Abstract: Disclosed are various embodiments for passive compliance violation notifications. In one embodiment, it is detected that that a policy violation with respect to use of a client device has occurred. It is then determined that the policy violation may be passive. A user notification of the policy violation is generated by the client device in response to determining that the policy violation may be passive. The frequency and/or intensity of this notification may depend upon an extent of the policy violation. If the policy violation is later determined to be active, additional actions may be performed, such as disabling access to or removing managed resources on the client device.

Abstract: A method of checking file system compliance including receiving a plurality of compliance rules corresponding to a file system of a production system, collecting, by a collector, file system meta data from the file system, analyzing, by an analyzer, the file system meta data using the plurality of compliance rules to determine at least one compliance deviation of the file system, and throttling the collector and the analyzer independently of one-another, wherein the collector and the analyzer are configured according to a model of performance for the production system and a schedule for the collection and analyzing.

Abstract: Trusted firmware on a host server is used for managing access to a hardware security module (HSM) connected to the host server. The HSM stores confidential information associated with an operating system. As part of access management, the firmware detects a boot device identifier associated with a boot device configured to boot the operating system on the host server. The firmware then receives a second boot device identifier from the HSM. The boot device identifier and the second boot device identifier are then compared by the firmware. Based on the comparison, the firmware determines that the boot device identifier matches with the second boot device identifier. Based on this determination, the firmware grants the operating system access to the HSM.

Abstract: Instructions and logic provide SIMD SM3 cryptographic hashing functionality. Some embodiments include a processor comprising: a decoder to decode instructions for a SIMD SM3 message expansion, specifying first and second source data operand sets, and an expansion extent. Processor execution units, responsive to the instruction, perform a number of SM3 message expansions, from the first and second source data operand sets, determined by the specified expansion extent and store the result into a SIMD destination register. Some embodiments also execute instructions for a SIMD SM3 hash round-slice portion of the hashing algorithm, from an intermediate hash value input, a source data set, and a round constant set. Processor execution units perform a set of SM3 hashing round iterations upon the source data set, applying the intermediate hash value input and the round constant set, and store a new hash value result in a SIMD destination register.

Abstract: One or more computer devices may receive a document from private content that is accessible by a set of users, and may extract metadata from the document. The metadata may provide information relating to one or more aspects of the document. The one or more computer devices may determine, based on the metadata, whether a portion of the document includes information that is only to be accessible by a particular user from the set of users, and may append a restrict indicator to the metadata when the portion of the document includes information that is only to be accessible by the particular user. The restrict indicator may identify the particular user and the portion of the document. The one or more computer devices may store the metadata and the restrict indicator in a personal search index.

Abstract: Secure transfer of mobile application content is disclosed. A state-related event associated with a managed application in a managed set of applications may be detected. It may be determined that content from the managed application is stored at a public storage location on a mobile device. At least a portion of the content may be transferred to a secure storage location accessible to the managed set.

Abstract: Techniques for representation of operating system context in a trusted platform module are described. In at least some embodiments, authorization principals that corresponds to representations of operating system context are derived in a trusted platform module. The authorization principals can be used to define authorization policies for access to security assets stored in a trusted platform module.

Abstract: A method and associated apparatus/system for controlling access to data in a database. A first login by a first user is accepted. A second login by the first user under the name of a second user is accepted. Third data is referred, based on first data of the database accessible from the first user and second data of the database accessible from the second user, upon request to refer to the database under the name of the first user or the second user after the first login and the second login are accepted.

Abstract: A device (e.g., a phone) can be provided by an entity (e.g., a business) to a user (e.g., an employee). The device includes a profile manager that allows the user to configure a personal profile comprising any of applications, settings, and stored data. The device is also configurable with an entity profile determined by the entity that also may include applications, settings, and stored data. The user can select from operating modes comprising at least a personal mode, and a unity mode; an entity mode also may be available for selection. The profile manager, based on the selected mode, determines whether entity profile data and applications are available to the user, and which applications from either profile may conduct user-perceptible activities. The profile manager may periodically verify entity profile rights with a server, and if verification fails, then the profile manager can restrict entity profile data and applications access, regardless of operating mode.

Abstract: Code is associated to a target based on an inspection of the code. A target may be a device or a user. A number of code components may be inspected at one time and then transferred or otherwise associated to a target based on the target's profile. A code component may be a policy of an information management system.

Abstract: Personalized services often utilize individual profiles, such as social network profiles, product purchase histories, or browsing histories. However, personalization may exhibit or imply a familiarity level between the service and the individual that is beyond the individual's comfort level. Presented herein are techniques for adapting personalized services to request supplemental individual information only within a current familiarity stage that has been established by the individual with the service, and only to provide a requested usage of a service. Such solicitation may inform the individual of the intended usage of the requested information. Usages that may involve more sensitive information may be predicated upon requesting and receiving individual consent from the individual to advance to a higher familiarity stage.

Abstract: Embodiments of the invention are directed to methods, systems and devices for providing sensitive user data to a mobile device using an encryption key. For example, a mobile application on a mobile device may receive encrypted sensitive user data from a mobile application server, where the user sensitive data is encrypted with a key from a token server computer. The mobile application may then request that the encrypted payment information be sent to the token server. The mobile device may then receive a payment token associated with the payment information from the token server.

Abstract: In an example, a client-server platform identity architecture is disclosed. The platform identity architecture may be used to enable a venue operator to provide online services and to collect telemetry data and metrics while giving end users greater control over privacy. When entering a compatible venue, the user's device generates a signed temporary pseudonymous identity (TPI) in secure hardware or software. Any telemetry uploaded to the venue server includes the signature so that the server can verify that the data are valid. The TPI may have a built-in expiry. The venue server may thus receive useful tracking data during the term of the TPI, while the user is assured that the data are not kept permanently or correlated to personally-identifying information.

Abstract: A tokenization system includes a vector table and one or more token tables. The tokenization system accesses sensitive data and a vector from a vector table column, and modifies the sensitive data based on the accessed vector. The tokenization system then queries the one or more token tables using a portion of the modified data to identify a token mapped to the portion of the modified data. The portion of the modified data is replaced with the token to create tokenized data. The vector table can be updated by replacing a vector table column with an updated vector table column. The tokenization system can modify subsequent data using the updated vector column prior to tokenization.

Abstract: The privacy-preserving cookie generator implementations described herein create a privacy-preserving data structure (also called a privacy-preserving cookie herein) that is used to provide personalization for online services without user tracking. In some implementations the privacy-preserving cookie generator encodes a user profile (for example, based on a user's online activity) into a data structure that has naturally occurring noise and that efficiently supports noise addition. In one implementation a Bloom filter is used to create the encoded profile. Additional noise is injected into the encoded profile to create an obfuscated user profile in the form of a privacy-preserving data structure. The privacy-preserving data structure or cookie can be attached to an online service request and sent over a network to an online service provider which can use it fulfill the services request, providing a somewhat personalized result while the user's privacy is maintained.

Abstract: Particular embodiments described herein provide for an electronic device that can be configured to receive untrusted input data at an enclave in an electronic device, isolate the untrusted input data from at least a portion of the enclave, communicate at least a portion of the untrusted data to an integrity verification module using an attestation channel, and receive data integrity verification of the untrusted input data from the integrity verification module. The integrity verification module can perform data integrity attestation functions to verify the untrusted data and the data integrity attestation functions include a data attestation policy and a whitelist.

Abstract: A method for verifying data integrity of a block device is provided. The method includes providing a secure world execution environment configured to monitor changes to data blocks of a block device, within the secure world execution environment, generating a hash for changed data blocks of the block device, and within the secure world execution environment, verifying and generating a cryptographic signature.

Abstract: A computing device includes technologies for securing indirect addresses (e.g., pointers) that are used by a processor to perform memory access (e.g., read/write/execute) operations. The computing device encodes the indirect address using metadata and a cryptographic algorithm. The metadata may be stored in an unused portion of the indirect address.

Abstract: A mesh grid protection system is provided. The system includes assertion logic configured to transmit a first set of signals on a first set of grid lines and a second set of grid lines. The system also includes transformation logic to transform the first set of signals to generate a second set of signals, to transmit the second set of signals on a third set of grid lines that are coupled to the first set of grid lines, and to transmit the second set of signals on a fourth set of grid lines that are coupled to the second set of grid lines. In addition, the system includes verification logic to compare the second set of signals on the third and fourth set of grid lines to an expected set of signals.

Abstract: Disclosed are various embodiments for a light bulb or other type of lighting fixture that integrates a light source and a radio frequency identification (RFID) reader. Embodiments of the disclosure can also forward identifiers corresponding to RFID tags detected by the RFID reader to another computing device that can facilitate identification of products or items associated with the RFID tags. RFID tags are energized with interrogator signals and/or an electromagnetic field emitted from the RFID reader and submit a response, which can be forwarded, or data extracted and transmitted, to another computing device.

Abstract: Systems and methods for detecting unauthorized tags are provided. A tag transmission report is received from a tag reader that receives wireless transmissions from a plurality of tags. A tag ID is determined for each tag of the plurality of tags in the tag transmission report. The determined tag IDs are compared to association information indicating associations between tag IDs. A notification is generated responsive to a comparison indicating that ones of the plurality of tags are not associated with other tags of the plurality of tags.

Abstract: Backscatter communication includes receiving electromagnetic energy from a base station and encoding first data and second data. The first data is encoded at a first frequency by adjusting a radar cross-section of a device to modulate the electromagnetic energy reflected back to the base station. The second data is encoded at a second frequency by limiting the adjusting of the plurality of radar cross-sections to either a first subset or a second subset of the plurality of radar cross-sections for a length of time. The second frequency is lower than the first frequency.

Abstract: A beaded prayer system includes a beaded prayer device, which includes a plurality of beads connected by at least one wire that passes through a center of the plurality of beads. The beaded prayer device also includes a power source and processing circuitry that can detect contact between two or more adjacent beads, store bead contact data in memory, and transmit the bead contact data to one of a plurality of RFID readers. The beaded prayer system also includes at least one server that receives the bead contact data from one of the plurality of RFID readers, processes the bead contact data to perform pattern extraction, and outputs usage patterns and/or statistics based on the pattern extraction.

Abstract: Embodiments are directed to a method of identifying an identification (ID) tag. The method includes using a movable reader to determine a presence of an ID tag, an absence of the ID tag and that the ID tag has moved. The method further includes using the movable reader to determine a localization probability score of the ID tag, and, based on the localization probability score, adjust the movable reader's determination of the presence of the ID tag.

Abstract: A register for counting and tracking items in a bag comprises a manifest and an RFID reader. The RFID reader is used to query a plurality of RFID tags attached to items contained in the bag. The register creates reports counting and/or identifying changes to items contained in the bag while the bag is routed and/or items in the bag are processed for a customer.

Abstract: To provide a non-transitory computer-readable recording-medium storing an information acquiring program (IAP) that can be implemented by a computer controlling a mobile terminal (MT). The IAP includes five program codes (PCDs). The 1st-PCD causes the computer to use a camera for capturing an on-printed-matter marker. The 2nd-PCD causes the computer to detect a mobile state of the MT. The 3rd-PCD causes the computer to recognize the mark for creating a provision request based on recognition information of the recognized marker and mobile information representing the MT's mobile state detected by the 2nd-PCD. The 4th-PCD causes the computer to transmit the provision request to an information provision apparatus and to receive indication information as a reaction to the provision request from the IA. The 5th-PCD causes the computer to create image information (II) based on the indication information and causes a display part to display the II.

Abstract: This patent specification describes an attachment for a camera device. The attachment comprises at least one of a target generating mechanism, a proximity sensor, illumination that is optimized for bar code reading, optics that provide an alternative optical path to the camera device, and a supplementary lens system that is optimized for bar code reading.

Abstract: An integrated auto-level and electronic rod reader is disclosed. In one embodiment, the integrated auto-level and electronic rod reader comprises a telescope and an image delivery device integrated with the auto-level which is configured for capturing an image of a standard grade rod visible through the telescope and a crosshair. Logic implemented by a processor automatically recognizes the crosshair, automatically compares the crosshair against a scale of the standard grade rod, and automatically determines an elevation of the standard grade rod based upon the comparing.

Abstract: A fingerprint sensor for sensing fingerprint information of a finger is provided. The fingerprint sensor includes a sensing array including a plurality of sensing units, an insulating surface disposed on the sensing array, a readout module, a memory array including a plurality of memory units respectively corresponding to the sensing units, and a processor. Each of the sensing units includes a sensing electrode. The readout module reads a sensing voltage of the sensing electrode of each of the sensing units, and provides a sensing output according to the sensing voltage. Each of the memory units is adjacent to the corresponding sensing unit and stores information of the corresponding sensing unit. The processor obtains the fingerprint information of the finger according to the sensing output and the information stored in the memory unit.

Abstract: An acoustic imaging system can contain a plurality of individual acoustic elements that each contain an acoustic transducer, drive circuitry, and low voltage sense and/or read circuitry. In many embodiments both the drive circuitry and the read circuitry can be independently addressable. For example, if the individual acoustic elements are arranged into rows and columns, each acoustic element can include row/column drive circuit enable switches and row/column read circuit enable switches.

Abstract: An acoustic imaging system can include an array of transducers in acoustic communication with a substrate configured to receive a subject for imaging. The transducers can independently or cooperatively send an acoustic pulse into the substrate toward the subject. In many examples, a number of adjacently-positioned transducers are activated substantially simultaneously so as to generate a plane wave into the substrate. After the plane wave has had an opportunity to propagate through the substrate, reflect from the top surface, and propagate through the substrate again, the electrical signals can be obtained from the transducers and an image of the subject can be assembled. In many embodiments, the plurality of transducers can be driven and read in groups such as non-intersecting (disjoint) sets or subarrays.

Abstract: An acoustic fingerprint imaging system having a plurality of acoustic elements, each acoustic element including a transducer, and independent drive and sense circuitry is disclosed. Drive circuitry may require higher voltage than low voltage sense circuitry. Many embodiments described herein include a ground shifting controller to apply a voltage bias to the low voltage sense circuitry during a drive operation, in order to prevent electrical damage to the sense circuitry.

Abstract: An information detection and display apparatus, and detecting method and displaying method thereof are provided. The information detection and display apparatus includes: an optical sensor; a protective layer disposed on the optical sensor; and a display screen disposed underneath the optical sensor, wherein the display screen serves as a light source when the optical sensor is used for detecting optical information. The information detection and display apparatus can be used for generating optical fingerprint image, detecting finger touching, and displaying information. Thus, the information detection and display apparatus has multiple functions and applications.

Abstract: An improvement to the optical performance of a digital fingerprint scanner is disclosed. The invention evens out the illumination while reducing unwanted artifacts. This results in a “clean” image with an improved S/N ratio, the purity of the captured image offers the ancillary benefit of lowering the overall power requirements of the system while having direct positive impacts on improving accuracy and speed in the fingerprint recognition.

Abstract: The present disclosure relates to a method for camera identification and detection on color features. In some aspects, the method comprises: 1) starting the camera, the image processing unit and the display unit at the beginning of testing; 2) using the camera to capture the color characteristic value; and 3) moving the untested object to the detection area of the camera for it to be detected, wherein the image processing unit extracts the mean color characteristic value from the color pixels of the detection area.

Abstract: A method and an apparatus for recognizing an iris is provided. The method of recognizing an iris in an electronic apparatus includes displaying a preview image by driving a regular camera, displaying an iris recognition area corresponding to an iris recognition camera in the preview image, determining whether an iris image exists in the iris recognition area, and obtaining image information from the iris recognition camera and performing iris recognition, when the iris image exists in the iris recognition area.

Abstract: A system for use in remote medical diagnosis of a biological subject, the system including one or more electronic processing devices that receive image data indicative of at least one image of part of the subject's eye from a client device via a communications network, review subject data indicative of at least one subject attribute, select at least one analysis process using results of the review of the subject data, use the analysis process to quantify at least one feature in the image data and generate an indicator value indicative of the quantified at least one feature, the indicator value being used in the assessment of a condition status of at least one condition.

Abstract: An improved diagnostic resolution of digital slide images is obtained by scanning a first digital slide image at diagnostic resolution that is then deconvolved into separate images with one stain per image. The single stain images are then enhanced with image adjustments and/or processed with image analysis algorithms. The resulting single image data sets from the image analysis algorithms can then be stored. Additionally, the resulting enhanced single images can be recombined into a second digital slide image at diagnostic resolution that is also enhanced.

Abstract: An elapsed-time determination apparatus includes: a storage unit that stores correlation information indicating a correlation between a state of a melanophore of a fish and an amount of time elapsed since the death of the fish; an acquisition unit that acquires an image of a fish; an analysis unit that detects a state of a melanophore of a fish by analyzing an image acquired by the acquisition unit; and a determination unit that determines the amount of time elapsed since the death of the fish in accordance with the state of the melanophore of the fish detected by the analysis unit, based on the correlation information, and outputs determination results.

Abstract: Provided are a method and system for automatically tracking a face position and recognizing a face. In the present invention, after a face image of a user is captured, a capturing unit is moved such that the face image is moved to a face authentication region where optimum face recognition is performed, thereby having a changed capturing direction. This can allow face recognition of the user to be executed without movement of the user. Accordingly, convenience in face recognition can be maximized. Further, a plurality of registered face images are stored with matching frequencies indicating the number of times that the plurality of registered face images have been matched with an authentication image, and the authentication image is firstly compared with registered face images having large matching frequencies. This can enhance a face recognition speed.

Abstract: A tactile feedback output device receives one or more warning signals for controlling one or more types of tactile output by the one or more tactile feedback output devices, the one or more warning signals representing that a predicted behavior of a monitored user represents a particular behavior that is potentially adverse and a percentage probability that the predicted behavior is adverse, the monitored user detected within a particular environment monitored by a supervising user, the one or more tactile feedback output devices worn by the supervising user.

Abstract: A method, non-transitory computer readable medium, and apparatus for training hand detection in an ego-centric video are disclosed. For example, the method prompts a user to provide a hand gesture, captures the ego-centric video containing the hand gesture, analyzes the hand gesture in a frame of the ego-centric video to identify a set of pixels in the image corresponding to a hand region, generates a training set of features from the set of pixels that correspond to the hand region and trains a head-mounted video device to detect the hand in subsequently captured ego-centric video images based on the training set of features.

Abstract: A processor accesses a first video image and a second video image from a sequence of video images and applies a patch descriptor technique to determine a first portion of the first video image that encompasses a first person. The processor determines a location of the first person in the second video image by comparing keypoints in the first portion of the first video image to one or more keypoints in the second video image.

Abstract: According to one embodiment, an electronic device executes a process for outputting a recognition result of a handwritten table including regions defined by a set of strokes. When a first region of the regions spans columns or rows, and the first region corresponds to a rectangular shape, the recognition result of the handwritten table includes a first table object. The first table object includes a first merged cell corresponding to the first region. When the first region spans columns or rows, and the first region corresponds to a non-rectangular shape, the recognition result of the handwritten table includes a second table object. The second table object includes a second merged cell corresponding to a part of the first region.

Abstract: According to an embodiment, an information processing device includes a storage unit, a reception unit, a recognition unit, and a specification unit. The storage unit stores therein accumulated information containing entry information of multiple types of forms accumulated by form type and entry field. The reception unit receives a form. The recognition unit recognizes the entry information contained in the form received by the reception unit. The specification unit compares the accumulated information and the entry information recognized by the recognition unit to specify the type of the form received by the reception unit.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for classifying one or more document images based on its content by determining blocks layout of the document image; recognizing the document image to obtain digital content data representing text content or the potential graphical content of the image; calculating feature values of the document image for features based on the digital content data and the blocks layout; and classifying the document image as belonging to one of document classes based on the calculated feature values.

Abstract: An optical system for an image acquisition device comprises a filter comprising a central aperture arranged to transmit both visible and selected near infra-red (NIR) wavelengths and a peripheral aperture arranged to block visible wavelengths and to transmit the NIR wavelengths. An image sensor comprises an array of pixels including pixels sensitive to visible wavelengths and corresponding pixels sensitive to the NIR wavelengths. A lens assembly is axially located between the filter and the image sensor and comprises a plurality of lens elements. The lens elements are arranged to simultaneously focus NIR light received from a given object through central and peripheral apertures of the filter and visible light received from the object through the central aperture onto the sensor surface.

Abstract: A method includes identifying one or more objects in one or more images of real-world scenes associated with a user, adding the identified one or more objects to a list of real-world objects associated with the user, assigning each object in the list of real-world objects to an object class based on object recognition, and providing a notification to the user that a content item has been associated with an object class assigned to one of the objects on the list of real-world objects associated with the user. A computer readable storage medium stores one or more computer programs, and an apparatus includes a processor-based device.

Abstract: A method for detecting sitting behavior includes acquiring a sequence of frames capturing a scene-of-interest at an overhead view. The method includes detecting at least one empty seat within the scene-of-interest and associating the seat as being unoccupied and the frame as a reference frame. The method includes extracting reference features describing a region of the unoccupied seat in the reference frame and quantifying the reference features to form a reference feature vector. The method includes extracting features describing the region in a given frame and quantifying the features to form a current feature vector. The method includes measuring a change in a feature vector over time using the reference feature vector and the current feature vector. The method includes and determining a status of the seat in the given frame as being one of occupied and unoccupied based on the change in the feature vector.

Abstract: A method for detecting settle-down time in a space includes acquiring a sequence of frames capturing a select space from a first camera. The method includes determining an initial time for computing a duration it takes for an associated occupant to settle into a seat in the select space. The method includes determining one or more candidate frames from the sequence of frames where one or both of a sitting behavior and seat occupancy is observed at the seat. The method includes determining a final frame and a final time associated with the final frame from the one or more candidate frames. The method includes computing the settle-down time using the initial and the final times.