Abstract: Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

Abstract: An access control system that protects signals between one or more secure databases for various user devices to ensure proper entrance or access into secure locations by approved personnel only that utilize one or more securitized container devices. These container devices may be software containers and either real or virtual devices. Specific methods and devices for securing (primarily digital and normally two-way) communications using applications that combine securing communications for wireless/cellular phones with personnel access card readers for entry into secure locations are also described. These combined communication and access devices require using specific encryption techniques impossible to corrupt and essential to denying fraudulent or otherwise unauthorized personnel the ability to enter or access security protected devices or locations.

Abstract: A data processing system (DPS) supports control-flow integrity (CFI). The DPS comprises a processing element with a CFI enforcement mechanism that supports one or more CFI instructions. The DPS also comprises at least one machine-accessible medium responsive to the processing element. Managed code in the machine-accessible medium is configured (a) to execute in a managed runtime environment (MRE) in the data processing system, and (b) to transfer control out from the MRE to unmanaged code, in response to a transfer control statement in the managed code. The machine-accessible medium also comprises a binary translator which, when executed, converts unmanaged code in the data processing system into hardened unmanaged code (HUC) by including CFI features in the HUC. The CFI features comprise one or more CFI instructions to utilize the CFI enforcement mechanism of the processing element for transfers of control initiated by the HUC. Other embodiments are described and claimed.

Abstract: Trampoline and return-oriented programming attacks employ a variety of techniques to maliciously execute instructions on a device in a manner different from a legitimate programmer's original intent. By instrumenting a device to detect deviations from predicted behavior, these exploits can be identified and mitigated.

Abstract: A computer-implemented method for detecting potentially malicious hardware-related anomalies may include (1) profiling a computing environment of at least one hardware component on a computing device, (2) detecting, by comparing the hardware component's profile with an expected profile for the hardware component, at least one anomaly in the hardware component's computing environment, (3) identifying additional suspicious activity on the computing device, and (4) determining, by correlating the additional suspicious activity on the computing device with the anomaly in the hardware component's computing environment, that the anomaly in the hardware component's computing environment is potentially malicious. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A microcontroller with a built-in self-healing function. A programmable memory stores a normal control routine. A processing unit is arranged to execute the normal control routine in order to provide output data on the output line. A danger signal input line which is connected to a logic unit and dedicated to communicating a danger signal to the logic unit. Processor and logic unit state lines are provided between the processing unit and the logic unit for communicating processor state data from the processing unit to the logic unit and communicating logic unit state data from the logic unit to the processing unit. An interrupt line between the logic unit and the processing unit is dedicated to communicating an interrupt signal from the logic unit to the processing unit.

Abstract: A method for protecting a computer, including receiving a data block, discovering code within the data block that can be disassembled for a machine instruction, building an execution path from the machine instructions, including parsing the machine instructions, and following the flow of the execution path, including conditional and unconditional branches of the machine instructions, validating an incremented location by scanning the execution path for machine instructions that increment a register that stores a location on the execution path, finding a self-modifying artifact by scanning remaining machine instructions in the execution path for an arithmetic or logic operation performed on a register that currently or previously held a location in the incremented location, finding a modified loop index by scanning remaining machine instructions in the execution path for registers that hold a loop value that is incremented or decremented, and blocking the data when finding the modified loop index.

Abstract: This document discloses a solution for detecting, by a computer apparatus, computer program library in a binary computer program code.

Abstract: An amount of data change associated with a version of a content file with respect to one or more previous versions of the content file is determined. The amount of change associated with the version of the content file is determined using a tree data structure associated with the content file that is stored on a storage cluster. One or more statistics associated with backup snapshot are provided to a server. The server is configured to determine that the amount of data change associated with the version of the content file is anomalous based in part on the one or more statistics associated with the backup snapshot. A notification that data associated with the backup snapshot is potentially infected by malicious software is received from the server. The version of the content file is indicated as being potentially infected by malicious software.

Abstract: A control flow enforcement solution for ensuring that a program or portion thereof behaves as expected during execution upon a processor. A reference control flow is pre-determined for the program using, for example, a control flow graph (CFG). The CFG is then analysed to provide a set of rules which describe how the program should behave under normal execution. As the program executes it is monitored and the rules are evaluated to enable detection of any unexpected control flow. An embodiment of this disclosure is configured to respond upon detection that a rule has been violated. The response can take the form of any appropriate intervention such as a processor interrupt, memory fault, processor reset or generation of an alert. In this way, an embodiment of this disclosure may provide a particularly effective mechanism for detecting and defending against malicious activities such as return oriented programming attacks.

Abstract: Example embodiments disclosed herein relate to determining whether a protective measure meeting criteria has been performed on data. Execution of an application under test (AUT) is monitored. A message that a field of the AUT should be considered sensitive is received. Data is determined to be entered into the field. The data is monitored during execution of the AUT to determine whether the protective measure that meets the criteria has been performed on the data.

Abstract: Techniques for identifying computer program security access control violations using static program analysis are provided. In one example, a computer-implemented method comprises generating, by a device operatively coupled to a processor, a mathematical model of a computer program product, wherein the mathematical model defines data flows through nodes of the computer program product that reach a secure node corresponding to a secure resource. The computer implemented method further comprises evaluating, by the device, a security protocol of the computer program product using static program analysis of the mathematical model to determine whether any of the data flows provides access to the secure node without proceeding through one or more security nodes corresponding to the security protocol, wherein the one or more security nodes are included in the nodes of the computer program product.

Abstract: According to the embodiments, a statistical model is developed to estimate the probability of being in a certain stage of a particular vulnerability in its life cycle. The methodology with the application of Markov chain theory gives the basis for calculating estimates for probabilities for different stages of a life cycle of the vulnerability considered. Using the developed method, it is possible to evaluate the risk level of a particular vulnerability at a certain time. These developments allow an advantage in taking measures to avoid exploitations and introduce patches for the vulnerability before an attacker takes the advantage of that particular vulnerability.

Abstract: In this method, a securing hardware module of a microprocessor: 1) verifies (176) the integrity and the authenticity of a cryptogram contained in a code line loaded with the aid of a message authentication code contained in this same line and triggers (172) the signalling of an execution fault if the integrity or the authenticity of the cryptogram is not confirmed, and then 2) decrypts (178) the cryptogram to obtain a decrypted instruction or a decrypted datum if the integrity and the authenticity of the cryptogram are confirmed, and then: in the case of a decrypted instruction, the decrypted instruction is recorded (180) in a queue of instructions to be executed successively one after another by an arithmetic and logic unit of the microprocessor, and in the case of a decrypted datum, the decrypted datum is recorded in an internal register of the microprocessor while waiting to be processed by the arithmetic and logic unit.

Abstract: A system and method to control access to data are disclosed. A request for a subject to perform an action on an object is received. A determination is made whether a policy for the subject limits the action to an object with integrity protection. The action is performed based on determining the object has integrity protection. The request is rejected based on determining the object does not have integrity protection.

Abstract: A document management computer system can validate a user with validation codes sent through a plurality of communication modes. The validated user may be provided with access to a stored electronic document.

Abstract: Securing an endpoint against malicious activity includes encrypting a plurality of files on an endpoint to prevent unauthorized access to the plurality of files, receiving a request to access a file from a process executing on the endpoint, decrypting the file for the process, and monitoring a security state of the process. If the security state becomes a compromised state, a technique involves maintaining access to any open files (including the file decrypted for the process), prohibiting access to other files, and initiating a remediation of the process by facilitating a restart of the process. If the remediation is successful, access by the process to the plurality of files may be restored.

Abstract: A content management system allows a user to create a collection folder to which a submitting user can add content items without being able to access content items added to the folder by other submitting users. A collection folder is created in a namespace of a collecting user and folder is made available to multiple submitting users to allow the submitting users to add items to the folder. When a submitting user first request to store a content item in the collection folder, the content management system creates a sub-folder associated with the submitting user in the collection folder and stores the content item in the sub-folder. The submitting user is given rights to the sub-folder, but is not given rights to sub-folders created for other submitting users.

Abstract: Systems, methods, and computer program products to perform an operation comprising receiving, from an application executing on a system, a request to access a data file, receiving data describing the request, wherein the data describing the request includes data from a runtime stack of the application, wherein the data from the runtime stack includes a program statement number, identifying, in a protected memory block, a first rule for accessing the data file, wherein the first rule specifies a program statement number permitted to access the data file, and upon determining that the program statement number from the runtime stack does not match the program statement number specified in the first rule, restricting access to the data file by the application.

Abstract: Facilities are provided to secure guest runtime environments (GREs). Security policy specifications may be associated with GREs. A GRE's security policy may be specific to the GRE and may also include security policy inherited from higher levels such as a host operating environment. The security policy of a GRE specifies restrictions and/or permissions for activities that may be performed within the scope of execution of the GRE. A GRE's security policy may limit what the GRE's guest software may do within the GRE. Restrictions/permissions may be applied to objects such as files, configuration data, and the like. Security specifications may be applied to execution initiated within a GRE. A GRE's security specification may restrict/permit executable objects from loading and executing within the GRE. The executability or accessibility of objects may be conditioned on factors such as the health/integrity of the GRE, the host system, requested files, and others.

Abstract: An access manager that detects a derivative work and automatically transfers digital access rights associated with an original work to the derivative work executes on a computing device. The access manager detects data to be written to a storage device and generates a new file signature for the data. The access manager compares the new file signature to existing file signatures, where the file signatures include piecewise signatures. When at least one of the piecewise signatures from the new file signature matches one of the piecewise signatures in the existing file signatures, the access manager determines that the new data to be written to the storage device is a derivative work generated from the existing file. The access rights associated with the existing file signature are copied to the new file such that the file access rights associated with the original work are passed on to the derivative work.

Abstract: An electronic device. The electronic device comprises a memory comprising a confidential information region and a non-confidential information region, a processor, and an application stored in the memory. When executed by the processor, the application determines if a reboot has occurred after a most recent power-off boot, where a reboot takes place without removing power from the processor and memory and, in response to determining that the reboot occurred after the most recent power-off boot, prevents access of applications to the confidential information region in the memory.

Abstract: A method begins by a processing module identifying, for a DSN (Dispersed Storage Network) memory using multiple IDA (Information Dispersal Algorithms) configurations simultaneously, a first IDA configuration with a highest security level relative to each of the multiple IDA configurations. The method continues by generating at least one master key. The method continues by encoding the master key with a secure error coding function to produce master key slices according to the first IDA configuration. The method continues by storing the master key slices in the DSN memory using the first IDA configuration. The method continues by, when storing data with a second IDA configuration having a security level lower than the first IDA configuration, retrieving the master key slices, decoding the master key slices to obtain the master key and encrypting the data using the master key.

Abstract: An alias key is generated for each person identification (ID) in a database table. The alias key us used to lookup the corresponding person ID in the database table. In addition, for each alias key, a temporary alias key is generated that is used to lookup the corresponding alias key in the database table. A plurality of queries are received from at least one remote client that each specify at least one of the temporary alias keys. Data is later transmitted to the at least one remote client that is responsive to the queries. Related apparatus, systems, techniques and articles are also described.

Abstract: A system and method for facilitating access to requested information in building. The system includes a database, a server having a central processing unit, a wireless network, video displays disposed in rooms, and a sensing unit in communication with the server over the wireless network. The sensing unit has a microphone and disposed in each of the rooms. The sensing units are configured to detect the presence of a user and actuate an associated video display. The microphone is configured to receive requested information from the user. The central processing unit processes the requested information so as to retrieve the requested information from the database and display the requested information on the associated video display. In one embodiment, the sensing unit is a beacon and a portable electronic device. In another embodiment, the sensing unit is a wireless voice command device.

Abstract: A user accessing data from a server in an authenticated session is determined to be human, an authorized bot, or a non-authorized bot based on receipt of behaviometric information from the user's interactions and responses to and with the server. The user is then denied or granted continued access to receive data, such as financial data, after it is determined if the user is authorized to do so by way of comparing the behaviometric data to known prior behaviometric data for particular humans and bots in embodiments of the disclosed technology.

Abstract: A system and method of operating a database system to protect personal identifiers from being revealed. The system and method obfuscates personal identifiers using a secret value, storing in a database records containing the obfuscated personal identifier, storing the secret value in a identifier translation device, receiving at a request preparer a record request identifying a requested record using a non-obfuscated personal identifier, and operating the request preparer to direct the identifier translation device to translate the non-obfuscated personal identifier into an obfuscated personal identifier using the secret value stored in the identifier translation device and using the obfuscated personal identifier in a query to the database.

Abstract: Systems and methods for tokenization to support pseudonymization are provided herein. An example method includes receiving an input set, seeding a random number generator with one or more secret data, transposing the input set using a first random number/transposition parameter generated by the random number generator to create a transposed input set, transposing a token set using a second random number/transposition parameter generated by the random number generator to create a transposed token set, and generating a token by substituting transposed input set values with transposed token set values.

Abstract: Methods, systems, and techniques for application isolation by remote-enabling applications are provided. Example embodiments provide an Adaptive Rendering Application Isolation System (“ARAIS”), which transparently and dynamically enables applications to run in an isolated execution environment yet be rendered locally in a manner that minimizes the amount of data to be transferred and the latency caused by expensive computation and/or by overburdening available bandwidth by remoting rendering using draw commands over rendering using pixel pushing or other techniques. In one embodiment, the ARAIS includes an orchestrator server which comprises remoting level determination logic and rules engine, pre-computed graphics libraries, connection support logic, data repositories for objects such as a render cache, whitelists, blacklists, client privileges, and application information, and one or more secure containers running remote application instances.

Abstract: A trusted computing device (TCD) includes an isolated environment, host interface, secure interface, and program instructions. The environment includes an isolated environment processor (IEP), memory (secure and non-secure partition), and an auxiliary processor (AP). Memory and AP are connected for data communication with the IEP, and communicate with a host only through the IEP. The host interface and each secure interface are connected for data communication with the IEP.

Abstract: A data processing device with a processor, a memory and an access control mechanism, the device having secure and non-secure modes, the memory having secure and non-secure regions, the secure region containing cryptographic data, and the access control mechanism preventing the processor from reading the cryptographic data when the device is operating in the non-secure mode. Also, methods of manufacturing and authenticating such a device, manufacturing an item of electronic equipment that includes such a device, a computer program for storing data on such a device, secure data processing hardware including such a computer program and a method of updating data stored in an item of electronic equipment including such a data processing device.

Abstract: There is provided an example memory system comprising a plurality of memory modules, each memory module comprising a persistent memory to store root key information and encrypted primary data; a volatile memory to store a working key for encrypting data, the encrypted primary data stored in the persistent memory being encrypted using the working key; and a control unit to provide load and store access to the primary data. The memory system further comprises a working key recovery mechanism to retrieve first root key information from a first module and second root key information from a second module; and compute the working key for a given module based on the retrieved first root key information and the retrieved second root key information.

Abstract: A method for fingerprint unlocking is provided. Fingerprint information for an application to be unlocked is acquired, where the fingerprint information is fingerprint ridges. The fingerprint information that is the fingerprint ridges is compared with preset fingerprint information. A display page of the application to be unlocked is refreshed in parallel with comparing the fingerprint information with the preset fingerprint information. A refreshed display page of the application to be unlocked is displayed, when the fingerprint information matches the preset fingerprint information. When the fingerprint information does not match the preset fingerprint information, the display page of the application to be unlocked is stopped to be refreshed. A terminal is also provided.

Abstract: A computer-implemented method and system automatically solves constraints in a computer-aided design (CAD) model. A CAD model of a real-world object capable of assuming various positions is constructed and a constraint solver process is initiated and executes while a user defines multiple positions of the CAD model. Input of data specified during a CAD design workflow is automatically input to the constraint solver process, and unknown variables are solved for as part of the CAD design workflow.

Abstract: Systems and methods are provided for providing real-time interactive design and simulation of a physical system to generate comparisons of varying system configurations under different physical conditions. A display is generated on a graphical user interface that displays a part in a physical system according to characteristic data. An initial simulation of the physical system is executed to determine an initial value for a metric of the initial design. The initial value is displayed on the graphical user interface. A system configuration change is received through a user interface manipulation to a first characteristic of the characteristic data or the environment condition. The simulation of the physical system is recalculated to determine a second value for the metric based on the manipulated first characteristic, the second value for the metric being displayed on the graphical user interface along with initial value in real time relative to the received manipulation.

Abstract: A design support apparatus supporting designing of a product which uses a fiber material includes a processor that creates a predicted shape model by predicting a shape of the product before a deformation processing. The processor: creates a 3-dimensional shape model of the product; creates curved shape models by separating the 3-dimensional shape model into two or more fiber layers; sets a correspondence relationship between the curved shape models; creates an orientation vector field in the curved shape models; and predicts the shape of the product before the deformation processing by developing the curved shape models on a flat surface based on the correspondence relationship between the curved shape models and the orientation vector field in the curved shape models, and creates the predicted shape model based on the predicted shape.

Abstract: The present disclosure relates to a system and method for use in an electronic design environment. Embodiments may include receiving, using at least one processor, an electronic design and generating a unique name for each hardware state element associated with the electronic design. Embodiments may further include generating a unique name for each software state element associated with the electronic design. Embodiments may also include combining a plurality of unique names into an arbitrary expression, wherein the plurality of unique names includes at least one software state unique name and at least one hardware state unique name. Embodiments may further include evaluating the arbitrary expression at one or more discrete time points. Embodiments may also include recording an evaluated expression in an electronic design database.

Abstract: Methods for simulating hydrocarbon (HC) migration and accumulation in a subsurface formation are provided. The methods include determining a plurality of HC mass associated with a plurality of grid cells representing the subsurface formation. The methods also include determining a plurality of HC mass outflow magnitudes for one or more grid cells in the plurality of grid cells, the HC mass outflow magnitude for each of the one or more grid cells having an upper bound value based on the HC mass in that grid cell. The methods update the HC mass of the plurality of grid cells based on the plurality of HC mass outflow magnitudes. The methods also determine that a set of grid cells in the plurality of grid cells contain an excess mass of HC, and perform an accumulation process to model filling of a trap associated with the set of grid cells.

Abstract: A method of computer aided engineering for designing a driveline comprises the steps of: creating a single parametric description of the driveline; analysing the parametric description for performance using one or more failure modes; and optimising performance by amending the parametric description and repeating the analysing step.

Abstract: A system generates a customized application data structure for modeling physical systems. The system includes a processor, an input device, optionally a display device, and a memory device. The processor is adapted to embed a multiphysics model data structure in the application data structure. The multiphysics model data structure comprises a representation of models of physical systems. Geometry data representing geometry subroutines and call data representing geometry subroutine calls are added to the embedded multiphysics model data structure. Data representing application features are added to the application data structure. Each application feature comprises one or more of (i) first data representing a form feature, or (ii) second data representing an action feature.

Abstract: Quantum circuits include quantum gates that require a certain amount of physical resources. It is desirable to reduce the number of certain quantum gates in order to improve the hardware efficiency of a quantum circuit. A system and a method are provided for synthesizing a quantum circuit that includes the operations of determining an ordered set or vector of phase coefficients and specifying a linear permutation. The operations also include determining a sequence of CNOT and Rz gates using the set of phase coefficients and the linear permutation, such that the number of Rz gates is reduced.

Abstract: Method and system for formally analyzing motion planning of a robotic arm based on conformal geometric algebra. The method includes determining specific structural and motion planning parameters of a robot, establishing a corresponding geometric model for the basic components and motion planning constraints of the robot based on a conformal geometric algebra theory, the established geometric model being described in a higher-order logic language, performing formal modeling for a motion process of the robot based on the established geometric model to obtain a logic model of the geometric relations involved in the motion process of the robot, obtaining a motion logic relationship corresponding to a constraint or attribute of a motion process to be verified of the robot, and verifying whether the motion logic relationship is correct. The method and system are used for analysis to improve the accuracy of the verification and reduce the complexity of the computations.

Abstract: A capacitor simulation method and nonlinear equivalent circuit model enabling dynamic simulation of nonlinear characteristics when direct-current voltage is applied with high precesion are easily provided using a simple configuration. An equivalent circuit of a capacitor is represented using a series circuit of passive circuit elements. Characteristic change ratios of the passive circuit elements when a direct-current voltage is applied are expressed as an approximate function on the basis of an actually measured value. A reference voltage is referred to by control current sources connected in parallel to the passive circuit elements. The characteristic change ratios are calculated in accordance with the reference voltage Vref.

Abstract: A printed circuit board (PCB) having a layout aligned with a Ball Grid Array (BGA) package, the PCB including a plurality of victim vias arranged in the PCB, at least one aggressor via arranged in the PCB having a transition with at least one victim via, wherein the transition is a space in the PCB between a victim via and an aggressor via along a row direction or a column direction, and the victim via is not positioned next to more than one transition.

Abstract: A method, terminal, cache server and system for displaying multimedia content in a browser, comprising receiving a webpage identifier in a browser window for a webpage comprising multimedia content, generating a multimedia content display request corresponding to the multimedia content, and sending the multimedia content display request to server, receiving multimedia content returned from the server, activating a multimedia display plug-in of the browser to display a multimedia display window, and displaying the received multimedia content in the multimedia display window, wherein the multimedia display window in an initial state is smaller than the browser window.

Abstract: A display control apparatus exaggeratedly displays a change in a printing image based on an alteration in a setting value of an editing item, on a display, when editing results of printing data on an editing screen are displayed on the display as the printing image and the setting value of the editing item of the printing data is altered.

Abstract: The present disclosure relates to linking text boxes and features associated with linked text boxes. A user interface feature in a document authoring application program for creating text boxes may include a text box creation graphical menu item presented on a display of an electronic device. In response to receiving user input indicative of a selection of the text box graphical menu item, the application program is configured to cause the electronic device to render a text box that includes a bounding edge in the document on the display. Additionally, the user interface feature includes a selectable visual indicator displayed as an integral part of the text box. The selectable visual indicator is indicative of a thread of text boxes in which the text box is included.

Abstract: An accessible processing method of webpage contents and accessible webpage device are provided. The foregoing accessible processing method may include the follows. A document outline list tag is added to a webpage. After the document outline list tag obtains a focus, the following is further included. All title tags of a specified level in current webpage may be traversed. An anchor point may be added to each title tag of the specified level. Text information of each title tag of the specified level may be respectively copied to a corresponding link newly established. The link newly established may be enabled to point to an anchor point of a corresponding title label. Each link newly established may be taken as a list item. The list item may be added to the document outline list tag.

Abstract: Some aspects described herein may include a computer implemented method to display documents. Aspects may include determining section hierarchies of a document and generating a first view of a section hierarchy. The first view may include a hierarchy title; a portion of text associated with each respective section; and an interface element associated with a first section. Based on a selection of the first section, the system may generate a second view including a portion of text associated with the first section; a first portion of text associated with a first subsection of the first section; and a second portion of text associated with the first subsection. The second portion of text may be determined based on at least one warning criteria. The second view may include a warning panel indicating the warning criteria associated with the second portion of text and visual indicia indicating the correspondence.

Abstract: Techniques are disclosed for providing visual path resolution in a context separated authoring environment of a REST- and component-based content management system. A web page editor is activated for editing a web page having a plurality of Document Object Model components. A structured document is generated and configured to present the web page components and at least a portion of the web page editor in a common frame of a browser window, as well as visual indications of regions of the web page that contain one or more of the components. In response to receiving an input that selects one of the components, the structured document is updated to present information about a property of the selected component, such as a path to a location of the selected component and/or a type of the selected component, in the same region of the web page that contains the selected component.