Abstract: A system and method for accessing content on an electronic device in an encrypted mode, a decrypted mode or a default mode. A request is transmitted to an application program interface to permit a requesting program to access at least one file. The request specifically identifies whether the requesting program wishes to access the file in an encrypted mode, a decrypted mode or a default mode. It is determined whether the specific form is supported by the application program interface being used by the system, whether the at least one file is protected; and whether the requesting program is permitted to access the at least one file. If the specific form is supported by the application program interface, if the at least one file is protected, and if the requesting program is permitted to access the at least one file, the at least one file is opened in the specific form for use by the requesting program.

Abstract: Systems, methods, and other embodiments associated with flexible supplicant access control are described. One example method includes collecting a network information associated with a network to which an endpoint is to be communicatively coupled. The network information comprises a network identification and information to facilitate the evaluation of network threats. The example method may also include classifying the network based, at least in part, on the network information, to assign a variable level access parameter (VLAP) to the network based on the policy locally configured on the endpoint or centrally managed by the administrator. The VLAP may establish three or more access levels for the network at the endpoint. The example method may also include communicating the network identification and the network VLAP to a second endpoint, a security agent, a security application, and so on.

Abstract: A registration flow to facilitate lending of digital content at an authorized location to an authenticated electronic device.

Abstract: An architecture and techniques to facilitate lending of digital content at an authorized location to an authenticated electronic device.

Abstract: An authentication scheme to facilitate lending of digital content at an authorized location to an authenticated electronic device.

Abstract: At a hosted storage service, a resource and a request to store the resource are received. The request includes a location of an access control service. The access control service is separate from the hosted storage service and controls access permissions for the resource. A request to access the stored resource is received. The hosted storage service accesses metadata stored in association with the resource and determines that access permissions for the resource are controlled by the access control service. An access request is from the hosted storage service to the access control service, the access request identifying the resource and a user of the client system.

Abstract: In general, the subject matter described in this specification can be embodied in methods, systems, and program products for receiving a request to retrieve electronic resources that correspond to a first network address. The resources are retrieved from a cache. The retrieved resources are responsive to the received request, correspond to the first network address, and are configured to activate a first web application. Activation of the first web application requires that the computing device be authenticated. Instructions that are in the retrieved resources and are for activating the first web application are executed. The execution includes determining that the computing device is not authenticated to activate the first web application, and requesting to retrieve electronic resources that correspond to a second network address and that are configured to activate a second web application. Activation of the second web application does not require that the computing device be currently authenticated.

Abstract: Apparatus and methods for protected content access, browsing and transfer over a network. In one embodiment, the network comprises a premises (e.g., residential) LAN, and the apparatus comprises a server and renderer consumer premise equipment (CPE). The renderer CPE scans the network to search for a server CPE that implement a compatible security framework. The renderer authenticates itself with the server, and the server allows content browsing and selection access only to an authorized and authenticated renderer. A negotiation and exchange protocol comprises messages exchanged between the renderer and the server that include one or more of device identification, encryption key exchange, digital certificates and information regarding security package used by each CPE.

Abstract: A method is described for managing rights for digital music, including registering music players, from among a plurality of music players, with digital archives that store songs, from among a plurality of digital archives, wherein songs can be copied from digital archives to music players, and from music players to digital archives, permitting a music player to copy a song from a digital archive for which it is registered, permitting a digital archive to copy a song from a music player that is registered with the digital archive, restricting a music player from copying a song from a digital archive for which it is not registered, and restricting a digital archive from copying a song from a music player that is not registered with the digital archive. A system and a computer-readable storage medium are also described.

Abstract: A computing system selects a portion of data of an unknown work and detects each event in the portion of data of the unknown work. An event is a perceptual occurrence in a work successively positioned in time. The system determines an event metric between each successive event in the portion of data in the unknown work and generates a list of event metrics between the events for the unknown work. The system compares the list of event metrics for the unknown work to a list of event metrics for a known work and determines the unknown work is a copy of the known work responsive to a match between the list of event metrics of the unknown work and the list of event metrics for the known work.

Abstract: A software validity period changing apparatus includes a password information storage unit, an input device, an authentication unit, and a validity period changing unit. The authentication unit calculates a first hash value of the password stored in the password information storage unit, calculates a second hash value of a password input via the input device, and determines whether the first hash value matches the second hash value. The validity period changing unit decompresses an installation package into components, the installation package including a validity period and version information on each of the components, detects a position of the validity period if it is determined that the first hash value matches the second hash value, changes the validity period identified by the position to a validity period input through the input device, changes the version information, and combines the components to reproduce the installation package.

Abstract: Systems and methods are described that relate to authentication and/or binding of multiple devices with varying security profiles. In one aspect, a first device with a higher security profile may vouch for the authenticity of a second device with a lower security profile when the second device requests access for content from a content provider. The vouching process may be implemented by allowing the first device to overlay its digital signature on a registration request that has been signed and transmitted by the second device. The second device with the lower security profile may access content from the content provider or source for a predetermined time period, even when the second device does not access content through the first device.

Abstract: A system, method, and computer program product are provided for redirecting internet relay chat (IRC) traffic identified utilizing a port-independent algorithm and controlling IRC based malware. In use, IRC traffic communicated via a network is identified utilizing a port-independent algorithm. Furthermore, the IRC traffic is redirected to a honeypot.

Abstract: The present invention provides a system and method for identifying and transferring digital media assets within a system through the use of identification data. The identification data is applied to each transferred copy and includes data specific to the customer and digital media asset. To facilitate transfers and ease of use the digital media assets can be made DRM-free.

Abstract: Systems and methods for limiting access to data in a portable data storage device. An exemplary method may use an electronic computing device to prevent access to the data and includes the step of providing the portable storage device with a first software program that has a current expiration time value. The first software program is able to compare the current expiration time value against a time based parameter and activate a security mechanism protecting the data stored in the portable data storage device based on the comparison. The method also includes the step of providing an electronic computing device with a second software program. The second software program is able to identify the portable data storage device and reset the current expiration time value of the first software program to a later time value when the electronic computing device is electronically communicating with the portable data storage device.

Abstract: A method and apparatus for secure generation of a short-term key SK for viewing information content in a Multicast-broadcast-multimedia system are described. A short-term key is generated by a memory module residing in user equipment (UE) only when the source of the information used to generate the short-term key can be validated. A short-term key can be generated by a Broadcast Access Key (BAK) or a derivative of BAK and a changing value with a Message Authentication Code (MAC) appended to the changing value. A short-term key (SK) can also be generated by using a private key and a short-term key (SK) manager with a corresponding public key distributed to the memory module residing in the user equipment (UE), using a digital signature.

Abstract: In a communication system in which two communication entities seek to have a private or confidential communication session, a trust relationship needs first be established. The trust relationship is based on the determination of a shared secret which in turn is generated from contextual information. The contextual information can be derived from the circumstances surrounding the communication session. For example, the contextual information can include topological information, time-based information, and transactional information. The shared secret may be self-generated or received from a third party. In either event, the shared secret may be used as key material for any cryptographic protocol used between the communication entities.

Abstract: A method that includes receiving a first request for video content from a user of a user device; retrieving an identifier for the user device using an application programming interface; sending a second request to receive the video content that includes the identifier; receiving an instruction to provide payment to rent or purchase the video content; sending the payment in response to the instruction; receiving the video content and a token, where the video content is encrypted based on a key and where the token indicates that the payment was processed; sending a third request to obtain a license associated with the video content that includes the token and the identifier; receiving the license, which includes the key and terms under which the video content is to be processed; decrypting the video content, using the key, when the decrypting is performed in a manner permitted by the terms; and playing the decrypted video content.

Abstract: A technique provides wireless communications security. The technique involves providing a mobile wireless communications apparatus (e.g., a smart phone) having DLP circuitry, and configuring the DLP circuitry to perform DLP scanning operations. The technique further involves conducting, after the DLP circuitry is configured to perform the DLP scanning operations, wireless communications sessions (e.g., a mobile phone calls) between the mobile wireless communications apparatus and external devices (e.g., wireless access points) while the DLP circuitry performs the DLP scanning operations. In some arrangements, the DLP circuitry is configured by a user to (i) allow only authorized apps to send sensitive information and/or (ii) block retransmission of the sensitive information (e.g., in the event an application containing spyware attempts to send the sensitive information to an attacker after the user has completed a legitimate transaction).

Abstract: A method for authenticating a computing device or hardware component includes computer-implemented process steps for assigning a unique identifier to the hardware component, generating a baseline fingerprint for the hardware component using algorithm-processing characteristic configuration data determined from the hardware component as input, wherein the baseline fingerprint is capable of being regenerated from the hardware component so long as configuration of the hardware component is not changed, transmitting the identifier in association with the baseline fingerprint for storage in a computer-readable data structure, and generating a data signal, in response to a query comprising the assigned identifier, indicating whether the stored baseline fingerprint for the assigned identifier matches a second fingerprint regenerated from the hardware component at a time after the baseline fingerprint is generated.

Abstract: Systems and methods are described which provide handling and secure routing of an article of content in accordance with a code or instruction set identifier embedded in or associated with the article of content. In one aspect, the invention provides a content handling system that comprises a digital data store containing a plurality of instruction sets, each defining a content handling workflow. The system further includes a content handling engine in communication with the store, wherein the content handling engine identifies a code associated with an article of content and executes workflow processing in accordance with an instruction set associated with the code. In various embodiments, an article of content comprises digitally encoded information (e.g., containing one or more of text, image, audio, video, data, and PACS data) and/or information otherwise convertible to digital format (e.g., printed matter, images, film, and audio recordings).

Abstract: A method and system for anonymizing data to be transmitted to a destination computing device is disclosed. Anonymization strategy for data anonymization is provided. Data to be transmitted is received from a user computer. Selective anonymization of the data is performed, based on the anonymization strategy, using an anonymization module. Accent preservation of data is selected. An accent value for the data is determined. The anonymized data with the determined accent value is transmitted to the destination computing device over a network. In one embodiment, the anonymized data has less number of characters than the input data.

Abstract: According to this disclosure, a user is identified (and selectively granted access to protected resources) by using information that describes the user's interpersonal relationships. This information typically is stored in a datastore, such as a digital address book, an online profile page, or the like. The user's digital address book carries an “acquaintance pattern” that changes dynamically in time. This pattern comprises the information in the user's contact list entries. In this approach, the entropy inherent in this information is distilled into a unique acquaintance digest (or “fingerprint”) by normalizing the contact list data, and then applying a cryptographic function to the result.

Abstract: In one set of embodiments, methods, systems, and apparatus are provided to enable secure local invocation of a web service in response to receiving a request from a first composite application to invoke a web service operation of a second composite application, where the first application is associated with a reference policy, and the second application is associated with a service policy, then determining, based upon the service policy and the reference policy, whether local invocation is secure, and invoking the operation using the local invocation in response to determining that the local invocation is secure. Attributes associated with the reference and service policies can indicate whether those policies can be used in a local invocation, or if user authentication is needed before performing the invocation with those policies. The local invocation may comprise a procedure call in an application server from the first application to the second application.

Abstract: A hijack-protected, secure storage device requires proof that the user has actual physical access to the device before protected commands are executed. Examples of protected commands include attempts to change storage device security credentials of the device, erasure of protected portions of the device, and attempts to format, sanitize, and trim the device. Various techniques for proving the actual physical possession include manipulating a magnet to control a magnetic reed switch located within the device, operating a momentary switch located within the device, altering light reaching a light sensor located within the device (such as by opening or shutting a laptop cover to change ambient light reaching the sensor), and manipulating a radio-transmitting device (such as a cell phone) near the storage device for detection of the manipulation by a compatible radio receiver located within the device.

Abstract: In some embodiments, a filter may filter web graphics library code executing on the graphics processing unit. As a result the web graphics library code may be prevented from accessing memory or other resources that are not allocated specifically for the web graphics library module. Likewise web graphics library code may not access any shared resources that have been explicitly assigned to the process specific web graphics library module.

Abstract: The invention relates to a computer implemented method for generating a pseudonym for a user comprising entering a user-selected secret, storing the user-selected secret in memory, computing a private key by applying an embedding and randomizing function onto the secret, storing the private key in the memory, computing a public key using the private key, the public key and the private key forming an asymmetric cryptographic key, erasing the secret and the private key from the memory, and outputting the public key for providing the pseudonym.

Abstract: Systems and methods are disclosed for preventing tampering of a programmable integrated circuit device. Generally, programmable devices, such as FPGAs, have two stages of operation; a configuration stage and a user mode stage. To prevent tampering and/or reverse engineering of a programmable device, various anti-tampering techniques may be employed during either stage of operation to disable the device and/or erase sensitive information stored on the device once tampering is suspected. One type of tampering involves bombarding the device with a number of false configuration attempts in order to decipher encrypted data. By utilizing a dirty bit and a sticky error counter, the device can keep track of the number of failed configuration attempts that have occurred and initiate anti-tampering operations when tampering is suspected while the device is still in the configuration stage of operation.

Abstract: An video receiving apparatus which reduces waiting time till image is displayed on a monitor include: a plurality of authentication executing units which perform respectively an authentication process to the external devices connected to each of the plurality of input terminals; a terminal selecting unit which selects one of the plurality of input terminals as a video input terminal based on an operation input from outside; an video receiving unit which receives the video information through one of the authentication executing units corresponding to the selected input terminal from the external devices connected through the selected input terminal; and a display control unit which outputs the received video information to a monitor.

Abstract: A method of protecting use of an entity's identity is provided. The method comprises setting a status of the identity to a first state, the first state defining a scope of permitted use of the identity, changing, in advance of an intended use of the identity, the status to a second state defining a scope of permitted use of the identity that is different from the first state, requesting use of the identity after the changing; and returning, after the requesting, the state back to the first state.

Abstract: The present invention relates to data rights management and more particularly to a secured system and methodology and production system and methodology related thereto and to apparatus and methodology for production side systems and are consumer side systems for securely utilizing protected electronic data files of content (protected content), and further relates to controlled distribution, and regulating usage of the respective content on a recipient device (computing system) to be limited strictly to defined permitted uses, in accordance with usage rights (associated with the respective content to control usage of that respective content), on specifically restricted to a specific one particular recipient device (for a plurality of specific particular recipient devices), or usage on some or any authorized recipient device without restriction to any one in specific, to control use of the respective content as an application software program, exporting, modifying, executing as an application program, viewing,

Abstract: A storage device in which file data is divided into multiple blocks for storage on a recording medium is provided. The storage device includes an additional data storing section for storing additional data to be recorded on the recording medium in association with the data to be written, a position determining section for determining recording positions on the recording medium where the blocks should be respectively written, based on the additional data, and a block writing section for writing the respective blocks on the recording positions on the recording medium determined by the recording position determining section. The additional data this defines a gap length between blocks of recorded data. During a read operation, if the gap length does not comport with the additional data, then an error is assumed.

Abstract: A method of access by at least one second user, to at least one service offered by a first user is provided, which includes transmitting by the first user to the second user at least one invitation comprising an access level defined by the first user to allow said at least one second user to access said at least one service; verifying the content of said at least one invitation, delivering to the second user an access authorization to said at least one service, dependent on the access level; and requesting access to said at least one service by the second user, on the basis of the access authorization.

Abstract: A system for securely authenticating software Application Program Interfaces (APIs) includes a handshake protocol that enables promulgation of licensing rights controlling Intellectual Property (IP) to multiple Actors. The Actors include components of a cable system that can include a Conditional Access System, Middleware, a Browser for a Set-Top-Box, a Guide and a Guide Data Provider. The handshake is a Challenge-Response protocol that includes a Challenge issued by one Actor who controls IP rights to verify a second Actor has Licensed IP rights when the second Actor Response includes a Hook IP function IPF1. Other Actors who wish to use software functions F that the first Actor provides will be encouraged to acquire rights to the IP License to obtain the function IPF1 for access. Subsequent Actors who have IP rights controlled by another function IPF2 can be pulled into the same IP Licensing system, or another IP License that becomes part of the same ecosystem with the system controlled using function IPF1.

Abstract: According to one embodiment, a processor accesses a storage module upon a request from a processor module, which selectively switches between a secure mode and a non-secure mode and performs predetermined data processing in each mode. In this case, the access to a protected area of the storage module is permitted only when the processor module is in the secure mode based on a report indicative of an own mode, which is output from the processor module.

Abstract: A computationally-implemented method, for certain example embodiments, may include, but is not limited to: determining that a first user of a computing device is associated with the computing device; and determining a level of authentication associated with the first user via the computing device, the level of authentication at least partially based on a behavioral fingerprint. A level of authentication determination may additionally/alternatively include at least determining a behavioral fingerprint via establishing a statistical predictability of one or more future actions of an authorized user of a computing device. A level of authentication determination may additionally/alternatively include at least determining an authentication level with respect to a computing device at least partially based on a behavioral fingerprint determined from interaction(s) with another device.

Abstract: Embodiments enable recovery of push notification channels via session information associated with user identifiers. A proxy service creates session information describing push notification channels (e.g., subscriptions) for a user and associates the session information with a user identifier. The session information is stored in a cloud service or other storage area separate from the proxy service. After failure of a user computing device or the proxy service, the session information is obtained via the user identifiers and the push notification channels are re-created with the session information. In some embodiments, the proxy service enables delivery of the same notification to multiple computing devices associated with the user identifier.

Abstract: A system and methods for coordinating the operation of a client security module and a host security module on a mobile electronic device. The modules communicate with each other through a platform abstraction layer using application programming interfaces to coordinate their activities. In particular, the client security module instructs the host security module when to lock and unlock the device, and the host security module alerts the client security module to attempts by the user to lock or unlock the device.

Abstract: Techniques for controlling the use of data stored on a media or integrated circuit sample are provided. A sample identifier is created at the point of sample use. The type of sample could range from storage media, such as a Digital Video Disc, or DVD, on which, for example, data representing a motion picture is recorded, to an integrated circuit in which computer code is stored. The sample identifier is stored at a location that is different from where the data is to be employed, and compared with other sample identifiers. The use of the data is controlled based on the results of the comparison.

Abstract: Methods and systems for dynamically bundling portions into secured destination files are provided. Example embodiments provide a Dynamic Digital Rights Bundling System (“DDRBS”), which dynamically bundles a set of portions each variously containing digital rights management components, user interface controls, and content, into a secured destination file in response to a designated content request. In one embodiment, the DDRBS comprises a bundling engine, a translation engine, a merging engine, and an assortment of data repositories. These components cooperate to dynamically assemble and provide customized secured destination files comprising the requested content together with specialized user interface and digital rights management controls. This abstract is provided to comply with rules requiring an abstract, and it is submitted with the intention that it will not be used to interpret or limit the scope or meaning of the claims.

Abstract: A system and method are provided for validating executable program code operating on at least one computing device. Program instructions that include a request for access to sensitive information are executed on a first computing device. An authentication request for access to the electronic information is sent from the first computing device to a second computing device. In response to the authorization request, a challenge is sent from the second computing device to the first computing device. The first computing device executes the challenge and generates an authentication response that includes at least one memory object associated with the program instructions.

Abstract: A mobile IPTV system enables authenticating and off-loading of IPTV operations from a mobile device to an external fixed viewing device. The mobile device performs authentication to an IPTV network to receive decryption key(s) for use in decrypting IPTV content and provides the decryption key to the viewing device. The viewing device uses the decryption key to decrypt and render IPTV content thereon.

Abstract: A data transfer method performed at a proxy server includes intercepting a data request from a client computer that is directed to a target server, encrypting profile information, augmenting the data request by adding the encrypted profile information to the data request, and sending the augmented data request to the target server. A data transfer method that is performed at an information server includes receiving a data request from a proxy server, extracting profile information added to the data request by the proxy server, using the extracted profile information to generate a response, and sending the response to the proxy server.

Abstract: A data transfer method performed at a proxy server includes intercepting a data request from a client computer that is directed to a target server, encrypting profile information, augmenting the data request by adding the encrypted profile information to the data request, and sending the augmented data request to the target server. A data transfer method that is performed at an information server includes receiving a data request from a proxy server, extracting profile information added to the data request by the proxy server, using the extracted profile information to generate a response, and sending the response to the proxy server.

Abstract: The present invention comprises a digital media delivery system with a physical authorization device for downloading media files to a digital media player. The physical authorization device is most preferably an indicia-bearing card, containing at least one of an NFC circuit with the NFC circuit comprising a reusable media authorization code, and/or a Quick Response code with a reusable media authorization code embedded in the QR code, and/or an eye-legible version of the reusable media authorization code. By touching or tapping the indicia-bearing card on the NFC enabled media player, or scanning the QR code, or entering the eye-legible media authorization code from the authorization device into a digital media player, the reusable media authorization code is transmitted to a file server on the Internet via an application on the digital media player and one or more media files will be downloaded to the digital media player or otherwise enabled for accessing on the digital media player.

Abstract: Methods, devices, and systems for managing sensitive data are provided. The management tool may be provided on a user input device, as opposed to being provided in memory or in a peripheral that can be read from a program running on a computing platform. The management tool may be maintained in a read/write isolation mode where no data is transmitted outside of the management tool unless the user input device is disengaged from the computing platform, at which point data may be transmitted from the management tool for ultimate delivery to the computing platform.

Abstract: The present application is directed to methods and systems for redirecting write requests issued by trusted applications to a secure storage. Upon redirecting the write requests, the data included in those requests can be stored in the secure storage area of a client computer. In some embodiments, the methods and systems can include determining whether an application issuing the request is a trusted application that requires data to be stored in a secure storage repository. Upon making this determination, a filter driver can identify a secure storage area on a client computer and can redirect the write request to this secure storage. In other embodiments, the filter driver may deny requests of trusted applications to write to unsecure storage areas.

Abstract: A gateway network device may establish secure connections to a plurality of remote network devices using tunneling protocols to distribute to the remote network devices multimedia content received from one or more content providers. The consumption of the multimedia content may originally be restricted to local network associated with the gateway network device. The secure connections may be set up using L2TP protocol, and the L2TP tunneling connections may be secured using IPSec protocol. Use of multimedia content may be restricted based on DRM policies of the content provider. DRM policies may be implemented using DTCP protocol, which may restrict use of the multimedia content based on roundtrip times and/or IP subnetting. Each content provider may use one or more VLAN identifiers during communication of the multimedia content to the gateway network device, and the gateway network device may associate an additional VLAN identifier with each secure connection.

Abstract: Network devices, such as a router and a downstream multicast distribution device, may use multiple control channels when setting up a multicast stream for a multicast request. For example, first messages may be transmitted using a first protocol to an upstream device over a first channel, the first messages indicating when a first multicast media stream is being requested by at least one of a number of client devices. Second messages may be transmitted using a second protocol over a second channel, the second messages being transmitted on a per-client basis and each identifying a one of the client devices as requesting the first multicast media stream. By using two control channels to convey the multicast channel requests, the router may obtain visibility into the action of the subscriber and can consequently perform per-subscriber operations such as access-control, bandwidth based admission control, statistics, and QoS adjustment for multicast IPTV streams received by the subscriber.

Abstract: According to one embodiment, a content playback apparatus which acquires desired content from a specific site accessed via a network and plays back the acquired content, comprises a determination module configured to determine, when a data input request is received from a currently accessed site, whether or not the site is at least a site included in the specific site, and a controller configured to generate, when the determination module determines that the currently accessed site is not included in the specific site, a warning that advises accordingly.