Abstract: Systems and methods that can facilitate the utilization of a memory as a slave to a host are presented. The host and memory can provide authentication information to each other and respective rights can be granted based in part on the respective authentication information. The host can determine the available functionality of the memory. The host can activate the desired functionality in the memory and can request memory to perform the desired function(s) with regard to data stored in the memory. An optimized controller component in the memory can facilitate performing the desired function(s) associated with the data to generate a result. The result can be provided to the host, while the data and associated information utilized to generate the result can remain in the memory and are cannot be accessed by the host.

Abstract: A method of verifying public parameters from a trusted center in an identity-based encryption system prior to encrypting a plaintext message by a sender having a sender identity string may include: identifying the trusted center by a TC identity string, the trusted center having an identity-based public encryption key of the trusted center based on the TC identity string; determining if the sender has a sender private key and the public parameters for the trusted center including the public encryption key of the trusted center and a bilinear map; and verifying the public parameters using the TC identity string prior to encrypting the plaintext message into a ciphertext by comparing values of the bilinear map calculated with variables from the trusted center. The ciphertext may include a component to authenticate the sender once the ciphertext is received and decrypted by the recipient using the private key of the recipient.

Abstract: Methods and systems for obscuring the location of critical system files are provided. In particular, the locations of files stored within a file system are selected by applying various inputs to a hash algorithm. For system files, the inputs applied to the hash algorithm can include a user name and password. For data files, the information provided to the hash algorithm can include the file name. In addition to providing random file locations, a file system in accordance with embodiments of the present invention can homogenize other information, including file names, sizes and creation dates.

Abstract: Systems and methods for providing sensitive data protection in a virtual computing environment. The systems and methods utilize a sensitive data control monitor on a virtual appliance machine administering guest virtual machines in a virtual computing environment, wherein each of the guest virtual machines may include a local sensitive data control agent. The sensitive data control monitor generates encryption keys for each guest virtual machine which are sent to the local sensitive data control agents and used to encrypt data locally on a protected guest virtual machine. In this manner the data itself on the virtual (or physical) disc associated with the guest virtual machine is encrypted while access attempts are gated by a combination of the local agent and the environment-based monitor, providing for secure yet administrable sensitive data protection.

Abstract: Disclosed is a content recording apparatus having recording devices A and B and first and second encrypting units that are provided for the respective recording devices. When receiving stream data representing content from an input unit, a rate changing unit operates so as to input streams of data in parallel to the respective encrypting units. The first encrypting unit encrypts the stream data with an encryption key generated from the IDs of the recording device A and of a recording medium a. The second encrypting unit encrypts the stream data with an encryption key generated from the IDs of the recording device B and of a recording medium b. Each of the recording devices A and B records the content encrypted by a corresponding one of the first and second encrypting units.

Abstract: An improved technique involves creating a new lockbox mechanism which is configured to work on a new or upgraded operating platform having different operating platform parameters, and then storing confidential information within the new lockbox (e.g., a copy of credentials which are also stored at a main site). When the new lockbox is then moved to the new or upgraded operating platform, the new lockbox mechanism properly works. Such operation enables the maintained compatibility with applications, control and maintenance of lockbox security throughout, and can be performed automatically and/or remotely.

Abstract: Embodiments of the disclosure provide a method and apparatus for sharing data. The method includes: initiating the data sharing application on a first terminal; inserting the file to be shared in a webpage of the data sharing application on the first terminal, and generating an URL for the file in the data sharing application; the data-sharing application of the first terminal broadcasts the URL to other terminal, so that other terminals can share the file via the URL. The present disclosure can reduce the cost of data sharing while improve on the real-timeliness.

Abstract: Systems and methods for document control using public key encryption are provided. An interface program serves as a software interface between user applications used to create and access documents and a data storage system that stores the documents in an encrypted form. When a document is saved for the first time, information corresponding to the destruction of that document is obtained either from a user or in accordance with predefined criteria. The document is encrypted and stored with a pointer to an encryption key on a token/key server. When the document is subsequently accessed, the interface program will read the pointer and attempt to retrieve the key. If the key has expired in accordance with the destruction policy, the document is inaccessible. Otherwise, the document is decrypted using the key. Multiple documents may be saved according to the same destruction policy and even the same key, thereby greatly enhancing the ability to “destroy” documents regardless of their location with minimal process.

Abstract: Apparatuses, methods, and systems for reconfiguring a secure system are disclosed. In one embodiment, an apparatus includes a configuration storage location, a lock, and lock override logic. The configuration storage location is to store information to configure the apparatus. The lock is to prevent writes to the configuration storage location. The lock override logic is to allow instructions executed from sub-operating mode code to override the lock.

Abstract: A tamperproof ClientID system to uniquely identify a client machine is invoked upon connection of a client application to a backend. Upon initial connection, the backend issues a unique ClientID containing a checksum. The client application prepares at least two different scrambled versions of the ClientID and stores them in respective predetermined locations on the client machine. Upon subsequent connection to the backend, the client application retrieves and unscrambles the values at the two locations, verifies the checksums and compares the values. If the checksums are both correct and the values match, the ClientID value is sent to the backend, otherwise the client application sends an error code.

Abstract: A content server is provided for storing and distributing digital content to a client. The content server includes a content database configured to electronically store the digital content and a DRM packager for adding a universal DRM layer to the digital content stored at the content database. The universal DRM layer is able to access digital content in conformance with a plurality of different DRM implementations, the digital content being in conformance with one of the plurality of different DRM implementations. The universal DRM layer can access the content by a variety of means, such as with a universal key, for example, that can decrypt content from many different DRM technologies. In this way the client only needs to have a DRM controller that is compatible with this higher-level, universal DRM implementation rather than with the individual, underlying DRM implementations.

Abstract: A method and apparatus for detecting behavioral changes in a security system is provided. The method includes the steps of providing a secured area having a plurality of security zones where access to each is controlled by an access controller, detecting entrances to at least some of the plurality of security zones by an authorized person through respective access controllers of the plurality of zones over a predetermined previous time period, forming a probability model of entry into each of the plurality of security zones from the detected entrances over the previous time period, detecting access requests for the authorized user from the access controllers during a current time period, and generating a security alert upon determining that an access request of the current access requests exceeds a probability threshold value associated with the probability model.

Abstract: A system and method for Write Once, Read Many (WORM) compliant storage is disclosed. A storage administrator in user space is employed as an interface between the kernel space WORM VFS and the user applications. The storage administrator accesses the WORM VFS through the operating system's Virtual File System. The WORM VFS comprises of three layers: a data encryption\compression layer, the WORM filesystem layer and a logical volume manager. The data encryption\compression layer preprocesses the data as it moves between from the user space and the WORM filesystem layer. The WORM filesystem layer stores the compressed and encrypted data on the physical disk drives in a specialized disk format. The logical volume manager manages the physical disk drives. A NVRAM journal aids in crash recovery.

Abstract: Systems and methods for selective authorization of code modules are provided. According to one embodiment, a whitelist containing cryptographic hash values of code modules that are approved for loading into memory of a computer system and execution on the computer system is maintained by a kernel mode driver of the computer system. At least a subset of the cryptographic hash values has been included within the whitelist based upon results of application of one or more behavior analysis techniques to a corresponding subset of code modules. The kernel mode driver monitors a set of events occurring within one or more of a file system accessible by the computer system and an operating system that manages resources of the computer system. The kernel mode driver causes a cryptographic hash value of a code module relating to an observed event of the set of events to be authenticated with reference to the whitelist.

Abstract: Protection of interpreted programming language code filesystem files from access and alteration may be provided by encrypting a file to be protected in a boot sequence. Run-time examination of a virtual appliance may be deterred by hiding the boot sequence in a restricted virtual appliance platform. No shell or filesystem access may be provided. Thus, permissions on a read-only filesystem (for example) may be kept from being altered. The permissions may be set along with filesystem access control lists to prevent unauthorized examination of the source files.

Abstract: A server uses an encryption key to decrypt authentication information thereby facilitating communication with network-accessible applications that may be remotely located from the server. Servers can also use encryption keys to decrypt files containing sensitive data. The encryption key is obtained by a collection of software agents, each providing a portion of information necessary for generating the encryption key. Each software agent performs a respective examination, the results of which determine whether the respective portion of information is valid or not. A complete encryption key can be obtained only when all of the contributing portions of information are valid.

Abstract: Systems and methods, including computer software adapted to perform certain operations, can be implemented for providing remotely defined security data to an application extension on a client device. A sequence of instructions and at least one permission indicator associated with the sequence of instructions are received. A first permission indicator is associated with a code extension to a software application adapted to execute at least a portion of the sequence of instructions. The code extension is adapted to perform one or more operations that supplement the operations supported by the software application. An instruction within the sequence of instructions associated with adapted for execution by the code extension and with an activity is identified. The first permission indicator is provided to the code extension. The code extension determines whether performance of the activity is permitted based, at least in part, on the first permission indicator.

Abstract: Systems and methods for selective authorization of dependent code modules are provided. According to one embodiment, responsive to a monitored file system or operating system event initiated by an active process, a real-time authentication process is performed or bypassed on a code module to which the monitored event relates with reference to a whitelist that includes cryptographic hash values of approved code modules, which are known not to contain viruses or malicious code. The active process is allowed to load the code module when the authentication process is bypassed or when the cryptographic hash value of the code module matches one of the cryptographic hash values of approved code modules within the whitelist.

Abstract: The present invention includes a system and process for monitoring the transmission of secured, marked digital files. A cryptographic token inertly embedded in markup language tags of digital files is sought at a transmission gateway.

Abstract: Methods and apparatuses for performing secure incremental backup and restore operations are disclosed.

Abstract: A piece of software code, as well as a series of semi-random character strings are embedded into a copy of a software application. The application executes the embedded code on activation and may also invoke the embedded code periodically thereafter. The embedded code generates a knowledge string from a seed string and then generates an activation code from the seed string and the knowledge string. The activation code is checked against an externally-supplied code to ensure that the codes match, indicating a non-pirated copy of the software application.

Abstract: Provided is a method of managing medical information in an operating system for a medical information database, the method including encrypting, by a first user, medical information having patient treatment information by using a group key, and second medical information having patient private key by using a private key, generating, by the first user, an index corresponding to the encrypted first medical information, storing the encrypted first and second medical information and the index to the medical information database, searching, by a second user, the medical information database for the encrypted first medical information by using the index; and decrypting the searched encrypted first medical information by using the group key.

Abstract: A computer-implemented method for securing data to be stored in a computing device programmed to perform the method includes determining in the computing device, a save request from an application running upon the computing device to an operating system of the computing device to save a file in a memory of the computing device, determining in the computing device, whether a first key is available, and when the first key is available, the method includes automatically encrypting in the computing device, the file using the first key to form an encrypted file, in response to the save request, and automatically requesting with the computing device, the operating system of the computing device to store the encrypted file in the memory.

Abstract: Embodiments of the present disclosure include systems and methods for upload and/or download streaming encryption to/from an online service, or cloud-based platform or environment. The encryption process includes the following parts: Upload encryption, download decryption, and a central piece of infrastructure called the Interval Key Server (IKS). During both upload and download, the encryption and decryption processes are performed while the files are being uploaded/downloaded, (e.g., the files are being encrypted/decrypted as they are being streamed).

Abstract: A method and apparatus for secure transparent backup and encryption of data including compression, elimination of redundant information, all working integrated whether data is stored locally or shared in networks. When data is shared in networks, several computers may access encrypted objects simultaneously with the same limitations as for non-encrypted objects. The method and apparatus can automatically and invisible take backups and can easily restore any object to the exact content as it existed for a selected point in time using a snapshot capability in combination with the user interface described that has its focus on making the use very easy for the end user. The invention offers security and performance enhancements when used with tables containing approved hashes for executables and other objects based on company policy and virus scanning. Specific objects may also be easily detected even if they are encrypted.

Abstract: A system and method for Write Once, Read Many (WORM) compliant storage is disclosed. A storage administrator in user space is employed as an interface between the kernel space WORM VFS and the user applications. The storage administrator accesses the WORM VFS through the operating system's Virtual File System. The WORM VFS comprises of three layers: a data encryption\compression layer, the WORM filesystem layer and a logical volume manager. The data encryption\compression layer preprocesses the data as it moves between from the user space and the WORM filesystem layer. The WORM filesystem layer stores the compressed and encrypted data on the physical disk drives in a specialized disk format. The logical volume manager manages the physical disk drives. A NVRAM journal aids in crash recovery.

Abstract: A method, apparatus, and a computer readable storage medium having computer readable instructions to carry out the steps of the method for anonymous access to a database. Each record of the database has different access control permissions (e.g. attributes, roles, or rights). The method allows users to access the database record while the database does not learn who queries a record. The database does not know which record is being queried: (i) the access control list of that record or (ii) whether a user's attempt to access a record had been successful. The user can only obtain a single record per query and only those records for which he has the correct permissions. The user does not learn any other information about the database structure and the access control lists other than whether he was granted access to the queried record, and if so, the content of the record.

Abstract: Systems and methods are provided for encrypting electronic files during a transfer to a low-security storage location is provided. In one embodiment, a method comprises receiving a file copy request for a file stored on a source storage system to be copied to a destination storage system; determining a desired file security level of the file based on a desired security level for the file when the file is accessed; determining a destination security level of the destination storage system; comparing the file security level and the destination security level; encrypting the file to create an encrypted file when the destination security level is less than the file security level prior to copying the file; and copying at least one of the file and the encrypted file to the destination storage system as a function of the comparison of the file security level and the destination security level.

Abstract: A client is redirected by a relying party to the supporting entity (such as an identity or claims provider). The relying party also sends a cookie that includes a nonce, and another copy of the nonce in a redirection context (e.g., in a context string). The client then communicates with the supporting entity to facilitate the supporting service, whereupon the supporting entity sends a validation token back to the client evidencing completion of the supporting service. The supporting party also sends the nonce back as part of the redirection context (e.g., in a context string). The client then sends a followup service request that includes the cookie, the nonce returned by the supporting entity, and the validation token to the relying party. The relying party may compare the nonce in the cookie with the nonce returned by the supporting entity to verify that the request is valid.

Abstract: A system is disclosed that can be used to monitor for an attempted intrusion of an access system. The system detects an access system event in the access system and determines whether the access system event is of a type that is being monitored. If the access system event is of a type that is being monitored, the system reports information about the access system event. This information can be used by a rules engine or other process to determine if the access system event was part of an attempted intrusion of the access system.

Abstract: In some embodiments, a method includes receiving a modifiable electronic document. The method includes generating a new version of the modifiable electronic document. The method also includes encrypting the new version of the modifiable electronic document using an encryption key that is used to encrypt the modifiable electronic document and different versions of the modifiable electronic document. The method includes saving the new version of the modifiable electronic document.

Abstract: A method and system for a business workflow of a composite document are described. An integrity and authenticity of an entry table are identified and verified using a verification key, a map file corresponding to entries in the table are identified using a private user decryption key, signature verification keys and access keys are read from the map file, and authenticity of the map file and the document parts are verified. Following verification, content is delivered to a user for review, update and/or modification of the content, and then is encrypted, signed, and moved along the workflow, normally to the next workflow participant.

Abstract: The invention relates to a method for generating a session key between two communicating electronic devices not requiring any prerecorded information in one of the two devices and enabling the authentication of one of said devices. The method uses a close collaboration between a symmetrical algorithm and an asymmetrical algorithm.

Abstract: A method and apparatus are provided for protecting confidential information. The method includes the steps of providing a plurality of files where each file contains at least one item of secret information, password protecting the plurality of files with a master password, detecting entry of passwords into a master password entry field, comparing entered passwords with the master password to identify incorrect master passwords and deleting the plurality of files upon successive entry of incorrect master passwords a predetermined number of times.

Abstract: Disclosed is a method and system for controlling access for a mobile agent in a home network environment. The method includes the steps of: issuing a role ticket to the mobile agent; verifying access authority to service requested by the mobile agent through the role ticket; and granting the mobile agent access authority to the service. Accordingly, a table for managing access authority of a user is distributed to devices, so that it is possible to provide the mobile agent access control method and system capable of minimizing network traffic in the home network environment.

Abstract: An image forming apparatus, a host apparatus, and an encryption method for print data, the method of encrypting the print data of the host apparatus connected to the image forming apparatus including: displaying an encryption setting screen for the print data; selecting an encryption logic to encrypt the print data through the encryption setting screen; converting the print data according to the selected encryption logic; and transmitting the converted print data to the image forming apparatus. Accordingly, the print data is encrypted and decrypted on the basis of the selected encryption logic and corresponding decryption logic set up according to users, thereby increasing security.

Abstract: Various embodiments are disclosed relating to performing a trusted copy and paste operations between a source application and a target application. For example, a trust system may receive a paste request for pasting copied source content, and may compare a source trust level associated with the source content to a target trust level associated with a target application. In this way, for example, harmful or disruptive code may be prevented from being pasted into the target application.

Abstract: In one example, a method includes intercepting, by a first security module, a request from a software application executing on the computing device to access a resource of the computing device. The first security module may include a first group of permissions received from a second security module included in an operating system. The second security module may control access by software applications executing on the computing devices to resources of the computing device based upon permissions granted to the software applications. The method may also include identifying a second group of permissions granted to the software application. The second group of permissions may be a subset of the first group of permissions. The method may also include determining, based upon the first group of permissions, whether the software application is allowed to access the resource. The method may also include controlling access to the resource, based on the determining.

Abstract: A video apparatus includes a video processor for performing video processing to generate normal video data. The video processor includes an on-screen display (OSD) module for selectively generating OSD data that is capable of being mixed into the normal video data. The video apparatus further includes a digital output path including a digital transmitter and an analog output path including a digital-to-analog converter (DAC). The video apparatus is capable of outputting OSD data through an unauthorized output path out of the digital and analog output paths to provide a user with a warning message or an interactive help dialogue.

Abstract: A server includes a central processing unit and electronic memory communicatively coupled to the central processing unit. The memory stores a dynamically tunable operating system kernel that includes at least one tunable implemented as a plurality of states. Each application managed by the operating system is assigned to one of these states according to a permission level association with the application. Each state defines a range of automated tuning of the tunable that is authorized to applications assigned to the state.

Abstract: According to one embodiment, there is provided a an information processing apparatus, including: a program acceptance portion; a program storage portion; a first function type storage portion; a function type extraction portion; a second function type storage portion; a first alternate function type storage portion; an alternate function type extraction portion; a second alternate function type storage portion; a selection portion; a judging portion; an updating portion; and a protection attribute determination portion.

Abstract: A reputation server is coupled to multiple clients via a network. Each client has a security module that detects malware at the client. The security module computes a hygiene score based on detected malware. The security module provides the hygiene score and an identifier of a visited web site to a reputation server. The security module also provides identifiers of files encountered at specified web sites to the reputation server. The reputation server computes secondary hygiene scores for web sites based on the hygiene scores of the clients that visit the web sites. The reputation server further computes reputation scores for files based on the secondary hygiene scores of sites that host the files. The reputation server provides the reputation scores to the clients. A reputation score represents an assessment of whether the associated file is malicious.

Abstract: Making a target file impractical to be retrieved comprises decrypting a directory manager file using a first directory manager file key. The directory manager file includes an encryption key for a segment that is used when reconstructing a target file. The directory manager file is modified by deleting a reference to the target file. The reference includes a file encryption key. Retrieving the target file is made impractical by the deletion of the reference to the target file in the directory manager file. The modified directory manager file is encrypted using a second directory manager file key.

Abstract: This disclosure provides various embodiments for searching one or more repositories hosting, storing, or maintaining a plurality of development artifacts. A search query for development artifacts is received through an interface of an integrated development environment, the search query identifying at least one search term. An index is used to identify a set of search results, the index identifying a plurality of development artifacts and including context data identifying, for each development artifact in the plurality of development artifacts, at least one attribute of the respective development artifact. The set of search results identify a subset of the plurality of development artifacts determined to potentially relate to the at least one search term. At least a portion of the set of search results are presented to a user, the listing including at least one development artifact in the subset of the plurality of development artifacts.

Abstract: One embodiment of the present invention provides a system that facilitates issuing rights in a digital rights management system. The system operates by sending a request to perform an operation on an item of content from a client to a rights-management server, wherein the request includes a usage parameter which specifies constraints involved in performing the operation. Next, the system receives a response from the rights-management server, wherein the response indicates whether or not the client has rights to perform the operation in accordance with the constraints specified by the usage parameter. Note that the response may also include a hint that facilitates generating subsequent requests to perform the operation. Finally, if the client has rights to perform the operation, the system performs the operation on the item of content.

Abstract: A method and an apparatus provide for operating a user interface of a device to receive from a user, for individual ones of a plurality of user privacy categories, a user privacy setting; to map each user privacy setting to one or more device sensors to form a sensor policy for the user privacy category; and to monitor application program accesses to device sensors to detect a violation of a sensor policy. An aspect of the exemplary embodiments of this invention is the user interface that can represent privacy levels of each application program to the user in a “user-friendly” format. Another aspect of the exemplary embodiments is to provide the user device with an ability to detect and act on or at least report privacy violations by the application programs.

Abstract: A method may include obtaining a source file at a node in peer-to-peer network and dividing the source file into a plurality of pieces. The pieces of the source file may be encoded using network coding principles. A last-modified-date (LMD) value may be appended to each of the encoded pieces, the LMD value being the same for each of the encoded pieces of the source file. The encoded pieces with the LMD values may be sent to one or more other nodes in the peer-to-peer network.

Abstract: A method, system and computer program product is disclosed for supporting role-based access control in a collaborative environment, wherein pluralities of users work together in a collaborative process using a software system. The method comprises componentizing the software system into a multitude of software components, and limiting access to specific software components to certain users based on roles assigned to the users as defined by a run-time state of the collaborative process. The set of components that a user can access is dynamic, that set can change based on the “context” or the step where the user is in a collaborative workflow/process.

Abstract: A method and apparatus for initiating secure operations in a microprocessor system is described. In one embodiment, one initiating logical processor initiates the process by halting the execution of the other logical processors, and then loading initialization and secure virtual machine monitor software into memory. The initiating processor then loads the initialization software into secure memory for authentication and execution. The initialization software then authenticates and registers the secure virtual machine monitor software prior to secure system operations.

Abstract: The present disclosure describes apparatuses and techniques for fail-safe key zeroization. In some aspects a periodic counter is activated that is configured to indicate an amount of time that content of a one-time-programmable (OTP) memory is accessible and overwriting of the content of the OTP is caused when the periodic counter reaches a predetermined value effective to zeroize the content. In other aspects a periodic counter is started in response to a power event and one or more encryption keys stored in OTP memory are zeroized if an indication of media drive security is not received within a predetermined amount of time.