Abstract: Systems and methods securely provide media content from a media server to a media client via a network. The media content is segmented to create multiple media segments that are each identified in a playlist, and at least one of the media segments is encrypted using a cryptographic key. The cryptographic key is also identified in the playlist, and the playlist is provided from the media server to the media client via the network. The various media segments and cryptographic keys may then be requested from and provided by the media server using hypertext transport protocol (HTTP) or similar constructs to allow the media client to receive and decrypt the various segments of the media content.

Abstract: Technologies for implementing a secure boot using multiple firmware sources are described. One or more fuses of a processing device can be configured. Based on such configuration, one or more keys can be generated. Based on the configuration of the various fuses, an operation of a firmware device can be initiated. Using the generated key(s), a protected section of the firmware device can be accessed.

Abstract: Example methods and apparatus to generate identifying tags for media content as described herein. An example method includes obtaining an identifier value associated with at least one of audio or video of received media content by at least one of: extracting the identifier value from at least one of the audio or the video or determining the identifier value based on inherent information of at least one of the audio or the video, generating a tag including the identifier value, and storing the tag with the media content to cause the tag to be distributed to a presentation location along with the media content.

Abstract: Systems and methods for application signing are disclosed. In some implementations, an application package identifier and a password may be received at an application signing server. Upon authenticating the application package identifier and the password, a fingerprint identifying the developer is received. Upon receipt of the fingerprint, the application signing server generates a secure key for the application based on the fingerprint, where the secure key is provided to the developer for inclusion within the application. Upon determining that the application package identifier and the secure key included in a request from an operating system of a mobile device matches an authorized application package identifier and an authorized secure key stored at the application signing server, the application signing server provides the requested list of the one or more APIs to the operating system to grant the application access to the APIs in the list.

Abstract: Example methods and systems for modifying the playback of content using pre-processed profile information are described. In some example embodiments, the methods and systems may access a stream of content to be delivered to a playback device, identify a piece of content within the stream of content to be delivered to the playback device, determine a profile for the identified piece of content, and deliver the determined profile to the playback device. In some example embodiments, the methods and systems may receive a stream of content at a playback device, access profile information associated with the stream of content, and modify playback of the stream of content based on the accessed profile information.

Abstract: Methods, apparatus, and systems are disclosed for, among other things, secure passphrase handling for computing devices. In one respect, a method is provided. The method includes receiving a plurality of passphrase elements from an input device. The method also includes performing a sequence of secure delay processing operations, each operation generating a delayed output value from an initial value. The passphrase is verified upon completion of the sequence of secure delay processing operations. Further, initial values of respective secure delay processing operations are based on respective passphrase elements and, for each secure delay processing operation after a first secure delay processing operation, a delayed output value from at least one other secure delay processing operations.

Abstract: Systems and methods for encoding, transmitting, and decoding are disclosed. The systems and methods include multimedia encoding, transmitting, and decoding instantiation systems which are capable of being modified on the basis of associated IPR costs. Further, the systems and methods include the capabilities of recording or transmitting the IPR and/or IPR costs associated with the instantiated encoders, transmitters, or decoders.

Abstract: A computer implemented system for audio watermarking for providing robust and blind audio watermarking. The system comprises a watermark embedding system wherein an audio signal is divided into audio frames, multi-level District Wavelet Transform (DWT) is applied on each frame, followed by Singular Value Decomposition (SVD) and embedding the watermark, further followed by inverse SVD and inverse DWT to get watermarked audio frames which are combined to generate a watermarked audio signal. The system further comprises watermark extracting detection system wherein the watermarked audio signal which may be attacked and/or modified is divided into watermarked audio frames, multilevel DWT is applied on each watermarked audio frame, followed by SVD, extracting the embedded watermarked, correlating the extracted watermark with pre-stored watermarks, calculating Peak to Sidelobe ratio (PSR) from the correlation coefficient arrays and finally comparing each PSR with a threshold to authenticate the embedded watermark.

Abstract: Approaches to enable the configuration of computing resources for executing virtual machines on behalf of users to be cryptographically attested to or verified. When a user requests a virtual machine to be provisioned, an operator of the virtualized computing environment can initiate a two phase launch of the virtual machine. In the first phase, the operator provisions the virtual machine on a host computing device and obtains cryptographic measurements of the software and/or hardware resources on the host computing device. The operator may then provide those cryptographic measurements to the user that requested the virtual machine. If the user approves the cryptographic measurements, the operator may proceed with the second phase and actually launch the virtual machine on the host. In some cases, operator may compare the cryptographic measurements to a list of approved measurements to determine whether the host computing device is acceptable for hosting the virtual machine.

Abstract: A system for fingerprinting audiovisual content. The system includes a content receiver and a display device in communication with the content receiver. The content receiver is configured to receive a video signal, where the video signal includes audiovisual content. The content receiver may then be configured to generate a matrix barcode that includes identification data. The content receiver is also configured to create a fingerprinted content that includes the audiovisual content from the video signal and the matrix barcode. The content receiver may then be configured to output the fingerprinted content. The display device is configured receive the fingerprinted content form the content receiver. Also, the display device is configured to display the fingerprinted content.

Abstract: A method of establishing secure groups of trusted contacts with access rights in a secure communication system. The method includes establishing secure groups of trusted contacts in the secure communication system; storing information corresponding to the trusted contacts of a secure group as a secure group in a database; and determining access rights of the secure group and storing the access rights in the database with the stored information corresponding to the secure group.

Abstract: Initiating document management in an enterprise network from outside of the network can challenge information technology (IT) specialists because many solutions require altering security of the enterprise network. In an embodiment, a method includes polling, from an automated agent in an agent-side network, a server in a cloud-side network for a request to access a document management resource of the agent-side network via an interface between the agent-side network and cloud-side network The method further includes, responsive to the polling, downloading the request via the interface between the agent-side network and the cloud-side network. The method additionally includes issuing the request to the document management resource to cause the document management resource to access a document stored on a device of the agent-side network and perform an operation associated with the request. The method, therefore, enables a user access to the document management resource from outside of an enterprise network.

Abstract: An apparatus and a method for secretly transmitting messages over public channels is described. Data from a first enterprise service bus (ESB) of a first computer system is encoded in a new media file using steganography. The new media file is transmitted to a third party server over a public channel. The new media file is then downloaded and decoded at a second enterprise service bus (ESB) of a second computer system.

Abstract: A method comprising generating a segment signature for a segment of a media content based on the segment, trusted information contained in a media presentation description (MPD), and a signature signing key, wherein the MPD describes the media content. An apparatus comprising a processor configured to compute a segment signature for a segment of a media content based on the segment, a signature signing key, and trusted information contained in a media presentation description (MPD), wherein the MPD describes the media content.

Abstract: A system and method for signing and authenticating electronic documents using public key cryptography applied by one or more server computer clusters operated in a trustworthy manner, which may act in cooperation with trusted components controlled and operated by the signer. The system employs a presentation authority for presenting an unsigned copy of an electronic document to a signing party and a signature authority for controlling a process for affixing an electronic signature to the unsigned document to create a signed electronic document. The system provides an applet for a signing party's computer that communicates with the signature authority.

Abstract: A system and method for signing and authenticating electronic documents using public key cryptography applied by one or more server computer clusters operated in a trustworthy manner, which may act in cooperation with trusted components controlled and operated by the signer. The system employs a presentation authority for presenting an unsigned copy of an electronic document to a signing party and a signature authority for controlling a process for affixing an electronic signature to the unsigned document to create a signed electronic document. The system provides an applet for a signing party's computer that communicates with the signature authority.

Abstract: Systems and methods are disclosed for embedding information in software and/or other electronic content such that the information is difficult for an unauthorized party to detect, remove, insert, forge, and/or corrupt. The embedded information can be used to protect electronic content by identifying the content's source, thus enabling unauthorized copies or derivatives to be reliably traced, and thus facilitating effective legal recourse by the content owner. Systems and methods are also disclosed for protecting, detecting, removing, and decoding information embedded in electronic content, and for using the embedded information to protect software or other media from unauthorized analysis, attack, and/or modification.

Abstract: An apparatus comprising a memory, a processor coupled to the memory and configured to obtain a protection description for media content comprising a plurality of content items, wherein the protection description comprises data signaling at least two protection mechanisms for at least two content items in a media content, wherein each of the at least two content items is protected by one or more of the at least two protection mechanisms, and wherein the protection mechanisms for the at least two content items are different, determine the protection mechanisms for the at least two content items from the data, and process the at least two content items according to their associated protection mechanisms.

Abstract: Methods for anonymous authentication and key exchange are presented. In one embodiment, a method includes initiating a two-way mutual authentication between a first entity and a second entity. The first entity remains anonymous to the second entity after performing the authentication. The method also includes establishing a mutually shared session key for use in secure communication between the entities, wherein the initiating and the establishing are in conjunction with direct anonymous attestation (DAA).

Abstract: A method for authenticating a document comprises obtaining the contents of a document, obtaining biometric characteristics from an individual, forming a message based on the contents of the document and the biometric characteristics of the individual, generating a digital signature based on the message and a key, and writing the digital signature to an Radio Frequency Identification (RFID) tag affixed to the document.

Abstract: Systems and methods are provided for updating one or more scanning rules. For example, one or more first operation records being uploaded are obtained; scanning information corresponding to the first operation records is extracted; one or more recommended operations corresponding to the scanning information are obtained based on at least information associated with one or more scanning rules; a matching degree between the first operation records and the recommended operations is calculated; and the scanning rules are updated based on information associated with the matching degree.

Abstract: Embodiments of the invention relate to systems, methods, and computer program products for improved electronic discovery. Embodiments herein disclosed provide for an enterprise-wide e-discovery system that provides for source-to-processing file conversion of electronic communications and, in some embodiments, decryption of encrypted electronic communication entries for the purpose of efficiently processing data and supplying the electronic data to third party data analysis providers.

Abstract: A system and method are disclosed for enforcing site or organization localized provisioning policy using cryptography. In an exemplary method, a signing key is used to generate a signature for an application. The signature of the application is verified using a verifying key in order to determine whether the application adheres to the site or organization localized provisioning policy. The verifying may be performed during initialization of a computing device or during runtime of an operating system at the computing device.

Abstract: A query fingerprint of a set of frames of video content captured at a client device may be generated. Multiple patches of the set of frames of video content may be selected and a value calculated for each of the selected multiple patches. The value for each patch may be indicated as a single bit along with an additional 1-bit value to indicate whether the patch value is weak. A database of known reference fingerprints may be queried using the generated query fingerprint. Matches between the query fingerprint and the reference fingerprints may be identified. Weak bits may be given reduced weight in identifying the match of fingerprints. Based on the matches, an identifier for the video content may be returned to the client device. The client device may use the received identifier to access the supplemental content.

Abstract: A system and method for signing and authenticating electronic documents using public key cryptography applied by one or more server computer clusters operated in a trustworthy manner, which may act in cooperation with trusted components controlled and operated by the signer. The system employs a presentation authority for presenting an unsigned copy of an electronic document to a signing party and a signature authority for controlling a process for affixing an electronic signature to the unsigned document to create a signed electronic document. The system provides an applet for a signing party's computer that communicates with the signature authority.

Abstract: According to one embodiment, a data processing arrangement is described comprising a processor configured to carry out a computer program including a plurality of program instructions; a signature determination arrangement configured to determine a signature of the program instructions carried out by the processor wherein the processor is configured to, when it carries out a program instruction of the plurality of program instructions which indicates the next program instruction of the plurality of program instructions to be carried out, provide information about the indication to the signature determination arrangement; wherein the signature determination arrangement is configured to take into account the information in the determination of the signature; and a detector configured to check, when the computer program is completely carried out, whether the determined signature is equal to a reference signature.

Abstract: Embodiments of the invention are directed to systems, methods and computer program products for providing targeted location-based communications. An exemplary apparatus is configured to receive an encoded signal, decode the encoded signal such that embedded data is retrieved, send the embedded data a remote server; and receive a message based at least partially on sending the embedded data. Create a message vector based on the message comprising of a plurality of key sequences, each of which comprises more than two frequency components and is associated with a unique bit. Another exemplary apparatus is configured to provide the encoded signal by receiving data input, receiving a host signal, embedding the data input within the host signal such that an encoded signal is generated, and transmitting the encoded signal.

Abstract: A fingerprinting method. For each round in a series of rounds: providing to each receiver in a set of receivers a version of a source item of content, the source item of content corresponding to the round. For the round there is a corresponding part of a fingerprint-code for the receiver, the part includes one or more symbols. The version provided to the receiver represents those one or more symbols. One or more corresponding symbols are obtained from a suspect item as a corresponding part of a suspect-code. For each receiver in the set of receivers, a corresponding score that indicates a likelihood that the receiver is a colluding-receiver is updated.

Abstract: There is provided an information processing apparatus including a display part to display video content on a screen, a rotation angle detection part to detect a rotation angle of the screen, a display formation determination part to determine a display formation of video content at any rotation angle of the screen or during transition of the rotation, and an image processing part to perform an image processing in accordance with the display formation determined by the display formation determination part such that the video content is conformed to the screen which is tilted by the rotation angle detected by the rotation angle detection part.

Abstract: The present invention relate generally to digital watermarking and data hiding. One claim recites a method including: obtaining first data and second color data, the first color data and the second color data represent data from a color image signal or color video signal; obtaining a digital watermark pattern, the pattern aiding detection of a watermark message; separating the digital watermark pattern into first frequency components and second frequency components; utilizing a programmed electronic processor or electronic processing circuitry, modifying the first color data by hiding the first frequency components therein; and utilizing a programmed electronic processor or electronic processing circuitry, modifying the second color data by hiding the second frequency components therein. Of course, other combinations and claims are provided too.

Abstract: A system and method for signing and authenticating electronic documents using public key cryptography applied by one or more server computer clusters operated in a trustworthy manner, which may act in cooperation with trusted components controlled and operated by the signer. The system employs a presentation authority for presenting an unsigned copy of an electronic document to a signing party and a signature authority for controlling a process for affixing an electronic signature to the unsigned document to create a signed electronic document. The system provides an applet for a signing party's computer that communicates with the signature authority.

Abstract: A system that performs time dependent cryptographic operations on input material resulting in outputs valid only over limited preconfigured life times to mitigate the security drawbacks of unattended operations while capturing the benefits of automation. Tamper protection circuitry is used to ensure the integrity of the system's internal independent source of time, cryptographic processor and key material. Configuration management of the system is authorized only after authenticated credentials held by multiple personnel are presented to the system.

Abstract: A memory access circuit and a corresponding method are provided. The memory access circuit includes a crypto block in communication with a memory that encrypts data of a data block on a block basis. The memory access circuit also includes a fault injection block configured to inject faults to the data in the data block. The memory access circuit further includes a data scrambler and an address scrambler. The data scrambler is configured to scramble data in the memory by shuffling data bits within the data block in a plurality of rounds and mash the shuffled data bits with random data. The address scrambler is configured to distribute the scrambled data across the memory. A memory system including the memory access circuit is also disclosed to implement the corresponding method.

Abstract: Data may be bound to a Uniform Resource Identifier (URI) template using a bind operation. Conversely, a URI may be matched against a URI template to result in data extracted from the URI. A URI may be matched against multiple URI templates using, for example, a template table to thereby generate an estimated best-match URI template for the URI, and potentially also return matched data extracted from the URI using the best-match URI template.

Abstract: Audio watermark encoding methods employ reversing polarity and pairwise embedding. A watermark signal is generated, mapped to pairs of embedding locations and inserted in the members of the pair with reverse polarity. The pairs of embedding locations correspond to adjacent regions or frames in time or frequency domains. A method for controlling an audio output device captures audio from the device, extracts its identity from a watermark, and modifies the operation of the device, e.g. varying watermark strength or audio loudness.

Abstract: Some embodiments of a system and a method to verify compliance in a disconnected system have been presented. For instance, a provider server can collect system management server state hashes from a set of computer systems in transactions not directly related to billing between the provider server and the computer systems. The computer systems may be coupled to a system management server that is within an internal network of a customer. The provider server can verify compliance information submitted by the customer using the system management server state hashes collected without communicating with the system management server in the internal network.

Abstract: Methods and systems are provided for performing and verifying transactions involving authentication with a secure credential, such as a smart card, in an untrusted or semi-trusted environment. An application module, operating in an untrusted or semi-trusted environment can be denied access to sensitive data. The application module can determine a preliminary command to be sent to the credential and transmit the preliminary command to a broker module. The broker module, operating in a trusted environment, can supply sensitive data and transmit the command to the credential. Subsequently, the broker module can extract sensitive data from a response before it is transmitted to the application module. A verification server can audit the transaction to verify that it was carried out properly.

Abstract: A method of playing back a moving picture in a portable terminal includes recognizing at least one playback list including moving picture files having file names that are more similar than a determined degree from among all moving picture files, identifying at least one overlap playback section formed of identical frames by analyzing frames of moving picture files included in the generated playback list, and upon playing one of the moving picture files included in the generated playback list, determining whether an auto-skipping function is activated, and playing the requested one of moving picture files based on the determination.

Abstract: Disclosed is a method in which a portable device processor may generate an application-level certificate for an application installed on the portable device. The processor may, for example, insert an application name in a package name field of a self-signed device-level certificate of the portable device to generate an application-level self-signed certificate. A request to authenticate the application may be forwarded to the controller. The request may include the application-level certificate. The portable device processor may receive a request to form a secure communication channel between the portable device and the controller based on the authenticated application-level certificate. A controller may respond to a portable device request for services by authenticating an application-level certificate provided by the portable device so requested services may be securely provided to the portable device.

Abstract: The data storage portion stores an encrypted medium device key Enc (Kcu, Kmd_i) generated by encrypting a medium device key (Kmd_i), a medium device key certificate (Certmedia), and encrypted content data generated by encrypting content data, the controller stores a controller key (Kc) and first controller identification information (IDcu), the information recording device being configured to execute, after being connected to an external host device, an one-way function calculation based on the controller key (Kc) and the first controller identification information (IDcu) to generate a controller unique key (Kcu) used when decrypting the encrypted medium device key Enc (Kcu, Kmd_i), and second controller identification information (IDcntr) used when decrypting the encrypted content data.

Abstract: The invention relates to a computer-implemented method for providing a data stream comprising a plurality of content elements. At least one of two or more copies of a first content element of the data stream has been watermarked with a different watermark. The method includes watermarking at least one of two or more copies of a second content element with a different watermark. In a rendering order of the data stream, the second content element is at an interval equal to or greater than a watermark interval from the first content element. The watermark interval is set to be sufficiently long so that the output quality of the rendered data stream can either completely recover or at least return to a predetermined acceptable level following the watermarking of the copies of the first content element before watermarking the copies of the next content element.

Abstract: One or more processing devices cause display of a service-monitoring dashboard that includes one or more key performance indicator (KPI) widgets. Each KPI widget provides a numerical or graphical representation of one or more values for a corresponding KPI indicating how a service provided by one or more entities is performing at one or more points in time. Each entity of the one or more entities is associated with machine data. A KPI is defined by a search query that derives the one or more values represented by the corresponding KPI widget from the machine data associated with the one or more entities that provide the service whose performance is reflected by the KPI.

Abstract: Information to link two attributes in a database is stored, and when one of the attributes is updated, a new value for the second attribute is computed and stored. Related systems and applications are also described.

Abstract: A DRM compliance system can include one or more DRM servers, capture devices capable of continuously encrypting content at capture, and one or more rights compliance software applications. Methods of ensuring DRM compliance can include registering and verifying capture devices prior to the presentation of protectable content. Unique IDs associated with the capture devices may be stored as DRM liens in a DRM server along with particular time periods an identified DRM policy is in effect. The rights compliance software application can consult a DRM server to determine if encrypted content captured by a device is subject to a DRM policy. The server can make such a determination based on attempting to match data identifying the capture device and time of capture to one or more DRM liens. When matches are found, applicable DRM policies are applied by decrypting the content and then rendering the content in a DRM-compatible form.

Abstract: An image processing apparatus includes an internal obtaining device configured to obtain authentication information, a communication unit configured to perform communication with an external obtaining device that is configured to obtain authentication information, an image processing unit configured to execute at least one of image reading and image formation, and a controller configured to execute determination processing including granting a permission for executing image processing by the image processing unit when the controller determines that the authentication based on the authentication information obtained from the internal obtaining device and first reference information is successful, and granting the permission for executing the image processing when the controller determines that the authentication based on the authentication information obtained from the external obtaining device and second reference information is successful, the second reference information being different from the first refer

Abstract: A service provider computing environment includes a service provider secrets policy. A service provider computing device receives tenant secrets policies from tenants. The tenants are tenants of multi-tenant assets of a service provider. The service provider computing environment determines of the tenant secrets policies satisfy the requirements of the service provider secrets policy. If the tenant secrets policies satisfy the requirements of the service provider secrets policy, the service provider computing environment allows the tenant secrets policies to be applied to tenant data or information in the multi-tenant assets.

Abstract: The subject matter described herein includes methods, systems, and computer readable media for preventing software piracy. One method includes specifying at least one codemark that is intrinsic to a computing system. The method further includes inserting guard code in an application. The guard code including a first code portion that uses a codemark and produces an output that depends on a value of the codemark and a second code portion that uses the output of the first code portion. The method further includes executing the first and second code portions and selectively triggering a protective action based on the output of the second code portion. Multiple types, styles, and frequencies of guard codes can be used to provide in-depth, long lasting, and strong protection.

Abstract: Improved duplicate and near-duplicate detection techniques may assign a number of fingerprints to a given document by (i) extracting parts from the document, (ii) assigning the extracted parts to one or more of a predetermined number of lists, and (iii) generating a fingerprint from each of the populated lists. Two documents may be considered to be near-duplicates if any one of their fingerprints match.

Abstract: A data transfer apparatus includes a first memory, a second memory, a search unit, and a data transmitting/receiving unit. The first memory holds information that associates a search key with an address. The second memory holds information that associates the address with verification information which is generated by a predetermined generation method based on at least a portion of the search key. The search unit generates the search key based on the received data, obtains, from the first memory, the address that is associated with the generated search key, obtains, from the second memory, the verification information that is associated with the obtained address, and verifies the verification information that is generated by the predetermined generation method based on at least a portion of the generated search key with the verification information obtained from the second memory. The data transmitting/receiving unit executes processing based on a result of the verification.

Abstract: A method, system or computer usable program product for securing pages that contain sensitive information including utilizing a processor to provide a user interface on a display allowing a user to select a page as password protected on a device, responsive to a user utilizing the UI to select the page as password protected, receiving a password from the user, and requiring entry of the password before displaying the page on the display.