Abstract: An access token broker is executed within a first iFrame, a fully trusted application is executed in a second iFrame within the first iFrame, and a partially trusted application is executed in a third iFrame within the second iFrame. The partially trusted application may identify the iFrame in which the access token broker is executing and request an access token from the access token broker. The access token broker determines whether the request for the access token is to be granted. If the request is to be granted, the access token broker requests the access token from a hosting application. The hosting application obtains the requested access token from an access token server and provides the access token to the access token broker. The access token broker receives the access token from the hosting application and provides the access token to the partially trusted application.

Abstract: Examples described herein include systems and methods for contextually providing automated device enrollment into a management system. A management application on a user device can receive network settings for connecting to a local server. The network settings can be preconfigured by an administrator. The management application can cause the user device to send an enrollment request and a device identifier to the local server. The device identifier can be used to validate the device and provide a security token to the management application. The management application can use the security token to complete enrollment of the user device.

Abstract: An asset management method is provided. The asset management method includes establishing a network connection between a cryptomining asset and an asset management server. The asset management method includes generating a digital token, wherein the digital token includes an identifier assigned to the cryptomining asset by a cryptomining asset provider. The asset management method includes transmitting, to the asset management server and via the network connection, the digital token. The asset management method includes receiving, from the asset management server, a message corresponding to the identifier, wherein the message includes a configuration of a cryptomining task. The asset management method includes loading the configuration in the cryptomining asset. Another asset management method and a cryptomining asset are also provided.

Abstract: The application provides an image acquisition apparatus, a server, and encryption and decryption methods, and relates to the field of data processing. The image acquisition apparatus includes: an image acquisition device including an encryption processor and a data interface provided in the image acquisition device, wherein the encryption processor is configured to encrypt, by using a stored first key, image data acquired by the image acquisition device to obtain image ciphertext data; the data interface is configured to obtain the image ciphertext data and output the image ciphertext data to a terminal device. With the technical solution of the application, security of the image data can be ensured.

Abstract: Presented herein are system and methods for validating electronic documents. A first server having one or more processors coupled with memory may identify an electronic document of a customer device. The first server may validate a record of the electronic document in accordance with a consensus algorithm by communicating associated data to a plurality of second servers. The first server may generate a token using the electronic document in response to the plurality of second servers successfully validating the record of the electronic document. The first server may append the record of the electronic document corresponding to the token to the plurality of records on a distributed ledger. The first server may generate an instruction to store the token on a wallet of the customer device to authorize the use of the electronic document across the plurality of second servers.

Abstract: Secure communication for autonomous vehicles can be increased by performing authentication operations before nodes, such as vehicles, roadside equipment (RSE), or base stations, are within communications range. A digital certificate management system for mobile nodes, including for moving vehicles, can facilitate ultra fast communications between vehicles and other nodes. The RSE can propagate vehicle node data, comprising direction, speed, or estimated time of arrival, to other vehicles and/or other RSEs. Consequently, this propagation of data prior to the communication between nodes can facilitate an efficient authentication system.

Abstract: A technique of inter-frame communication during an insurance related workflow includes receiving from a client a request to provide content that is renderable on the client, the content including code used to invoke a third party engine and to render results from the third party engine on the client in a child frame that is embedded in a parent frame. It further includes obtaining the content. It further includes sending the content to the client to be rendered in the child frame.

Abstract: Provided is a computer-implemented method for securely receiving data via a third-party webpage, including: generating configuration data in response to a request from a first system, the configuration data including a public key of a first key pair; digitally signing the configuration data based on a private key of a second key pair; transmitting the configuration data to the first system, the configuration data including code configured to facilitate the first system to embed a plurality of frames in a webpage, wherein the plurality of frames loads content from a domain that is independent from a domain that hosts the webpage; and verifying the configuration data based on a public key of the second key pair. The computer-implemented method may also include receiving, from a master frame of the plurality of frames, encrypted data. Systems and computer program products are also provided.

Abstract: An access control system is provided to prevent the surreptitious granting of access to privacy related functionality on an electronic device. Software-based events to grant access to device functionality can be validated by confirming that the software event corresponds with a hardware input event. This validation prevents the spoofing of a user interface input that may be used to fraudulently grant access to specific functionality.

Abstract: A computer-implemented method, in a communication framework in which each of a plurality of users has one or more devices associated therewith, and in which the users use at least some of their devices to communicate via a backend system. A first user has a first set of first one or more associated trusted devices, and a second user has a second set of second one or more trusted devices associated therewith. The first user forms a first trust relationship between a first device in the first set and a second device in the second set. Based on (i) the first trust relationship, and (ii) the second set associated with the second user, the first user forms a second trust relationship between each device in the first set and each device in the second set. A least one device in the first set communicates with one or more devices in the second set based on the second trust relationship.

Abstract: Systems, computer program products, and methods are described for creating a multi-device functional code logit component allowing for multiple device communications on a distributed platform. As such, the invention allows for multiple wearable devices to each possess a unique non-fungible token (NFT) within a private distributed ledger. Each wearable device on has a unique immutable identity NFT. The grouping of NFT associated wearable devices are linked together for consensus resource distribution. Upon an initiation of a resource distribution request from a user using the user's wearable device, the other users in the distributed ledger group receive coded communications of the initiated resource distribution requiring an action approval request. If accepted action and a consensus is generated among the distributed ledger, the resource distribution is granted to the requesting wearable device.

Abstract: The presently disclosed technology is directed to combatting data theft, particularly of verified authentication data (or hashes thereof) such as login information, thumbprint data, digital signatures, identification numbers, and any other data that should be known to an accessor of stored data. The verified authentication data is initially saved for later comparison in a new type of memory, write-and-compare-only memory, where the data may be queried as to whether a to-be-verified value matches the stored verified value, but the stored and verified data is not read from the write-and-compare-only memory. This prevents a data breach by preventing the verified authentication data from being read by anyone, including those with access (whether legitimate or illegitimate) to any system connected to the write-and-compare-only memory.

Abstract: Systems and methods for gateway communications between non-distributed ledger systems and distributed ledger systems are disclosed. In one embodiment, a method for gateway communication may include: (1) receiving, at a listener comprising a computer processor and from an application in a first domain, a message for a destination distributed ledger system that is one of a plurality of distributed ledger systems in a second domain; (2) generating, by the listener, a payload for the message, wherein the payload identifies the destination distributed ledger system for the message; and (3) encrypting, by the listener, the payload and passing a payload message comprising the encrypted payload to one of a plurality of adapters in a gateway communication service using an API. The adapter may receive the payload message, decrypt the payload, identifies the destination distributed ledger system, and communicate the decrypted payload to the destination distributed ledger system.

Abstract: Described herein are techniques for seamlessly transitioning streaming content between user devices. In some embodiments, such techniques may be performed by a content transition platform. The techniques may comprise receiving a transition request including a set of identifiers for a plurality of user devices that includes at least a first user device from which the transition request originated. The techniques may further comprise identifying one or more active communication sessions associated with the plurality of user devices, each of which comprise a series of communications between one of the plurality of user devices and a content provider. The techniques may further comprise determining, based on the one or more active communication sessions, a second user device of the plurality of user devices, and transitioning an active communication session of the one or more active communication sessions between the first user device and the second user device.

Abstract: The present disclosure relates to systems, methods, and computer-readable media for facilitating a convenient transfer of control elements for a gaming session from one device to another device without interrupting the gaming session for one or more players. For example, systems disclosed herein include pairing an input device (e.g., a gaming controller) with one or more client devices. Once paired, the input device may detect a trigger condition based on proximity of a registered client device to the input device. The client device may pull control of one or more control elements for the gaming session. The client device may then continue the gaming session without interrupting the experience for the user or for other users that may be engaged within the gaming session.

Abstract: In one embodiment, the invention provides a portable wireless personal communication system for cooperating with a remote certification authority to employ time variable secure key information pursuant to a predetermined encryption algorithm to facilitate convenient, secure encrypted communication. The disclosed system includes a wireless handset, such as PDA, smartphone, cellular telephone or the like, characterized by a relatively robust data processing capability and a body mounted key generating component which is adapted to be mounted on an individual's body, in a permanent or semi-permanent manner, for wirelessly broadcasting, within the immediate proximity of the individual, a secret or private key identifying signal corresponding to a time variable secure key information under the control of the certification authority.

Abstract: In one embodiment, the invention provides a portable wireless personal communication system for cooperating with a remote certification authority to employ time variable secure key information pursuant to a predetermined encryption algorithm to facilitate convenient, secure encrypted communication. The disclosed system includes a wireless handset, such as PDA, smartphone, cellular telephone or the like, characterized by a relatively robust data processing capability and a body mounted key generating component which is adapted to be mounted on an individual's body, in a permanent or semi-permanent manner, for wirelessly broadcasting, within the immediate proximity of the individual, a secret or private key identifying signal corresponding to a time variable secure key information under the control of the certification authority.

Abstract: This disclosure describes techniques for authenticating a user device for a session. For instance, an authentication entity may authenticate a user device using single sign-on authentication and/or multi-factor authentication. The authentication entity may then determine a duration for which the user device is authenticated for the session. For example, the authentication entity may receive information representing a state of an environment of the user device. The authentication entity may then use the information to identify one or more transitions associated with the environment between the session and a previous session. Using the one or more transitions, the authentication entity may determine the duration for the session by increasing or decreasing a previous duration associated with the previous session.

Abstract: An embodiment includes software that causes a third node to perform operations comprising: in response to receiving a first identifier for a first node that includes at least one processor, authenticate a first user of the first node via a first authentication service; in response to receiving a second identifier for a second node that includes at least one processor, authenticate a second user of the second node via a second authentication service that is unequal to the first authentication service; in response to authenticating the first user of the first node, communicate a first list of media assets to the first computing node; in response to authenticating the second user of the second node, communicate a second list of media assets to the second computing node. Other embodiments are described herein.

Abstract: Disclosed herein is a storage platform for managing privacy compliance in an organization. The storage platform comprises a plurality of storage servers and at least one storage controller. The at least one storage controller receives user data from a user associated with the organization and splits the user data into a plurality of data chunks. Further, each data chunk of the plurality of data chunks are stored on a separate storage server selected from the plurality of storage servers. Also, each of the plurality of data chunks are encrypted using encryption keys stored on a distributed ledger. Thereafter, an authentication token corresponding to the stored user data is generated and provided to the user to enable the user to securely share the stored user data with the organization.

Abstract: Embodiments of the present invention are directed to systems, devices, and methods for displaying and securing articles of merchandise. In one example, a merchandise security system includes a plurality of security devices. Each of the security devices is configured to be attached to an article of merchandise and includes an illumination source for generating a light signal. The system also includes at least one computing device configured to communicate with the illumination sources in order to obtain data from the security devices and/or the articles of merchandise. Each of the security devices is configured to configured to generate a security signal in response to removal of the article of merchandise from the security device.

Abstract: Systems and methods provide access to location-restricted resources outside of recognized locations. An example, a method includes receiving a request for a controlled access resource from a client device and determining that the request is not associated with a recognized location but that state data exists for the client device identifier. In response to identifying the state data, the method includes generating a link for accessing the controlled access resource at a server, generating an encrypted token including a timestamp, a random number, and licensed resource information from the state data, including the encrypted token in the link, and providing the link to the client device. The client device uses the link to request the controlled access resource from the server, which determines that the request includes the token, determines that the token is not expired, and provides the controlled access resource to the client device.

Abstract: Secure communication for autonomous vehicles can be increased by performing authentication steps before the nodes (e.g., vehicles, roadside equipment (RSE), base stations, etc.) are within communications range. For example, a digital certificate management system for mobile nodes, specifically for moving vehicles, can facilitate ultra fast communications between vehicles and other nodes. In some embodiments, the RSE can propagate vehicle node data (e.g., direction, speed, estimated time of arrival, etc.) to other vehicles and/or other RSEs. Consequently, this propagation of data prior to the communication between nodes can facilitate a for efficient authentication system.

Abstract: Provided is a computer-implemented method for securely receiving data via a third-party webpage, including: generating configuration data in response to a request from a first system, the configuration data including a public key of a first key pair; digitally signing the configuration data based on a private key of a second key pair; transmitting the configuration data to the first system, the configuration data including code configured to facilitate the first system to embed a plurality of frames in a webpage, wherein the plurality of frames loads content from a domain that is independent from a domain that hosts the webpage; and verifying the configuration data based on a public key of the second key pair. The computer-implemented method may also include receiving, from a master frame of the plurality of frames, encrypted data. Systems and computer program products are also provided.

Abstract: The present disclosure relates to systems, methods, and computer-readable media for facilitating a convenient transfer of control elements for a gaming session from one device to another device without interrupting the gaming session for one or more players. For example, systems disclosed herein include pairing an input device (e.g., a gaming controller) with one or more client devices. Once paired, the input device may detect a trigger condition based on proximity of a registered client device to the input device. The client device may pull control of one or more control elements for the gaming session. The client device may then continue the gaming session without interrupting the experience for the user or for other users that may be engaged within the gaming session.

Abstract: A token management system includes a generation unit that generates a non-fungible token associated with a product identifier in a distributed ledger, a management unit that associates the non-fungible token with a first public key, and a second public key for licensing processing in the distributed ledge, and a transfer unit that performs transaction processing of changing the first public key associated with the non-fungible token on the basis of a first private key is realized.

Abstract: In one embodiment, the invention provides a portable wireless personal communication system for cooperating with a remote certification authority to employ time variable secure key information pursuant to a predetermined encryption algorithm to facilitate convenient, secure encrypted communication. The disclosed system includes a wireless handset, such as PDA, smartphone, cellular telephone or the like, characterized by a relatively robust data processing capability and a body mounted key generating component which is adapted to be mounted on an individual's body, in a permanent or semi-permanent manner, for wirelessly broadcasting, within the immediate proximity of the individual, a secret or private key identifying signal corresponding to a time variable secure key information under the control of the certification authority.

Abstract: A method and an apparatus for providing a service using a kiosk by a service providing server by performing the steps of: receiving a device list of at least one kiosk having an ability to provide the service among a plurality of kiosks registered in a blockchain from a kiosk server; authenticating a first kiosk through a smart contract function embedded in the blockchain when a user requests the service through the first kiosk and determining whether the first kiosk is included in the device list; and providing the service to the user when the first kiosk is authenticated by the smart contract function and is included in the device list are provided.

Abstract: The present invention relates to a system and a method for authenticating an electronic money using a smart card and a communication terminal. The present invention provides a system and a method for authenticating an electronic money, wherein the system comprises a smart card and a communication terminal. The smart card takes biometric signature from a user as an input, transmits recognition completion information to the communication terminal when the biometric signature inputted by the user matches the stored biometric signature, receives an update command from the communication terminal, updates the amount of stored balance data, and transmits an update completion message to the communication terminal. The communication terminal is connected to the smart card in a wired or wireless manner, and transmits the update command to the smart card upon receipt of the recognition completion information.

Abstract: A technique includes creating, by a computer, a sandboxed user account on the computer, where creating the sandboxed user account includes generating credentials for the sandboxed user account. The technique includes creating, by the computer, an operating system session and executing a single sign on (SSO) tool in the operating system session in association with the sandboxed user account. In response to a request that is associated with another user account to start up an application, authorizing, by the computer, use of the application by the other user account based on credentials that are associated with the other user account and starting up the application by the computer. Starting up the application includes using the SSO tool to inject SSO credentials for the other user account based on policy authorization into the application such that the application is executed in association with the sandboxed user account.

Abstract: Authentication processing is provided which includes generating an authentication parameter as a function of a time-dependent input using a predetermined transformation having an inverse transformation. Multiple authentication modes are supported, with a bit-length of the time-dependent input of one authentication mode being different from a bit-length of the time-dependent input of another authentication mode. Generating the authentication parameter is dependent, in part, on whether the time-dependent input is of the one authentication mode or the other authentication mode. A time-dependent password including a character string is generated from the authentication parameter using another predetermined transformation having another inverse transformation. The time-dependent password is forwarded within the authentication system for authentication by an authenticator.

Abstract: An oblivious distributed file system is provided using an oblivious random access machine (ORAM), including an ORAM balanced tree structure, where each node in the tree is configured to store data blocks, the structure including at least two shares. The system also includes at least two ORAM servers, each of the servers configured to communicate with a client ORAM device, and programmed to facilitate storage of a different subset of the shares of the tree structure using a distributed file system and to implement an access procedure of a tree-based ORAM using the tree structure, including a retrieval phase and an eviction phase. In the retrieval phase, the servers utilize an authenticated Private Information Retrieval (PIR) protocol to retrieve data blocks as requested from the client ORAM device. In the eviction phase, the servers utilize a linear secret sharing scheme.

Abstract: An example operation may include one or more of receiving, by a blockchain node, a file as a part of a blockchain transaction, splitting, by the blockchain node, the file into a plurality of chunks based on a file size, transmitting, by the blockchain node, the plurality of the chunks to at least one peer-to-peer data store node on a blockchain network, and generating a storage plan based on locations of individual chunks of the plurality of the chunks on the at least one peer-to-peer data store node.

Abstract: A communication device obtains identification information and a public key of a first other communication device by a particular obtaining method that does not use a wireless LAN and notifies the first other communication device of a role of the first other communication device in a communication based on Wi-Fi Direct. In addition, the communication device obtains identification information and a public key of a second other communication device by the particular obtaining method and notifies the second other communication device of a role of the second other communication device in the communication based on Wi-Fi Direct. One of the notified roles is a P2P Group Owner and the other one is a P2P Client, and the communication based on Wi-Fi Direct can be performed between the first other communication device and the second other communication device based on the notifications.

Abstract: A system for implementing a distributed certificate authority using trusted hardware includes a first verifying node communicatively coupled to a plurality of remote devices, the verifying node designed and configured to receive an authorization request from a remote device, wherein receiving the authorization request further comprises receiving an identifier of the remote device, authenticate the remote device, and generate an authorization token, wherein generating the authorization token further includes associating the identifier of the remote device with at least an authorization datum, associating the identifier of the remote device with at least a temporal attribute, and digitally signing the authorization datum, and generating the authorization token containing the digitally signed authorization datum.

Abstract: An application program authorization method includes: when a first application on a terminal is logged into, sending, by the terminal to a first application server by using the first application, a first request message used for negotiating a token binding identifier of the first application; receiving, by the terminal, a first response message including generation information of the token binding identifier from the first application server; generating, by the terminal, the token binding identifier based on the generation information of the token binding identifier, and sending the token binding identifier to the first application server; and when the at least one second application on the terminal logs in by using the first application, sending, by the terminal to the first application server, a second request message, where the second request message includes the token binding identifier.

Abstract: A method and system for security authorization on an electronic device are disclosed. The method includes detecting whether a trusted device is present in proximity to the electronic device. The trusted device is associated with a user profile of the electronic device, and the user profile includes access to private information. The method further includes allowing access to the user profile in response to detecting that the trusted device is present in proximity to the electronic device, and defaulting access to a public user profile of the electronic device in response to detecting a lack of presence of the trusted device in proximity to the electronic device.

Abstract: This invention discloses method and system for supporting posting (sharing) or un-posting (stop sharing) files, folders, and messages through utilizing private and group common workspaces. The stop sharing file or folder will not delete actual file or folder that contradicted to and enhanced for the then-existed technology for the file and folder sharing. The un-post message operation facilitates a user to remove (delete or withdraw or stop sharing) his/her previously posted message from viewing of a recipient such as from a user interface (UI) of the recipient, so that the user can avoid embarrassment if the message was not proper. Thus, the un-post the posted message has also enhanced the then-existing technology with better user experiences for message sharing.

Abstract: A user authentication method in a distributed processing system commences by receiving, at a first processing unit (108), a request (1004) to initiate an authentication session, wherein the request includes a unique identifier of a user requiring authentication. The first processing unit acquires at least one item of authentication data (412, 1712), which is valid during the authentication session. The authentication data is transmitted (1006) to a second processing unit (106) which is associated with a terminal device operated by the user. The second processing unit transforms the authentication data using a transformation algorithm based upon one or more session-specific authentication factors (404, 1704), to generate transformed authentication data that is characteristic of the authentication session and of the user.

Abstract: Techniques for enabling secure access to data using data blocks is described. Computing device(s) can provide instruction(s) to a component associated with an entity, wherein the instruction(s) are associated with an identifier corresponding to a data block of a plurality of data blocks. The computing device(s) can receive, from the component, data associated with the component, wherein the data is associated with the identifier and is indicative of a state of the component. The computing device(s) can store the data in the data block and monitor, using rule(s), changes to the state of the component based at least partly on the data in the data block. As a result, techniques described herein enable near real-time—and in some examples, automatic—reporting and/or remediation for correcting changes to the state of the component using data that is securely accessed by use of data blocks.

Abstract: A method includes generating, by a portable communication device, a first random code and transmitting the first random code to an access device. The access device receives the first random code, generates a second random code, receives a personal token from a user of the portable communication device, and hashes the first random code, the second random code, and the personal token to form a first hash output. The first hash output and the second random code are received from the access device. The first random code, a stored personal token, and the second random code are hashed to form a second hash output. A determination is made if the first hash output and the second hash output are equal. A secure communication channel is formed between the portable communication device and the access device when the first hash output and the second hash output are equal.

Abstract: An authentication process for an endpoint device uses a pair of tokens. Tokens are generated at an authentication server that maintains a data store of token states, where the states are defined to include a “normal” state sequence along which a token is expected to advance. The endpoint device can store a token pair in non-volatile local storage. To authenticate, the endpoint device can provide its stored token pair to the authentication server, which can determine whether authentication succeeds based on the states of the tokens in the token pair. After successful authentication, the authentication server can provide a new token pair to the endpoint device and advance the token states along the normal sequence. When the endpoint device confirms receipt of the new token pair, which replaces the previous token pair, the authentication server can advance the state of the tokens again.

Abstract: Examples disclosed herein relate to securing a controller of a device. The controller is to determine whether a network interface of the device is connected to the Internet. Communications are restricted on the network interface in response to the port having access to the Internet. In some examples, the restriction can be related to a vulnerability.

Abstract: A system and method for facilitating authenticating a client application to enable communications with another server-side application running on a server in communication with the client application (client). An example embodiment involves providing an authenticator for the client to a shared library that is accessible to the client and server, and then registering the authenticator for the client at the server. After registration, the client sends a request message (addressed to a server-side application) and token to the server. The token is derived using the authenticator at the shared library. The server then uses the token to check that the authenticator associated with the received token is registered. The server then communicates with the shared library to authenticate the client by verifying that the received token identifies the client that has provided the authenticator to the shared library. Client identity is then set to enable communications with the server-side application.

Abstract: A technique of inter-frame communication during an insurance related workflow includes receiving from a client a request to provide content that is renderable on the client, the content including code used to invoke a third party engine and to render results from the third party engine on the client in a child frame that is embedded in a parent frame. It further includes obtaining the content. It further includes sending the content to the client to be rendered in the child frame.

Abstract: Embodiments of the present invention disclose a cyber security management system, method, and apparatus. The system includes user equipment (UE), an access network (AN), a network function selection module, and at least two authentication modules. The UE is configured to send a first service request to the network function selection module, where the first service request carries authentication protocol information. The network function selection module is configured to: select a target authentication module based on the authentication protocol information, and send a second service request to the target authentication module. The target authentication module is configured to perform mutual authentication with the UE. The target authentication module is further configured to: determine a first security configuration according to a specified security policy, and send the first security configuration to the AN.

Abstract: An authentication request including at least one of a user identifier and a wearable device identifier of a user is received at a server from a terminal. The server stores a relationship between the user identifier, the wearable device identifier, and a server authentication key. Downlink authentication information is acquired by the server. A detection instruction including the downlink authentication information and the wearable device identifier is issued to the terminal. A detection acknowledgment returned by the terminal is received by the server. The detection acknowledgment includes uplink authentication information generated by a wearable device designated in the detection instruction, according to a device authentication key and the downlink authentication information. The device authentication key is the same as, or corresponds to, the server authentication key.

Abstract: Disclosed embodiments relate to verifying identities based on identity-inherent data that is inaccessible to the system. Techniques include receiving, from a client, an encrypted token, the encrypted token having been encrypted at the client using a cryptographic key created at the client based on identity-inherent data of an identity of the client; wherein the identity-inherent data of the identity is not itself received by the system, and wherein the cryptographic key is accessible only to the client; and storing the encrypted token in association with a hash of a decrypted version of the encrypted token to allow for comparing the stored hash with a created hash and determining whether to verify the identity based on a result of the comparing.

Abstract: Methods, non-transitory computer readable media, and network traffic manager apparatus that assists managing security tokens based on security violations includes monitoring network traffic data between a client and a web application server. Next, the monitored network traffic data is determined for at least one security violation. One or more access tokens associated with the client is modified when the at least one security violation is detected in the monitored network traffic data. The client is restricted from accessing one or more web applications based on the modified one or more access tokens.

Abstract: A speech-processing system capable of receiving spoken commands from a public or semi-public voice controlled device and determine a user who spoke the command for purposes of both command execution and output data routing. Identity of the user may be determined by various techniques such as facial identification, voice identification and the like. Identification techniques may be biased in view of users nearby to a voice controlled device. Private data resulting from the spoken command may be routed to a personal device of the user where non-private data may be output by the public voice controlled device.