Abstract: Deterring output of data from a computing platform may be accomplished by launching a driver to filter write requests to selected output ports of the computing platform, receiving a write request, and denying the write request when the write request is for a selected output port identified as being in a read-only mode.

Abstract: Various embodiments are disclosed relating to performing a trusted copy and paste operations between a source application and a target application. For example, a trust system may receive a paste request for pasting copied source content, and may compare a source trust level associated with the source content to a target trust level associated with a target application. In this way, for example, harmful or disruptive code may be prevented from being pasted into the target application.

Abstract: An authentication framework is provided which enables dynamic user authentication that combines multiple authentication objects using a shared context and that permits customizable interaction design to suit varying user preferences and transaction/application requirements. For example, an automated technique for user authentication comprises the following steps/operations. First, user input is obtained. At least a portion of the user input is associated with two or more verification objects. Then, the user is verified based on the two or more verification objects in accordance with at least one verification policy operating on a context shared across the two or more verification objects. The user authentication technique of the invention may preferably be implemented in a flexible, distributed architecture comprising at least one client device coupled to at least one verification server.

Abstract: A method for inhibiting phishing can include sending information from a mobile network device to a website server, generating a one time password at the mobile network device from the information, generating a one time password at the website server from the information, sending the one time password generated at the website server to the mobile network device when the mobile network device subsequently accesses the website, and comparing the one time password generated at the website server to the one time password generated at the mobile network device. In this manner, the website can be authenticated such that the occurrence of phishing is substantially mitigated.

Abstract: In one embodiment, a picture signature password system may use a picture signature password to determine access to a computing device or service. A display screen 172 may display a personalized digital image 310. A user input device 160 may receive a user drawing set executed by a user over the personalized digital image 310. A processor 120 may authenticate access to the user session if the user drawing set matches a library drawing set associated with the user.

Abstract: A persona determination approach can be utilized to apply digital personas across multiple communications domains. A service gateway can determine whether to transfer a request for communications services to a Persona Determination Mechanism (PDM). The PDM can select a digital persona based on available information and transmit the digital persona to the service gateway. The service gateway can process the communications services based on the selected digital persona or based on the determination not to transfer the request. In some methods, the service gateway can forward the processed request to one or more network elements for further processing. Related systems are also disclosed.

Abstract: Methods and apparatus to control privileges of mobile device applications are disclosed. A disclosed example method includes assigning a process identifier to an application on a mobile device, the process identifier generated by an operating system of the mobile device, determining via a digital certificate that the application is authorized to be executed on the mobile device and that the application is authorized to access a network interface of the mobile device, configuring a mandatory access control module of the mobile device to enforce access of the network interface by providing the process identifier to the mandatory access control module, and enabling the application to access the network interface.

Abstract: An apparatus and methods are disclosed for performing peer authentication without the assistance of a human “guard.” In accordance with the illustrative embodiments, a peer is selected from a non-empty set of candidates at authentication time based on one or more of the following dynamic properties: the current geo-location of the user to be authenticated; the current geo-locations of the candidates; the current time; the contents of one or more directories (e.g., a telephone directory, an organizational chart or directory, etc.), the contents of one or more call logs; and the candidates' schedules.

Abstract: Methods, computer program products and systems are described for online-content management. Online content from multiple contributors is received at one or more first computers for public online display. An authentication score is determined for a contributor of the multiple contributors. The contributor's name and a representation of the contributor's authentication score is published online for display on one or more second computers in association with the online content received from the contributor.

Abstract: A mechanism for creating secure storage for firmware for a computing device. A designated secure storage area holding firmware that is executable prior to a loading of an operating system for the computing device is created during a build of a ROM image. The creating marks one or more files as requiring encrypted storage and the one or marked files are combined during the build into the designated secure storage area. The designated secure storage area is located outside the ROM image and includes, during the build of the ROM image, a reference to the designated secure storage area in a build of firmware placed in the ROM image. The reference includes a flag indicating a current encrypted status of the designated secure storage area.

Abstract: Methods and apparatus are provided for implementing a system such as a programmable chip system having hardware and software usage limitations and restrictions. Usage limitation circuitry is integrated onto a device. A usage limitation function is integrated into software, such as an operating system for the device. The usage limitation function can be configured to interact with the usage limitation circuitry. The usage limitation circuitry and the usage limitation function are operable to disable the device and the associated software.

Abstract: The described embodiments of invention comprises a method and an apparatus for regulating access to objects by authorized entities. Authorized entities are entities authorized for access by either an owner entity of the regulated object or an entity authorized to authorize access to the regulated object. Each user, which may be a physical person or another information system, is identified using standard user validation techniques. When an object is first created or introduced to the system, that information is associated with an owner, who is one user on the system. The present embodiment allows the owner to define relationships with other users, either generally or regarding a particular object. The owner may or may not have trusted relationships with other users. A second user that has a trusted relationship with the owner automatically has access to the object without additional intervention by the owner. In addition, the second user may have a trusted relationship with another user.

Abstract: The present invention provides a bootstrap system comprising a network system and a mobile handset where the mobile handset can easily receive services of NFC bootstrap application. The handset is effectively authenticated after a bootstrap controller in the network verifies whether a user credential derived in the mobile handset and a user credential separately received from a network server are equal. The application setting is sent to a handset from a bootstrap controller via ad-hoc near field communication (NFC) between the mobile handset and the bootstrap controller. Then the user of the mobile handset can receive various services of the NFC application after the network server delivers the user credential to the service devices with NFC interface.

Abstract: In accordance with embodiments, there are provided mechanisms and methods for authenticating and authorizing an external entity. These mechanisms and methods for authenticating and authorizing an external entity can enable improved data security, more efficient data transfer, improved data access channels, etc.

Abstract: Various embodiments include at least one of systems, methods, software, and data structures to evaluate function calls within a host, such as a scripting or application programming interface (API) host, prior to execution. Such embodiments may determine if a called function is authorized for execution. When the function is not authorized for execution, the function is not executed. Authorized and unauthorized functions may be set in a representation including one or both of authorized and unauthorized function functions. The representation may be stored external to the host so as to be modifiable.

Abstract: A system for selectively enabling a microprocessor-based system is disclosed. State information that describes the operating conditions or circumstances under which a user intends to operate the system is obtained. In the preferred embodiment of the invention, a valid hash value is determined, preferably based on the state information and preferably by locating the valid hash value within a table of valid hash values indexed by the state information. Candidate authorization information is obtained from the user, and a candidate hash value is generated by applying a hashing algorithm to the candidate authorization information, the state information, or a combination of the candidate authorization information and state information. The candidate hash value and the valid hash value are then compared, and the microprocessor-based system is enabled if the candidate hash value matches the valid hash value.

Abstract: Medical devices having restrictive access, and methods thereof are provided.

Abstract: A circuit arrangement and method utilize a process context translation data structure in connection with an on-chip network of a processor chip to implement secure inter-thread communication between hardware threads in the processor chip. The process context translation data structure maps processes to inter-thread communication hardware resources, e.g., the inbox and/or outbox buffers of a NOC processor, such that a user process is only allowed to access the inter-thread communication hardware resources that it has been granted access to, and typically with only certain types of authorized access types. Moreover, a hypervisor or supervisor may manage the process context translation data structure to grant or deny access rights to user processes such that, once those rights are established in the data structure, user processes are permitted to perform inter-thread communications without requiring context switches to a hypervisor or supervisor in order to handle the communications.

Abstract: A browser is requested to display a text file having a description of a screen structure. The state information on a current state of the embedded device is acquired. An access request for requesting the browser to update, with the acquired state information, a value of at least one node in a document object model (DOM) tree generated from the text file by the browser, is submitted by a state display control program. The at least one node is recorded in an access history list. At a subsequent time, it is determined whether to permit a subsequent access request. If the source of the subsequent access request is not the state display control program, and the at least one node is recorded in the access history list, the subsequent access request is denied.

Abstract: An approach is provided for requesting access to content associated with a resource identifier. A system receives a first request to access content associated with a resource identifier. The system then determines to generate a second request for validating the content based, at least in part, on the resource identifier and to transmit the second request to a validation service. The system receives validation information based, at least in part, on the second request. In one embodiment, the validation information includes a preview of the content.

Abstract: Various systems and methods generate access control policies. For example, one method can receive attribute information regarding a computer user. The method can compare the attribute information with access control information and select a value of an access restriction based on a result of the comparing. The access restriction indicates whether a computer resource can be accessed or not. The method then generates an access control policy that includes the value of the access restriction.

Abstract: Authentication systems and methods for increasing the security of online account access and transactions by leveraging the use of customer equipment provided by VoIP service providers. A method includes registering a packet telephony device with a packet telephony service provider for subsequent packet telephony communication, where the registration is based at least on an encoded encryption key. On a subsequent request to access an account, instructions are transmitted which require physical access to the packet telephony device to perform. Upon receipt of an indication that the instructions were successfully performed, the request is authenticated and access to the account is granted. Authentication may require a secure connection be automatically established between a web-enabled device and a packet telephony device. The instant disclosure leverages the security in the customer equipment hardware such as a Terminal adaptor (TA) or router so that a compromised account may be recovered.

Abstract: An embodiment of the invention is directed to a data processing system having a plurality of users, a portion of which were previously assigned permissions respectively corresponding to system resources. The embodiment includes acquiring data from a first data source, containing information pertaining to the portion of users and their permissions, and further includes acquiring data from a second data source, containing information pertaining to attributes of each user of the plurality. A set of permissions is determined for a given role, from both first and second data sources. First and second criteria are determined for assigning users to the given role, from information in the first and second data sources, respectively. A particular user is selected for admission to the given role only if the particular user is in compliance with both the first criterion and second criterion.

Abstract: A method is used in identity assurance. A process is executed that is used to verify a user identity. A description of the executed process is stored and is used to determine a level of trust.

Abstract: Devices, systems and methods are disclosed which authorize applications to access location-determining technologies on user devices and on service provider networks. An A-GPS agent resident on the device acts as an interface between applications requesting access to the user's location from the A-GPS chipset and helps to coordinate connections between the A-GPS chipset and the Assistance Server. Introduced into the network maintained by the service provider is a verification server running an application identification engine which determines if the request for preliminary location information engendered by the requesting application is approved.

Abstract: A method of communicating over a communications system includes determining that a communication event at a user terminal of the communications system requires use of a feature for processing data, the communication event being over the communications system and determining that the feature required by the communication event is not enabled for use at the user terminal when the communication event is initiated. Following the step of determining that the feature is not enabled, the method further includes retrieving a certificate enabling the use of the feature at the user terminal and using the feature at the user terminal to process data of the communication event.

Abstract: Some embodiments provide a system that executes an application. During operation, the system obtains a resource list associated with the application and stores a set of resources including a native code module from the resource list through communications over a network connection, wherein the resources are stored in persistent local storage. The application then loads the application in the web browser and loads the native code module into a secure runtime environment. Next, the application executes the application independently of the network connection using the native code module and the stored resources.

Abstract: Systems and methods for individualized distribution of digital content to purchasers via portable kiosks are described. The systems contain a storage device for storing the digital content and distribution devices for distributing the digital content to a user. The distribution devices can be configured to be portable so that users who are not mobile can access the distribution device. As well, the users can use a receiving device containing unique identification data to receive and access the digital content. Such a system is extremely useful for users who are not mobile and whose use of the distribution devices needs to be controlled, such as detainees in a corrections facility. Other embodiments are described.

Abstract: A location collection system is described herein that provides a uniform facility for reporting location data to a cloud-based service from a variety of devices, and that provides a uniform facility for accessing aggregated location data collected by the cloud-based service. The system collects location information related to a user and reports the location information to a central service to provide a variety of useful services to the user. By providing a big, secure location vault in the cloud, the system enables big data analytics to be used to allow current and future questions to be asked of this data and to correlate this with other data to enable new scenarios not yet enabled. Thus, the location collection system provides a model to report, gather, and analyze location data across devices and users.

Abstract: An authentication system includes a plurality of electronic tags (120, 122, 124) that are each associated with a respective unique identity ID. The tags include a memory (220) with a first memory location (222) for storing a pre-computed challenge and a second memory location (224) for storing a pre-computed response that is associated with the challenge. The first memory location (222) is non-readable from outside the tag. An access circuit (210) only provides the response after having received a challenge that matches the challenge stored in the first memory location. A reader station (110) obtains the identity associated with a tag. It then determines a corresponding challenge and sends the challenge to the tag. It receives a response from the tag and verifies the authenticity of the tag by comparing the received response to a response that corresponds to the challenge.

Abstract: Methods of securely performing online transactions are described which involve two independently controlled web servers. In order to complete a transaction, a user interacts concurrently with each of the two web servers and authentication may occur between the user and each web server and between web servers. Each of the two web servers provide data which is used to complete the transaction and the data provided by the first web server is communicated directly to the second web server for use in the transaction. In an embodiment, the first web server provides a web page which enables a user to specify a variable which is used in the transaction. This is communicated to the second web server which processes the transaction along with an identifier for the message. The identifier may be used in validating the variable before it is used in processing the transaction. Following completion of a transaction this may be reported in real time to the first web server.

Abstract: Apparatus and methods for provisioning of customer premise equipment (CPE) equipped with a secure microprocessor to receive e.g., digital video content by entering unique identification of the CPE at one or more servers located at the headend or other location of a content-based network. In one embodiment, the CPE comprises a download-enabled (e.g., DCAS) host with embedded cable modem and embedded set-top box functionality, and the provisioning includes enabling DOCSIS functionality of the CPE, assigning an IP address to the CPE and providing the CPE with a client image for the conditional access system chosen by the network operator. In one variant, the network operator can deactivate a provisioned device while connected to the network, as well when disconnected from the network. The network operator can also add, delete or replace conditional access client image in a provisioned device.

Abstract: Methods and system for implementing a clustered storage solution are provided. One embodiment is a storage controller that communicatively couples a host system with a storage device. The storage controller comprises an interface and a control unit. The interface is operable to communicate with the storage device. The control unit is operable to identify ownership information for a storage device, and to determine if the storage controller is authorized to access the storage device based on the ownership information. The storage controller is operable to indicate the existence of the storage device to the host system if the storage controller is authorized, and operable to hide the existence of the storage device from the host system if the storage controller is not authorized.

Abstract: Methods and apparatuses for handling an invitation to a multi-device networked-application session are disclosed. In one such method, a client device receives a pushed invitation notification from an invitation server. The pushed invitation notification indicates that an inviter user has invited an invitee user to join a multi-device session of a networked application, but the pushed invitation notification omits an invitation payload to enable the invitee user to join the multi-device session. The client device notifies the user of the client device, and the user indicates to accept the invitation. The client device responds to the invitation server, authenticates the user, and receives from the invitation server an invitation payload, according to which the client device attempts to join the multi-device session.

Abstract: Embodiments for providing differentiated access based on authentication input attributes are disclosed. In accordance with one embodiment, a method includes receiving an authentication input at an authentication authority using an authentication protocol. The authentication input being associated with a client. The method also includes providing one or more representations for the authentication input, wherein each of the representations represents an attribute of the authentication input.

Abstract: An apparatus for providing a secure predefined boot sequence may include a processor. The processor may be configured to verify a predefined boot sequence certificate that defines a boot sequence for a device, verify one or more software elements referenced by the predefined boot sequence certificate, and execute one or more software elements that have been verified in the sequence defined by the predefined boot sequence certificate. Corresponding methods, systems, and computer program products are also provided.

Abstract: When setting up communication from a user equipment UE (1), such as for providing IP access for the UE in order to allow it to use some service, information or an indication or at least one network properly relating to a first network, e.g. the current access network (3, 3?), is sent to the UE from a node (13) in a sue and network such as the home network (5) of the subscriber ask UE. The information or indication can be sent in a first stage of an authentication procedure being part of the setting up of a connection from the UE. In particular, the network property can indicate whether the access network (3, 3?) is trusted or not.

Abstract: To prevent gaming of a reputation system, a security token is generated for a security module using metadata about the client observed during the registration of the security module. The registration server selects metadata for use in generating the security token. The generated security token is provided to identify the client in later transactions. A security server may conduct a transaction with the client and observe metadata about the client during the transaction. The security server also extracts metadata from the security token. The security server correlates the observed metadata during the transaction with the extracted metadata from the security token. Based on the result of the correlation, a security policy is applied. As a result, the metadata in the security token enables stateless verification of the client.

Abstract: The present invention provides a method and system of receiving data in a data store in a server computer system. In an exemplary embodiment, the method and system include (1) receiving client authentication information of a client computer system, (2) receiving a data signature of the data from the client computer system, and (3) attempting to locate in the data store at least one data chunk with a stored data signature equal to the received data signature.

Abstract: An apparatus providing for a secure execution environment. The apparatus includes a microprocessor and a secure non-volatile memory. The microprocessor is configured to execute non-secure application programs and a secure application program, where the non-secure application programs are accessed from a system memory via a system bus. The secure non-volatile memory is coupled to the microprocessor via a private bus. The secure non-volatile memory is configured to store the secure application program, where transactions over the private bus between the microprocessor and the secure non-volatile memory are isolated from the system bus and corresponding system bus resources within the microprocessor.

Abstract: A computer implemented method for logging extensions to platform configuration registers inside a trusted platform module instance is provided. A request to extend the current state of at least one of a plurality of platform configuration register is received. At least one platform configuration register within the trusted platform module instance is extended. The extension of the at least one platform configuration register is logged inside the trusted platform module instance as a logged entry by storing at least a tuple of platform configuration register indexes and hash values used for extending the platform configuration register. Information about new entries in the consolidated logs can be retrieved by polling or by subscribing to events that are automatically generated. A report of an extend operation and its logged hash value is sent to subscribers interested in receiving notifications of extend operations on a set of PCR registers.

Abstract: A system and method which may allow users to interact with Internet servers with graphical mouse movements. The invention is especially useful to enhance online transaction security. A user may use a mouse to draw a pattern and store the pattern as his password to an online account, and draw the pattern with a mouse to log in the online account. The password may include a drawing, one or more letters, one or more numbers, or one or more characters. In an embodiment, a computer program product may include a computer-readable medium having instructions which, when performed by a computer, perform a user authentication method. The user authentication method may include receiving at an Internet server a username; receiving at the Internet server a password which is drawn with graphical movements of a graphical drawing input device; determining whether the password drawn matches a password previously stored with the username; and authenticating a user accordingly.

Abstract: A license management server connected to an MFP includes an activating unit that, upon receiving an application activation request from the MFP, accesses a license management DB, and, when the number of licenses associated with a product key of the application in the license management DB is one or greater, grants a license for the application to the MFP and cancels the license for the application granted to the MFP upon receiving a deactivation request, and a license managing unit 315 that decrements the number of licenses by one when the license for the application has been granted to the MFP and increments the number of licenses by one when the license for the application granted to the MFP has been canceled.

Abstract: A mobile device for the display of messages includes a message viewer application for displaying segments of the message received from a server. The message can include content that is encoded in a first encoding that is renderable for display on the device, and the same content encoded in a second encoding. On determination that the received portion of the message includes a first part comprising content encoded in a first encoding and is renderable for display, first displayable portion of the message content, the server is signalled to halt forwarding further segments of the message.

Abstract: Various embodiments described herein relate to apparatus for executing software in a secure computing environment. A secure processor can be used and configured to request a context swap from a first context to a second context when switching execution from a first portion of software to a second portion of software. A context manager, which can be in communication with the secure processor, can be configured to receive and initiate a requested context swap. A trust vector verifier, which can be in communication with the secure processor and the context manager, can be configured to load a trust vector descriptor upon command from a context manager.

Abstract: A system and method for program access control includes, for a typestate, providing typestate properties and assigning a role to the typestate in a program in accordance with the typestate properties. Access to operations is limited for the typestate in the program based on the role assigned to the typestate and an access permission level.

Abstract: Methods and apparatus to control privileges of mobile device applications are disclosed. A disclosed example method includes assigning a process identifier to an application on a mobile device, the process identifier generated by an operating system of the mobile device, determining via a digital certificate that the application is authorized to be executed on the mobile device and that the application is authorized to access a network interface of the mobile device, configuring a mandatory access control module of the mobile device to enforce access of the network interface by providing the process identifier to the mandatory access control module, and enabling the application to access the network interface.

Abstract: A biometric authentication device performs authentication of a user based on biometric information. In the biometric authentication device, a registry information storage stores pre-registered biometric information as registry information. An acceptance value determiner determines a verification acceptance value used for authentication, based on quality of the registry information with regard to reliability of characterizing an individual. An authentication information acquirer obtains biometric information of a user as authentication information. A similarity calculator compares the authentication information of the user with the registry information and calculates similarity between the authentication information and the registry information. An authenticator identifies whether the user is a registrant corresponding to the registry information, based on the similarity and the verification acceptance value.

Abstract: Methods and structure are provided for implementing security features in SCSI Enclosure Services (SES) systems. The system comprises an SES device server, which includes a frontend interface, control unit, and backend interface. The frontend interface is operable to receive SES commands generated by Small Computer System Interface (SCSI) devices, and the backend interface is operable to manage operations of at least one peripheral device communicatively coupled with the SES device server based on received SES commands. The control unit is operable to determine whether a SCSI initiator that generated an SES command is an authorized device. The control unit is further operable to perform the SES command in response to determining that the SCSI initiator is an authorized device, and is further operable to reject the SES command in response to determining that the SCSI initiator is not an authorized device.

Abstract: A presentation system including a computing device, a display device coupled to the computing device and an image capture device that obtains an image containing facial images of at least two individuals capable of viewing the display device, the at least two individuals including a primary user and at least one secondary user, is provided. The system also includes a recognition apparatus operably coupled to the computing device and including a permission engine, the permission engine applying a policy to a protected information element displayed on the display screen, the policy causing one or more actions to be taken based on the identify of the primary and one or more of the secondary users.