Abstract: Methods and devices for detection of malware, such as ransomware, are disclosed. Ransomware encrypts files, making them useless to the owner. The entropy value of files is calculated and, in response to a predetermined event, such as a write operation to the file, a new entropy value is calculated. If the change in entropy value exceeds a threshold, or if the magic number of a file is missing or is inconsistent with the file type, then malware may be present. Steps are then taken to prevent further encryption by the malware.

Abstract: An apparatus and method for monitoring a virtual machine based on a hypervisor. The method for monitoring a virtual machine based on a hypervisor includes monitoring an attempt to access an executable file located in a virtual machine, when the attempt to access the executable file is detected, extracting a system call transfer factor, input through a task that attempted to make access, acquiring, based on the system call transfer factor, an execution path corresponding to the executable file and a reference path corresponding to a reference file that is executed together with the executable file, and checking based on the execution path and the reference path whether any of the executable file and the reference file is malicious, and collecting a file in which malicious code is present when the malicious code is present in any of the executable file and the reference file.

Abstract: Virus detection by executing electronic message code in a virtual machine is disclosed. An example method includes detecting that an electronic message includes executable code, the electronic message designating a destination recipient. Two or more destination computing systems are identified for the electronic message corresponding to the destination recipient specified in the electronic message prior to delivery of the electronic message to the two or more destination computing systems, the two or more destination computing systems including a first destination computing system and a second destination computing system different from the first destination computing system. Two or more simulation environments corresponding to the two or more destination computing systems are identified. The executable code is executed in the two or more simulation environments. The two or more simulation environments are monitored for a malicious action.

Abstract: A system and methods are disclosed for securely booting a processing system using a three step secure booting process. Several embodiments are presented, wherein upon power-on-reset, the first boot step uses a secure boot device comprising of a programmable device or an FPGA which boots up first, validates its configuration file and then validates the processor(s) configuration data before presenting the configuration data to the processor(s). This enables validation of ‘pre-boot’ information, such as the Reset Control Word and pre-boot processor configuration data. The second and third boot steps validate the internal secure boot code and external boot code respectively using one or more of secure validation techniques, such as encryption/decryption, Key mechanisms, privilege checking, pointer hashing or signature correlation schemes.

Abstract: A virtual asset testing environment is provided that is distinct from a production computing environment. A virtual asset creation template associated with a class of virtual assets to be verified is identified, each virtual asset of the class of virtual assets being created using the virtual asset creation template. A designated test virtual asset is generated using the virtual asset creation template that is deployed in the virtual asset testing environment. The designated test virtual asset is then analyzed in the virtual asset testing environment to identify any vulnerabilities in the designated test virtual asset. If a vulnerability is identified in the designated test virtual asset, a remedy to the vulnerability is applied to the virtual asset creation template, and/or virtual assets created by the virtual asset creation template deployed in the production environment.

Abstract: An invention that enables an automatic discovery of Vulnerabilities in software that consists of compiled and linked machine code. Once the vulnerability, i.e., a set of values in a file or memory or network packet that causes unintended execution of commands, is discovered, the invention also automatically creates a set of commands to execute to enable a user to execute unauthorized commands. Through the employment of random input file generation that follows a set of constraints, and symbolic execution that creates solutions in the form of data input sets, which results in the CPU's program counter to execute malicious code, the invention creates novel software vulnerabilities and exploits.

Abstract: A testing system for testing computer system security includes control logic interposed between tester computers and a computer system under test. Tester computers are used by testers to test for security vulnerabilities of the computer system under test. A test results database contains records of tester interactions with the computer system under test and responses of the computer system under test to the tester interactions. A test mark database, coupled to the control logic, contains records related to granular elements of the computer system under test that are amenable to being tested for security vulnerabilities. Records of the test mark database indicate whether a corresponding granular element has been tested for security vulnerabilities. A coverage application, coupled to the test mark database, inputs data from the test mark database and outputs data indicating which granular elements of the computer system under test are to be tested.

Abstract: In one embodiment, a malicious code prevention module identifies potentially malicious instructions in volatile memory of a computing device and replaces them with innocuous instructions. In another embodiment, the malicious code prevention module identifies a potentially malicious thread within an operating system and replaces the first instruction in the thread with a new instruction that terminates the thread. Malicious code prevention module prevents malicious code from inflicting any harm on the computing device and its contents.

Abstract: Apparatus, method and article of manufacture providing a randomized encoding scheme for sequential logics, for resistance to data leakage. Invention employs dual-rail encoding to randomize the information in the chip, and employs three-dimensional integration technology to protect the critical information that is needed to decode the data anywhere on-chip. With the present invention, even when the entire design is completely known to the attacker who also has full access to the outsourced portion, it is still not always possible to identify the information in the chip using data leakage Trojans.

Abstract: A computer receives a set of objects from a client, whereby at least one of the objects of the set are respectively associated and encrypted with a unique file encryption key (FEK). The computer encrypts each of the FEKs with a common master encryption key, MEK, resulting in respective locked keys. In an initial backup, the encrypted objects together with their associated locked keys are transmitted to a backup server where a first module determines if locked key has changed via referencing an encryption state associated with the encrypted objects. If an MEK has changed, the existing FEKs are re-encrypted with the changed MEK to generate new locked keys, and, in a subsequent backup operation, sending the new locked keys to the backup server to replace the existing locked keys, while avoiding transmitting to the backup server the objects whose associated FEKs are affected by the changed MEK.

Abstract: Example embodiments for descrambling and scrambling a memory channel include executing a training mode for the memory device to discover XOR vectors used by the host system to scramble data. The training mode inputs all zero training data to a scrambling algorithm for all memory locations of the memory device to generate scrambled training data that is transmitted over the memory channel to the memory device. The scrambled training data are equal to the XOR vectors corresponding to those memory locations. The scrambled training data is received over the memory channel by the memory device and stored as the XOR vectors for each corresponding memory location. During a functional mode, the scrambled data is received over the memory channel for a specified memory location and the XOR vector stored for the specified memory location is used to descramble the scrambled data prior to writing to the specified memory location.

Abstract: Methods and apparatuses are presented for obfuscating the locations of terrestrial wireless transceivers, including wireless access points and femtocells. According to some embodiments, a method may receive, by a mobile device, data for a terrestrial wireless transceiver, wherein the data includes location coordinates of the terrestrial wireless transceiver, and wherein the location coordinates include an error term. Additionally, the method may include determining the error term based on the data. Furthermore, the method may include determining a corrected location of the terrestrial wireless transceiver by removing the error term from the location coordinates. In some instances, the data can further include a unique identifier associated with the terrestrial wireless transceiver, and wherein the error term is further determined based on the unique identifier.

Abstract: A method to provide negotiation control to data such that a person or entity can negotiate the use of data gathered beyond what is needed for a particular use by a third party transaction.

Abstract: A method for managing access to a device includes receiving restriction information and access to a user's calendar, scanning the calendars for entries corresponding to travel, determining if the user is prohibited from accessing content on a device, and accordingly denying the user access to the content on the device in response to determining that the user is not in compliance with the restriction information. The restriction information indicates requirements a user must comply with to access content with a device, as well as which content is regulated by said requirements. The requirements indicated by the restriction information include a timeframe around and including a calendar entry corresponding to travel during which the user is denied access to content. A computer program product and a computer system corresponding to the method are also disclosed.

Abstract: A system uses information submitted in connection with a request to determine if and how to process the request. The information may be electronically signed by a requestor using a key such that the system processing the request can verify that the requestor has the key and that the information is authentic. The information may include information that identifies a holder of a key needed for processing the request, where the holder of the key can be the system or another, possibly third party, system. Requests to decrypt data may be processed to ensure that a certain amount of time passes before access to the decrypted data is provided, thereby providing an opportunity to cancel such requests and/or otherwise mitigate potential security breaches.

Abstract: Techniques for secure data synchronization are described. In one or more implementations, a determination is made as to whether enterprise data is stored locally on a first device corresponding to an enterprise device. Based on a determination that the second device is a non-enterprise device, a determination is made as to whether a permission associated with the first device indicates that the first device is permitted to propagate the enterprise data to non-enterprise devices. If the first device lacks permission to propagate the enterprise data to non-enterprise devices, the enterprise data is prevented from being propagated to the second device.

Abstract: Provided is a process including: receiving a request to write a new version of a document to a tamper-evident, immutable data repository; determining that the new version of the document is different from the previous version of the document; and in response to determining, storing a difference between the previous version of the document and the new version of the document in the tamper-evident, immutable data repository.

Abstract: The disclosed technology includes techniques for secure access to data associated with an organization and includes providing a user device access to a user interface that is configurable by a user of the user device to execute function requests. Upon receipt of a function request, a router can randomly select an available computer from a computer cluster to execute the function. The computer can access a predetermined portion of the organization's data, generate an output by executing the requested function based on the predetermined portion of the organization's data, and transmit the output to the user device.

Abstract: Systems and methods are provided executing jobs immediately upon receipt of a notification. The systems and methods may include receiving, at a cloud compute service, a notification that a sensitive file comprising sensitive data has been received at a file receipt location, the sensitive file being sent by a client device; generating, by the cloud compute service, a container instance in response to the notification; retrieving, by the container instance, the sensitive file from the file receipt location; generating, by the container instance, a stripped file by stripping the sensitive data from the sensitive file based on a configuration file; transmitting, by the container instance, the stripped file to a storage location; deleting the sensitive file and associated file pointers from the file receipt location; and terminating the container instance, wherein terminating the container instance comprises deleting files comprising sensitive data and associated file pointers.

Abstract: A system and method is provided for encrypting data for secure storage or transport. The method includes identifying a first object comprising a string of binary values and a second object comprising a string of integers, and processing the first and second objects to generate a wave screen comprising a set of remapping instructions associated with a block map layout. For each data segment to be encrypted, the method includes positioning the bits of the data segment within the block map layout to generate a data map, and encrypting the data map by applying the wave screen to remap the positions of the bits within the block map layout in accordance with the set of remapping instructions. The encrypted data map is then stored or transported as a representation of the data segment.

Abstract: Embodiments of the invention provide systems and methods for controlling presentation of sensitive information in a user interface of an application. More specifically, embodiments of the present invention provide for masking the sensitive information when being entered by the user. However, if the user wants to verify the entry or display the sensitive information in readable text, the information can be displayed or unmasked upon request. For example, in response to the user clicking a button or other control of the user interface associated with the sensitive information or by another mouse or keyboard event, the requested sensitive information can be unmasked and displayed in the clear, for example as a tool tip or in the originally presented element of the user interface. The user can then close the tooltip or mask the information, e.g., after verification of what he/she typed.

Abstract: The privacy of linear queries on histograms is protected. A database containing private data is queried. Base decomposition is performed to recursively compute an orthonormal basis for the database space. Using correlated (or Gaussian) noise and/or least squares estimation, an answer having differential privacy is generated and provided in response to the query. In some implementations, the differential privacy is ?-differential privacy (pure differential privacy) or is (?,?)-differential privacy (i.e., approximate differential privacy). In some implementations, the data in the database may be dense. Such implementations may use correlated noise without using least squares estimation. In other implementations, the data in the database may be sparse. Such implementations may use least squares estimation with or without using correlated noise.

Abstract: A device may receive content data from a content provider, the content data including: data identifying content, and data for verifying that the content has not changed. The device may access a blockchain associated with the content data, the blockchain including validation information specifying instructions for validating the content. In addition, the device may perform, based on the validation information, validation of the content to determine a measure of confidence that the content is accurate and store results of the validation in the blockchain as a transaction. Based on the validation results, the device may perform an action.

Abstract: A secure containment enclosure such as an equipment rack is disclosed that includes an electronic locking system. The electronic locking system locks and, upon receipt of a valid credential to a credential input device, unlocks an access door to the secure containment enclosure. The electronic locking system locks the access door during normal operation, and is prevented from unlocking the access door during normal operation and for a predetermined period of time after the secure containment enclosure is powered off to ensure that all data on electronic devices in the secure containment enclosure is erased. Other security features include storage encryption, network encryption, preventing administrative logon access to customers' compute nodes, and dedicated instances in which only virtual machines from specified customer accounts can be located on the same electronic device.

Abstract: In an approach to managing a quick response code branding device and management of a quick response code branding device, one or more computer processors receive one or more quick response code configuration parameters. The one or more computer processors determine one or more program instructions corresponding to the one or more quick response code configuration parameters based on one or more task-specific factors. The one or more computer processors send the one or more program instructions to a quick response code branding device. The one or more computer processors receive quick response code branding device status data. The one or more computer processors determine whether the quick response code branding device status data meets the one or more quick response code configuration parameters.

Abstract: An asset tag apparatus and methods of monitoring assets with an asset tag are provided. The asset tag apparatus includes a housing and a wireless transmitter located within the housing. A processor is located within the housing, wherein the processor is in communication with the wireless transmitter. An accelerometer is positioned within the housing, wherein the accelerometer is in communication with the processor, wherein a wake-up signal is transmitted from the accelerometer to the processor in response to an activation of the accelerometer, and wherein the wireless transmitter transmits a signal externally from the housing in response to the wake-up signal received by the processor.

Abstract: Methods and apparatus relating to processing a low-energy data packet are provided. A method includes receiving, using a receiver in a portable wireless device, a low-energy data packet from a low-energy tag. The portable wireless device is stationary. The low-energy data packet includes data identifying the low-energy tag. The method can also include determining at least an approximate distance between the low-energy tag and the portable wireless device. The method can also include transmitting, via an intermediate wireless device and to a central device, the data identifying the low-energy tag, the data identifying the at least approximate distance, or both.

Abstract: A radio frequency identification (RFID) system for frequency multiplexing includes, in one exemplary embodiment, and RFID interrogator configured for generating an RFID signal, wherein a channel frequency of the RFID signal changes over time; a first narrow band antenna, characterized by a first passband, the first passband corresponding to a first range of frequencies; a second narrow band antenna, characterized by a second passband, the second passband corresponding to a second range of frequencies, wherein the second range of frequencies differs from the first range of frequencies, whereby the second passband differs from the first passband; and first and second feed lines configured for feeding the RFID signal to each of the first and second narrow band antennas, respectively. Other embodiments include systems and methods including similar and different RFID components and aspects for frequency multiplexing.

Abstract: Techniques for determining an item location based on multiple RFID parameters from multiple read events are described. In an example, a computer system may access a first read event. A first RFID reader located within a first zone may have generated the first read event at a first time. The first read event may identify an RFID tag and may include first RFID parameters. The computer system may access a second read event. A second RFID reader located within a second zone may have generated the second read event at a second time within a predefined amount of time from the first time. The second read event may identify the RFID tag and include second RFID parameters. The computer system may determine whether the item location falls within the first zone or the second zone based on two or more first RFID parameters and two or more second RFID parameters.

Abstract: Systems and methods for controlling at least one security device based on the behavior of at least one tag. The methods comprise: generating sensor data relating to movement by at least one sensor disposed in a first tag; analyzing the sensor data to determine if an item to which the first tag is coupled is being handled in an unusual, abnormal or nervous manner; determining if an enterprise system has lost communicative contact with the first tag coupled to the item that is being handled in an unusual, abnormal or nervous manner; and causing an operational state of the security device to change in response to the loss of the communicative contact between the enterprise system and the first tag.

Abstract: An authentication method includes RFID tags authenticating RFID readers. A tag sends a tag identifier and a reader challenge to a reader in response to one or more commands from the reader. The reader then either derives a response to the reader challenge itself or has a verification authority derive the response. The response may be derived from parameter(s) in the reader challenge, and may be derived using a cryptographic key. The reader then sends the response to the tag along with one or more commands. The tag verifies the response before executing action(s) associated with the command(s).

Abstract: Methods and systems are disclosed that relate to causing indicators to present indications. Sensor data associated with a space of a fixture that includes a set of slots may be received. The sensor data may indicate that a sensor has sensed a condition of a container relative to the space. It may be determined that the condition corresponds to a slot of the set of slots based at least in part on the sensor data. Information usable to associate the container with a record may be generated. An indicator corresponding to the slot may be caused to produce an indication.

Abstract: A method and system for identification of an item is provided, wherein the system includes a conveyor belt, a positioning device and a reader operable to receive at least one reading at at least one first antenna from at least one tag attached to the item, the first antenna being adapted to be arranged at a read point along the conveyor belt, wherein the positioning device is configured to retrieve a first position of the item at a first time instant before the first antenna and a second position of the item at a second time instant after the first antenna, the first and second time instants defining a time window, wherein the reader is configured to extract from each reading retrieved by the first antenna a measurement (6) of the phase of the signal transmitted by the tag (5) and perform a data processing of the phase measurements whereby the identification of the item (2) is accomplished.

Abstract: The present invention discloses a method for detecting, storing, analyzing and enabling access to collected biological or environmental test data. The method includes providing one or more test packs comprising one or more testing strips or swabs for testing biological or environmental materials. The method further includes testing a targeted material at a targeted location and scanning, via a scanning device connected to a computer network, the one or more testing mediums to create collected test data based on the revealed information of the testing, wherein the scanning takes place a short time after the testing and at the targeted location, and wherein the collected test data includes the time, date and geographical tracking data based on the GPS location of the scanning device at the time of the scanning.

Abstract: A system controlled responsive at least in part to data read from data bearing records is operative to cause vehicle repair parts to be determined and furnished. Data read by a reader from a tag associated with a damaged vehicle is used to determine vehicle identifying data. A repair estimate calculation circuit (RECC) operates responsive to the read data to produce a needed parts record (NPR). The records produced by the RECC are operative to cause a vehicle repair entity (VRE) to be furnished the vehicle repair parts.

Abstract: Systems, methods, and devices for conducting a secure ticketing transaction at a first location within a transit system. A media reader described herein may include a barcode reader, a barcode display, and processor(s). The processor(s) may be configured to perform operations including receiving a key for performing encryption or decryption of data, reading, from a display of a mobile communication device, an encrypted first barcode to obtain encrypted first barcode data, decrypting the encrypted first barcode data to obtain first barcode data, generating second barcode data indicating entry information, encrypting the second barcode data to obtain encrypted second barcode data, displaying an encrypted second barcode containing the encrypted second barcode data, and allowing the transit customer to enter the transit system at the first location.

Abstract: An indicia reading terminal has a three-dimensional depth sensor, a two dimensional image sensor, an autofocus lens assembly, and a processor. The three dimensional depth sensor captures a depth image of a field of view and create a depth map from the depth image, the depth map having one or more surface distances. The two dimensional image sensor receives incident light and capture an image therefrom. The autofocusing lens assembly is positioned proximate to the two dimensional image sensor such that the incident light passes through the autofocusing lens before reaching the two dimensional image sensor. The processor is communicatively coupled to the two dimensional image sensor, the three dimensional depth sensor, and the autofocusing lens assembly.

Abstract: A recognition apparatus includes one or more processors, a memory to store a plurality of instructions which, when executed by the processors, cause the processors to extract an optically-readable symbol from an optically captured image including an image of the optically-readable symbol, the optically-readable symbol including a first cell line having a plurality of first cells, and one or more second cell lines each having one or more second cells, each of the one or more second cell lines connected to respective ones of the plurality of first cells of the first cell line, recognize first information expressed by the first cell line included in the extracted optically-readable symbol, recognize second information expressed by the one or more second cell lines included in the extracted optically-readable symbol, and acquire identification information included in the optically-readable symbol based at least in part on the first information and the second information.

Abstract: A barcode reader may include an image sensor array, an optic system, an image buffer, and a plurality of pre-processing circuits implemented in hardware. The optic system may be configured to focus an image of a barcode onto the image sensor array. The plurality of pre-processing circuits may collectively implement a plurality of different image processing functions. Each pre-processing circuit may be configured to receive as input an image frame from the image sensor array or an image data record from the image buffer. The image data record may be derived from the image frame. Each pre-processing circuit may also be configured to perform an image processing function with respect to the image frame or the image data record, thereby generating a new image data record. A decoder may use at least one image data record to decode the barcode.

Abstract: A fingerprint detection liquid that makes it possible to recover clear fingerprints from wet objects and various other objects without adjustment of concentration and composition. The fingerprint detection liquid includes not only pigment particles and a silicone but also a cationic surfactant and an ionizing liquid that ionizes the cationic surfactant. The cationic surfactant preferably includes octyldimethylethylammonium ethylsulfate.

Abstract: A printed circuit board assembly (PCBA) and a method to assemble the PCBA are disclosed. The PCBA includes a printed circuit board (PCB), an image sensing chip and a protection layer. The PCB includes a first insulation layer, a second insulation layer, a first electrically conductive layer, a second electrically conductive layer, and a third electrically conductive layer. The image sensing chip has a number of bonding pads with a sensor portion facing down through the second opening. The PCBA can function as an image sensing module and make the module have the thinnest thickness.

Abstract: A fingerprint sensor for reinforcing an electric field and preventing electric interference between adjacent electrodes. The fingerprint sensor includes a plurality of sensor electrodes provided on a substrate, an insulating layer, and a discontinuous grid formed in the insulating layer. The discontinuous grid includes a plurality of walls that are arranged in a two-dimensional (2D) manner. The plurality of walls are electrically insulated from each other.

Abstract: A fingerprint sensing device comprises a substrate and an array of sensor cells formed over the substrate. The sensor cells are divided into multiple groups. Each group is associated with a group-identifiable signal. The sensor cells in each group are configured to transmit the group-identifiable signal of the respective group and are further configured to simultaneously receive the group-identifiable signals transmitted by the sensor cells in other groups. The group-identifiable signals are orthogonal with respect to each other.

Abstract: A dermatoglyph identification apparatus and an identifying method thereof are provided. The dermatoglyph identification apparatus includes a switch circuit, a signal source and a plurality of sensors. The signal source is selectively connected to the sensors through an impedance element. The switch circuit switches at least one sensor to be connected to the impedance element, and switches rest of the sensors to be connected to a ground terminal of the signal source. The dermatoglyph identification apparatus identifies dermatoglyph according to a sensing signal generated by the sensor connected to the impedance element in response to a reference signal of the signal source.

Abstract: The present disclosure provides a fingerprint identification device, a touch panel, an input device and a fingerprint identification method. The fingerprint identification device includes a fingerprint identification module, gate lines and signal lines. The gate lines and the signal lines cross so as to define a plurality of sensing regions including a thin film transistors and a sensing electrode connected to the thin film transistors. A gate electrode of the thin film transistor is connected to the corresponding gate line, a source electrode is connected to the corresponding signal line, and a drain electrode is connected to the corresponding sensing electrode. The signal lines include signal-transmitting lines and signal-receiving lines, the sensing electrodes include transmitting electrodes and receiving electrodes.

Abstract: A fingerprint sensing system has a fingerprint sensing device and a power supply circuit. The fingerprint sensing device has a high-voltage input terminal and a low-voltage input terminal. During scan phases of the fingerprint sensing device, the power supply circuit provides a first voltage to the high voltage input terminal and provides a second voltage to the low voltage input terminal. During the read phases of the fingerprint sensing device, the power supply circuit provides a third voltage to the high voltage input terminal and provides a fourth voltage to the low voltage input terminal. A first voltage difference is between the first voltage and the second voltage. A second voltage difference is between the third voltage and the fourth voltage. The first voltage difference is greater than the second voltage difference.

Abstract: A touchscreen, now incorporated in most smartphones, tablets, laptops, and similar devices, presents an effective and transparent method to incorporate continuous active user verification schemes. The touchscreen element grid structure can be used to capture information, such as a set of one-dimensional time-varying signals produced as the user's finger moves past the grid intersections points. This information may be used to verify the user, or that a valid user currently has possession of the mobile device, even while the user is not consciously engaged in an active verification process. Further functions, such as habitual gesture recognition, can also be performed using the same grid outputs.

Abstract: The present invention generally relates to a method for forming a fingerprint using a fingerprint sensing system, and specifically to the possibility of allowing the formation of a fingerprint when only separated portions of the fingerprint is available. The invention also relates to the corresponding fingerprint sensing system and to a computer program product.

Abstract: An optical apparatus adapted to contact an object is provided. The optical apparatus includes an optical device and a processing circuit. The optical device includes a reflection structure and a transmission structure. The optical device senses light signals of the object via the reflection structure and the transmission structure. The processing circuit is electrically connected to the optical device. The processing circuit is configured to identify the object according to the light signals. In addition, a method for identifying an object is also provided.

Abstract: A fingerprint identification device includes a cover, a light-shielding layer formed on the cover, an intermediate layer formed on the light-shielding layer, an adhesive layer formed on the intermediate layer, a protection layer formed on the adhesive layer, and a fingerprint identification element. The fingerprint identification element is configured to identify a fingerprint. The fingerprint identification element is embedded in the protection layer.