Abstract: In an example of a system and method for time-based local authentication, an Information Handling System (IHS) may include a processor and a memory coupled to the processor. The memory may have program instructions stored thereon that, upon execution, cause the IHS to generate a first time token and to transmit the first time token to a secondary IHS via a local network, where the secondary IHS is configured to generate a second time token and to transmit the second time token to the IHS via the local network. The IHS may receive the second time token from the secondary IHS and it may determine whether the first time token matches the second time token. In response to the first time token matching the second time token, the IHS may receive access to a protected resource.

Abstract: Disclosed is a file security method for reinforcing file security, which includes: by a first communication device, detecting an access to a file stored in a virtual drive; by the first communication device, requesting a decryption key of the file to a second communication device and receiving the decryption key; and by the first communication device, decrypting the access-detected file by using the decryption key.

Abstract: Present invention provides a method, system and application for providing authentication of a mobile device user, based on the measurement of electromagnetic fields modified by a pre-established movement of a specific magnetic token associated to the user. This univocal process will be able to obtain new authentication factors, including something that the user owns (i.e., the token), something that the user knows (i.e., the interaction between the token and the device), and somewhere that the user is (i.e., where the interaction takes place).

Abstract: Methods and apparatus, including computer program products, related to relationship-based authorization. In general, data characterizing a request for authorization to a computer-based resource is received, and the authorization may be provided based on one or more relationships of a requesting principal. A determination may be made as to whether a requesting principal is authorized, which may include determining whether the requesting user has a relationship with a principal that has management rights of the computer-based resource and determining whether the relationship allows for an access, such as a use of the computer-based resource, if the requesting principal has a relationship with the other principal. If there is no such relationship, a determination may be made as to whether an organization of the requesting principal has a relationship with the other principal that allows for the access.

Abstract: Aspects of the embodiments include performing, by a personal computing device, a secure handshake with a secure server accessible through an identity provider to log into the secure server. A temporary identity (TID) token can be received at the personal computing device a from an identity provider system over a telecommunications network. The TID token can be encrypted using a cryptographic key stored in a hardware storage element of the personal computing device. The encrypted TID token can be transmitted to a connected wearable device across a Bluetooth connection or other connection protocol. When a user wishes to log into a network location accessible through the identity provider, the wearable device can provide the encrypted TID token to the computing device. The personal computing device can decrypt the encrypted TID token and use the decrypted TID to access the network location.

Abstract: A transaction authorization apparatus includes a processor in communication with a communications interface. The processor is configured to receive a request for a transaction requested by a user with whom a plurality of user devices are associated, to obtain respective transaction measurements from at least some available devices from among the plurality of user devices, and to confirm approval of the request for the transaction in response to confirmation that the transaction measurements satisfy a multi-device authorization policy associated with the transaction.

Abstract: A method and apparatus that securely obtains services in response to a request for a service while concealing personally identifiable information (PII) includes a software package having a user identification (ID) and network protection module that runs on a third party system and an anonymizer module that runs on a user system. The user system sends the request for the service via an API that invokes the user ID and network protection module to validate the request. In response to receiving validation, the anonymizer module modifies the request for the service to conceal at least part of the PII and sends the modified request to the service provider. In one embodiment, the third party system may be an application program configured to run on the user system. Thus, no PII or data to identify the unique individual is transmitted to the service provider.

Abstract: An identification, authentication and authorization method in a laboratory system is presented. The system comprises at least one laboratory device. The method comprises receiving identification data identifying a user; receiving identity confirmation data to authenticate the user; and generating authentication data upon successful authentication of the user. The authentication data is configured to enable authentication of the user based on only the identification data during a validity time period without repeated receipt of the identity confirmation data. The method further comprises receiving the identification data by an identification unit; validating the authentication data corresponding to the identification data comprising the step of verifying non-expiry of the validity time period; and granting authorization to the user for the laboratory device upon successful validation of the authentication data.

Abstract: A management system includes a reception unit configured to receive identification information for identifying an account, allocated by an authentication apparatus, corresponding to a terminal, the terminal being authenticated by the authentication apparatus, and a management unit configured to determine whether a function provided by the management system can be used by the terminal based on the identification information received by the reception unit.

Abstract: There is provided, in accordance with some embodiments, a method comprising using one or more hardware processors for receiving a behavioral biometric model that characterizes a human user according to pointing device data of the human user, where the pointing device data comprises screen coordinate and time stamp pairs. The method comprises an action of monitoring an input data stream from a pointing device in real time, wherein the input data stream covers two or more spatial regions of a display screen, and an action of segregating the input data stream into one or more subset streams that is restricted to one of the plurality of spatial regions. The method comprises an action of computing a similarity score based on one or more comparisons of the behavioral biometric model and the one or more subset streams, and an action of sending the similarity score to a user authorization system.

Abstract: A system that includes a threat management server configured to store a device log identifying device information for endpoint devices that have passed authentication. The threat management server is configured to identify an endpoint device from the device log file and to identify a switch connected the endpoint device. The threat management server is further configured to send a device information request to the switch requesting device information for the endpoint device. The threat management server is configured to compare the received information to the information in the device log file. The threat management server is configured to block the endpoint device from accessing a communications network in response to determining the received device information does not match the information in the device log file.

Abstract: An unlocking control method is applied in a wearable device and a lockable electronic device. The wearable device communicates with the electronic device and can be bound to it. The wearable device can produce an unlocking setting instruction to set an unlocking mode of the electronic device, and can send the unlocking setting instruction to the bound electronic device. The wearable device can set the unlocking mode of the electronic device and produce an unlocking control instruction, sending the unlocking control instruction to the electronic device. The electronic device receives the unlocking control instruction, and is controlled to unlock itself according to the received unlocking control instruction and the unlocking mode of the electronic device.

Abstract: A Pushlet IM method for pushing a message from a first client device to a second client device includes the steps of: providing a Java-based web service; receiving a message from the first client device, the message including information of a recipient entity; verifying identity of a sender entity who intends to send the message to the recipient entity using the first client device; and creating a thread according to the information of the recipient entity for pushing the message to the second client device that is associated with the recipient entity.

Abstract: Disclosed is a method and apparatus for preventing cross-site request forgery. The recommendation method comprises storing a first environment fingerprint associated with a client, wherein the first environment fingerprint uniquely identifies the client based on local terminal information associated with the client; receiving an access request message from the client, the access request message including at least one operation and a second environment fingerprint generated by the client; determining whether the second environment fingerprint matches the first environmental fingerprint; rejecting the access request message if it is determined that the second environment fingerprint does not match the first environment fingerprint; and executing the operation included with the access request message if it is determined that the second environment fingerprint matches the first environment fingerprint.

Abstract: Methods, systems, and computer readable mediums for utilizing a platform controller device are disclosed. According to one method, the method includes obtaining, by a platform controller device in a computing system cabinet, identification data for each of a plurality of computing system components included in the computing system cabinet. The method further includes acquiring, upon the insertion of a removable memory device into the platform controller device, system configuration profile data that is stored on the removable memory device and includes component configuration data corresponding to each of the plurality of computing system components. The method also includes utilizing the identification data and the component configuration data to configure each of the computing system components in accordance to the system configuration profile data.

Abstract: Techniques for identifying a user and authenticating payment transactions based on the identification include requesting the user to send his audio, video, and/or image from the point of sale location and comparing the received audio, video, and/or image to an audio/video/image on file to identify and authenticate the user as being the official holder of the payment device being used in the transaction. Once the user is authenticated, the payment processing can be performed using conventional techniques. Some techniques involve use of accelerometer data associated with the user in addition to or in lieu of the audio, video, and/or image data to perform the identification and authentication of the user.

Abstract: System-on-chip data security appliance (“SoC-DSA”) and methods of operating the same. In one embodiment, the SoC-DSA includes data security mechanisms enclosed within a protected boundary of a single chip. In some embodiments, isolation and access control features are hidden within an on-chip field-programmable gate array (“FPGA”). The isolation and access control features can be implemented such that they are not visible to or alterable by software executing on the processing cores of the SoC-DSA, which provides for continued data security even in the presence of software exploitation, such as a malicious implant, that otherwise compromises data security in software-only systems. The SoC-DSA can be used to enhance data security in existing data security devices and protocols, such as high assurance guards (“HAG”) and can be used to create new types of security devices, such as devices enforce alternative human data interactions (“HDI”) models.

Abstract: A method for authenticating a user of a user equipment provided with a mobile cellular network card module in a public wireless network. The method includes, during an authentication procedure following an attempt by the user to access the public wireless network with the user equipment for availing of services provided by the public wireless network: retrieving from the mobile cellular network card module a code that uniquely identifies such mobile cellular network card module; retrieving from a database wireless credentials of the user associated with said retrieved code that uniquely identifies such mobile cellular network card module; providing said retrieved wireless credentials of the user to the public wireless network; and granting the user access to the public wireless network conditioned to the correctness of the provided wireless credentials.

Abstract: An approach is provided that enhances computer system security. In the approach, a set of users is authorized to be notified when any of a selected set of activities occurs on the user's account. When the system detects that one of the activities has occurred on the account, a notification is sent to the set of authorized users. The set of users may individually send a responsive security response to protect the user's account. Responsive to receiving the security response from one of the set of users, a security action is performed that is anticipated to protect the user's account.

Abstract: Multi-touch groupings of characters are detected for device authentication and access. In an embodiment, one or more non-character based factors are used in combination with an inputted authentication code (character based) for device authentication and access.

Abstract: An authentication system includes an authentication server, an application having a proxy, and a token store. The token store receives an authentication request and sends the request to the authentication server. The authentication server authenticates the user based on the request. The token store requests an offline token from the authentication server. The authentication server sends the offline token to the token store. The token store generates a key-secret pair and stores the offline token and the key-secret pair in a database. The token store sends the authentication result of the user to the application. The application receives an authentication result and requests a key-secret pair from the token store. The token store sends the key-secret pair to the application. The key-secret pair is used to configure an agent, which adds the key-secret pair to a communication request sent to the application. The application processes the communication request.

Abstract: A system includes one or more memory devices storing instructions, and one or more processors configured to execute the instructions to perform steps of a method providing sensor-based authentication of customers. The system may detect customer biometric data associated with an unknown customer present at a merchant location. The system may determine, based on a known customer identification profile and the detected customer biometric data, a confidence level that the unknown customer is the same individual as the known customer and authenticate the unknown customer based on a determination that the confidence level exceeds a predetermined threshold. The system may transmit identification information associated with the known customer to a financial service provider and receive payment credentials of one or more accounts associated with the known customer and authorization to utilize the one or more accounts to perform a financial transaction.

Abstract: An apparatus includes a tokenizer and a validator. The tokenizer divides a file into first, second, and third portions. The tokenizer also encrypts the first, second, and third portions using a first key to produce first, second, and third tokens. The validator receives a fourth token with a signature of a first user and receives a fifth token with a signature of a second user. The validator also combines the first token, the fourth token, and the fifth token to produce a second key and determines whether the second key matches the first key. If the second key does not match the first key, the validator communicates an alert indicating that the first key does not match the second key. If the second key does match the first key, the validator decrypts first, fourth, and fifth tokens to reproduce the file.

Abstract: A verification system, includes: an arithmetic/logic unit (“ALU”) to perform one or more mathematical operations and compare selected variables; a register to hold a value from a comparison of selected variables performed by the ALU; an instruction decoder to provide read and write commands to memory; an address bus to provide an address to memory for a read or write operation; and a data bus to provide or access data for a write or read operation to or from memory, wherein the ALU generates and provides a recipient identifier to a target computational device, the recipient identifier being related to an identity of the target computational device and/or a target device human operator, and write the recipient identifier to memory in response to a write command issued by the instruction decoder and, as a part of a transaction, the ALU receives, from a user computational device of a first user, the recipient identifier and a credential of the first user and/or user computational device, compares each of the rec

Abstract: In one example in accordance with the present disclosure, a system may comprise a node accessor to access a first node belonging to a plurality of nodes and an interface determiner to determine a hardware interface associated with the first node. The system may comprise a template determiner to determine a template corresponding to the hardware interface, wherein the template contains a predefined identifier associated with the hardware interface. The system may comprise a network handler to identify a network associated with the predefined identifier associated with the hardware interface; and a network associater to associate each node in the plurality of nodes, including the first node, with a network specified in the template.

Abstract: A method or system for determining a required certification level of storage area for storing data of a write request based on a characteristic of the data, selecting a target storage area based on a media certification table and the required determined certification level of the media area and storing data at the target storage area.

Abstract: A security network system may include a security gateway operable to establish a client session between the security gateway and a client device. The security gateway is operable to receive client session information from the client session. The client session information includes an identification of a server with which the client device needs to exchange data. The security network system may also include a Hardware Security Module (HSM) in communication with the security gateway. The HSM is operable to establish, in concert with the security gateway, a secure session between the security gateway and the server based on the client session data, a public key, a secret key, and context attributed to the secure session.

Abstract: Dynamic user interfaces modules are configured to communicate with a web service that provides, through HTTP requests and responses, JavaScript Object Notation objects declaring instances of user interface elements according to a predefined specification. The dynamic user interface modules render the instances in accordance with the JSON objects received from the web service and the properties defined for each user interface element declared thereby.

Abstract: Disclosed are systems and methods for performing entry access over two or more networks. The two or more networks are leveraged to accelerate the entry access and provide redundancy. Performance over each of the two or more networks is tracked in order to allow a mobile device to exchange entry access messaging over the particular network providing fastest start-to-unlock time. The mobile device can alternatively exchange the entry access messaging simultaneously over the two or more networks to create a race condition whereby the fastest start-to-unlock time is obtained without monitoring network performance. Performing the entry access messaging exchange over the two or more networks also ensures reliability in the event a particular network is down or congested, an authorization device on a particular network is down or overloaded, a radio of a mobile device communicating over a particular network is disabled or slow performing.

Abstract: A healthcare prescription delivery mechanism using a money transfer network is disclosed. In the healthcare prescription delivery mechanism, a prescription for a patient from a healthcare provider is sent to a designated pharmacy. The pharmacy then processes the prescription and delivers the prescribed medicine to a chosen address of the patient. A payment for the healthcare prescription order is made by either the patient or a third party through the money transfer network to the pharmacy.

Abstract: A system and/or method is provided to implement authentication via Bluetooth devices. In particular, a user's Bluetooth device, such as a smart phone, may be registered to be used for automatic authentication for an online user account. When the user is attempting to log onto the online user account at a user device, such as a laptop, the user device may detect that the user's Bluetooth device is in proximity to the user device and the user may be logged into the online user account at the user device automatically. Thus, the user may be logged into the online user account seamlessly without requiring the user to input credentials, such as user name and/or password.

Abstract: The present invention relates to a method to protect, in a secured container using an encryption key, a set of mixed sensitive and public data to be transferred to an entity. The method includes the steps of: generating a random key, ciphering the set of mixed sensitive and public data using said random key to obtain a ciphered set of data, generating an initialization value, and defining configuration information for the secured container. The initialization value, the configuration information and random key form a preamble. The preamble and the ciphered set of data are encrypted. The initialization value renders the resulting encrypted data variable from a secured container to another even in case of repetitive configuration information in the preamble.

Abstract: An agent inserts one or more hooks into a sub-execution runtime environment that is configured to include a script and/or targeted to include the script. The agent including the one or more hooks monitors a behavior of the sub-execution runtime environment and/or the script. The agent subsequently obtains context information regarding the sub-execution runtime environment and/or the script so that it can control the runtime of at least the sub-execution runtime environment. Related systems, methods, and articles of manufacture are also disclosed.

Abstract: Systems and methods for user identification and authentication are disclosed. In one embodiment, a method of authenticating a first party to a second party may include the following: (1) receiving, from one of an electronic device of a first party and an electronic device of a second party, a request to generate authenticating indicia; (2) using at least one of a plurality of computer processors, generating the authenticating indicia; (3) transmitting, over a network, the authenticating indicia to the electronic device of a first party and to the electronic device of the second party; (4) receiving, from an electronic device of the second party, an indication that the second party has confirmed that the first party is authentic; and (5) storing an identity of the first party, the second party, and the authenticating indicia in a database.

Abstract: A web application receives a request for a web site's login page. The web application sends, via a domain name, a response including the login page, a first token in a first field in the login page's header, and a second token in a second field in the login page's header, wherein the first field is modifiable only via a related domain name which is related to the domain name, and wherein the first token is a function of the second token. The web application receives a request to login to the site from a client, wherein the request to login includes a header that includes the first field and the second field. The web application establishes a session with the client if the first field in the header includes a token which is the function of a token in the second field in the header.

Abstract: Systems, devices and techniques for establishing a secure file transfer session for secure downloading of configuration files to a Demarcation device are disclosed. Communication is established with a first network device. A password challenge message is received from the first network device. A username is generated. A password is generated using the password challenge message and a locally stored salt key. The username and the password are communicated to a second network device via the first network device, to facilitate establishing a secure file transfer connection with the second network device.

Abstract: A method for authenticating a user seeking access to first and second resources that have different authentication levels. The method includes receiving a primary token that is associated with a first authentication event of the user and authenticates the user to access the first resource, and receiving a first request to access the second resource. The method further includes receiving first credentials of the user. The method further includes, responsive to validating the first credentials, generating a second authentication event, associating the second authentication event with the primary token, and issuing a first secondary token that authenticates the user to access the second resource.

Abstract: This invention provides for data generated by intelligent devices exchanging information about their operation and performance over the so-called “Internet of Things” to be unidentified. Where particulars about an individual associated with a networked device are relevant to the operation and performance of the device, this invention provides for said particulars to be made available in digital certificates bound to the device. Data records generated by the device when operating with a certain individual are digitally signed at the time and later verified using said certificates, thus reliably conveying those particulars with the data. The identity of the individual is decoupled from the device and the data generated by the device.

Abstract: Embodiments of the present application provide a method for controlling access of an application to a network, and a device. The method includes: acquiring application configuration information, where the application configuration information includes identification information of an application that is allowed to access a network or identification information of an application that is prohibited from accessing a network. The method also includes receiving access control information that is sent by an access network device, and determining, according to the application configuration information and the access control information, whether to allow an application of user equipment to access the network.

Abstract: An electronic device, a method of an electronic device authenticating a user and a computer readable recording medium are provided, The electronic device includes a storage configured to store an identifier and attributes of a first object as authentication information, a display configured to display a plurality of authentication objects comprising a second object that has one or more of the attributes of the first object and has a form different from a form of the first object, in response to a request to perform an authentication procedure, and a controller configured to authenticate a user based on an attribute of an authentication object selected by the user from among the plurality of displayed authentication objects and the stored authentication information.

Abstract: A facility for accessing information relating to a person is described. In a reader device, the facility accesses first credentials stored in a first storage device, second credentials stored in a second storage device, and third credentials stored in the reader device. In the reader device, the facility uses a combination of the first credentials, second credentials, and third credentials to decrypt information relating to the person stored in the first storage device.

Abstract: A biometric access-control system is disclosed, wherein the system is compatible with access cards, comprising a biometric reader that converts biometric data to emulate an access card number, wherein only the emulated access card number is stored in a database.

Abstract: This disclosure is directed to securely exchanging information between private domains. Methods and systems of the disclosure perform operations including providing a user identifier (“ID”) and a first session ID to a user of a first private domain. The operations further include receiving from the user a service call for a first analytic service. Additionally, the operations include providing a service message for a second analytic service residing in a second private domain. Moreover, the operations include receiving a first verification message from the second private domain. The operations also include validating the first verification message. The operations further include providing a second verification message. Additionally, the operations include receiving a response message from the second private domain, the response message including information determined by the second analytic service based on job information in the service message.

Abstract: According to one aspect, a system for locating application-specific data that includes a server, a broker, and an agent. An operator may define a command using the server, and this command may be sent to the broker. The broker may then send the command to the agent operating on an end-point system. The agent may then conduct an application-specific data search on the end-point system in respect of the user command. Search results may then be sent to the broker. The broker may then sent the search results to the server.

Abstract: A method of managing authentication during a user session comprises the steps of operating a user session for a specific user, maintaining a user authentication level for the user session, monitoring one or more factors relating to the user's activity, applying one or more rules to the monitored factors, detecting that a rule has indicated the user's current authentication level is too high, and lowering the user's authentication level, without ending the user's session.

Abstract: The application relates to systems, devices and methods for controlling enablement of resources based on a number of tokens in a token store. A resource is enabled when a number of tokens in the token store is greater than a minimum value. The resource is disabled when the number of tokens in the token store is not greater than the minimum value. When used in combination with an authorisation source, such as an authorisation source stored on a server or storage means, the token store provides a grace period during which the resource is enabled, even if the authorisation source is unavailable due to network or hardware failure, or disconnection of the storage means, for example.

Abstract: A method of accessing a physically secured rack includes assigning a task identification by a key computer system, which specifies a task for an administrator of an administration user group for access to the rack, transmitting the task identification from the key computer system to the administrator and an access control unit for the rack, prompting an input of the task identification by the access control unit, verifying the input task identification by the access control unit, prompting input of a personal access identification of the administrators by the access control unit, verifying the input personal access identification of the administrator by the access control unit, and releasing a physical access security system for the access to the administrator to the rack if both preceding verification steps are successful.

Abstract: Devices and methods are described to enable devices to be paired in a convenient and secure way based on proximity with the use of a single radio transmission protocol. Using devices configurable to perform the processes described, users are able to pair Bluetooth enabled devices or other radio communication protocols simply by putting the devices briefly in contact, or within close proximity, usually few centimeters. When the two devices touch or are in close proximity, the encryption key is shared across the two devices without further interaction required by the user. The encryption key is not made visible, so one potential source of security breach is eliminated. After first setup, proximity is not required and the device can communicate securely based on the previously exchanged security tokens (and encryption keys) without the requirement of proximity.

Abstract: An information processing method, a trusted server, and a cloud server. The method includes acquiring user data of a user terminal, extracting summary information of the user data, where the summary information includes privacy information and non-privacy information of a user, generating a unique identifier (UID) for the privacy information, and transmitting the non-privacy information and the UID to a cloud server, so that the cloud server saves a correspondence between the non-privacy information and the UID.

Abstract: A secure fob that enables a user to pay for an item or items without needing to present a mobile device. A secure fob may include a proximity capability to ensure that a mobile device is within a particular range, thereby eliminating the risk of fraudulent charges on a stolen fob. In such an embodiment, a fob may be disabled if the fob is not paired with the mobile device by virtue of being disconnected and/or physically separated from the mobile device. The secure fob also may include enhanced features to authorize transactions and locate the mobile device and/or the secure fob.