Abstract: A biometric token is generated for a user and provided to a user-operated device. A pre-staged transaction is defined by a user and the user supplies the token for association with the pre-staged transaction. Subsequently, a user visits a transaction terminal and a new candidate token is generated from biometric attributes of the user. The candidate token is matched to the token associated with pre-staged transaction to authenticate the user and the pre-staged transaction is processed at the transaction terminal as a completed transaction.

Abstract: Methods and systems related to distributing payment keys to multiple discrete devices in a point of sale (POS) system are disclosed. One method includes storing a payment key on a first discrete device for a POS system and a public key certificate on a second discrete device for the POS system. The method also includes communicatively connecting the first discrete device with the second discrete device using a wire, transmitting the public key certificate from the second discrete device to the first discrete device using the wire, and verifying the public key certificate on the first discrete device. The method also includes finalizing a secure connection between the first discrete device and the second discrete device over the wire using a transport layer secure (TLS) protocol after the public key certificate is verified.

Abstract: A system and method for providing remote access to a device is disclosed. The method comprises receiving an automatically expiring authentication token having encrypted authentication token data including a session key from the device, transmitting the authentication token to secure facility, receiving the decrypted authentication token data from the secure facility, signing a tool package with a package verification key derived at least in part from the session key, the tool package comprising processor instructions providing remote access to the device when executed by the processor, providing the signed tool package to the device. The device verifies the signed tool package using the package verification key and executes the tool package only if the signature of the tool package is verified.

Abstract: Systems, devices, methods, and computer readable media are provided in various embodiments having regard to authentication using secure tokens, in accordance with various embodiments. An individual's personal information is encapsulated into transformed digitally signed tokens, which can then be stored in a secure data storage (e.g., a “personal information bank”). The digitally signed tokens can include blended characteristics of the individual (e.g., 2D/3D facial representation, speech patterns) that are combined with digital signatures obtained from cryptographic keys (e.g., private keys) associated with corroborating trusted entities (e.g., a government, a bank) or organizations of which the individual purports to be a member of (e.g., a dog-walking service).

Abstract: Disclosed are various embodiments for issuing virtual cards to client devices. Also disclosed are embodiments for provisioning a transaction terminal to process transactions with virtual cards. A zero-knowledge proof algorithm can be utilized to validate the transactions. A virtual card can be based upon a public key of a client device that is managed by a hardware security module.

Abstract: A method for controlling public access of resources in a secure distributed storage system using an API level model. A request to access a volume is checked for authentication. If the request does not include an authentication token ID, a guest role is created and assigned to the requestor. The guest role can only access public volumes or owned volumes that specifically allow public access. The guest role can be updated using API management.

Abstract: A method for enrolling a device in a secure network to which an information system is connected, the method comprising the steps, implemented by a trusted device connected to the secure network, of: a) receiving from a user terminal, distinct from the device to be enrolled, an authorization to connect to the device to be enrolled, b) generating cryptographic keys intended for the device to be enrolled to access the secure network, and c) transmitting the cryptographic keys to the device to be enrolled.

Abstract: A client device comprises a first secure element and a second secure element. The first secure element comprises a first computer-readable medium having a payment application comprising instructions for causing the client device to initiate a financial transaction. The second secure element comprises a second computer-readable medium having a security key, a payment instrument, stored authentication data and instructions for generating a secure payment information message responsive to the payment application. The secure payment information message comprises the payment instrument and is encrypted in accordance with the security key.

Abstract: Aspects of the disclosure provide various methods relating to enclaves. For instance, a method of authentication for an enclave entity with a second entity may include receiving, by one or more processors of a host computing device of the enclave entity, a request and an assertion of identity for the second entity, the assertion including identity information for the second identity; using an assertion verifier of the enclave entity to determine whether the assertion is valid; when the assertion is valid, extracting the identity information; authenticating the second entity using an access control list for the enclave entity to determine whether the identity information meets expectations of the access control list; when the identity information meets the expectations of the access control list, completing the request.

Abstract: A method for providing improved personalized security mechanisms for transferring electronic data is disclosed. In an embodiment, the method comprises generating, at a client computer, a user key pair, wherein the user key pair comprises a user private key and a user public key; transmitting the user public key from the client computer to a server computer; receiving, at the client computer, from the server computer, a user account public key; generating a virtual memory stick (“VMS”) file and including, in the VMS file, one or more keys and one or more passphrases; encrypting the VMS file with a protection passphrase to generate an encrypted VMS file; and transmitting the encrypted VMS file to the server computer.

Abstract: Disclosed are an electronic device and a method of performing digital key provisioning of an electronic device. The electronic device according to an embodiment includes a communication unit, a memory that stores programs and data for performing digital key provisioning, and a processor configured to, by executing the programs stored in the memory, perform device authentication on a target device by performing short-range communication with the target device, identify a digital key service access right of the target device through a server by obtaining user information, and control generation and storing of a digital key in response to a digital key generation request from the target device.

Abstract: An electronic device is provided. The electronic device includes at least one wireless communication circuit, a processor operatively connected with the at least one wireless communication circuit, and a memory operatively connected to the processor, wherein the memory stores instructions that, when executed, cause the processor to detect an event related to transmission of identification information through the at least one wireless communication circuit, in response to the detection of the event, perform a first authentication procedure for obtaining access right to the identification information, relay a second authentication procedure between an external electronic device and a server through the at least one wireless communication circuit, and receive the identification information that is stored in the external electronic device from the server through the at least one wireless communication circuit.

Abstract: Various embodiments set forth techniques for managing access to a resource at a device. In one aspect, a method includes receiving a request by an application to access a resource, determining that an application permission associated with the application and the resource grants the application access to the resource, where the application permission includes a signature of a permission review entity associated with the resource, and granting the request to access the resource based on the application permission. The permission review entity associated with the resource may be authorized through device permissions specified by an implementer or provider of the device.

Abstract: Various techniques are disclosed herein for storing and managing master data in hierarchical data systems. Several related concepts, embodiments, and examples are disclosed, including techniques for incremental rationalization in a hierarchical data model, techniques for implementing governance pools in a hierarchical data model, techniques for application materialization in a hierarchical data model, techniques for data intersection mastering in a hierarchical data model, techniques for change request visualization in a hierarchical data model, and techniques for hierarchy preparation in a hierarchical data model.

Abstract: Provided are systems and methods for conducting secure remote transactions between mobile devices and merchants.

Abstract: A method for providing improved personalized security mechanisms for transferring electronic data is disclosed. In an embodiment, the method comprises generating, at a client computer, a user key pair, wherein the user key pair comprises a user private key and a user public key; transmitting the user public key from the client computer to a server computer; receiving, at the client computer, from the server computer, a user account public key; generating a virtual memory stick (“VMS”) file and including, in the VMS file, one or more keys and one or more passphrases; encrypting the VMS file with a protection passphrase to generate an encrypted VMS file; and transmitting the encrypted VMS file to the server computer.

Abstract: A system includes an intelligent electronic device (IED) of an electric power distribution system and a key device. The key device is configured to perform operations that include receiving a request from the TED for communication with an additional component of the electrical power distribution system, establishing a Media Access Control security key agreement (MKA) connectivity association with the TED in response to receipt of the request, generating a security association key (SAK) in response to receipt of the request, and distributing the SAK to the IED via the MKA connectivity association to enable the TED to use the SAK to communicate via a Media Access Control security (MACsec) communication link that is isolated from the key device.

Abstract: Traditional information sharing will delete a file in order for stop sharing the file, and after shared a message, the message cannot be stopped for sharing. This invention discloses method and system for user posting (sharing) or un-posting (stop sharing) files, folders, and messages by deploying dynamic workspace technology. The stop sharing file or folder will not delete actual file or folder, so that the file or folder can be shared again to other users without requiring to recreate the file or folder. The un-post message operation facilitates a user to delete or withdraw his/her previously posted message from user interface (UI) of a recipient such that the user can avoid embarrassing if the message is not proper. Specially, a sharing control list is provided to user to control stop sharing files, otherwise, the user may do not remember how many files being shared with how many recipients.

Abstract: According to various embodiments of the present disclosure, it is possible to present on a home screen or an application screen such a display that an appropriate favorite setting for each of the home screen and the application screen is applied to the respective home screen or the respective application screen according to read card information.

Abstract: The present disclosure includes a system for re-establishing a Bluetooth Low Energy (BLE) pairing PIN key to repair a secure connection between a mobile device and vehicle. The system may detect an error state, and provide a prompt to the user to determine if they wanted to intentionally remove their account. Responsive to an affirmative response from the user that the removal of the connection credentials was intentional, the system may send a revoke request to a server associated with the vehicle. Responsive to a user input that indicates that the removal of the credentials was unintentional, the vehicle may fetch an encrypted PIN seed of the BLE pairing PIN from memory or request the PIN seed from the server. The PIN seed re-establishes the secured pairing of the mobile device and the vehicle infotainment system without undergoing a new device setup procedure.

Abstract: A method in a system comprising at least one portable data carrier, an authentication server and at least one reading device of at least one service provider which is couplable to the authentication server. The data carrier is adapted to communicate contactlessly with the reading device and comprises a security marking which can be read contactlessly by the reading device and on the basis of which the data carrier can be authenticated by the authentication server. The method comprises the step of equipping the data carrier with a data-carrier management marking that encodes a piece of data-carrier management information and readable contactlessly by a portable terminal. The method includes contactlessly reading out the data-carrier management marking by a portable terminal, transferring the data-carrier management information encoded in the data-carrier management marking to the authentication server, and managing the data carrier in the system employing the data-carrier management information.

Abstract: Tracking, identifying and article management systems and methods for reliably and repeatedly determining one or more physically uncopiable attribute instances (of the same or varying types) from or inherent in an article of manufacture, using the selected physical uncopiable attribute(s) to produce an unforgeable identity for the article, and then integrating that unforgeable identity into computer-based tracking systems in a way that permits the tracking system to track and monitor articles for which identity information is known. Applications include documents, fashion accessories, artwork, and other objects.

Abstract: Embodiments of the invention provide systems and methods to unlock an account associated with a user for a limited period of time to enable the user conduct a transaction using funds from that account. In one embodiment of the invention, the user may select options relating to the transaction using a payment menu provided at a mobile communications device associated with the user. A notification message is received at the mobile communications device informing the user that the account is unlocked for a certain period of time and for a certain amount. After the transaction is complete, the user is notified and the account is locked again.

Abstract: A method of issuing an electronic voucher by an issuer is provided. The method includes steps of: (a) creating and registering a transaction including a voucher data, a public key and a signature value of the issuer, with a private blockchain database, providing the issuer with a PrivTxid locating the transaction in the private blockchain database, and updating and registering value information including a balance of the voucher data with a BDB; and (b) acquiring and registering a representative hash value calculated using a specific hash value, which is a hash value of the voucher data, the public key, and the signature value, and its corresponding hash values which include a hash value of a delta_n including all balances of all vouchers, identifiable by all PrivTxids locating their transactions, with a public blockchain database, and acquiring a Txid locating the representative hash value in the public blockchain database.

Abstract: The invention proposes a method of authentication of an electronic identity device (1) presented by an individual, the method being characterized in that it comprises the implementation of steps of: (b) Reception by data processing means (21) of a server (2) of an acquired image of said electronic identity device (1), the image representing at least one personal visual element of the individual and a dynamic verification code that are visible on said electronic identity device (1), said dynamic verification code containing at least one item of reference information representative of an expected appearance of said visual element; (c) Extraction, by analysis of said acquired image by the data processing means (21) of the server (2), of: an item of candidate information representative of the appearance of said visual element as represented in the acquired image; the reference information representative of the expected appearance of said visual element contained in said dynamic verification code as represente

Abstract: A device that includes a biometric device that is configured to capture a biometric signal for a user. The biometric signal is a signal that is linked to the user based on the physical characteristics of the user. The device further includes a memory operable to store a plurality of biometric signals. The device further includes a processor configured to obtain a user password from a user and obtain a first biometric signal for the user. The processor is further configured to identify a stored biometric signal from among the plurality of biometric signals in the memory that closest matches the first biometric signal. The processor is further configured to generate an authentication token by encrypting the user password with the stored biometric signal and to send the authentication token to an authentication device.

Abstract: A system includes an authorization token with a memory configured to store user attributes including a record of previous usage of the data store by the user, pre-authorization data for the user, and an access signature for accessing contents of a data store. The authorization token receives an authorization request. Session attributes are collected associated with a file path used by the user to request access to a file. A consistency measure is determined associated with whether the file path used by the user to request access to the file is consistent with a previous file path stored in a record of previous usage of the data store by the user. In response to determining that the consistency measure is greater than a threshold value, the access signature is provided to the data store, thereby granting the user access to the file.

Abstract: The present disclosure provides systems, methods, and products for providing a tokenization service and a complementary API. The tokenization service may provide format-preserving tokens. The tokenization service may associate different tokens generated by different users from the same data, so that users can retrieve and use associated tokens for collaboration and access to each other's data, information, etc. The tokenization service may restrict the creation of an association between, and access to, users' tokens based on a requirement for a relationships between users according to a social graph model.

Abstract: Various embodiments are generally directed to authenticating a user for non-payment purposes utilizing a payment protocol, a computer device and a contactless card. The payment protocol may be consistent with an EMV standard. An application may determine that authorization or verification of a user may be required to access non-payment features of another application associated with the user and the computer device. The application may then receive and/or facilitate transmission of encrypted data from a communications interface of a contactless card associated with an account and utilizing either an offline or online technique to do so. The offline or online technique may involve one or more operations that can verify the identity of the user and/or otherwise authorize the user to have access to various aspects of the other application.

Abstract: An access control system and methods according to at least one embodiment leverage wireless access credentials to allow a user to securely gain access to a secured area using his or her mobile device. As such, a credentialed mobile device may permit access to the secured area without requiring a real-time connection to a credential management system and/or an administrative system.

Abstract: Embodiments described herein disclose technology for authenticating a user. In some embodiments, a smart card or other similar authentication device can be associated with a user profile. When a request to interact is received via an application associated with a device, the system prompts the user to waive the smart card within a threshold proximity of the device. In response to the smart card being placed within the proximity, the system collects information from the smart card and verifies that the smart card is associated with the user profile of the user. In response to verifying the information from the smart card, the system authenticates the user and allows the user to interact.

Abstract: Techniques are described for extending virtual desktops across different devices. The virtual desktop client sets up a web server on a primary device. A QR code encoded with information identifying the web server is displayed on the primary device and is scanned by a secondary device. A web browser is launched on the secondary device and the web browser connects to the web server on the primary device. The virtual desktop is reconfigured to produce its GUI on two monitors, one for the primary device and one for the secondary device. The GUI data for the second monitor is streamed by the virtual desktop client to the secondary device over the HTTPS connection, to be displayed on the secondary device. GUI data for the first monitor is displayed on the primary device. Inputs are streamed from the secondary device to the primary device and are forwarded to the virtual desktop.

Abstract: A high-level functionality generates a Data Model which is used to automatically generate Applications comprising Application Clients, Application Servers, Client-Server Protocols, Dashboards and other components. These Applications are derived for different mobile and non-mobile's Operating Systems. This functionality uses Services, Service Representation, Application Flow, Rules, and Presentation Attributes. The input for the automation is a very high-level, “service” level “language,” from which all parts are automatically generated. The output of the automation also includes a way to validate the correctness of the generated Applications. The generated Dashboard provide a Business Entity with functionality to continuously update the generated Data Model based on the Services and Business Entity data, and from the updated Data Model automatically generate updated versions of the Application.

Abstract: In an aspect, a computing system is configured to: send, to a transfer rail server, a request for stored card data associated with a value transfer card; receive stored card data identifying an entity having a stored representation of the value transfer card; provide user interface data to a client device, the user interface data causing the client device to display a user interface that includes an entity listing that is based on the stored card data, the user interface including a selectable option to add an entity-based control to the identified entity; receive, from the client device, an instruction to apply an entity-based control to an identified one of the entities in the stored card data; and in response to receiving the instruction to apply the entity-based control, implement the entity-based control to affect use of the value transfer card by the identified entity and not affect use of the value transfer card by other entities.

Abstract: The present disclosure includes secure communication between a vehicle and a remote device. An embodiment includes a processing resource, memory, and a vehicular communication component configured to, in response to receiving a request from a remote communication component to switch a state of a lock, calculate a challenge count for the request, generate a vehicular private key and a vehicular public key, perform a number of verification iterations, each respective verification iteration including providing the public key to the remote communication component, receiving, from the remote communication component, code for switching the lock state, verifying the remote communication component's identity, and incrementing a counter in response to verifying the remote communication component's identity, and decrypt the code using the private key and switch the lock state in response to the counter being incremented to a value equal to or greater than the challenge count.

Abstract: Data can be protected in a centralized tokenization environment. A security value is received by a central server from a client device. The central server accesses a token table corresponding to the client device and generates a reshuffled static token table from the accessed token table based on the received security value. When the client device subsequently provides data to be protected to the central server, the central server tokenizes the provided data using the reshuffled static token table and stores the tokenized data in a multi-tenant database. By reshuffling token tables using security values unique to client devices, the central server can protect and store data for each of multiple tenants such that if the data of one tenant is compromised, the data of each other tenant is not compromised.

Abstract: Systems and methods for automatically disseminating a private key are presented. A first message requesting a key proxy instance is received from a first user device. The first message comprises a first symmetric key. A key proxy server is directed to allocate a key proxy instance for communication with the first user device based on a device public key that corresponds to the first user device. A unique URL corresponding to the key proxy instance is received from the key proxy server. A second message comprising the unique URL is sent to the first user device. The second message is encrypted using the first symmetric key and signed using a server private key. A third message comprising the URL of the key proxy instance is received from the first user device and forwarded to a second user device.

Abstract: According to one embodiment, a memory system includes a non-volatile semiconductor memory device, a control unit, a memory as a work area, a wireless communication module, and an extension register. The control unit controls the non-volatile semiconductor memory device. The extension register is provided in the memory and has a data length by which a wireless communication function of the wireless communication module can be defined. The control unit causes the non-volatile semiconductor memory device to store, as a file, an HTTP request supplied from a host, causes the extension register, based on a first command supplied from the host, to register an HTTP transmission command transmitted together with the first command, and causes the wireless communication module to transmit the HTTP request stored in the non-volatile semiconductor memory device based on the transmission command registered in the extension register.

Abstract: Techniques are described for providing session management functionalities using an access token (e.g., an Open Authorization (OAuth) access token). Upon successful user authentication, a session (e.g., a single sign-on session) is created for the user along with a user identity token that includes information identifying the session. The user identity token is presentable in an access token request sent to an access token issuer authority (e.g., an OAuth server). Upon receiving the access token request, the user identity token is parsed to identify and validate the session against information stored for the session. The validation can include various session management-related checks. If the validation is successful, the token issuer authority generates the access token. In this manner, the access token that is generated is linked to the session. The access token can then be used by an application to gain access to a protected resource.

Abstract: Embodiments provide a method of using access tokens for identification of breach attempts in a client-server communication. The method includes receiving, by a server system, a token validation request for validation of a token from an Application Programming Interface (API) server sent from a client device to the API server. The method includes accessing one or more token configuration parameters associated with a valid token. The token configuration parameters include one or more of a number of allowable access attempts using the valid token in the API session and a range of frequency of allowable access attempts using the valid token in the API session. The method includes verifying whether the token conforms to the token configuration parameters associated with the valid token. The method further includes determining a breach attempt associated with the token if the token does not conform to the token configuration parameters.

Abstract: A platform for delivering secure web applications to a client browser. A software plug-in is provided configured for integration into a web browser. The plug-in includes: a request hook that intercepts web browser requests associated with a secure web application; a request processing system that redirects an request to access the secure web application to a network service, and then redirects subsequent HTTP requests to interact with the secure web application to the network service; and a package manager that receives a text-based data package from a customer domain server in response to the initial request and renders the secure web application in the web browser, and receives an updated text-based data package from the customer domain server in response to the subsequent HTTP request and renders updates to secure web application in the web browser.

Abstract: A method for the processing, by a transaction-processing server, of a transaction at least partially initiated from a communications terminal connectable to the server by using a communications network. This method includes: creating a secured communications channel with the communications terminal; instantiation, within an execution server on the communications network, of a virtual payment terminal capable of exchanging information with the communications terminal by using the secured communications channel; and processing a transaction between the communications terminal and the virtual payment terminal implementing at least one secure element of the communications terminal, the secure element being configured to exchange an identifier of the type of service.

Abstract: Managing a storage array includes: receiving, by a client-side array services module from a cloud-based security module through data communications on a wide area network, a token representing authentication of user credentials; and managing, by the client-side array services module, a storage array only through data communications on a local area network, including sending, to the storage array, the token with a management instruction.

Abstract: Systems and methods are provided for use in enabling, providing, and managing digital identities in association with mobile communication devices. One exemplary method includes capturing an image of a physical document comprising a biometric of a user associated with the physical document, and extracting the biometric from the image and converting it to a biometric template. The method also includes capturing a biometric of the user and comparing it to the biometric template. The method then includes, when the captured biometric matches the biometric template, transmitting a message to an identification provider comprising at least the image of the physical document and the biometric template, whereby the biometric template is verified against a repository, and binding data representative of the mobile communication device, a mobile application included therein, and the biometric template and/or the captured biometric of the user into a token.

Abstract: Implementations of the present specification disclose blockchain data processing methods, apparatuses, devices, and systems, including a computer-implemented method for blockchain data processing. Blockchain transaction data of a plurality of transaction participants is received. Each of the plurality of transaction participants provides a respective certificate indicating a respective legal membership in a blockchain. The respective legal membership enables processing of the blockchain transaction data. A mutual identity querying is performed to confirm whether each of the plurality of transaction participants has the respective legal membership in the blockchain. Supervision keys of a supervision node in the blockchain are determined, where the supervision node corresponds to a supervisor, and where the supervision keys are dynamically updated based on a predetermined rule. The blockchain transaction data is encrypted by using the supervision keys. The blockchain transaction data is stored.

Abstract: A computer system is configured to provide a payment card security application programming interface (API) for providing a payment card security score to a partner entity computer system. Responsive to receipt of user identification data for a card holder from the partner entity computer system via the API, the computer system retrieves payment card electronic funds transfer (EFT) transaction data records corresponding to the card holder, and determines a transaction type and security level associated for the user's transactions. The computer system generates, based on the determined security level for each of the transactions, a security score for the card holder. The partner entity computer system provides the user identification data for the card holder to the payment card security API responsive to receipt of an authorization request for a new transaction. The partner entity computer system may determine whether to approve or deny the new payment card EFT transaction based upon the security score.

Abstract: A device may receive, from a client device, a request with a single packet authorization (SPA) packet that includes data identifying a universal client device identifier (UID), a counter, a first one-time password generated based on a first shared key, the UID, and the counter. The device may generate a second shared key associated with the UID, and may compare the SPA packet to a comparison message authentication code (MAC) generated based on the second shared key, the UID, and the counter. The device may determine whether the SPA packet matches the comparison MAC, and may validate the client device when the SPA packet matches the comparison MAC. The device may provide a MAC associated with the SPA packet to the client device to enable the client device to validate the device for a secure communication based on establishing a pre-master key with the client device.

Abstract: The present invention involves with a method and system of state consistency protection for Intel software guard extension (SGX). In a method of state consistency protection for a central processing unit capable of creating enclaves, the central processing unit supports creation of at least one enclave, wherein the central processing unit communicates with a remote server providing services for the central processing unit through remote communication and the remote server has a remote attestation module, configuring the remote attestation module to facilitate the completion of every execution state storing operation and/or every execution state restoring operation, wherein the remote attestation refers to an attestation mechanism by which the central processing unit proves to the remote server that it has created the specific enclave in a local platform so that the remote server trusts the specific enclave. The present invention does not require special hardware and is favorable to cross-platform migration.

Abstract: In virtualized environments a method of determining authorization to a resource cannot use a hardware specific identifier, such as a MAC address. As a result upgrading a virtual host may cause licenses associated with that host to be invalid, even though the upgraded virtual host should be authorized. Authentication methods and systems are disclosed such that a key may be shared with a second host along with a license file and, provided at least the second host has a key associated with its system identifier and a key associated with a license file, access to a licensed resource may be authorized.

Abstract: A method of a responding entity for creating a secure link with a requesting entity in an embedded universal integrated circuit card (eUICC) environment is provided. The method includes: receiving, from the requesting entity, a secure link creation message including signature information of the requesting entity; verifying the signature information of the requesting entity by using trust information of the requesting entity, the trust information of the requesting entity being generated by a certificate authority (CA) and transferred to the responding entity; generating a shared key used for communication between the responding entity and the requesting entity; and creating the secure link with the requesting entity by using the shared key.