Abstract: A system is for a proof of knowledge enrollment or authentication. The system includes a processor having an input, an output and a routine; and a display having an image from the output of the processor. The routine is structured to input from the input of the processor a plurality of different position selections and/or a plurality of different path selections on the image. The routine is further structured to authenticate the proof of knowledge as a function of the plurality of different position selections and/or the plurality of different path selections on the image.

Abstract: Techniques are provided for the controlled scheduling of the authentication of devices in a lossy network, such as a mesh network. An authenticator device that is configured to authenticate devices in a lossy network receives an authentication start message from a particular device to be authenticated. The authenticator device determines a schedule for engaging in an authentication procedure for the particular device based on an indication of current network utilization.

Abstract: A device for identification and authentication of a remote user connecting to a service over a network includes a cryptographic processor and at least one cryptographic key and storage means, additional processing means and interface means to generate and transmit a unique authentication code as emulated keystrokes through a standard input, means of a client terminal. The code may be transmitted only by an explicit command of the user.

Abstract: An information processing system including an information processing device connected to a first communication network, a terminal device connected to the first communication network, and a server device connected to a second communication network. The server device includes a receiving unit, a first request unit, and a providing unit. The receiving unit receives an instruction from the terminal device to provide the information processing device with a predetermined service. The first request unit presents a test to the information processing device to authenticate whether or not the information processing device is being operated by a human. The providing unit provides the information processing device with the service in accordance with the instruction. The terminal device includes an instruction unit and a response unit. The instruction unit sends the instruction to the server device. The response unit makes a response to the test on behalf of the information processing device.

Abstract: Methods, systems, and computer readable media are provided for managing and securing personal information. Personal information is stored in a central repository (personal information store) for a given personal information owner. As personal information is changed, the owner of the personal information may access the personal information store to update information stored therein. Access codes may be established for all personal information, and the use of the codes may be restricted by application of one or more rules or permissions applied to the information requesters. Alternatively, special access codes may be established for one or more pieces or combination of pieces of personal information data contained in the personal information store. Upon request or requirement for personal information, information requesters may be provided one or more access codes to allow the information requester to receive only that personal information for which they are authorized.

Abstract: An embodiment generally relates to a method of increasing user convenience. The method includes displaying a log-in user interface and receiving an authentication attempt in the log-in user interface. The method also includes determining a status of the authentication attempt and delaying a completion of an authentication attempt by a time-based function in response to a status being a failed authentication attempt.

Abstract: In connection with authenticating a client of a network, information is acquired that characterizes the client in a manner that enables a determination about authenticating the client of the network, the information being acquired other than in the form of a digital message that is passed on behalf of the client to the network; an authentication decision is made based on the information. Information is encrypted in a manner that is based on a physical property of an intended recipient of the information, and delivering the encrypted information to the recipient. A source of a beacon is physically associated with a person, times of receipt of the beacon at multiple stations are measured, and the location of the person is determined based on the times of receipt.

Abstract: To provide for cryptographic separation, embodiments of the invention employ containment mechanisms provided by trusted operating systems to ensure that plaintext data which must be encrypted in accordance with a security policy (or, in reverse, ciphertext data which is to be decrypted) is processed by a suitable encryption routine before being sent onwards for transmission, storage, or the like. Such containment mechanisms usually include mandatory system access control rules which specify to which system resources the output of a system resource (such as an application) may be supplied. By specifying a suitable set of such rules, mandatory encryption can be enforced at the operating system kernel level.

Abstract: The present invention discloses methods for protecting a host system from information-security risks posed by a URD, the method including the steps of: operationally connecting the URD to the host system; communicating, between the URD and the host system, via a network protocol, through a firewall residing in the host system; and configuring said firewall to provide security measures related to the URD. Preferably, the firewall is a software firewall or a hardware firewall. A method for protecting a host system from information-security risks posed by a URD, the method including the steps of: operationally connecting the URD to the host system; communicating, between the URD and the host system, via a network protocol, through a firewall residing in the host system; and configuring said firewall to restrict access of at least one application to the URD. Preferably, the firewall is a software firewall or a hardware firewall.

Abstract: According to one embodiment, a device includes a cell array including an ordinary area, a hidden area, and an identification information record area in which identification information which defines a condition for accessing the hidden area is recorded. An authentication circuit performs authentication. A sensing circuit recognizes information recorded in the identification information storage area, determines the information recorded in the identification information record area when an access request selects the hidden area, validates an access to the hidden area when determined that the identification information is recorded, and invalidates an access to the hidden area when determined that the identification information is not recorded.

Abstract: A cellular phone includes a telephone line communication part, a telephone functional part for making a telephone call via the telephone line communication part, an entry qualification holding part for holding fixed-term entry qualification information in which an entry target is specified, which is received via the telephone line communication part, and an entry communication part for transmitting the fixed-term entry qualification information held by the entry qualification holding part.

Abstract: A method of authorizing use of a computer program only able to be used when an authorized message is received from an authorizing system includes providing an authorization system, making a request to use a computer program, signalling the request to the authorization system, the authorization system recording the use of the computer program and providing the authorization message to the computer program upon receipt of the authorization message the computer program may be used.

Abstract: An information terminal device is provided that may use the input functionality of a touch panel to remove the restriction on the use thereof, for example, release the key lock. The information terminal device (1) is an information terminal device including a display (11) and a touch panel (12), including: a pattern storage memory (43) configured to store a release pattern that is to be entered into the touch panel (12) to remove the restriction on the use of the information terminal device, the release pattern being designated by a user as a graphic pattern; a comparison unit (44) configured to determine whether an entered pattern entered into the touch panel matches the release pattern; and a controller (34) configured to remove the restriction on the use of the information terminal device if the comparison unit (44) determines that the entered pattern matches the release pattern.

Abstract: Methods and devices for controlling system settings of a computing device are described herein. One example embodiment comprises: determining configuration data associated with a software application, wherein the configuration data identifies one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, and wherein the configuration data is digitally signed; and in response to an initiation of the execution of the software application, reconfiguring system settings on the computing device; wherein the reconfiguring comprises verifying at least one digital signature associated with the digitally signed configuration data; wherein if the at least one digital signature associated with the digitally signed configuration data successfully verifies, then the reconfiguring further comprises temporarily enforcing new system settings for the duration of the execution of the software application.

Abstract: A system controls policy distribution with partial evaluation to permit/deny access to protected alternatives. The system includes a database to store access control policy functions for protected alternatives, a guard to guard access to a protected alternative and construct an access control request including attributes regarding the protected alternative, a policy decider to receive the access control request from the guard, a policy distributor connected to the database and policy decider, to collect the static attributes of the protected alternative, and send them to the policy distributor, which constructs a partial access control request from the static attributes, performs partial evaluation against the stored access control policy function, resulting in a simplified access control policy function, and sends the simplified function to the policy decider, to evaluate access control requests regarding the protected alternative, and return a permit or deny response to the guard.

Abstract: An identity management system incorporates privacy management processes that enable the user to exercise privacy controls over the disclosure of user identity information within the context of an authentication process. A combination includes an identity selector, a privacy engine, and a ruleset. The identity selector directs the release of a user identity in the form of a security token to satisfy the requirements dictated by a security policy. Prior to release of the user identity, the engine conducts a privacy enforcement process that examines the privacy policy of the service provider and determines if it is acceptable. The engine evaluates a ruleset against the privacy policy. A preference editor enables the user to construct, in advance, the ruleset, which embodies the user's privacy preferences regarding the disclosure of identity information.

Abstract: A authenticating system and process for authenticating user devices to a access a media service where access to certain portions of the media service may be limited according to a gateway or other device used by a user device to facilitate interfacing a user with the media service. The authentication may be achieved without directly assessing a trustworthiness of the user devices, and optionally, without requiring a user thereof to complete a sign-on operation.

Abstract: In one embodiment, the method performed by mobile equipment to authenticate communication with a network includes generating keys using cellular authentication and voice encryption, and then generating an authentication key based on these keys. The authentication key is used to generate an expected message authentication code used in authenticating the network according to authentication and key agreement security protocol.

Abstract: This disclosure relates to generating whitelists respectively identifying subsets of content from a library of content, maintaining respective associations between tokens and the whitelists, and selectively limiting access only to the subsets of content identified in whitelists based upon one or more tokens included in a request for access to the library of content.

Abstract: Embodiments of the present invention provide verification and/or authentication service engines that provide a customizable solution that can be “dialed” based on the risk level assigned to individual or grouped applications. The systems can also incorporate internal and external sources of data used to verify information provided by the user. It is dynamic and can pull information from a myriad of sources during the verification process, enabling credit reporting agencies (e.g., Equifax and others), FSPs, and other service providers to facilitate real-time approval and access to products and services.

Abstract: Systems and methods for securing a document for transmission are discussed. In one embodiment, a document is checked for an indication of confidentiality. The document is then passed to a secure driver, in response to a finding of the indication of confidentiality. The document is passed to a non-secure driver, in response to a failure to find the indication of confidentiality. The document is then transmitted after processing by the secure driver or the non-secure driver.

Abstract: According to one embodiment, an apparatus may store a plurality of tokens indicating a user is requesting access to a resource over a network. The apparatus may determine a condition associated with accessing the resource based on the plurality of tokens. The condition may be determined in addition to a determination to grant or deny access to the resource. The condition may include an obligation to be fulfilled and a message providing instruction regarding how to fulfill the obligation. The apparatus may generate a decision token representing the condition, and communicate the decision token to a resource provider to facilitate enforcement of the condition.

Abstract: In certain embodiments, detecting scans may include receiving packets, where each packet has a target. The number of distinct targets of the packets may be counted using one or more Bloom counters. The number of distinct targets may satisfy a scan threshold for detecting a scan. If the scan threshold is satisfied, it is determined a scan is present.

Abstract: In a method of temporarily registering a second device with a first device, in which the first device includes a temporary registration mode, the temporary registration mode in the first device is activated, a temporary registration operation in the first device is initiated from the second device, a determination as to whether the second device is authorized to register with the first device is made, and the second device is temporarily registered with the first device in response to a determination that the second device is authorized to register with the first device, in which the temporary registration requires that at least one of the second device and the first device delete information required for the temporary registration following at least one of a determination of a network connection between the first device and the second device and a powering off of at least one of the first device and the second device.

Abstract: According to one embodiment, an electronic apparatus comprises a communication module and a connection control module. The communication module is configured to execute close proximity wireless transfer. The connection control module is configured to start an operation of establishing a connection between the communication module and an external device which is in close proximity to the communication module if an identifier of the external device wirelessly transmitted from the external device is included in a connection permission list. The connection control module is configured to display a password entry screen if the identifier is not included in the connection permission list, and to add, if a password entered on the password entry screen matches with a registered password, the identifier to the connection permission list and start the operation of establishing the connection between the communication module and the external device.

Abstract: Read access logging is performed by tracing data accesses in all domains. The logged data is traced on metadata level with some additions identifying the exposed data records. All data relevant for read access logging is stored at first in a temporary log, which is later processed, structured, and archived.

Abstract: A system and method for providing authentication of a user is disclosed. The use of a non-confidential and unique user identification number and a temporary access code separates authentication of the user from transmission of any user passwords or user-identifiable data, as well as provides a ubiquitous means to authenticate the user with unrelated organizations, without any information passing between those organizations.

Abstract: An entertainment device comprises communication means operable to receive media data from a media data source, storage means operable to store the received media data, in which the storage means limits the duration of access to the media data which was received from the media data source.

Abstract: An authentication system in which a authentication server and a plurality of clients are coupled through a network and configured to process an authentication from a user of a client, is configured to determine as a cache target user another user who is different from the user who requested the authentication; is configured to generate an identifier that indicates the cache target user; and is configured to transmit biometric data of the cache target user and the identifier to the client from which the authentication of the user was requested. A cache availability determiner can determine whether biometric data of any cache target user are available on a client.

Abstract: A system and method for sharing data is provided. A request is received from a mobile device to transfer a set of data to a recipient. The set of data is stored by a server and controlled by a user of the mobile device. The request is authenticated, and the data is encrypted. The set of data is transmitted to a recipient specified by the user via the mobile device.

Abstract: A method and system of synergizing hardware, firmware, software, and useful feature(s) into a trusted, secure, and verifiable operating environment (TSVOE) that is critical for businesses and consumers that rely on information technology products and/or services. Such products provide various capabilities such as protecting the corporate infrastructure from attack, protecting the client from attack, designing a customizable operating schema, advanced validation of client authentication, establishing a clean environment within a dirty environment, etcetera. Moreover, by ensuring that operating environment security is achieved, a product can provide guarantees that modern state-of-the-art systems cannot. Finally, diversification of hardware, software, firmware, and features creates robust products.

Abstract: A system and method that maintains a secure chain of trust from domain name owner to publication by extending the trust placed in existing cryptographic identity systems to the records published in the Internet's Domain Name System (DNS) and secured by its DNS Security Extensions (DNSSEC) infrastructure. Automated validation and processing occur within a secured processing environment to capture and preserve the cryptographic security from the source request.

Abstract: An information processing device includes: a memory having a protected area which is a data recording area in which access restriction is set; and a data processing unit that determines accessibility in response to a request for accessing the protected area from an access requesting device, wherein the data processing unit verifies a device certificate received from the access requesting device and determines accessibility to the protected area based on access control information recorded in the device certificate.

Abstract: An apparatus and a method for validating requests to thwart cross-site attacks is described. A user identifier token, a request identifier token, and a timestamp, are generated at a web application of a server. A Message Authentication Code (MAC) value is formed based on the user identifier token, the request identifier token, and the timestamp using a secret key of the web application. Names of the form elements are enciphered. Fake form elements can also be added to the dynamic form. The entire page also can be enciphered. The dynamic form is sent with the MAC value and the time stamp to a client. A completed form comprising a returned MAC value and a returned timestamp is received from the client. The completed form is validated at the server based on the returned MAC value and the returned timestamp.

Abstract: A method of authorising a user in communication with a workstation is disclosed. According to the method, a system automatically determines a plurality of available user information entry devices in communication with the workstation. The system then determines predetermined user authorization methods each requiring data only from available user information entry devices. The user then selects one of the determined authorization methods for use in user authorization. Optionally, each authorization method is associated with a security level relating to user access to resources. Once the authorization method is selected, the user provides user authorization information in accordance with a determined user authorization method and registration proceeds.

Abstract: In a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, the resource owner detects an occurrence of an event, wherein the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence. The resource owner sends an authorization token to the resource requestor in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

Abstract: The invention relates to a value-added service applied to the broadcasting of video programs or content and more particularly to mobile television (Mobile TV). The invention promotes service continuity during the broadcasting of programs having an undefined duration and the broadcasting of which has been subject to a Pay-Per-View type purchase.

Abstract: One embodiment of the invention is a method utilizing a CAPTCHA to generate a human likeness score including blocks: a) receiving a user solution to the CAPTCHA; b) receiving a user interaction pattern descriptive of an interaction undertaken by the user, through a graphical interface of the CAPTCHA, to achieve the user solution; c) determining the accuracy of the user solution; d) comparing the user interaction pattern against an interaction model generated from interaction patterns of previous users; e) calculating the human likeness score based upon the determination of block c) and the comparison of block d), wherein the human likeness score lies within a continuum of human likeness scores.

Abstract: A method for implementing unified authentication for user logon, the method comprising the steps of: establishing an authentication server; creating a user authentication account number in the authentication server; storing user information which the user uses in a plurality of systems into the authentication server; associating, in the authentication server, the created user authentication account number with the user information which the user uses in the plurality of systems; and providing an authentication flag to the client of the user by the authentication server based on the association between the user authentication account number and the user information which the user uses in the plurality of systems established in the authentication server so that the user can log on the plurality of systems using the authentication flag.

Abstract: Embodiments of the invention are generally directed to apparatuses, methods, and systems for a computing system feature activation mechanism. In an embodiment, a computing system receives a remotely generated feature activation information. The computing system compares the remotely generated feature activation information with a built-in feature activation mechanism. In an embodiment, a feature of the computing system is activated if the remotely generated feature activation information matches the built-in feature activation mechanism. Other embodiments are described and claimed.

Abstract: A method and system for using subscription service content are provided. The method includes: receiving a registration request for using subscription service content transmitted from a user terminal, where the registration request carries an identifier (ID) of the user terminal; determining whether the registered number of the user terminals using the subscription service content registered by a user is greater than the maximum number of the user terminals permitted to use the subscription service content according to the ID of the user terminal, and if not, activating the user terminal according to the ID of the user terminal; and providing authorization for permission of using the service content for the activated user terminal. Through the provided technical solutions, a user is capable of conveniently using the service content at different terminals while unauthorized spread of the service content is avoided during network handover of a user equipment (UE).

Abstract: A system, method and computer program product for a user to verify that a network resource address is trusted. At least one entity registration is stored at a server. Each entity registration comprises an identity of an entity and entity addressing information associated with the identity of the entity. The existence of at least one entity whose identity is included in the at least one entity registration is confirmed. A query comprising a target addressing information is received from a client. If the target addressing information matches the entity addressing information, the identity of the entity associated with the entity addressing information is determined and a result comprising the identity of the entity associated with the entity addressing information matching the target addressing information is transmitted to the client. If no entity addressing information matches the target addressing information, an indication of such is transmitted to the client.

Abstract: A communication system that obtains a key includes: a server that confirms support of Identity Based Encryption (IBE) authentication; the server obtains public parameters and a private key for IBE; and the server receives a PreMasterSecret key encrypted through the IBE, and obtains a plain text of the PreMasterSecret key according to the public parameters and the private key. The system includes a client and a server. The client includes an IBE negotiating module, a public parameter obtaining module, a server identifier obtaining module, and a processing module. The server includes an IBE negotiating module, a public parameter obtaining module, a private key obtaining module, and a processing module. Through combination of the IBE technology and the SSL/TLS technology, the modes of encrypting a PreMasterSecret key in the existing SSL/TLS protocol are diversified, and the use scope of the existing SSL/TLS protocol is extended substantially.

Abstract: A system and method for providing persistence in a secure network access by using a client certificate sent by a client device to maintain the identity of a target. A security handshake is performed with a client device to establish a secure session. A target is determined. A client certificate is associated with the target. During subsequent secure sessions, the client certificate is used to maintain persistent communications between the client and a target. A session ID can be used in combination with the client certificate, by identifying the target based on the session ID or the client certificate, depending on which one is available in a client message.

Abstract: An anti-malware approach uses a storage drive with the capability to lock selected memory areas. Platform assets such as OS objects are stored in the locked areas and thus, unauthorized changes to them may not be made by an anti-malware entity.

Abstract: Embodiments of the present invention provide an MTC device authentication method, an MTC gateway, and a related device, which are used to solve a problem that direct interaction between a large quantity of MTC devices and a network side brings a heavy load to a network when the MTC devices are authenticated in the prior art. The method includes: performing, by an MTC gateway, mutual authentication with a core network node; performing, by the MTC gateway, mutual authentication with an MTC device; reporting, by the MTC gateway, a result of the mutual authentication with the MTC device to the core network node; and providing, by the MTC gateway, a non access stratum link protection key K between the MTC device and the core network node according to a key K1 or a key K2.

Abstract: A method of user authentication on a computing device is proposed, together with computing device on which the method is implemented. In the method a modified base image is overlaid with a modified overlay image on a display and movement of either the modified base image or modified overlay image is responsive to receiving an input starting outside a display area of a touchscreen. Positive authentication is indicated in response to the base image reference point on the modified base image being aligned with the overlay image reference point on the modified overlay image.

Abstract: Systems and methods of authentication according to the invention are provided comprising a user, a service client, a service server, a portable communications device and an authentication server, wherein the method comprises use of one time passwords and out-of-band outbound communication channels. This system gives access to authentication seekers based on OTP out of band outbound authentication mechanism. The authentication seeker or system user scans a multi-dimensional barcode or another like encoding mechanism and validates the client and triggers the out of band outbound mechanism. The portable mobile device invokes the client server to request authentication. The client server authenticates the user based on a shared secret key and the user is automatically traversed to the next page.

Abstract: A method, apparatus and computer program product for providing one-time programs is presented. A program to be converted to a new program having a predetermined lifetime is identified. The program is compiled to produce the new program having a predetermined lifetime and wherein the new program having a predetermined lifetime is guaranteed to only have the predetermined lifetime.

Abstract: Preventing web crawler access includes receiving a request for a webpage that includes web content that should be protected from a web crawler, encrypting the web content to be protected to generate encrypted content and responding to the request, including sending the encrypted content and a decryption instruction. The decryption instruction is configured to allow a web browser to decrypt the encrypted content.