine the characters, and applies information from the QR code and the characters to register the product. As another example, a security indicator is captured with an image of the QR code and applied to access information of the QR code, such as by using GPS position information, local network information, or telephone number information to encrypt and/or decrypt information stored in the QR code.

Abstract: Systems and techniques for managing software licensing are described. When a computing system service request is made, the request is intercepted and software information that may be more or less continuously updated in a managed computing environment is examined to determine the effect of the service request on software usage by the system. The software usage represented by the service request is evaluated based on licensing information to determine license usage by the system and changes in license usage based on the service request, and license usage information is determined based on the software usage and the licensing information. The license usage information may be used in connection with a system of rules to govern actions such as reporting licensing usage or allowing or preventing the use of software based on whether use of the software will violate licensing requirements.

Abstract: A security system assesses the response time to requests for information to determine whether the responding system is in physical proximity to the requesting system. Generally, physical proximity corresponds to temporal proximity. If the response time indicates a substantial or abnormal lag between request and response, the system assumes that the lag is caused by the request and response having to travel a substantial or abnormal physical distance, or caused by the request being processed to generate a response, rather than being answered by an existing response in the physical possession of a user. If a substantial or abnormal lag is detected, for example due to the fact that the information was downloaded from the Internet, the system is configured to limit subsequent access to protected material by the current user, and/or to notify security personnel of the abnormal response lag.

Abstract: An automatic software audit system includes a client and a server. The client includes a network interface, a software installation record database, a software audit rule database, a software release database and a central processing unit (CPU). The network interface is coupled to the client. The software installation record databases stores a software installation record of the client. The software audit rule database stores a software audit rule. The software release database stores a software release record of the client. The CPU installs an agent program to the client to collect the software installation record, and generates a software audit result of the client according to the software installation record, the software audio rule and the software release record.

Abstract: Systems and techniques for managing software licensing are described. When a computing system service request is made, the request is intercepted and software information that may be more or less continuously updated in a managed computing environment is examined to determine the effect of the service request on software usage by the system. The software usage represented by the service request is evaluated based on licensing information to determine license usage by the system and changes in license usage based on the service request, and license usage information is determined based on the software usage and the licensing information. The license usage information may be used in connection with a system of rules to govern actions such as reporting licensing usage or allowing or preventing the use of software based on whether use of the software will violate licensing requirements.

Abstract: The subject matter disclosed herein relates to authenticating an identity of users desiring access to an application program and determining whether an authenticated user is authorized to access one or more aspects of the application program.

Abstract: An information processing device is arranged to acquire a first public key certificate and a first secret key from a server device by acquiring an individual identification information which is uniquely discriminable for the information processing device from the information processing device and transmitting the individual identification information to the server device. The information processing device is arranged to determine whether the information processing device is permitted to transmit device information to the server device through an encryption communication using the first public key certificate and the first secret key, by acquiring the individual identification information from the information processing device and comparing the acquired individual identification information with the individual identification information associated with at least one of the first public key certificate and the first secret key.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for securing data. One of the methods includes receiving, by the map reduce framework, data for analysis. The method includes identifying, by the map reduce framework, private data in received data. The method includes encrypting the private data. The method includes storing the encrypted private data in a location separate from the received data. The method includes obfuscating the private data by adding a reference to the location of the encrypted private data in the received data.

Abstract: Software activation and revalidation.

Abstract: An image forming apparatus includes a login unit configured to receive a login of a user; a program storage unit; a function introduction unit configured to obtain a first program licensed to the user and license information of the first program, and to store the first program and the license information in the program storage unit without deleting a second program that is a different version of the first program from the program storage unit; a user information storage unit configured to store user information that registers license information of introduced programs and version information with user IDs; and a function providing unit configured to specify license information and version information that are associated with a user ID of a user who logs into the image forming apparatus in order to provide a function realized by a program corresponding to the license information and the version information to the user.

Abstract: An optical medium containing virtual write protect information can be recorded in drives and systems without first changing the write protection from on to off by receiving valid user input. The virtual write protection may also be enabled or disabled by additional information on the disc.

Abstract: A conditional access system (CAS) computer in a downloadable CAS receives a downloadable management certificate (DMC) and determines, using the DMC, security information including a DMC key size and an expiration time of a DMC subordinate certificate authority (sub-CA) certificate, for the client device. The CAS computer then determines whether the DMC is valid based on the expiration time of the DMC sub-CA certificate. If the DMC is determined to be valid, the CAS server sends a cryptographic identity for the client device and a CAS client to the client device protected using the DMC. At a later time, if the DMC key size is considered to be still sufficiently secure, the validity of the DMC is extended by issuing a new DMC sub-CA certificate with the same public key as the original DMC sub-CA certificate.

Abstract: Disclosed is a method and system of preventing browser-based abuse. The method of preventing browser-based abuse may include determining whether an access based on a browser function extension module is a malicious access for acquiring data of an Internet browser, and blocking the access based on the browser function extension module when the access is determined to be a malicious access.

Abstract: Methods and systems to allow for the streaming of media from a file server to a client, where the streaming occurs concurrently with the execution of an information security protocol. The security protocol allows the client to securely receive one or more keys that allow the client to access the media. This permits a user to access the media sooner than would otherwise be possible, while allowing timely performance of security related processing.

Abstract: A data storage device may include one or more pages, each page having a fixed number of memory cells, each memory cell being adapted to store one unit of data; a verification page, the verification page having a corresponding fixed number of verification cells, each verification cell storing a predetermined value; and a controller configured to 1) receive a read command having an address value, and 2) upon receiving the read command, a) retrieve a predetermined value from a verification cell corresponding to the address value, b) determine whether the retrieved predetermined value is an expected value, and c) if so, providing a retrieved unit of data, and if not, initiating a protective action. Determining whether the retrieved predetermined value is the expected value may include applying a function to the address value to obtain a result and determining whether the result corresponds to the retrieved predetermined value.

Abstract: Systems and methods of detecting copying of computer code or portions of computer code involve generating unique fingerprints from compiled computer binaries. The unique fingerprints are simplified representations of the compiled computer binaries and are compared with each other to identify similarities between the compiled computer binaries. Copying can be detected when there are sufficient similarities between at least portions of two compiled computer binaries.