Abstract: Methods and systems for providing access to content are disclosed. The method is performed at least in part at a client computer system having a processor and memory. The method includes executing a host application associated with a first party. In some implementations, the host application is a media player. The method further includes initiating a secure communication channel between the host application and a server associated with the first party. The method further includes executing a supplemental application associated with a second party. The method further includes accessing, with the supplemental application, content licensed to the first party, wherein the licensed content is accessible to the supplemental application via the secure communication channel subject to terms of a licensing agreement. In some implementations, the content is media content, such as music, movies, and the like.

Abstract: A system for preventing fraud at a service provider's website has a fake credential distributor for creating a set of valid but fake credentials to access such website and distributing such set to a plurality of predefined websites, a fake user database including said set of fake credentials and a monitor for real-time monitoring any user login attempt from any origin network location to the website and comparing the credentials used in such user login attempt with the set of fake credentials in the fake user database. If the credentials used in such a login attempt coincide with any fake credential in the fake user database, such origin network location is added to a tainted connections list; and if there is another login attempt of a user from a network location in said tainted connections list, said user access request is refused even when it is using real credentials.

Abstract: A method and system for securing a user transaction involving a subscriber unit (“SU”) (having a processor, memory, and a display configured to accept user input), a credential information manager (“CIM”) (having a processor and memory), and a transaction service provider (“TSP”) (having a processor and memory). A cyber identifier (“CyberID”), a subscriber identifier (“SubscriberID”), and subscriber information, each associated with the user, is stored in the CIM. A transaction request is sent from the SU to the TSP, which creates a transaction identifier (“TID”), stores it in the TSP memory and transmits it to the SU. The SU transmits an authentication request, the TID, and SubscriberID to the CIM, which authenticates the SubscriberID and verifies the TID to the TSP. The TSP verifies the TID and reports it to the CIM, which transmits the CyberID and subscriber information to the TSP, and transmits a transaction authorization to the SU.

Abstract: Methods and systems for generating anonymous MAC addresses and determining permanent MAC addresses from anonymous MAC addresses are disclosed. Permanent MAC addresses may be associated with a location in a location database. Generating anonymous MAC addresses may protect user privacy and allow manufacturers and users of wireless access points to control their inclusion in location databases.

Abstract: A method of determining whether a response received from an electronic device is generated by a person or by an automated software. The method receives a set of capabilities of the electronic device for detecting a group of actions that include at least a gesture or a device movement. The method selects a set of actions based on the device capabilities. The method sends a request to the electronic device for performing the set of actions in the plurality of actions. The method, based on a result of the set of actions performed on the electronic device, determining whether the set of actions are performed by a human.

Abstract: A system for authenticating a user to a service includes a service, an authentication server and a device. The service includes first signal interface, first processing hardware and first user interface. The authentication server includes second signal interface and second processing hardware. First signal interface transmits a request to the authentication server to authenticate a user. Second processing hardware creates a session identifier and encodes it into a pictogram. Second signal interface transmits the pictogram to the service. The device includes third processing hardware that scans the pictogram and extracts the session identifier, and a third signal interface that transmits the credentials and the session identifier to the authentication server. Second processing hardware verifies the credentials, and second signal interface securely transmits the result of the authentication to the service.

Abstract: Auditing system logs of a remote client device is provided. Login session information entered at a workstation device accessing the remote client device to perform an activity associated with a work request is received. An access token is generated based on the login session information and information associated with the work request on the remote client device. The access token is compared with an audit log report of the remote client device that includes the activity associated with the work request performed by the workstation device on the remote client device. It is determined whether information in the access token matches information in the audit log report of the remote client device. In response to determining that the information in the access token does not match the information in the audit log report of the remote client device, an action alert is sent.

Abstract: A system includes one or more mobile devices and a shared server. Each of the one or more mobile devices is associated with a unique identification tag and configured to send biometric information about anonymous users to a shared server space. The shared server provides the shared server space. The shared server is generally configured to store biometric information about a plurality of anonymous users associated with the unique identification tag of each of the one or more mobile devices. In response to a query about a lost or stolen mobile device, the shared server is enabled to track credentials of anonymous users associated with the unique identification tag of the lost or stolen mobile device.

Abstract: The invention relates to a method and system for authenticating a mobile network node in a Wireless Local Area Network, wherein the mobile network node requests access to the WLAN at an access point. Within a closed first network region, before authentication all network protocol layers up to the Layer 3 protocol layer (L3) are set up. An authenticator based on Extensible Authentication Protocol (EAP) is generated on the Web server as captive portal and the Layer 3 protocol layer between the authenticator and the mobile network node comprising an EAP peer is extended bidirectionally by means of a defined bit sequence. In case of an access request, the Web server transmits an authentication stimulus to the mobile node by encoding an EAP message request and transmitting it in the Layer 3 protocol layer by means of the defined bit sequence.

Abstract: In order to issue a security credential, a client of a system is configured to send a credential request in order to have a credential issuer prepare a security credential. The credential request is received by a credential attribute intermediary connected between the client and the credential issuer. At least one attribute of the requesting client is ascertained by the credential attribute intermediary. The at least one attribute ascertained by the credential attribute intermediary is confirmed to the credential issuer. The security credential is issued by the credential issuer based on the credential request received by the credential attribute intermediary and based on the at least one attribute confirmed by the credential attribute intermediary.

Abstract: One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer.

Abstract: A method is used in validating association of client devices with authenticated clients. An authentication request for authenticating a client is received from a client device used by a client for establishing a session with a server. The client is authenticated by an authentication device. A token is created and provided to the client device. Identification information of the client device is gathered. The identification information identifies the client device. The identification information gathered from the client device is evaluated. Based on the evaluation, it is validated that the identification information corresponds to a client device associated with the authenticated client.

Abstract: A server storing a pool of unassigned access credentials selects an access credential from the pool, assigns it to an individual, identifies a mobile communication device associated with the individual, and pushes the access credential to the mobile communication device over a secure and authenticated channel such that the access credential is receivable by the mobile communication device. If the mobile communication device supports a proximity technology and is proximate to an access node that supports the proximity technology, the mobile communication device employs the proximity technology to present the access credential to the access node.

Abstract: Disclosed are various embodiments for providing managed security credentials to network sites for authentication. Multiple accounts of a user are maintained for multiple network sites. A secured resource of a network site is to be accessed by a computing device. One of the accounts is identified according to a domain name of the network site. The account is associated with a different network site having a different domain name from the domain name. The computing device is automatically authenticated with the network site using a security credential associated with the account.

Abstract: Modular authentication and session management involves the use of discrete modules to perform specific tasks in a networked computing environment. There may be a separate authentication server that verifies the identity of the user and an authorization client that grants various levels of access to users. There may also be an authentication client that receives an initial request from a requesting application and forwards the request to the authentication server to verify the identity of the use. The authorization client may then be invoked to provide the necessary level of access. The use of discrete modules allows multiple business applications to use the same modules to perform user authentication tasks, thus alleviating the unnecessary multiplication of code.

Abstract: Online and on-premise applications identify trusted authentication providers. The applications are configured with a list of trusted issuers of authentication credentials. When an application receives a request requiring authentication, the application returns a 401 response that includes the trusted issuer list. The requesting application compares the trusted issuer list from the 401 response to its own list of authentication providers. If there is a match between the two lists, then the requesting application creates a self-issued token for the authentication provider. The authentication provider uses the self-issued token to generate an authentication token for the requesting application. The requesting application may also directly create a token for a target partner application, without an authentication provider, if there is a direct trust between the two applications.

Abstract: Concepts and technologies are disclosed herein for management of application access. A security management application can be configured to set access controls and/or other security settings relating to application programs. Additionally, or alternatively, particular functions and/or functionality associated with application programs may be individually configured. Settings reflecting the access controls and/or other security settings can be stored and can be applied at the user device. The security management application also can be configured to determine if security settings and/or access controls are to be overridden. Data can be collected from various sensors and/or other sources to use in determining if particular application programs and/or application program functionality is to be allowed. Thus, normally disallowed activities can be allowed in emergency conditions, when in a business location associated with a particular device, and/or at other times and/or under other circumstances.

Abstract: A method and apparatus for providing collaborative claim verification using an identification management (IDM) system. The IDM system collaborates with at least one trusted authority that provides information to a validity database within the IDM system. The database information collected from the at least one trusted authority is used to verify a user's entered identification information i.e., a user's identity claim. Such validation through a plurality of trusted authorities can provide a statistical truth to the identity claims provided by a user.

Abstract: System and methods for access control in a Universal Plug and Play (UPnP) network are based on a user identity. A control point has an identity assertion capability for identifying a user. The control point is configured to declare a value of an attribute associated with the identity assertion capability. A device is communicatively coupled to the control point via the UPnP network. The device has a first access control list and a trusted-to-identify access control list (TIA). The device is configured to permit the user to perform one or more actions based upon whether the user identity appears as a subject in the first access control list.

Abstract: Versioning management provides for efficient and effective handling of varying policy versions, client versions and client platform versions in one system. Software version negotiation provides for simplified, secure policy management in an environment supporting varying versions of the same software product. In conjunction with parameter stripping, which resolves differences among varying minor versions of a software policy, software version negotiation allows for management tools of one version to manage client software, clients and/or client platforms of another version. Policy schema translation, in conjunction with parameter stripping as needed, provides a mechanism for converting policies that normally would be impossible to interpret on varying clients and/or client platforms to policy versions that can be understood by these clients and/or client platforms.

Abstract: A system for security self-assessment for a computer platform. The system comprises a memory, a processor, and an application stored in the memory. When executed by the processor, the application in association with a call to action transmits security self-assessment logic and at least one security self-assessment policy to a computer platform, wherein the security self-assessment policy defines at least one scan tool to be used by the security self-assessment logic when executed on the computer platform to perform a security self-assessment of the computer platform. The system further comprises a plurality of scan tools stored in the memory and accessible for downloading by the computer platform. The security self-assessment logic is configured to cause a processor of the computer platform to download at least one scan tool defined by the security self-assessment policy and to perform a security self-assessment.

Abstract: Method and system are disclosed for limiting use of a service account to only applications that have been authorized. The method and system provide a service account security infrastructure for verifying the identity of an application requesting credentials from a service account and for checking that the application is authorized to use the service account. The infrastructure also allows service account owners and security personnel to manage service accounts, including establishing a secure identity for each application and granting authorization to the application to use a service account.

Abstract: A network security monitoring apparatus and a network security monitoring system manages “permitted” or “not permitted” communication between nodes based on an access policy. A network security monitoring system includes nodes 31,32,33, application server 20, router 40, and network security monitoring apparatus 10 deployed in the network. The network security monitoring apparatus 10 judges whether the nodes are permitted to communicate with other nodes in the network or not based on the access policy, and repeatedly transmits data to block the communication between nodes judged as “not permitted” at fixed time intervals until the access policy is changed from “not permitted” to “permitted”. This invention enables to block communication between nodes defined as “not permitted” for communicating with other nodes in the access policy, and to allow communication between nodes defined as “permitted” for communicating with other nodes in the access policy.

Abstract: The present invention relates to a method of embodying a cooperation system between SEND and IPSec in an IPv6 environment. The cooperation system between SEND and IPSec in accordance with the present invention includes: receiving an authentication completion report message including a first IP address of a host whose authentication is completed by the SEND; generating new authentication information corresponding to the host and storing the new authentication information in a temporary storage area, if authentication information for the host is not present in the temporary storage area, wherein the authentication information includes the first IP address; and if an authentication check request message including a second IP address is received from the IPSec, checking whether the second IP address is present in the temporary storage area, and sending the result of checking to the IPSec.

Abstract: A method includes receiving data related to an individual, the data comprising a plurality of elements of personally-identifying information (PII). The method further includes building, via the plurality of elements of the PII, a compositional key for the individual. In addition, the method includes storing the compositional key and a biometric print for the individual as a biometric record in a biometric repository. The method also includes, via the compositional key, providing a plurality of federated entity (FE) computer systems with access to the biometric repository.

Abstract: A method and apparatus of to negotiate access with a captive network is described. In an exemplary method, a mobile client detects, with a network interface, a network. The mobile client associates with the network, where associating allows the mobile client to communicate with the network. In addition, the mobile client probes the network by requesting a web page, where the web page is independent of the network. In response to the web page request, the mobile client receives a capture web page. The mobile client determines the type of authentication used for the network based on the received capture web page.

Abstract: Security is improved as compared to the security of conventional authentication systems, only by requesting a user to perform operations involving the same number of operations as that of the conventional authentication systems. When login information is registered, an authentication system (1, 1A) accepts registration of a type of a login image that composes an authentication button for initiating user authentication. When displaying an authentication page that is used for user authentication, the authentication system (1, 1A) displays buttons including the authentication button composed of the login image and dummy buttons composed of other images. The authentication system (1, 1A) performs user authentication in a case in which an operation button selected by the user is the authentication button.

Abstract: One or more first servers may receive a token, generated by a second server based on the second server validating an authorization parameter received by a third server; receive, from the second server, a token parameter, associated with the token and being associated with the authorization parameter and identifying a credential associated with the third server; receive, from the third server, a request to update the credential, the request including the token; validate the token; form an updated credential based on the token parameter and based on validating the token; and provide the updated credential to the third server. The credential may be replaced, by the third server, with the updated credential without interaction with a user of the third server.

Abstract: A method and system of independent generation of dynamic password by a client and a server for subsequent verification of the generated password by either the server or the client is provided. The method includes registration of user ID for identification of the client and associating client's related information. Then the client provides one or more static values and one or more variable values for the registered user ID. The server then drives the base value and further the instructions are then applied on the registered ID. Thus generating the random password and further verifying the generated password with the random password and thus authorizing the client.

Abstract: A mobile information handling system (IHS) includes an application (app) that may include a unique-identification tool and a device capability determination tool. The unique-identification tool may generate a signature string that is unique to the mobile IHS. The device capability determination tool may determine the hardware capability of the mobile IHS, the network capability of the mobile IHS and the capability of a network between the mobile IHS and a server IHS, and generate a device determination therefrom. The app may transmit the signature string and the device determination to a server IHS. In response to the signature string and device determination that the server IHS receives, the server IHS may generate and transmit a corresponding response containing specific data to the mobile IHS. The app may output the specific data by displaying the specific data on a display of the mobile IHS.

Abstract: A password audit system is provided for determining the strength of user passwords in a computer system, application or network to which users have access via a user identification and password. The password audit system may include: an interface for establishing a data connection between the password audit system and the computer system, application or network, configured to retrieve cipher text user passwords stored thereon; a central processing unit, configured to successively generate different plain text passwords, encode them into corresponding cipher text passwords, and compare the encoded cipher text passwords to a given one of the retrieved cipher text passwords, until a match is found or a predetermined time has elapsed; and data storage means for storing data relating to the strength of the user passwords, the strength being dependent on the employed method to generate the different plain text passwords and/or the time needed to find a match.

Abstract: The present invention proposes a data storage system and method used for the security information interaction. Said data storage system used for the security information interaction comprises a security information storage device, an unlock password generating device and an unlock server. The data storage system and method used for the security information interaction disclosed in the present invention reduce the potential security risks due to the divulgement of unlock passwords, and reduce the complexity of the unlock process, as well as reduce to the potential security risks existed in the generating and writing process of the unlock password on the whole.

Abstract: An improved authentication method for authenticating user identity for access to a computer service.

Abstract: Data management techniques are provided for handling information resources. A data management process can account for attributes of information resources by analyzing or interpreting the workspace location, source, channel and device associated with an information resource, and effectuating policies, based on the attributes. Rules govern the attribute determination and policies for access restriction to the information resource. The attributes and policies determined are tagged to the information resource and is dynamically updated based on the attributes related to the information resource within different workspaces, such as a corporate workspace and a personal workspace.

Abstract: A method of controlling an apparatus comprising a plurality of features and adapted to receive messages via a first network interface, wherein said method is implemented in a filter superposed on the top of an existing architecture of the apparatus. The method comprises the following steps: receiving network management message via said first network interface; interrogating said message in order to identify a feature said network management message relates to and filtering the received management message such that said management message is rejected if the identified feature is classified as disabled and said management message is allowed top go through if said feature is classified as enabled.

Abstract: Systems, methods, and apparatuses are provided for facilitating authorization of a roaming mobile terminal. A method may include receiving a request for security key related policy information for a user equipment device. The request may be sent by a service providing node on a visited network. The method may further include causing a service authorization information request including a user security settings package to be sent to a policy decisioning server. The method may also include receiving, in response to the service authorization information request, a service authorization information answer including a modified user security settings package including the authorization policy information for the user equipment device. The method may additionally include causing the requested security key related policy information to be sent to the service providing node. Corresponding systems and apparatuses are also provided.

Abstract: This disclosure describes, generally, methods and systems for password management. In one embodiment, a method may include receiving, at a centralized password repository, requests from users. Each request may be configured to request a password to allow access to an associated application. In one embodiment, at least two of the users are at different locations. The method may further include performing a validation analysis for the users' credentials, and in response to verification of a user's credentials, transmitting a response including the password configured to provide access to the associated application.

Abstract: A method and system for generating contexts of targets to estimate a high-order context. The system includes: a detection device including: a sensor for detecting a target; module for extracting the target and a primary context of the target based on data detected by the sensor; and module for encrypting the primary context with a key corresponding to the target; a storage device for recording encrypted primary context from the detection device; and a processing device including: module for receiving the encrypted primary context from the storage device; module for receiving the key corresponding to the target involved in the encrypted primary context; module for decrypting the encrypted primary context using received key; and module for estimating a high-order context using the decrypted primary context; where the processing device further includes a module for requesting the detection device to delete information on a key corresponding to a specific target.

Abstract: Systems and methods for maintaining data security using Luhn validation in a multiple domain computing environment are presented. Each domain includes a token generator that can generate tokens associated with sensitive data such as credit card numbers. The token generation algorithm includes a Luhn validation routine for producing a tokenized data string that either passes or fails Luhn. The possibility of token collision is eliminated by a token generation algorithm that embeds a domain designator corresponding to the active domain where the token was created. When multiple tokens represent the same sensitive data, the token manager returns a set of all such tokens found.

Abstract: A method, system and program for uploading a resource from remote storage to a remote service. The method comprises the steps of connecting to the remote service, initiating an upload of the resource to the remote service, selecting the remote storage as a source of the resource, acquiring the resource from the remote storage, and uploading the resource to the remote service. In one embodiment, at least part of the method is executed by a proxy server and the step of acquiring the resource from the remote storage comprises downloading the resource to the proxy server. In another embodiment, the remote service communicates directly with the remote storage. In this further embodiment, a client device acquires authentication data for the resource from the remote storage and the step of acquiring the resource from the remote storage includes providing the authentication data to the remote storage.

Abstract: Systems and methods for preparing and submitting documents to a regulatory agency in an on-line environment are provided, which are used for the purpose of complying with various securities regulations. The systems generally include a server that hosts a website in which a user may access, prepare, and submit one or more of various standardized reports to the regulatory agency through an on-line portal. The systems further include a database that includes (i) a listing of the standardized reports (and a listing of data fields included within such reports) and (ii) a listing of acceptable data types for each of such data fields. The website is preferably configured to display all of such data fields for a single standardized report within a single graphical user interface of the website.

Abstract: A method and system for protection of and secure access to a computer system or computer network. The method includes the steps of receiving a first login account identifier, such as a user name from a user in communication with the computer system or network. A determination is made if the user is recognized and enrolled from the first login account from the first login account identifier. If the user is recognized, a grid of randomly generated visual images is displayed including one visual image from an image category which has been preselected by the user upon enrollment. An image category identifier is randomly assigned to each visual image in the grid. An image category identifier, second login account identifier, such as a password, is entered and received. If the login account identifier and the image category is validated, access is permitted to the computer system or network.

Abstract: An apparatus and method establish a secure, direct, station-to-station communication between a first station and a second station in a topology (e.g., PBSS) having a central secret holder/provider that allows secure, direct, station-to-station communications and that allows secure station-to-station broadcast communications. The first station and the second station will have previously established a security association (SA) with a topology control point (PCP). The method includes creating pair-wise unique material for the first station. The pair-wise unique material is computed as a function of (i) a known shared secret associated with the PCP, (ii) a first piece of unique data associated with the first station, and (iii) a second piece of unique data associated with the second station. The method includes securely communicating the pair-wise unique material from the first station to the second station.

Abstract: Secure configuration of a mobile application (“app”) includes sending the required configuration data for the app to the user's mobile computing device in a communication, for example an email with an attachment. A verification value is included in the attachment to protect the authenticity and integrity of the configuration data. A challenge code is issued to the user (or group of users). The challenge code is used to verify the configuration data.

Abstract: A method and apparatus are disclosed for using a single credential request (e.g., registered public key or ECQV certificate) to obtain a plurality of credentials in a secure digital communication system having a plurality of trusted certificate authority CA entities and one or more subscriber entities A. In this way, entity A can be provisioned onto multiple PKI networks by leveraging a single registered public key or implicit certificate as a credential request to one or more CA entities to obtain additional credentials, where each additional credential can be used to derive additional public key-private key pairs for the entity A.

Abstract: A method and apparatus for geo-spatial and social relationship analysis are disclosed. In one embodiment, a method of contacting a target member of a community includes obtaining a target location of the target member, obtaining a social path to the target member, determining an association between a node location of at least one node of the social path and the target location of the target member, generating a geo-spatial index that determines a geographic proximity each node is from the target member, and communicating with the target member using the at least one node of the social path based on the geographic proximity between each node and the target member. The method may include establishing a social link with the target member using the at least one node.

Abstract: A method to provide trusted parties an auxiliary access password that allows access to password protected data while allowing the owner of the data to keep the data secure until certain events occur. Two or more Key Elements are created that can be concatenated in any order or in a specified order to become a valid alternative to the primary password. The Key Elements are shared with trusted parties or institutions that are trusted by the User. The Key Element instructions for each of the trusted parties include a specific time, event or occurrence, such as the death or incapacitation of the owner of the data, when the trusted parties should give their Key Elements to a designated trusted party who will concatenate the Key Elements to gain access to the password protected data.

Abstract: A computer-implemented method for implementing multi-factor authentication may include 1) receiving, as part of a secondary authentication system, an authentication request from a client system, 2) redirecting the client system to first perform a first authentication with a primary authentication system in response to receiving the authentication request, 3) receiving an assertion of the first authentication from the client system that demonstrates that the first authentication was successful, and 4) performing a second authentication with the client system in response to receiving the assertion of the first authentication. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Techniques are provided for the controlled scheduling of the authentication of devices in a lossy network, such as a mesh network. An authenticator device that is configured to authenticate devices in a lossy network receives an authentication start message from a particular device to be authenticated. The authenticator device determines a schedule for engaging in an authentication procedure for the particular device based on an indication of current network utilization.

Abstract: A system that incorporates teachings of the present disclosure may include, for example, a non-transitory computer-readable storage medium operating in a mobile device server that has computer instructions to execute a web server application at the mobile device server. The web server application can be operable to detect a media resource center while roaming in a communication zone of the media resource center and to transmit a pairing key to the media resource center responsive to acquiring communication access to the communication zone. The web server application can be further operable to receive from the media resource center an indication that a roaming charge will be applied to a subscriber account associated with the mobile device responsive to the media resource center identifying from the pairing key that the mobile device server is a guest device. Other embodiments are disclosed.