Abstract: Device authentication is based on the ability of a human to synchronize the movements of his or her fingers. A pairing procedure for two wireless devices may thus involve a synchronization test that is based on the relative timing of actuations of input devices on each of the wireless devices. In some aspects a synchronization test involves determining whether actuations of user input devices on two different wireless devices occurred within a defined time interval. In some aspects a synchronization test involves comparing time intervals defined by multiple actuations of user input devices on two wireless devices.

Abstract: A system and method provide efficient, secure, and highly reliable authentication for transaction processing and/or access control applications. A personal digital key (PDK) is programmed using a trusted programming device to initialize and/or register the PDK for use. In one embodiment, the initialization and registration processes are administered by a specialized trusted Notary to ensure the processes follow defined security procedures. In a biometric initialization, the programming device acquires a biometric input from a user and writes the biometric data to a tamperproof memory in the PDK. In registration, the Programmer communicates to one or more remote registries to create or update entries associated with the user PDK. Once initialized and registered, the PDK can be used for various levels of secure authentication processes.

Abstract: A data security system includes providing a unique identification from a first system to a second system; copying the unique identification in the second system by the first system; and unlocking a memory in the first system or the second system only when the unique identifications in the first system and the second system are the same.

Abstract: Provided are techniques for providing security in a computing system with identity mediation policies that are enterprise service bus (EBS) independent. A mediator component performs service-level operation such as message brokering, identity mediation, and transformation to enhance interoperability among service consumers and service providers. A mediator component may also delegate identity related operations to a token service of handler. Identity mediation may include such operations as identity determination, or “identification,” authentication, authorization, identity transformation and security audit.

Abstract: A method for providing message protection includes generating a ciphered message based upon a first counter, a message, and a ciphering key. The method further includes generating an unciphered message authentication code (MAC) based upon the first counter, an integrity protection key, and either the message or the ciphered message, and transmitting security protected data, which includes the MAC and the ciphered message, over a transmission medium.

Abstract: A mobile terminal includes a near-field communication device capable of performing near-field wireless communication with an external device, and a controller configured to instruct the external device or the near-field communication device to execute a command. The near-field communication device has a storage unit, a first mutual authentication unit for authenticating the controller and for requesting the controller to authenticate the near-field communication device, a first communication key setting unit for setting a first communication key, a second mutual authentication unit for authenticating the external device and for requesting the external device to authenticate the near-field communication device, and a second communication key setting unit for setting a second communication key.

Abstract: A computer-based peer-to-peer anonymous networking using a coding scheme with a formal information theoretic security characterization to construct a corresponding overlay subgraph is presented. A code construction based on linear coding which can be used for data transfer in an anonymous network is also presented. Various performance and simulation of the presented codes are provided in the Annex A1 which makes part of the present disclosure.

Abstract: Embodiments of the present invention provide a portable system and method for accessing data remotely. The system and method include a first module and a second module, each of the modules being associated with the host system, wherein the first module is capable of being connected to the host system and the second module, and the second module is capable of being connected to the remote system to establish a secure communication channel between the first and second modules across the data link to access the data.

Abstract: In a certification request, a user device includes an object identifier. When a certification authority generates an identity certificate responsive to receiving the certification request, the certification authority includes the object identifier, thereby allowing improved management of the identity certificate at the user device and elsewhere.

Abstract: There is provided a device application programming interface (API) for securely monitoring and managing mobile broadband devices. There is provided a client device with a processor configured to detect, using an API, the WWAN device, wherein the WWAN device conforms to the API, to perform a mutual authentication with the WWAN device by using a digital certificate of the WWAN device and a client digital certificate of the client device, to establish a secure connection with the WWAN device upon a successful authentication of the mutual authentication with the WWAN device. Moreover, the processor may be configured to issue, using the API, various commands to the WWAN device to monitor and manage the WWAN device.

Abstract: A method for securely authenticating a user of a consumer device at an access device comprising the following steps. First, a dynamic data element and a first set of transactional information is sent to the consumer device from the access device. Next, the consumer device creates an authentication code as a function of at least the dynamic data element, a subset of the first set of transactional information, and a password. The authentication code, along with other data, is then sent from the consumer device back to the access device. The access device then uses the authentication code to send an authentication request message to the service provider of the user. The service provider then attempts to authenticate the user by recreating the authentication code and comparing the recreated authentication code with the authentication code received from the access device.

Abstract: Embodiments of the present invention comprise systems and methods of creating monetary accounts for members in a social network. One aspect of one embodiment of the present invention comprises receiving transaction data associated with at least one member of a social network, associating a first member of the social network with a trust factor, associating a second member of the social network with another trust factor, and determining whether to create an account between the first member and second member, based at least in part on the trust factor of the first member and the trust factor of the second member. Another aspect of one embodiment of the present invention comprises receiving transaction data from a plurality of members of a social network, wherein each member has an associated trust factor, and resolving the transaction data based at least in part on the trust factors associated with the plurality of members.

Abstract: A method and system for securing a user transaction involving a subscriber unit (“SU”) (having a processor, memory, and a display configured to accept user input), a credential information manager (“CIM”) (having a processor and memory), and a transaction service provider (“TSP”) (having a processor and memory). A cyber identifier (“CyberID”), a subscriber identifier (“SubscriberID”), and subscriber information, each associated with the user, is stored in the CIM. A transaction request is sent from the SU to the TSP, which creates a transaction identifier (“TID”), stores it in the TSP memory and transmits it to the SU. The SU transmits an authentication request, the TID, and SubscriberID to the CIM, which authenticates the SubscriberID and verifies the TID to the TSP. The TSP verifies the TID and reports it to the CIM, which transmits the CyberID and subscriber information to the TSP, and transmits a transaction authorization to the SU.

Abstract: A system for preventing fraud at a service provider's website has a fake credential distributor for creating a set of valid but fake credentials to access such website and distributing such set to a plurality of predefined websites, a fake user database including said set of fake credentials and a monitor for real-time monitoring any user login attempt from any origin network location to the website and comparing the credentials used in such user login attempt with the set of fake credentials in the fake user database. If the credentials used in such a login attempt coincide with any fake credential in the fake user database, such origin network location is added to a tainted connections list; and if there is another login attempt of a user from a network location in said tainted connections list, said user access request is refused even when it is using real credentials.

Abstract: A technique for performing domain-based access control for granular isolation on a data processing system includes assigning, using the data processing system, one or more first domain tags to a dynamic object that is created by a first process that is executing on the data processing system. The technique also includes assigning, using the data processing system, one or more second domain tags to a second process that is executing on the data processing system. The first and second domain tags are evaluated, using the data processing system, according to one or more enforced rules to determine whether to grant or deny the second process access to data associated with the dynamic object.

Abstract: There is provided a communication device, which includes a physical layer which performs close-range one-to-one communication with a device B through electric field coupling or magnetic field coupling, an authentication information changing unit which dynamically changes device information for mutual authentication according to a type of data selected on an application, a protocol selection unit which selects one protocol that can be utilized by the communication device and the device B, a start information transmission unit which transmits the device information and information showing the selected protocol to the device B in order to make the device B start an application corresponding to the type of data and the selected protocol, and a protocol conversion unit which converts a protocol utilized by the application into a protocol utilized by the physical layer in order to transfer data between the applications of the communication device and the device B.

Abstract: A system enables intermediary communication components to carry out cross enterprise communication. At a first sending enterprise the system comprises: a processor executing code to: receive a signed encrypted message from a sender within a first enterprise; validate the sender; decrypt the message; encrypt the message for receipt by a second enterprise; sign the encrypted message by the first enterprise; and send the re-signed re-encrypted message to a second enterprise. At the second receiving enterprise, the system comprises a processor executing code to: receive a signed encrypted message from a first enterprise; validate that the first enterprise is the sender; decrypt the message; encrypt the message for receipt by recipients at the second enterprise; sign the encrypted message by the second enterprise indicating that the message is from the first enterprise; and send the re-signed re-encrypted message to the recipients of the second enterprise.

Abstract: A method in a multimedia device (130) including obtaining protected content having a limited exercisable right associated therewith, obtaining an extension of the limited exercisable right when a condition is satisfied, for example, when the device enters a DRM system different than the DRM system from which the protected content originated, wherein the extension of the limited exercisable right is obtained from an entity other than the multimedia device, for example, from an anomaly detector.

Abstract: A network security monitoring apparatus and a network security monitoring system manages “permitted” or “not permitted” communication between nodes based on an access policy. A network security monitoring system includes nodes 31,32,33, application server 20, router 40, and network security monitoring apparatus 10 deployed in the network. The network security monitoring apparatus 10 judges whether the nodes are permitted to communicate with other nodes in the network or not based on the access policy, and repeatedly transmits data to block the communication between nodes judged as “not permitted” at fixed time intervals until the access policy is changed from “not permitted” to “permitted”. This invention enables to block communication between nodes defined as “not permitted” for communicating with other nodes in the access policy, and to allow communication between nodes defined as “permitted” for communicating with other nodes in the access policy.

Abstract: A method is provided for obtaining a certificate revocation list (CRL) for a vehicle in a vehicle-to-vehicle communication system. A portable security unit is provided to access secured operations for the vehicle. The portable security unit is linked to a device having access to a communication network. The communication network is in communication with a certificate authority for issuing an updated CRL. The updated CRL is downloaded from the certificate authority to the portable security unit. At a later time, when a user enters the vehicle, a communication link is established between the portable security unit and a vehicle processor unit. Mutual authentication is exchanged between the portable security unit and the vehicle processing unit. The updated CRL stored in the portable security unit is downloaded to a memory of the vehicle communication system in response to a successful mutual authentication.

Abstract: A method of transferring an item of data representative of a right between two electronic entities, at least one of the electronic entities including short range wireless communication elements suitable for transmitting the item of data to use the right, the electronic entities being suitable for communicating directly or indirectly via a long range communication interface. The method includes steps of transmission and of reception of the item of data by the electronic entities, the item of data being transmitted via the long range communication interface, of authentication and of storage of the item of data in the electronic entity having received it.

Abstract: According to an embodiment, a system is provided comprising a memory and a processor. The memory may be operable to store a master image associated with a user account. The master image may comprise an image of a physical, non-living object. The processor may be coupled to the memory and may be operable to receive a request to perform a transaction associated with the user account. The processor may be further operable to receive an image that is scanned in real-time in conjunction with the request to perform the transaction. The processor may be further operable to compare the scanned image with the master image associated with the user account and to perform the transaction if the scanned image is substantially similar to the master image.

Abstract: Techniques are provided for the controlled scheduling of the authentication of devices in a lossy network, such as a mesh network. An authenticator device that is configured to authenticate devices in a lossy network receives an authentication start message from a particular device to be authenticated. The authenticator device determines a schedule for engaging in an authentication procedure for the particular device based on an indication of current network utilization.

Abstract: Systems, methods and apparatus for a distributed security that provides authentication and authorization management. The system can include an epoch processor that is used to validate authentication and authorization data that is valid only for an epoch. The epoch processor can maintain a public key that can be used to decrypt the authentication and authorization data during the epoch that the key is valid. The epoch processor can receive a new public key during each epoch. The epoch processor can also determine if the authentication or authorization data was fraudulently generated based on the contents of the data, and verifying whether the data is valid for the epoch in which it was decrypted.

Abstract: A security mechanism provided by a server protects files in data storage from untrusted clients. In one embodiment, the server generates a filename in response to a request from a client for creating a filename. The filename is associated with a file to be stored in the data storage managed by the server. The server manages a directory that contains the filename, and hides the directory contents from the client. The client is granted access to the file when the client provides the filename associated with the file.

Abstract: The present invention provides a cooperation method of a mobile hardware secure unit and a fixed hardware secure unit, comprising: providing user's identification information of a mobile hardware secure unit; providing platform's identification information of a computer-based or other-device-based fixed hardware secure unit; establishing a bidirectional communication pipe between the mobile and fixed hardware secure unit; and binding the mobile and fixed hardware secure units through interaction of the user's identification information and the platform's identification information. The present invention further provides a cooperation system of a mobile hardware secure unit and a fixed hardware secure unit as well as a computer device, with which the security solution based on a fixed hardware secure unit can be combined with a mobile hardware secure unit securing a user's identity.

Abstract: Disclosed herein are systems, methods, and tangible computer readable-media for detecting synthetic speaker verification. The method comprises receiving a plurality of speech samples of the same word or phrase for verification, comparing each of the plurality of speech samples to each other, denying verification if the plurality of speech samples demonstrate little variance over time or are the same, and verifying the plurality of speech samples if the plurality of speech samples demonstrates sufficient variance over time. One embodiment further adds that each of the plurality of speech samples is collected at different times or in different contexts. In other embodiments, variance is based on a pre-determined threshold or the threshold for variance is adjusted based on a need for authentication certainty. In another embodiment, if the initial comparison is inconclusive, additional speech samples are received.

Abstract: The present invention relate to a method for authenticating a low performance device, and more particularly, to a device authenticating method, in which a low performance device such as a smart meter of a smart grid is authenticated in a matrix operation instead of an exponential operation through a homomorphic hash function (HHF) of a non-square matrix M, so that the amount of operations required for authenticating the device can be reduced and the device can be safely authenticated even without a separate certificate authority.

Abstract: A method, system and non-transitory computer-readable medium product are provided for functionality watermarking and management. In the context of a method, a method is provided that includes identifying a request to establish an association between a watermark template and a function of at least one user device and determining whether the request to establish the association between the watermark template and the function of the at least one user device is authorized. The method further includes authorizing the request to establish the association between the watermark template and the function of the at least one user device in response to a determination that the request to establish the association between the watermark template and the function of the at least one user device is authorized.

Abstract: A storage device and method for storage device state recovery are provided. In one embodiment, a storage device commences an authentication process to authenticate a host device. The authentication process comprises a plurality of phases, and the storage device stores the state of the authentication process, wherein the state indicates the phase(s) of the authentication process that have been successfully completed. After a power loss, the storage device retrieves the state of the authentication process and resumes an operation with the host device without re-performing the phase(s) of the authentication process that have been completed.

Abstract: Methods for anonymous authentication and key exchange are presented. In one embodiment, a method includes initiating a two-way mutual authentication between a device and a remote entity. The device remains anonymous to the remote entity after performing the authentication. The method also includes establishing a mutually shared session key for use in secure communication, wherein the initiating and the establishing are in conjunction with direct anonymous attestation (DAA).

Abstract: In a method for activating a destination network node (SN) to be woken up in a wireless network (1), in particular a sensor network, the destination network node (SN) is woken from a sleep operating mode if the destination network node verifies a received secret wake-up token (WUT) by a predefined test function and at least one stored wake-up token reference value (WUTRV). The method protects network nodes in a wireless network (1) from attacks which reduce the lifetime of the network nodes by preventing a sleep operating mode. The method is particularly suitable for sensor networks.

Abstract: A computer-implemented method for authenticating devices may include (1) identifying a request from a device for a credentialing service to issue a credential to the device, the request including an application identifier encrypted with a first encryption key, the first encryption key having been derived by the device based on a token provisioned to the device by a vendor of the device, (2) transmitting the request to the credentialing service, (3) receiving, from the credentialing service, the credential encrypted using a second encryption key, the second encryption key having been derived by the device based on the token, and (4) providing the encrypted credential to the device. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method and system for mutually authenticating an identity and a server is provided in accordance with an aspect of the present invention. The method commences with transmitting a token from the server. Thereafter, the method continues with establishing a secure data transfer link. A server certificate is transmitted during the establishment of the secure data transfer link. The method continues with transmitting a response packet to the server, which is validated thereby upon receipt. The system includes an authentication module that initiates the secure data transfer link and transmits the response packet, and a server authentication module that transmits the token and validates the response packet.

Abstract: With a conventional image-display system, a presenter sometimes has difficulty in providing every viewer with an easy-to-see picture. When projecting an image transmitted from a computer operated by the presenter and enabling the viewer to watch the image projected by the projector, the projector receives image data transmitted through two-way communication from the computer operated by the presenter, projects an image represented by the received image data and transmits the received image data to a client computer operated by the viewer through the two-way communication, and the client computer receives the image data transmitted through the two-way communication and displays the image represented by the received image data on its display.

Abstract: In one embodiment, the method performed by mobile equipment to authenticate communication with a network includes generating keys using cellular authentication and voice encryption, and then generating an authentication key based on these keys. The authentication key is used to generate an expected message authentication code used in authenticating the network according to authentication and key agreement security protocol.

Abstract: Systems and methods for publishing datasets are provided herein. According to some embodiments, methods for publishing datasets may include receiving a request to publish a dataset to at least one of an internal environment located within a secured zone and an external environment located outside the secured zone, the request comprising at least one selection criteria, selecting the dataset based upon the at least one selection criteria, the dataset being selected from an index of collected datasets, and responsive to the request, publishing the dataset to at least one of the internal environment and the external environment.

Abstract: Computer-based systems and method for automating the workflow for generating and sending e-mails with attached reports to external recipients in order to reduce security breaches in certain business reporting processes. The system may utilize a first computer system that may import data eligible for attachment to be sent with the e-mail based on user-entered search criteria. The attachments may be strongly encrypted using an encryption program on the user's computer. In some embodiments, a password for decrypting the attachment may be unique to combination of third party (e.g., trading name) and the role of the external recipient with respect to the attachment.

Abstract: Embodiments of the invention may provide for systems and methods for secure authentication. The systems and methods may include receiving, by a constrained device, a random string transmitted from a server; determining, by the constrained device, a responsive output by evaluating a first deterministic function based upon the received random string, a locally generated string and a first private key stored on the constrained device; and transmitting at least one portion of the responsive output and the locally generated string from the constrained device to a server.

Abstract: A secure hardware comprises a secure pipe, a secure DMA, a secure assist and a secure bus, which connects between those blocks. The secure pipe stores a common encryption key in an encryption key table so as not to be able to access from software. The secure DMA comprises a data common key system process function and a hashing process function. The secure assist comprises a common key system process function and an authentication process function, receives an issued command from a program executed by the processor core via a public IF, and performs setting/control of the secure pipe and the secure DMA via the secure bus.

Abstract: A local content server system (LCS) for creating a secure environment for digital content is disclosed, which system comprises: a communications port in communication for connecting the LCS via a network to at least one Secure Electronic Content Distributor (SECD), which SECD is capable of storing a plurality of data sets, is capable of receiving a request to transfer at least one content data set, and is capable of transmitting the at least one content data set in a secured transmission; a rewritable storage medium whereby content received from outside the LCS may be stored and retrieved; a domain processor that imposes rules and procedures for content being transferred between the LCS and devices outside the LCS; and a programmable address module which can be programmed with an identification code uniquely associated with the LCS. The LCS is provided with rules and procedures for accepting and transmitting content data.

Abstract: Methods, apparatuses and systems directed to the application of network QoS policy to different data types multiplexed over a connection corresponding to a given session between a first host and a second host. In one implementation, the present invention includes a dual gateway architecture where a first gateway terminates the connection with a remote access client, demultiplexes the remote access session data stream into a plurality of separate streams for transmission to a second gateway. The second gateway re-multiplexes the separate data streams into a single remote access session data stream for transmission to a remote access server. The use of separate data streams between the first and second gateways allows for the application of individual policies on the components of the remote access session data flow. For example, a policy scheme can be configured that gives preference to mouse movements, transmitted in a first data stream, over printer traffic, transmitted in a second data stream.

Abstract: In a method of temporarily registering a second device with a first device, in which the first device includes a temporary registration mode, the temporary registration mode in the first device is activated, a temporary registration operation in the first device is initiated from the second device, a determination as to whether the second device is authorized to register with the first device is made, and the second device is temporarily registered with the first device in response to a determination that the second device is authorized to register with the first device, in which the temporary registration requires that at least one of the second device and the first device delete information required for the temporary registration following at least one of a determination of a network connection between the first device and the second device and a powering off of at least one of the first device and the second device.

Abstract: According to one embodiment, an apparatus may store a plurality of token-based rules that facilitate access to a resource, and a plurality of tokens indicating a user is using a device to request access to a resource over a network. The apparatus may receive a risk token indicating the risk associated with granting at least one of the user and the device access to the resource. The risk token may be computed from a set of tokens in the plurality of tokens. The apparatus may determine at least one token-based rule based at least in part upon the plurality of tokens and the risk token. The apparatus may then make an access decision based upon the at least one token-based rule, and communicate a decision token representing the access decision.

Abstract: There is disclosed a method in a communications system for enabling authentication of a sender device and a receiver device in the communication system, wherein the sender device is associated with a self-generated first identity and a first master device, the receiver device is associated with a self-generated second identity and a second master device and wherein the authentication is enabled by utilizing the first master device and the second master device for the sender device and the receiver device to verify the identities of each other. In one embodiment, both the sender device and the receiver device are also associated with a third device ant the third device is used in addition to the master devices for verifying said identities. There is also disclosed a method In a sender device, a method in a receiver device, a method in a third device, a sender device, a receiver device, a third device, and a computer program product for the same.

Abstract: A method for securing communication among members of a group. The method includes a first member obtaining a first secret. An n-bit generator executing on the first member generates a first message digest using the first secret. The first member extracts a first encryption solution and a second encryption solution, at least in part, from the first message digest, encrypts a first communication using the first encryption solution to obtain a first encrypted communication, and sends, to a second member of the group, the first encrypted communication. The first member further receives, from the second member, a second encrypted communication, and decrypts the second encrypted communication using the second encryption solution to obtain a second communication.

Abstract: Disclosed is an apparatus and method to access privileges of Virtual Mobile Management (VMM) client in mobile device. A disclosed example method contains an assigning embedded stub to raise the access privilege of the tool on a mobile device, the embedded stub is integrated by an operating system of the mobile device with “root” privilege, determining via a secured key exchange algorithm that the VMM client and tools is authorized to be installed on the mobile device then, the VMM client and tools of a mobile device are authorized to access a network interface of the Communication Endpoint Gateway (CEG) server, configuring the embedded stub to install the key exchange procedure for the shared certification between the embedded stub, VMM client and the session mediation server, enabling the embedded stub to communicate through a secure link via VMM client.

Abstract: A system and methods for establishing a mutually authenticated secure channel between a client device and remote device through a remote access gateway server. The remote access gateway server forwards secure connection requests and acknowledgements between the client and the remote device such that the remote access gateway does not possess any or all session keys necessary to decrypt communication between the client device and remote device.

Abstract: Providing for employing a real time firewall to secure components of an automation control network from unauthorized communication to or from such components is disclosed herein. A monitoring component can inspect at least a portion of an instance of communication directed toward or originating from a component of the automation control network. Such inspection can, e.g., be a deep packet inspection based on information received from a communication request and/or response protocol. A filtering component can selectively admit or deny propagation of the instance of communication based on the inspection and a predetermined security criterion. In such a manner, the subject innovation can provide for limited access to network components from office network machines and for securing components of an automation control network from influence by unauthorized entities.

Abstract: Protecting a user against web spoofing in which the user confirms the authenticity of a web page prior to submitting sensitive information such as user credentials (e.g., a login name and password) via the web page. The web page provides the user with an identifiable piece of information representing a shared secret between the user and the server. The user confirms the correctness of the shared secret to ensure the legitimacy of the web page prior to disclosing any sensitive information via the web page.