Abstract: A computer, including a processor and a memory, the memory including instructions to be executed by the processor to acquire a first image with a visible and NIR light camera and acquire a second image with an infrared camera. The instructions can include further instructions to determine whether the second image includes a live human face by comparing a first infrared profile included in the second image with second infrared profile included in a previously acquired third image acquired with the infrared camera; and when the second image includes the live human face, output the first image.

Abstract: A robotic process automation system includes a server processor that performs an automation task to process a work item, by initiating a java virtual machine on a second device. A first user session that employs credentials of a first user for managing execution of the automation task is also initiated on the second device. The server processor loads into the java virtual machine, with a platform class loader, one or more modules, such as logging and security, that perform functions common to the sets of task processing instructions. A first class loader a first set of task processing instructions is also loaded. Then each instruction in the first set of task processing instructions is loaded with a separate class loader. The server processor causes execution, under control of the first user session, on the second device, the task processing instructions that correspond to the work item.

Abstract: Apparatuses and methods are disclosed for protection of data servers configured for data replication of a database. As an example, one apparatus includes at least one processing circuit configured to receive records indicating respective modifications performed on a first version of the database stored in a first data server of the plurality of data servers. The at least one processing circuit is configured to delay replication of the modification in one or more additional servers in the plurality of data servers for a respective length of time specified for the servers in security profile data. While delaying replication of the modification, the processing circuit determines a probability that the modification is malicious based on a first set of factors indicated in a security profile. If the probability is greater than a threshold specified in the security profile data, the processing circuit prevents the modification from being performed.

Abstract: A client device for use with a gateway device (or a Wi-Fi APD) with a key stored therein and an external server where an original singe sign on (SSO) password is stored. The client device transmits a one time password (OTP) request to the external server, obtains the OTP from the external server, transmits the OTP to the external server to authenticate the client device, transmits an encrypted SSO password request to the external server, onboards the gateway device using a temporary password, receives the encrypted SSO password from the external server, obtains the key from the gateway device, decrypts the encrypted SSO password using the key to obtain the SSO password, and changes the temporary password of the gateway device to the original SSO password.

Abstract: An electronic device includes a slave interface configured for coupling to a machine controller of a machine via a multi-drop bus (MDB), a host interface configured for coupling to a first peripheral device of the machine, and memory storing one or more programs to be executed by the one or more processors and comprising instructions for: registering the electronic device as a slave to the machine controller, registering the first peripheral device as a slave to the electronic device, receiving from a mobile device a request to access signals generated by the first peripheral device, validating the request, and sending a reset command to the first peripheral device via the host interface, the reset command including a directive to update a signal destination address of the first peripheral device from a controller address of the machine controller to a device address of the electronic device.

Abstract: A method and apparatus for testing and simulating an access control policy are disclosed. Evaluating an access control policy may be performed by utilizing a deny statement that causes the access request to be rejected despite actions indicated in the access request being authorized. Further, an independent simulation environment may be utilized for testing access control policy evaluation.

Abstract: An information processing apparatus which anonymizes data composed of records including one or more items through statistical processing, includes a memory and a processor to execute classifying respective records constituting the data into one or more sets based on masking target items indicating items to be masked among the items, a dictionary which expresses categories of item values in a tree structure for each of the masking target items, a selected hierarchy level indicating a hierarchy level selected in the tree structure for each of the masking target items, and the number of records included in the data, and calculating the number of records N of each set and a ratio of records belonging to a set including N records, and dividing the data into one or more pieces of data in a case where the ratio of the records belonging to the set including N records satisfies a predetermined condition.

Abstract: Systems and methods for interoperable network token processing are provided. A network token system provides a platform that can be leveraged by external entities (e.g., third party wallets, e-commerce merchants, payment enablers/payment service providers, etc.) or internal payment processing network systems that have the need to use the tokens to facilitate payment transactions. A token registry vault can provide interfaces for various token requestors (e.g., mobile device, issuers, merchants, mobile wallet providers, etc.), merchants, acquirers, issuers, and payment processing network systems to request generation, use and management of tokens. The network token system further provides services such as card registration, token generation, token issuance, token authentication and activation, token exchange, and token life-cycle management.

Abstract: A method and system for provisioning access data in a second application on a mobile device using a first application on the mobile device. Authentication data may be input into the first application, and an authentication code may be requested from a remote server. After the authentication code is received by the first application in the mobile device, it can pass the authentication code to a second application that initiates an access data provisioning process.

Abstract: The disclosed exemplary embodiments include computer-implemented systems, apparatuses, and processes that, among other things, authenticate device identity and authorize exchanges of data in real-time based on dynamically generated cryptographic data. For example, an apparatus may receive a first signal that includes a first cryptogram associated with a client device, and may perform operations that authenticate an identity of the client device based on a comparison of the received first cryptogram and a second cryptogram generated by a computing system associated with an application program executed by the client device. In response to the authenticated identity, the apparatus may load profile data associated with the client device from a storage unit, and perform operations consistent with the profile data in accordance with the authenticated identity.

Abstract: A system and method for a distributed security model that may be used to achieve one or more of the following: authenticate system components; securely transport messages between system components; establish a secure communications channel over a constrained link; authenticate message content; authorize actions; and distribute authorizations and configuration data amongst users' system components in a device-as-a-key system.

Abstract: An entity may generate digital account credentials when a new account is approved for generation by an authorizing entity that controls or issues new accounts. A user may contact an authorizing entity to open a new account with the authorizing entity. The authorizing entity may authenticate the user and may approve a new account to be generated for the user. The user may wish to conduct transactions immediately upon approval. However, the authorizing entity may not immediately generate a physical identification device along with an actual account identifier associated with the new account. An intermediary entity may generate digital account credentials for the new account immediately after the authorizing entity approves generation of the new account, provide the digital account credentials to the account holder, and process transactions using the digital account credentials.

Abstract: Systems, apparatuses, and methods related to a computer system having a processor and a main memory storing scrambled data are described. The processor may have a secure zone configured to store keys and an unscrambled zone configured to operate on unscrambled data. The processor can convert the scrambled data into the unscrambled data in the unscrambled zone using the keys retrieved from the secure zone in response to execution of instructions configured to operate on the unscrambled data. Another processor may also be coupled with the memory, but can be prevented from accessing the unscrambled data in the unscrambled zone.

Abstract: Embodiments are provided for protecting boot block space in a memory device. Such a memory device may include a memory array having a protected portion and a serial interface controller. The memory device may have a register that enables or disables access to the portion when data indicating whether to enable or disable access to the portion is written into the register via a serial data in (SI) input.

Abstract: Systems and methods as provided herein may create a biometric model associated with a user. The created biometric model may be used to generate challenges that are presented to the user for authentication purposes. A user response to the challenge may be compared to an expected response, and if the user response matches within a predetermined error of the expected response, the user may be authenticated. The systems and methods may further generate challenges that are adaptively designed to address weaknesses or errors in the created model such that the model is more closely associated with a user and the user is more likely to be the only person capable of successfully responding to the generated challenges.

Abstract: Example implementations can involve a system, which can involve a server configured to distribute role decision condition expressions created based on user input to one or more storage devices; and the one or more storage devices, which can involve a processor, configured to, for receipt of a request, determine user identification information, request source environment information and requested contents from the request; determine a role from the role decision condition expressions based on the user identification information and request source environment information; and determine whether or not the request can be executed based on the role.

Abstract: A method includes receiving a communication identifying a remote database and a first value stored in the remote database that is being transferred to a first entity by a second entity. That first value is capable of being modified by the second entity. Modification of the first value stored in the remote database by the second entity is prevented by identifying an application programming interface allowing operations to be performed on the remote database, and using that API to transfer the first value so as to be associated with one or more other identifiers unknown to the second entity. After modification of the first value stored by the second entity is prevented, a transfer of a second value to a database record associated with the second entity is triggered. Related systems and applications of the method and those systems are also disclosed.

Abstract: In various embodiments, authentication stations are distributed within a facility, particularly in spaces where mobile devices are predominantly used—e.g., a hospital's emergency department. Each such station includes a series of authentication devices. Mobile device may run applications for locating the nearest such station and, in some embodiments, pair wirelessly with the station so that authentication thereon will accord a user access to the desired resource via a mobile device.

Abstract: A disclosed method for managing encryption keys, which may be performed by a key management server, responds to receiving, from a first client, a request to create a new key for a self-encrypting drive (SED) associated with the first client by retrieving unique identifiers of the first client and the SED, generating and storing the new key and a corresponding key identifier (KeyID), and associating the unique identifiers of the SED and first client with the new key. Upon receiving, from a second client, a locate key request that includes the SED identifier, providing the new key, the KeyID, and the first client identifier to the second client. Associating the SED and first client identifiers with the new key may include adding the identifiers as attributes of the KeyID. Embodiments may be implemented in accordance with a key management interoperability protocol (KMIP) standard.

Abstract: A user authentication method performed in an unmanned delivery system including a server, a buyer customer device, a deliveryman customer device, and an autonomous delivery vehicle includes: generating, by the server, a session key based on order information received from the buyer customer device, and transmitting the generated session key to the deliveryman customer device and the buyer customer device; generating, by the deliveryman customer device, a One-Time Password (OTP) based on the session key; applying, by the deliveryman customer device as a first application step, a hash function to the OTP a first predetermined number of times; additionally applying, by the deliveryman customer device as a second application step, the hash function to the OTP generated in the first application step a second predetermined number of times; and generating, by the deliveryman customer device, a first Quick Response (QR) code based on the OTP generated in the second application step.

Abstract: This disclosure describes techniques for implementing a Single-sign-On Domain-Agnostic Proof-of-Possession (SODA-POP) token (or access token) to solve generation of multiple POPs for authentication of multiple domains that may belong to a single mobile network operator (MNO). The access token may be implemented by a JSON Web Token (JWT) that includes a map of key-value pairs as confirmation claims. The key-value pairs may include multiple domains/sub-domains and their corresponding public keys. These key-value pairs may be registered and added in the confirmation claims to automatically authenticate each one of the domains to access a corresponding service provider. To register a new domain, the new domain redirects a request back to an already registered domain, which updates the access token and then redirects the request back to the new domain. After registration, the updated access token may be used to access services at all registered domains without further reauthentication.

Abstract: Described is a hybrid centralized-decentralized system for managing data and token transactions among a decentralized group of stakeholders. The system uses a blockchain architecture to maintain secure identities for the stakeholders, as well as allow any stakeholder to perform a data or token transaction with another stakeholder. A central organization manages a central application and a data exchange. The central application manages profile data from users and interaction data for users with developer applications, and provides it to the data exchange. The data exchange organizes and packages the data, and may provide it to other stakeholder for analysis.

Abstract: An inspection apparatus that performs quality inspection on a printed matter printed by a printer using a reference image and a scanned image of the printed matter. When inspecting the quality of the printed matter, selection is performed as to which to use as the reference image, a pre-printed image for use in printing the printed matter, or the scanned image. In a case where a difference is detected as a result of comparison between the pre-printed image and the scanned image, a reference image selection screen including the pre-printed image and the scanned image is displayed. A user input is received concerning whether or not the detected difference is a defect. The reference image is selected based on the received user input.

Abstract: The disclosure provides an approach for certificate management for cryptographic agility. Embodiments include receiving, by a cryptographic agility system, a cryptographic request related to an application. Embodiments include selecting, by the cryptographic agility system, a cryptographic technique based on contextual information associated with the cryptographic request. Embodiments include determining, by the cryptographic agility system, based on the cryptographic request, a certificate for authenticating a key related to the cryptographic technique. Embodiments include providing, by the cryptographic agility system, the certificate to an endpoint related to the cryptographic request for use in authenticating the key.

Abstract: The present disclosure relates to devices and methods for protecting data from physical attacks. The devices and methods may establish an encryption protocol to encrypt data transmitted over a bus to one or more removable devices in communication with a computer device. The devices and methods may use the encryption protocol to communicate with the removal devices and perform storage requests at the removal devices. The devices and methods may also perform another layer of encryption on the data stored at the removal devices using a data at rest key stored on the removal devices.

Abstract: A computer-implemented method is disclosed. The method includes: receiving, via a communication interface from a client application executing on a first device, a first signal including a request to obtain an access token for accessing a protected resource, the request including a public key associated with an end user; validating the request to obtain the access token; and in response to validating the request: encrypting an authorization code associated with the request using the public key to generate a first code; and transmitting, via the communication interface to the client application on the first device, a second signal including both the access token for accessing the protected resource and the first code.

Abstract: A computer-implemented system and method that includes receiving, by a messaging hub, a code and a transaction amount from a recipient and determining, by the messaging hub, based at least partially on the code, an account number for a credit card held by a user. The system and method may include receiving, by the messaging hub, funds equaling the transaction amount from the credit card and depositing the funds in an account held by the messaging hub, the funds being received via a four-party credit card transaction in which the messaging hub operates as a merchant and sending the funds from the account held by the messaging hub to an account held by the recipient.

Abstract: Systems and methods are provided for verifying recurring transactions to payment accounts. One exemplary method includes initially receiving an authorization request for a transaction to a payment account and involving a merchant, where the authorization request includes a recurring payment indicator. The method also generally includes transmitting, by at least one computing device, a verification request to a consumer associated with the payment account, and inhibiting, by the at least one computing device, at least one or authorization or clearing of the transaction until a verification of the transaction, based on a direction from the consumer, is recognized, whereby the consumer is able to verify the transaction before the transaction is cleared.

Abstract: Embodiments of the invention are directed to systems, methods, and computer program products for generation of dynamic authentication tokens for use in system-to-system transaction authorization and user identity verification. The system utilizes user biometric data to generate unique authentication tokens which are customized to a particular user. Furthermore, the system rotates not only the encryption algorithms used, but also the datasets being encrypted in order to provide a high level of security such that even if a user's biometric data was compromised, it would be highly unlikely that an attacker would be able to recreate the authentication token stemming from said biometric data at any given point in time. The system eliminates the need for user-provided authentication credentials and provides a more secure and more efficient method of authenticating data exchange between multiple systems or applications.

Abstract: A data storage device 100 comprising: a non-volatile storage medium 108 configured to store user data 109; a data port 106 configured to transmit data and power between a host computer system 130 and the data storage device 100; a data access state indicator 140; and a controller 110 configured to: selectively set a data access state of the data storage device 100 to either: an unlocked state to enable access to the user data 109; or a locked state to disable access to the user data 109; and generate an indicator control signal to cause the data access state indicator 140 to indicate the data access state, wherein the data access state indicator 140 is configured to indicate the data access state irrespective of whether the data storage device 100 is powered through the data port 106.

Abstract: A biometric token is generated for a user and provided to a user-operated device. A pre-staged transaction is defined by a user and the user supplies the token for association with the pre-staged transaction. Subsequently, a user visits a transaction terminal and a new candidate token is generated from biometric attributes of the user. The candidate token is matched to the token associated with pre-staged transaction to authenticate the user and the pre-staged transaction is processed at the transaction terminal as a completed transaction.

Abstract: A method, including identifying, in network traffic during multiple periods, scans, each scan including an access of multiple ports on a given destination node by a given source node, and computing, for each given source in the scans, an average of destinations whose ports were accessed by the given source during any scan by the given source, and a fraction of periods when the given source accessed at least one of the destinations in at least one scan performed by the given source node. A whitelist is assembled sources for which one or more of the following conditions applies: the average of destinations accessed in the scans was greater than a first threshold, and the fraction of periods during which at least one destination was accessed in at least one scan was greater than a second threshold. Upon detecting a scan by any non-whitelisted node, a preventive action is initiated.

Abstract: Authenticating devices utilizing Transport Layer Security (TLS) protocol to facilitate exchange of authentication information or other data to permit or otherwise enable access to services requiring authentication credentials, certificates, tokens or other information. The authentication may utilize Digital Transmission Content Protection (DTCP) certificates, Diffie-Hellman (DH) parameters or other information available to the authenticating devices, optionally without requiring device requesting authentication to obtain an X.509 certificate.

Abstract: Embodiments disclosed herein generally related to a system and method of authenticating a user with a third party server. In one embodiment, a method is disclosed herein. A computing system receives, from a remote client device of the user, a token. The token includes personal identification information and a digitized file of a biometric captured by a biometric scanner. The computing system identifies via the personal identification information that the user has a user account. The computing system queries a database with the personal identification information and the digitized file to determine whether the biometric matches a stored biometric in the user account. Upon determining that the biometric matches the stored biometric, the computing system generates a message to be transmitted to the third party server that authenticates the user. The computing system transmits the message to the third party server.

Abstract: The CLOUD-BASED VIRTUAL WALLET NFC APPARATUSES, METHODS AND SYSTEMS (“EAE”) transform user enhanced security transaction initiation requests using EAE components into time-limited, session-specific transaction bounding tokens. In some implementations, the disclosure provides a processor-implemented method of transforming a transaction bounding token request into transaction bounded tokens and purchase authorizations.

Abstract: Systems and methods for transferring funds from an acquirer processor account to one or more financial accounts. The transferring of the funds can be directed by one or more settlement rules defined by a merchant.

Abstract: An apparatus and method of protecting information by using a system on a chip (SoC) are discussed. The apparatus includes a SoC memory which is disposed in a predetermined SoC and includes a first region accessible only by a unit having an access right, and a hardware (HW) filter configured to monitor at least one unit attempting to access the SoC memory. When a unit without an access right attempts to access the first region, the HW filter can block access of the unit without the access right.

Abstract: A client application establishes a connection between the client application and an origin server over one or more networks. The application generates a request to establish a secure session with the origin server over the connection. The request includes information, in a header of the request, that flags traffic sent during the secure session to a network of the one or more networks as subject to one or more optimizations performed by the network. Subsequent to establishing the secure session, the application encrypts the traffic in accordance with the secure session and sends the traffic to the origin server over the connection, subject to the one or more optimizations. The infrastructure service applies the one or more optimizations to the traffic as it passes through the edge network to the origin server.

Abstract: A computer-implemented method for authentication of a queried device having an electrical circuit exhibiting physically unclonable functions (PUFs). The method includes: at the queried device, generating a first random number based on an initial first counter value; matching the first random number against a first value of a record stored in a database of a querying device, the record including second (shuffled) and third values; at the queried device, generating a second random number based on a once incremented first counter value, deterministically generating a de-shuffled second value based on an initial second counter value, determining that the second random number matches the de-shuffled second value, and submitting sub-challenges corresponding to the second random number to the electrical circuit to generate a response; and, at the querying device, determining that the response matches the third value of the record to complete a first authentication of the queried device.

Abstract: Techniques are disclosed relating to secure message exchanges. In some embodiments, a first computing device generates an account key associated with a user account shared by a plurality of computing devices. The first computing device signs a public key of the first computing device with the generated account key to produce a digital signature and sends the public key and the digital signature to a first server system for distributing the public key to a second computing device attempting to send an encrypted message to the first computing device. The first computing device sends the account key to an external storage external usable by others of the plurality of computing devices to obtain the account key and use the account key to sign public keys of the other computing devices. The first computing device receives, from the second computing device, the encrypted message encrypted using the public key.

Abstract: Migration of a pairing of wearable device to a new companion electronic device is disclosed. In one embodiment, pairing migration is performed by syncing and verifying a migration key in the wearable and new companion device. Pairing migration includes moving settings and pairing data of the wearable to the new companion device in response to detecting the wearable is associated with the migration key, wherein the migration key establishes a validation of trust of the wearable relative to the companion device. The settings and pairing data can include configuration and protected data and one or more keys to establish a trust relationship between the wearable and new companion device. The settings and pairing data can also include device data such that the wearable can be discoverable by the new companion device.

Abstract: A method, system, and computer-readable medium are disclosed for generating a unified user profile. For example, a system may store, on a client device, a token under a first domain name. The token may specify state data for a communication session between the client device and a first content publisher addressed by the first domain name. The communication session utilizes a stateless communication protocol. The system may then generate a redirection resource locator. The redirection resource locator may include an identifier for a web object belonging to a second content publisher addressed by a second domain name and the token. The system then stores, on the client device, the token under the second domain name by directing the client device to send a web object request generated based at least in part on the redirection resource locator to the second content publisher. The web object request may request the web object from the second content publisher and including the token.

Abstract: A method, server and storage medium for verifying a transaction using a smart card are disclosed. A server receives a transaction request to perform a transaction with a user of the smart card. The transaction request includes identification information and encrypted data extracted from the smart card, and transaction information. The server determines a user account linked to the identification information. The server performs a first verification process to authenticate the smart card by verifying that the smart card possesses a correct decryption key corresponding to the identification information. The server performs a second verification process to authenticate the smart card by verifying that the encrypted data extracted from the smart card encodes stored data corresponding to the respective user account linked to the identification information. If the first and the second verification processes are successful, the server processes the transaction in accordance with the transaction information.

Abstract: Transferring data between memories may include reading data associated with a memory transfer transaction from a first memory, determining whether a bypass indication associated with the memory transfer transaction is asserted, and transferring the data from the first memory to a second memory. The transferring may include bypassing the first-processing if the bypass indication is asserted. The transferring may further include bypassing second-processing the data if the bypass indication is asserted. Following bypassing the second-processing, the data may be stored in the second memory.

Abstract: A method of validating the contents of an electronic file. The method comprises requesting an electronic file by an application executing on a computer system by providing a multi-segment filename, wherein the multi-segment filename comprises a unique delimiter between each of the segments of the multi-segment filename and one of the segments of the multi-segment filename is a hash of a content of the electronic file referenced by the multi-segment filename, receiving by the application the electronic file referenced by the multi-segment filename, determining a hash over the content of the electronic file by the application, comparing by the application the hash determined by the application to the hash of the content stored in the one of the segments of the multi-segment filename, and, based on the two hashes agreeing, opening by the application the contents of the electronic file for use.

Abstract: In an information processing system, a storage control server (storage control node) that has received a read request of data from a compute server (compute node) transmits the read request to a drive box. The drive box that has received the read request from the storage control server reads encrypted read target data corresponding to the read request from non-volatile storage media, decrypts the read target data with key data acquired at a predetermined timing, and then transmits the decrypted read target data to the compute server as a read request source.

Abstract: Various examples described herein are directed to systems and methods for processing a payment using a mobile wallet network and issuer. A mobile wallet application provides payment information and an indication if payment may be done directly via the mobile wallet network to a point of sale (POS) terminal. The POS terminal determines which payment network to use. A bill may be sent to the mobile wallet application. The mobile wallet application requests payment authorization from an issuer. The issuer provides the authorization and the transaction is completed between the POS terminal and the mobile wallet application.

Abstract: A device management service to facilitate onboarding of a remote IoT device may receive, from a client service, a request for a session certificate for a remote device. The device management service may send the session certificate to the client service, where the session certificate is valid for the remote device to obtain a primary certificate during a session duration. The device management service may receive, from the remote device, a request for the primary certificate for the remote device. The device management service may send, to the remote device, the primary certificate, wherein the primary certificate enables communication between the remote device and the device management service, and wherein the primary certificate has a primary duration that is longer than the session duration. The device management service may establish a communication channel with the remote device according to the primary certificate.

Abstract: A biometric token is generated for a user and provided to a user-operated device. A pre-staged transaction is defined by a user and the user supplies the token for association with the pre-staged transaction. Subsequently, a user visits a transaction terminal and a new candidate token is generated from biometric attributes of the user. The candidate token is matched to the token associated with pre-staged transaction to authenticate the user and the pre-staged transaction is processed at the transaction terminal as a completed transaction.

Abstract: Methods and systems related to distributing payment keys to multiple discrete devices in a point of sale (POS) system are disclosed. One method includes storing a payment key on a first discrete device for a POS system and a public key certificate on a second discrete device for the POS system. The method also includes communicatively connecting the first discrete device with the second discrete device using a wire, transmitting the public key certificate from the second discrete device to the first discrete device using the wire, and verifying the public key certificate on the first discrete device. The method also includes finalizing a secure connection between the first discrete device and the second discrete device over the wire using a transport layer secure (TLS) protocol after the public key certificate is verified.