Abstract: The disclosed principles describe systems and methods for assessing the security posture of a target device, wherein the assessment is performed by a scanning computer in communication with the target device via a communication network. By employing a system or method in accordance with the disclosed principles, distinct advantages are achieved. Specifically, conducting such a remote scan allows for the scanner computer to perform a remote scan of the remote device without installing client software to the remote device. Thus, the disclosed principles reduce the need for internal IT resources to manage the deployment and updates of client software on the target device. Also, conducting a remote scan according to the disclosed principles allows for the remote scan to be performed even if the scanner computer and remote device run different operating systems.

Abstract: Systems and methods are provided for securing a virtual machine by causing a plurality of shares of virtual machine files to be separately stored in response to a stop command. Systems and methods are also provided for restoring a data set with a cryptographic restoration application in response to a series of user inputs received when no visual indicator of the cryptographic restoration algorithm is displayed, and for restoring a data set with data shares received from another computer device in response to detecting a communication link with the device.

Abstract: A data-hosting system facilitates binding a decoupled name to a data object. During operation, the system can receive a command to generate a decoupled name that binds a new name to the data object. The system generates a hash for the data object based on the data object's content, such that the hash is not generated based on a name for the data object. The system then obtains a private key for signing the data object, and generates the decoupled name for the data object by encrypting the data object's hash and the new name using the private key. This decoupled name binds the new name to the data object. When a client request the data object based on the network name, the system can return the decoupled name associated with content of the data object. The client can use the decoupled name to validate the data object.

Abstract: Techniques to provide secure cloud-based storage of data shared across file system objects and clients are disclosed. In various embodiments, a primary encryption key is determined for an object associated with a plurality of component chunks of file system data. The primary encryption key is used to generate for each of said component chunks a corresponding chunk key, based at least in part on the primary encryption key and data comprising or otherwise associated with the chunk. The respective chunk keys are provided to a file system client configured to create and store the object at least in part by encrypting each chunk included in the plurality of component chunks using the chunk key provided for that chunk to generated encrypted chunk data, and combining the encrypted chunk data to create and store the object.

Abstract: Methods, systems, and computer program products for encrypting photograph metadata are provided. An image file is received. The image file includes digital image data and a plurality of data fields. A first data field of the plurality of data fields includes a first metadata. A rule set for modifying the first metadata is received. In response to determining that at least one rule of the rule set corresponds to the first metadata, the first metadata is encrypted based to create a second metadata. The second metadata is stored in the image file.

Abstract: As disclosed herein a computer system for secure database backup and recovery in a secure database network has N distributed data nodes. The computer system includes program instructions that include instructions to receive a database backup file, fragment the file using a fragment engine, and associate each fragment with one node, where the fragment is not stored on the associated node. The program instructions further include instructions to encrypt each fragment using a first encryption key, and store, randomly, encrypted fragments on the distributed data nodes. The program instructions further include instructions to retrieve the encrypted fragments, decrypt the encrypted fragments using the first encryption key, re-encrypt the decrypted fragments using a different encryption key, and store, randomly, the re-encrypted fragments on the distributed data nodes. A computer program product and method corresponding to the above computer system are also disclosed herein.

Abstract: Identity context-based access control is implemented by generating an identity context expression from user identity data. In particular, users are clustered based on combinations of one or more attributes. These clusters comprise one or more identity context(s). Preferably, an intersection of attribute sets of each user in the cluster is formed. In addition, an intersection of attribute sets of each user not in the cluster also is formed. If the attribute set that is common across the cluster of users is not a subset of the attribute set that is common across the rest of the users, then the attribute set forms a unique identity context expression. To reduce the number of roles used in role-based access control (RBAC), at least one role is replaced with an identity context expression. Run-time access control is then enabled.

Abstract: The present embodiments describe methods and systems for intercepting unauthorized communications in a controlled-environment facility. Unauthorized communications may originate from contraband cell phones, for example. In an embodiment, attempted communications from the contraband communication device are intercepted by the facility communication systems. The attempted communication may or may not be connected or completed, depending upon facility rules, policies, and regulations.

Abstract: A transmission system is used in a method of transmitting a camouflaged transmission of signals by generating an underlying transmission comprising a plasma transmission discharge constituting background noise having a first amplitude and generating an embedded transmission of signals within the underlying transmission.

Abstract: Examples disclosed herein relate to replacement text for textual content to be printed. Examples include a covert version of a document including textual content to be printed, the covert version including replacement text having, for each character of a plurality of first characters of the textual content, a corresponding second character having a different semantic meaning than the first character. The covert version also includes an encrypted representation of the textual content.

Abstract: A dynamic data minimization server implements minimization protocols to entity-specific information based on access rights (e.g., privacy rights) of a requesting entity. The minimization may be applied on the fly (e.g., as the entity-specific information is requested) and the level, type, protocol, etc., of encryption (or other minimization process) may be selected based on a particular type of a data item. The dynamic data minimization server may determine and apply transformation functions, such as encryption, to items of protected information, transforming those items of protected information into items of minimized information. If a requesting entity has appropriate rights, the dynamic data minimization server may selectively apply a reverse transformation function, such as decryption, to recover the original information.

Abstract: The present application discloses systems and methods for systems and methods of creating, administrating, assigning, and managing lockout-tagout (LOTO) procedures and other safety compliance procedures.

Abstract: A method and a system access data of a database in a MES system by a client application where the database access is required to satisfy a set of custom data protection rules depending on a set of user credentials. The method includes providing, at developing time a secure access layer for enabling the client application to access data to/from the database in a protected manner taking into account the set of custom data protection rules; and at runtime or engineering time by the client application, requesting, through a given authenticated user, data access to/from the database by sending to the secure access layer a given data access descriptor and the given user credentials of the given authenticated user. By the secure access layer, the received data access descriptor is processed to generate a given SQL statement for data access.

Abstract: A system and method are provided for detecting fraud and/or misuse of data in a computer environment through generating a rule for monitoring at least one of transactions and activities that are associated with the data. The rule can be generated based on one or more criteria related to the at least one of the transactions and the activities that is indicative of fraud or misuse of the data. The rule can be applied to the at least one of the transactions and the activities to determine if an event has occurred, where the event occurs if the at least one criteria has been met. A hit is stored if the event has occurred and a notification can be provided if the event has occurred. A compilation of hits related to the rule can be provided.

Abstract: Devices, systems, and methods for performing particularized encryption of confidential information within real-world data files that are subsequently stored within a cloud environment are described. Specific rules/logic are executed in a local computing environment to identify the type(s) and/or magnitude(s) of confidential information contained within each real-world data file. The identified type(s) and/or magnitude(s) of confidential information is thereafter specifically encrypted using various encryption processes. Once encrypted, the data is packaged and stored within a cloud environment without the need for further encryption at either the local computing or cloud environments.

Abstract: A mechanism is provided for sensor sharing control dynamically. One or more sensor use permissions are received from one or more sensor provider terminals. For each sensor use permission, a sensor use permission is recorded in an authorization policy thereby forming a set of authorization policies. A use request is recorded for sensor use request information received from a sensor user terminal in a request policy. A search is performed for any authorization policy in the set of authorization policies that matches the request policy. Responsive to identifying the authorization policy that matches the request policy, a list of sensors included in the sensor use permissions of an authorization policy that matches the request policy is created. The list of sensors is transmitted to the sensor user terminal, where the search is performed again dynamically when the request policy or one of the set of authorization policies is changed.

Abstract: A security mechanism in a database management system enforces processing restrictions stored as metadata to control how different pieces of a multi-nodal application are allowed to access database data to provide data security. The security mechanism preferably checks the data security restrictions for security violations when an execution unit attempts to access the data to insure the nodal conditions are appropriate for access. When the security mechanism determines there is a security violation by a query from an execution unit based on the security restrictions, the security mechanism may send, delay or retry to maintain data security. Nodal conditions herein include time restrictions and relationships with other columns, rows or pieces of information. For example, multiple processing units may execute together, but the security mechanism would prohibit these processing units to access specific pieces of information at the same time through the use of metadata in the database.

Abstract: Embodiments of the present invention disclose a method, computer program product, and system for data obfuscation and right-protection. An initial matrix Xi, represents the initial data set of the application and final matrix Xf is obtained from Xi. The final matrix Xf is obtained by performing one of the following operations Xf=(P(Xi)+E)F; Xf=P(Xi)F+E; and Xf=P(XiF)+E. Where P(.) is a projection operator that projects an input initial matrix in a space having a lower dimension than the input matrix, E represents a noise matrix, and F represents a matrix as a perturbation series. The matrix F is represented as a perturbation series, whose leading term is the identity matrix I, one or more higher-order terms of the perturbation series embedding a secret, multiplicative noise, so as for a matrix multiplied by the matrix F is right-protected.

Abstract: Technologies are generally described for privacy protection for a life-log system. In some examples, a method performed under control of a life-log system may include receiving, from a user account, a request to change one or more real life-log data entries relating to a real event that are stored in a first part of a database; removing the one or more real life-log data entries relating to the real event from the first part of the database; and storing, in the first part of the database, one or more misleading life-log data entries relating to a false event corresponding to the real event.

Abstract: The present disclosure relates to receiving and sharing wellness data. The wellness data can be received by a user device from any number of sensors external or internal to the user device, from a user manually entering the wellness data, or from other users or entities. The user device can securely store the wellness data on the user device and transmit the wellness data to be stored on a remote database. A user of the device can share some or all of the wellness data with research entities conducting research studies, friends, relatives, caregivers, healthcare providers, or the like.

Abstract: Methods, systems, and computer readable media for extending security of an application-based computer operating system are disclosed. One system includes a memory. The system also includes an application-based operating system security module bridge implemented using the memory. The application-based operating system security module bridge is for receiving, from a reference monitor, a registration for at least one security authorization hook, for receiving a callback when a protected event occurs, for communicating with the reference monitor that registered the at least one security authorization hook corresponding to the callback, and for receiving, from the reference monitor, an access control decision associated with the protected event.

Abstract: Maintaining cryptoprocessor types in a multinode system includes receiving a selection of a cryptoprocessor type; identifying, within a multinode system, a node having a cryptoprocessor of the selected cryptoprocessor type; and designating the node having the cryptoprocessor of the selected cryptoprocessor type as a primary node for the multimode system.

Abstract: A relatively small amount of programmable logic may be included in a mostly ASIC device such that the programmable logic can be used as a substitute for a fault-infected ASIC block. This substitution may occur permanently or temporarily. When an ASIC block is temporarily substituted, faulty outputs of the ASIC block are disabled just at the time they would otherwise propagate an error. The operations of the temporarily deactivated ASIC block(s) may be substituted for by appropriately programmed programmable logic. Thus, a fault-infected ASIC block that operates improperly 1% of the time can continue to be gainfully used for the 99% of the time when its operations are fault free. This substitution can be activated in various stages of the ASIC block's life including after: initial design; pilot production; and mass production. This provides for cost saving and faster time-to-market, repair, and maintenance even years after installation and use.

Abstract: A data storage system uses the free space that is not yet filled with data after the deployment of the data store. The free space is used to store additional ‘opportunistic’ protection information for stored data, possibly above and beyond the specified protection level. As the system fills up, the additional protection information is deleted to make room for more data and specified protection information.

Abstract: A Universal Serial Bus (USB) dock for connecting a USB data storage device to a computing network. The USB dock includes a chassis for coupling the USB dock to the computing network, at least one panel coupled to the chassis, and at least one USB port coupled to at least one of the panels. The USB port indicates when a USB data storage device is connected to the USB port. The USB dock includes an operating system for booting the USB dock, for creating a table associated with the connected USB data storage device and for initiating an antivirus scan of the connected USB data storage device. If the antivirus scan detects a virus on the connected USB data storage device, an option of removing the virus from the connected USB data storage device is provided. If the detected virus is not removed from the connected USB data storage device, the USB port to which the USB data storage device is connected is disabled, thereby preventing the virus from entering the computing network.

Abstract: According to an example, a security apparatus to house a device may include a chassis, a front stop having a front stop wall and a front stop opening, a rear stop having a rear stop wall and a rear stop opening, a front cover to be positioned in front of the front stop having a front cover opening, in which the front stop wall blocks direct line of sight into the front opening of the chassis through the front cover opening when the front cover is positioned in front of the front stop, and a rear cover to be positioned behind the rear stop having a rear cover opening, in which the rear cover blocks direct line of sight into the rear opening of the chassis through the rear cover opening when the rear cover is positioned behind the rear stop wall.

Abstract: The invention is directed to systems and methods for detecting the loss, theft or unauthorized use of a device and/or altering the functionality of the device in response. In one embodiment, a method includes detecting that a security compromise event has occurred for a mobile device. The method also includes altering a function of the mobile device in response to the security compromise event to mitigate loss of control by an authorized user. Altering the function of the mobile device includes denying access to data stored on the mobile device.

Abstract: Disclosed are fibers which contains identification fibers. The identification fibers can contain a plurality of distinct features, or taggants, which vary among the fibers and/or along the length of the identification fibers, a fiber band, or yarn. The disclosed embodiments also relate to the method for making and characterizing the fibers. Characterization of the fibers can include identifying distinct features, combinations of distinct features, and number of fibers with various combinations of distinct features and correlating the distinct features to supply chain information. The supply chain information can be used to track the fibers, fiber band, or yarn from manufacturing through intermediaries, conversion to final product, and/or the consumer.

Abstract: An RFID tag may execute instructions from an authenticated RFID reader. A tag determines a handle and a first parameter, both of which may be random numbers, and sends the handle to a reader. Upon receiving a challenge from the reader, the tag determines and sends a cryptographic response to the challenge based on an algorithm, a tag key, the first parameter, and the challenge. Upon receiving a message with a second parameter and a tag instruction, the tag executes the tag instruction upon verifying that the second parameter derives from the first parameter and the tag handle.

Abstract: Synthesized-beam RFID readers may be used to locate RFID tags. In one embodiment, a tag's response rates on different beams can be used, along with the target locations of those beams, to estimate the tag's location. The estimated tag location is within a region where beams with nonzero tag response rates overlap, and the distances of the estimated tag location from any two different beam target locations may correspond to a ratio of tag response rates on the two different beams. In another embodiment, a tag's response rates on different beam pairs configured to cooperatively power RFID tags can be used, along with the target locations of those beam pairs, to estimate the tag's location.

Abstract: A method of managing objects in a site includes producing a guided surface wave with a guided surface waveguide probe, the guided surface wave having sufficient energy density to power object identification tags in an entirety of a site; receiving reply signals from the object identification tags, each object identification tag associated with an object; and identifying geolocation of one or more the objects according to received reply signals from the object identification tags that are associated with the one or more of the objects.

Abstract: The present invention discloses a method and apparatus for a mobile terminal to process a visual graphics code. The method mainly comprises: obtaining a digital image recorded by the mobile terminal; analyzing the digital image to obtain a visual graphics code in the digital image; decoding the visual graphics code and classifying decoded information obtained after decoding; and processing the decoded information according to the classification of the decoded information. The present invention can achieve an effect that the mobile terminal can adaptively recognize and process various types of visual graphics codes, and greatly enhance the ability for the mobile terminal to intelligently process a visual graphics code, thereby improving the function of the mobile terminal, and causing the mobile terminal to meet the need of a user better.

Abstract: Methods and system for encoded information processing are described. In one embodiment, an encoded pattern may be optically detected from source media. Gaming data and associated synchronization data may be decoded from the encoded pattern. The gaming data may be synchronized for use during gaming based on the synchronization data. Additional methods and systems are disclosed.

Abstract: A method for evaluating an output pattern printed on a medium is described. A reference pattern is stored. The output pattern is printed on the medium based correspondingly on the stored reference pattern. A scan based instance of the output pattern is rendered, which has a set of features at least corresponding to the printed output pattern and zero or more features additional thereto. A difference image, having the zero or more features of the rendered scan instance, is computed based on a comparison of the rendered scan instance to the stored reference pattern. Upon the zero or more features including at least one feature, the computed difference image is evaluated in relation to a proximity of at least one feature to locations pixels of the reference pattern.

Abstract: A system and method for reading a machine readable code associated with an object moving relative to an imaging device may include capturing a first image of the machine readable code at a first resolution. A second image of the machine-readable code with a non-integer pixel shift in alignment at the first resolution may be captured. An interleaved image may be formed from the first and second images. An image of the machine-readable code may be generated at a second resolution using the interleaved image, where the second resolution is higher than the first resolution.

Abstract: A fingerprint sensor includes a pixel array, an offset cancellation circuit, a correlated double sampling and integration circuit, a sample and hold circuit, and an analog-to-digital converter. The pixel array includes unit pixels arranged in rows and columns, each of which generates an analog signal by detecting a fingerprint of a user. The offset cancellation circuit receives the analog signal from the unit pixels through a plurality of column lines, and outputs one of the analog signal and an offset cancellation signal as an integration signal based on an offset control signal. The correlated double sampling and integration circuit accumulatively performs a correlated double sampling operation and an integration operation on the integration signal to generate an accumulation signal. The sample and hold circuit samples the accumulation signal based on a hold signal to generate a sampling signal. The analog-to-digital converter converts the sampling signal to a digital signal.

Abstract: A first method comprises using an imaging device to produce a plurality of images of a culture device, analyzing a first image to identify a microorganism colony at a first location, analyzing a second image to identify a gas bubble at a second location, and determining whether the first location is proximate the second location. A second method comprises analyzing an image of a culture device to detect gas bubbles and classifying the gas bubbles according to a size parameter associated with each of the gas bubbles. A third method comprises analyzing a first area of an image of a culture device to detect a first number of gas bubbles, analyzing a second area of the image to detect a second number of gas bubbles, and comparing the first number of gas bubbles to the second number of gas bubbles.

Abstract: A method for preventing overlap during the application of a universal identifier (UID) to a signature document in an electronic signature service is disclosed. The method includes parsing an image file of the signature document to obtain a content vector. A set of addresses of the content vector uniquely correspond with a set of locations in the image. Each value in the content vector indicates content at a corresponding location in the image. The method also includes measuring an overlap quantity for a potential UID location using the content vector to measure the overlap quantity. The method also includes selecting a UID location in the signature document using the overlap quantity. The method also includes applying the UID to the signature document using the UID location.

Abstract: Aspects of the subject disclosure may include, for example, systems and methods aggregating video content and adjusting the aggregate video content according to a training model. The adjusted aggregate video content comprises a first subset of the images and does not comprise a second subset of the images. The first subset of the images is determined by the training model based on a plurality of categories corresponding to a plurality of events. The illustrative embodiments also include presenting the adjusted aggregate video content and receiving identifications for the first subset of the images in the aggregate video content. Further, the illustrative embodiments include adjusting the training model according to the identifications and providing the adjusted training model to a network device. Other embodiments are disclosed.

Abstract: An example method for positioning feature points of a human face edge including fitting a profile edge curve of a human face edge in a human face image according to the human face image; calculating by using a preset human face edge feature point calculation model to obtain feature points of the human face edge in the human face image; calculating by using a preset convergence algorithm to obtain feature information of a convergence feature point corresponding to each feature point; determining respectively whether a distance from each feature point to the profile edge curve is greater than a distance from a respective corresponding convergence feature point to the profile edge curve; and determining whether a magnitude of overall position change of all the feature points of the human face edge in the human face image before and after the above determination is less than a preset threshold.

Abstract: A face comparison device according to the present invention includes: an occluded-feature point estimation unit that estimates an occluded-feature point that is a feature point of an invisible face, and outputs position information of the occluded-feature point; a pseudo-feature point estimation unit that estimates a pseudo-feature point that is an erroneously detected feature point not captured within the input image due to occlusion, and outputs position information of the pseudo-feature point; and a comparison unit that generates a normalized image of the input image by using the position information of the occluded-feature point and the pseudo-feature point, generates a normalized image of an acquired comparison image, and compares the first facial feature vector extracted from the normalized image of the input image and the second facial feature vector extracted from the generated normalized image of the comparison image.

Abstract: Systems and methods are disclosed for operating, calibrating, and dynamically optimizing a system for a virtual reality environment where colored marker lights are attached to objects, the objects including players, controllers, and devices related to the game. One or more color cameras are used to view one or more spaces, and track positions and orientations of players and other objects according to the attached marker lights. A hierarchical system of servers may be used to process positions and orientations of objects and provide controls as necessary for the system. A method for color assignment is described as well as a calibration process, and a dynamic optimization process. A synchronization process is also described that ensures that a plurality of cameras and attached servers are properly coordinated. Head-mounted devices may also be used in conjunction with marker lights to provide information regarding players.

Abstract: An automated process of transferring an object (e.g., the head with hair) from an image into another image, or to a different location in the same image is described. The implementation is a comprehensive and fully automated approach enabling the object's transfer without intermediate intervention and support from the user. The process automates both steps: the object's delineation, and its blending into the new background as well.

Abstract: A system for document processing including decomposing an image of a document into at least one data entry region sub-image, providing the data entry region sub-image to a data entry clerk available for processing the data entry region sub-image, receiving from the data entry clerk a data entry value associated with the data entry region sub-image, and validating the data entry value.

Abstract: A method for linking objects to electronic content is disclosed. The method includes providing a digital copy of a layout of an object; processing the digital copy for distinguishing text objects each associated with a visual form of at least portion of a word or a combination of adjacent words in the layout, and determining bounding boxes of the text objects; coding each text object in a binary descriptor corresponding to its visual form, whereby the coding includes: scaling the bounding box of the text object to a fixed size binary image, and flattening the binary image to form the binary descriptor; representing the layout in a binary vector formed as an array of the binary descriptors of at least the text objects in the layout; and assigning hashwords to the binary descriptors, for converting the binary vector into a searchable text form.

Abstract: A mobile computing device-implemented method of imaging an object to read information, includes capturing, by running an image capturing thread, a plurality of raw images of the object by an image capturing component of the mobile computing device and placing in an image queue in a first memory location; processing, by running an image processing thread, one or more raw images to extract one or more potential machine readable zone (MRZ) candidates and placing in a MRZ candidate queue in a second memory location; analyzing, by running an image analysis thread, an MRZ candidate to detect an MRZ and placing in an MRZ queue in a third memory location; and creating a composite MRZ if a timer has expired, or the MRZ queue has reached a predetermined threshold.

Abstract: Smart eyeglasses with iris recognition device comprise at least one glasses frame, a glasses arm connected to a side of the glasses frame; an iris recognition device installed on the glasses frame and having a recognition unit facing an inner side of the glasses frame. A light source device installed on the glasses frame projects a light on an inner side of an outer boundary of an iris of an eyeball, and not in contact with the outer boundary of the iris. The iris is sampled more easily and clearly with luminosity compensation of the light source device for enhancing the accuracy and sampling speed.

Abstract: Embodiments are disclosed for eye tracking systems and methods. An example eye tracking system comprises a plurality of light sources and a camera configured to capture an image of light from the light sources as reflected from an eye. The eye tracking system further comprises a logic device and a storage device storing instructions executable by the logic device to acquire frames of eye tracking data by iteratively projecting light from different combinations of light sources of the plurality of light sources and capturing an image of the eye during projection of each combination. The instructions may be further executable to select a selected combination of light sources for eye tracking based on a determination of occlusion detected in the image arising from a transparent or semi-transparent optical structure positioned between the eye and the camera and project light via the selected combination of light sources for eye tracking.

Abstract: A method to determine whether a user is experiencing difficulty visually resolving content is disclosed. The method includes capturing one or more images of the user while the user is viewing the content. The method also includes obtaining facial parameters related to a visual acuity of the user from the captured one or more images. The method further includes determining whether the user is experiencing difficulty visually resolving the content based on the obtained one or more facial parameters. The method is implemented in a device such as a smartphone, tablet computer, or television. The facial parameters include information about the extent to which the user has their eyes open or closed, whether the user is wearing glasses, and the distance at which the user is viewing the content.

Abstract: A user terminal and a providing method thereof are provided. The method includes acquiring an iris image, determining a capturing condition of the iris image, converting the acquired iris image to an iris code and performing iris recognition by comparing the converted iris code with an iris code corresponding to a determined capturing condition among pre-registered iris codes, determining a physical condition of a user who is subject to the iris recognition on the basis of an iris recognition matching rate being within a preset range, and providing a determined physical condition result.