Abstract: A method is disclosed for determining the authentication capabilities of a supplicant before initiating an authentication conversation with a client, for example, using Extensible Authentication Protocol (EAP). In one aspect, the method provides for sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by an authentication server; receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant; determining how many second authentication methods in the counter-list match the first authentication methods; and performing an authentication policy action based on how many of the second authentication methods match the first authentication methods. Policy actions can include blocking access, re-directing to sources of acceptable authentication methods, granting one of several levels of network access, etc.

Abstract: A method may include detecting initiation of a power-management mode that suspends the functionality of at least one component of a computing device while maintaining the functionality of the device's memory. The method may also include, before the device enters the power-management mode, (1) identifying, within the device's memory, an encryption key that is required to access encrypted data stored in the device's storage device, and (2) removing the encryption key from the device's memory in order to protect against unauthorized access of the encrypted data during implementation of the power-management mode. The method may also include, upon detecting discontinuation of the power-management mode, (1) obtaining user credentials from a user of the device in order to authenticate the user and, upon successfully authenticating the user, (2) using the user credentials to regenerate the encryption key in order to enable access to the encrypted data stored in the storage device.

Abstract: System and method for storing identity mapping information in an identity management system to enable a user authenticated at a first domain to access a second domain. The method may include digitally signing the identity mapping information by the user; providing the mapping information to an identity management system; and storing the user-signed mapping information after being further digitally signed by the identity management system.

Abstract: In an example implementation, a data structure comports with a secure application instruction protocol. The data structure includes a first application-level request and a second application-level request. The first application-level request has application-specific instructions from a requestor and a requestor signature over the application-specific instructions from the requestor. The second application-level request has application-specific instructions from an intermediary and an intermediary signature over at least the application-specific instructions from the intermediary.

Abstract: Techniques for mitigating forgotten password attacks are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for mitigating forgotten password attacks comprising receiving an indication of a forgotten password communication for a user, identifying verification information associated with the forgotten password communication, determining a level of difficulty of inferring the verification information based on public information associated with the user, and calculating a level of risk associated with the verification information.

Abstract: Assertions for elevated privilege associated with transparent code may be ignored, prohibited, or modified.

Abstract: A data packet generator periodically generates a data packet including a passcode comprising a plurality of characters. The data packet is sent to a server or a computing device for validation. If validated, the data packet is used, for example, to identify the location of a user or device. Additional systems and methods involving such a data packet generator are also disclosed.

Abstract: A network access control system includes an information device that has access to a relay device which relays communication in a communication network, by the use of access information, and performs communication via the relay device, and a management unit that finds information devices, wherein when the found information device has no access to the relay device and is a second information device which is allowed to have access to the relay device by a first information device, the management unit transmits the access information to the second information device without a request for authentication.

Abstract: An improved adaptive authentication technique involves defining a window array which stores the number of distinct fact values per time unit over a predetermined number of time units. Each element of the window array has a value set to the number of distinct fact values over a time unit. The window array is stored in a database. Under the improved technique, upon a user initiating an authorization request, the risk engine extracts the request and the window array from the database into a cache on the authorization server. The risk engine uses the request which contains a value of the fact to adjust values of the elements of the window array and, once the adjusting is completed, computing the fact velocity which is used in the determination of a risk score for the request.

Abstract: A multifunction apparatus 21 of the present invention communicates with an information processing apparatus 51 via a communication network 50. The multifunction apparatus 21 includes an apparatus control section 7, a second web server section 8, and a web browser section 5 which communicates with a first web server section 53 or the second web server section 8. The apparatus control section 7 transmits login information entered by a user to an authentication server 91. The web browser section 5 (i) accepts, from the first web server section 53, control information for informing the second web server section 8 of a control instruction to obtain user related information from the authentication server 91 and (ii) carries out an informing process in which the second web server section 8 is informed of the control instruction. The apparatus control section 7 obtains the user related information from the authentication server 91 in accordance with the control instruction received by the second web server section 8.

Abstract: A method of identity authentication and fraudulent phone call verification uses an identification code of a communication device and a dynamic password. The “dynamic password” is directly sent to an Internet user via a dynamic web-page of a specific website instead of by means of a traditional telephone short message. Thus, the “dynamic password” cannot be copied from the spyware infected communication device of the Internet user. Furthermore, even if the “dynamic password” is intercepted or otherwise discovered by a hacker or intruder, authentication is still secure because the dynamic password must be sent back to the specific website via a short message or the like from the same communication device having the corresponding identification code that was initially input by the Internet user in order to generate the dynamic password.

Abstract: In one embodiment, a method includes receiving from a credential a credential-owner authentication information associated with an identity of an individual. A issuer validation information associated with an issuer of the credential is also received. The method also includes providing a plurality of options, including a first option associated with a first domain and a second option associated with a second domain mutually exclusive from the first domain. The method also includes sending to a portion of the first domain the credential-owner authentication information and the issuer validation information in response to the first option being selected.

Abstract: In a pull printing system, it is possible to perform an alternate print with appropriate security and in consideration of loads on a server while securing convenience of the user requesting a third party for the alternate print. An image processing apparatus in the pull printing system comprises a user authentication unit configured to confirm authority of an alternate process to a first user during login, a bibliographic information managing unit configured to acquire bibliographic information of print data stored in a storage server by a second user from a bibliographic information server for displaying the print data corresponding to the second user and a log information managing unit configured to acquire a log of an operation of the alternate process executed by the first user to the print data corresponding to the second user.

Abstract: At least one embodiment of the present invention relates to a method for ensuring authenticity of an electronic transaction performed during a transaction session. The method includes receiving, over a first network, a request from a user for the completion of an electronic transaction; receiving, over the first network, an authentication code from the user which has been provided to the user over a second network separated from the first network, thereby authenticating the user, completing the electronic transaction; and storing information associated with the electronic transaction and the transaction session. The method further includes generating a one-way hash value based on information comprised in the electronic transaction and information associated with the transaction session, and providing the one-way hash value to the user, wherein the one-way hash value is usable for ensuring the authenticity of the electronic transaction.

Abstract: An information processing device includes: a local memory unit for storing data including an encrypted content; a memory for storing data including key information used to reproduce the encrypted content; and a data processing unit performing a process of writing data to the local memory unit and the memory, and a process of reproducing the encrypted content, wherein the data processing unit performs a process of writing encrypted content downloaded from a server or encrypted content copied from a medium to the local memory unit, and performs a process of decoding the encrypted content or a validity authenticating process using the data stored in the local memory unit and the data stored in the memory when reproducing the encrypted content written to the local memory unit.

Abstract: Computer-readable media, systems, and methods for encrypting communications between a client and an online service provider to ensure the communications are secure. In embodiments an authentication request is received from a user agent associated with the client and the authentication request includes identification information and authentication information. Additionally, it is determined that the identification and authentication information are associated with a user. An authentication ticket is created that includes a user identification and an authentication and indicates to the online service provider that the user is authenticated to access one or more services. Further, a session key is generated and an encrypted session key is embedded into the authentication ticket. The session key is encrypted and the private key is known only to the online service provider and the public key is known at least by an authentication server.

Abstract: A method and apparatus are disclosed in a data processing system for establishing virtual endorsement credentials. The data processing system includes a hardware trusted platform module (TPM). Logical partitions are generated in the system. A different virtual TPM is generated for each one of the logical partitions. For each one of the logical partitions, the virtual TPM that was generated for the logical partition then dynamically generates a virtual endorsement key, which is stored only within a corresponding virtual TPM. Using the virtual endorsement key, each virtual TPM also generates a virtual endorsement credential for use by the logical partition that includes the virtual TPM. The virtual endorsement credential is generated within the data processing system without the data processing system or its devices accessing a trusted third party that is external to the data processing system.

Abstract: There is provided a device for protecting a digital content. The device includes a digital content processing section that causes a digital content to be protected using security information; and an encrypting section that encrypts the security information, using a key acquired from a Digital Right Management system of an electronic ticket system.

Abstract: A computer implemented method and system for generating and managing multiple passwords associated with multiple online accounts is provided. The computer implemented method and system provides a password management platform accessible by a computing device via a network. The password management platform acquires information on the online accounts and user passwords associated with the online accounts via a graphical user interface (GUI) provided by the password management platform. The password management platform generates one or more unique secure random passwords to replace the user passwords for each of the online accounts on receiving an indication via the GUI. The password management platform stores the generated unique secure random passwords associated with each of the online accounts for managing access to each of the online accounts.

Abstract: Systems ands methods for managing service account security are described. The apparatus may include a security record data store that contains information regarding a plurality of service records, a retrieval module coupled to the security record data store to retrieve security record information and a user interface module to convey the security record information to one or more users. The method may include retrieving information regarding one or more security records, conveying the information to the user and updating the information if the user indicates a change in the information.

Abstract: Methods and apparatus for providing a single-sign-on service are disclosed. An example method includes receiving, at a computing device, a username and a password. The example method further includes providing the username and the password to a cloud-based credential server. The example method also includes receiving, from the cloud-based credential server, authentication information corresponding with the username and the password. The example method still further includes granting or denying access to the computing device and one or more cloud-based services based on the authentication information.

Abstract: In an information management system, policies are deployed to targets and targets can evaluate the policies whether they are connected or disconnected to the system. The policies may be transferred to the target, which may be a device or user. Relevant policies may be transferred while not relevant policies are not. The policies may have policy abstractions.

Abstract: Methods, devices, and systems are provided for optimizing the dissemination of information in various types of systems such as an access control system. More specifically, there are provided various mechanisms to increase the efficiency with which system updates and other types of information are spread throughout an access control system having at least one non-networked reader.

Abstract: In a gaming environment, a method of periodically downloading dynamically generated executable modules at random intervals that perform system configuration integrity checks in a secure and verifiable manner is disclosed. The dynamically generated executable module returns the signature to a server from which it was downloaded and deletes itself from the system being checked. The next time such an executable module is downloaded, it will contain a different randomly chosen subset of hashing and encryption algorithms. The server that is performing the system configuration integrity check maintains a database of expected system configurations and performs subset of hashing and encryption algorithms as contained in the dynamically generated executable module. The result returned by the downloaded executable module is compared to that computed locally, and an error condition is raised if they do not match.

Abstract: A system is illustrated as including a One-Time Password (OTP) device operatively coupled to a computer system to receive data, and a server operatively coupled to the computer system via a network connection. A method is illustrated as including initiating a transmission control protocol (TCP) and internet protocol (IP) connection, requesting a current time, receiving the current time, and updating a clock to reflect the current time. An apparatus including one or more processors to generate two or more clock values, pass these two or more clock values through a hashing function to generate two or more One Time Password (OTP) tokens, display these two or more OTP tokens on a screen, transmit data through a Universal Serial Bus (USB), and receive data through a Universal Serial Bus (USB).

Abstract: A device for use in a system with multiple receiving units, and multiple intermediate units each configured to communicate with the device and at least some of the multiple receiving units, includes a communication module configured to send information toward and receive information from the receiving units and the intermediate units, a memory, and a processor coupled to the memory and the communication module.

Abstract: A method for online authentication includes receiving membership authenticating information specific to members of a particular affiliation from the members and from one or more remote databases. The information is aggregated and stored in an aggregate database. An individual is authenticated, via a widget at least one of integrated into, and accessible by, at least one of a mobile application and a website of a provider of at least one of a particular program and a particular service, as a member of the particular affiliation based on a comparison of authenticating indicia provided online by the individual and the information stored in at least one of the aggregate database and the remote databases. Digital credentials are provided to the individual for access to the at least one of the particular program and the particular service when the individual is authenticated. The credentials include a unique identifier, a login and password.

Abstract: The creation of multiple personae in mobile devices. Access to personae is controlled based on the persona that is currently active. The creation or existence of different personae helps prevent data leakage or loss, in that any or all of the following characteristics, by way of example, may be manifested: business data and applications are firewalled from applications or other items associated with personal use; connectivity of the device is controlled; resources (such cameras, GPS, other sensors, etc.) on the device are controlled; data are protected even if removable storage or the device itself are lost.

Abstract: When transmitting position/time information calculated by means of a GPS function to a server apparatus, authentication is carried out with the server apparatus. The position/time information may be certified as legitimate measured by a portable apparatus with a GPS reception function employed by a user. When transmitting information related to the position and the time acquired from a portable phone terminal having the GPS function and a network function by means of the GPS function to the server apparatus, authentication is carried out between the portable phone terminal and the server apparatus. The position/time information is transmitted to the server apparatus, only if the server apparatus is authenticated as a legitimate counterpart for connection. A secret key holding section is provided for holding different secret keys for different apparatuses.

Abstract: One disclosed aspect of the present invention includes authentication and user account automation within a compute cluster for each cluster node that requires password or other credential administration. For example, a storage appliance computing system may rely on a plurality of subsystems (such as databases, storage management software, and application servers) that each have internal user accounts with associated passwords and credential keys that need to be changed at frequent intervals. Rather than requiring an administrator to manually manage all of these accounts, the presently described invention includes techniques and an authentication manager component to automatically manage, update, and refresh authentication information as required. Further, the authentication manager component may be used to perform and propagate automatic credential changes such as new sets of SSH keys or updated passwords as required within a computing system, and respond to new nodes or out-of-sync credentialing scenarios.

Abstract: A method, an apparatus and a system for authorization-dependent access to multimedia contents. A first terminal produces a first request for a multimedia content for an output of the multimedia content via the first terminal. A first authorization information item is used to check that the output of the multimedia content is authorized. The first terminal produces a second request for an output of the multimedia content via a second terminal. A check is carried out to determine whether to output a first security note via the first terminal. The output of the multimedia content takes place via the second terminal if the first security note is not to be output, or an input of a confirming acknowledgement for the first security note is identified by the first terminal.

Abstract: A method of establishing keys for at least partially securing media plane data exchanged between first and second end users via respective first and second media plane network nodes. The method comprises sending session set-up signalling from said first end point towards said second end point, said session set-up signalling including a session key generated by said first end point. The set-up signalling is intercepted at a first signalling plane network node and a determination made as to whether or not a signalling plane key has already been established for securing the signalling plane between said first end point and said first signalling plane network node. If a signalling plane key has already been established, then a media plane key is derived from that signalling plane key, and the media plane key sent to said first media plane network node for securing the media plane between said first end user and said first media plane network node.

Abstract: In accordance with embodiments of the present disclosure, systems and methods for facilitating network transactions include user authentication over a network by providing strong mutual authentication of client web application to server side application server, providing session encryption key negotiation after authentication to continue encryption during communication, and providing a high-level encryption technique referred to as an effective zero knowledge proof of identity (eZKPI) algorithm. In various implementations, the eZKPI algorithm is adapted to couple something the user Knows (e.g., a password or personal identification number) with something the user Has (e.g., a secure identification card) to create a stronger identity authentication proof for access to a mobile device and applications running on the mobile device.

Abstract: A novel system for utilizing an authorization token to separate authentication and authorization services. The system authenticates a client to an authenticating server; generates an authorization token with the authenticating server and the client; and authorizes services for the client using the generated authorization token.

Abstract: An information processing apparatus includes: an acquiring unit that acquires specific information; a preparation unit that makes out a certificate signing request based on the specific information, wherein the preparation unit makes out a first type certificate signing request including extensions and makes out a second type certificate signing request not including extensions; a display control unit that displays a selection screen on a display unit; and an output unit that is configured to output one of the first type certificate signing request and the second type certificate signing request to an outside according to selecting by a user in the selection screen.

Abstract: There is provided an identifier authentication system in which information requesting users can share all predetermined information held in a plurality of information providing servers. In the identifier authentication system, when an identifier holding user 19 presents an identifier to an information requesting server 15, the information requesting server 15 asks a location management server 13 about a location of an information providing server 14 corresponding to the presented identifier, the location management server 13 returns the confirmed IP address of the information providing server 15 corresponding to the presented identifier to the information requesting server 15 based on the location information, the information requesting server 15 accesses the information providing server 14 corresponding to the confirmed IP address by using the confirmed IP address, and receives predetermined information corresponding to the presented identifier from the accessed information providing server 14.

Abstract: Embodiments of the invention are directed to systems and methods for protecting content by automatically identifying a display surface viewable only to authorized users and displaying protected content on the identified display surface. In one example embodiment, content is displayed on a first display surface in viewable range of a first user authorized to view the content. The entrance of a second user into viewable range of the first display surface is detected, and automatically determined to be unauthorized to view the content. A second display surface in viewable range of the first user but not viewable by the second user is automatically identified in response to detecting the entrance of the second, unauthorized user into viewable range of the first display surface. The display of the content is automatically moved from the first display surface to the second display surface to prevent the content from being viewed by the unauthorized user.

Abstract: Methods for managing a virtual machine wherein an administration console (AC) (1104) transmits a query to a virtualization server (1116). The virtualization server 1116 includes at least one virtual machine (VM) (1124). AC (1104) receives, in response to the query, identification of a VM (1124) and establishes an authenticated communications link with a proxy machine (1108) adapted for communicating with the VM (1124). AC (1104) transmits over the authenticated communications link to proxy machine (1108) the identification of the VM (1124) and performs a management function with respect to the VM (1124).

Abstract: In one embodiment, a system and associated processes for transparent client-side cryptography are provided. In this system, some or all of a user's private data can be encrypted at a client device operated by the user. The client can transmit the encrypted user data to a content site that hosts a network application, such as a social networking application, financial application, or the like. The content site can store the private data in its encrypted form instead of the actual private data. When the content site receives a request for the private data from the user or optionally from other users (such as social networking friends), the server can send the encrypted user data to a client associated with the requesting user. This client, if operated by an authorized user, can decrypt the private data and present it to the authorized user.

Abstract: An image forming apparatus includes: a forming unit that includes an image forming function for forming an image; a restricting unit that restricts usage of the image forming function based on presence or absence of usage authorization for the image forming function of the forming unit; an adjusting unit that executes an image quality adjusting process to improve a quality of the image formed by the forming unit; and a control unit that inhibits the adjusting unit from executing the image quality adjusting process in accordance with presence or absence of restriction of the usage of the image forming function by the restricting unit.

Abstract: Apparatuses and methods for security profile update are presented. In one embodiment, the method comprises determining the version of a security profile associated with a wireless client and determining whether a new security profile exists. The method includes calculating a one-time password based at least on a random character table and some image areas within an image. The method further includes generating an encrypted version of the new security profile by using a first part of the one-time password as an encryption key and sending to the wireless client a profile update request.

Abstract: A security system is provided including providing a device including: storing a security rule for operation of the device when an event occurs; and implementing the security rule upon the occurrence of the event to allow non-obtrusive user access to the device.

Abstract: The present invention discloses an authentication method for a Universal Serial Bus (USB) device. The authentication method includes performing two-way authentication with an authentication server via a server, to generate an authentication result indicating whether the authentication is successful; and generating a one time password according to the authentication result.

Abstract: A bootstrap authentication framework may automatically provide stored authentication credentials to an application server on behalf of an application. The bootstrap authentication framework may receive an access request from a protocol handler to access the authentication credentials stored in a subscriber identity module (SIM) of the electronic device. The access request may be initiated by an application that uses the authentication credentials to access a network service on an application server. In turn, the bootstrap authentication framework may provide the authentication credentials to the protocol handler when a digital signature associated with the protocol handler indicates that the protocol handler is allowed to access the authentication credentials.

Abstract: Methods and systems are provided for facilitating the secure entry of a user's PIN for electronic transactions such as merchant checkout, payment authorization, or access authorization. A physiological response of the user can indicate which one of a random sequence of numbers is a number of the user's PIN. For example, the user can blink, wink, or make a subtle facial movement to provide the indication.

Abstract: A system and method for preventing an administrator impersonating a user from accessing sensitive resources on a target system is provided. The method comprises receiving a first request from a user to change the user's password on a target system to be changed, sending a “change password” request for the user to the target system, storing the user's new password, receiving a second request from the target system on behalf of the user for access to a sensitive resource, wherein the second request contains information about the user's password, and denying the second request if the information about the user's password is not consistent with the user's stored new password.

Abstract: In general, the subject matter described in this specification can be embodied in methods, systems, and program products for providing access to secured resources. A token providing system stores a primary authentication token that is used to obtain temporary authentication tokens. The token providing system provides, to application programs that are unable to access the primary authentication token, the temporary authentication tokens. The token providing system receives, from a first application program of the application programs, a first request to obtain a first temporary authentication token. The first request does not include the primary authentication token. The token providing system transmits a second request to obtain the first temporary authentication token. The second request includes the primary authentication token. The token providing system receives the first temporary authentication token.

Abstract: An invention is afforded for providing security for a protected network resource. The system includes a network access apparatus in communication with a receiver that receives signals from a remote source. The network access apparatus is capable of collecting current microprint data for the receiver, which is a plurality of values based on data values received at the receiver over a predefined period of time, for example, forty-five seconds. The system also includes an authentication computer in communication with the network access apparatus. The authentication computer has access to an LSDF for the receiver, which is a plurality of values based on data values received at the receiver over a predefined period of time, for example, a twenty-four hour period of time.

Abstract: An authorization scheme controls whether an interface is established between communication nodes. Such a scheme may be used, for example, to determine whether to establish a direct interface (e.g., an X2 interface) between a pair of access points. A decision to establish a direct interface between nodes may be based on a node type of one or both of the nodes. A decision to establish a direct interface between nodes may be based on whether the nodes belong to the same group.

Abstract: An information processing apparatus is disclosed that includes a user authentication unit that identifies a current user, a task acquiring unit that acquires task information of a relevant task associated with a file to be processed by the current user, and a file information storage unit that stores file information of the file to be processed in association with the task information of the relevant task.