Abstract: The present invention provides a new method of site and user authentication. This is achieved by creating a pop-up window on the user's PC that is in communication with a security server, and where this communication channel is separate from the communication between the user's browser and whichever web site they are at. A legitimate web site embeds code in the web page which communicates to the security server from the user's desktop. The security server checks the legitimacy of the'web site and then signals both the web page on the user's browser, as well as the pop-up window to which it has a separate channel. The security server also sends a random image to both the pop-up window and the browser. If user authentication is requested by the web site the user is first authenticated by the security server for instance by out of band authentication. Then the security server computes a one time password based on a secret it shares with the web site and sends it to the pop up window.

Abstract: A method includes storing a security credential associated with a communication network on a portable storage device. The method also includes detecting removal of the portable storage device from a specified location. The method further includes allowing at least one communication device to communicate over the communication network using the security credential. In addition, the method includes revoking the security credential after a specified time period has elapsed. The portable storage device could represent a card, and the specified location could represent a card reader/writer. Also, the communication network could represent a wireless network, and the security credential could represent a cryptographic key.

Abstract: A system for detecting network intrusions and other conditions in a network is described. The system includes a plurality of collector devices that are disposed to collect data and statistical information on packets that are sent between nodes on a network. An aggregator device is disposed to receive data and statistical information from the plurality of collector devices. The aggregator device produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The aggregator runs processes that determine network events from aggregating of anomalies into network events.

Abstract: A method of configuring a network access device connected to an access network connected to a plurality of service networks, the network device having a first network address allocated to a subscriber of services of a first service provider provided by a first service network, with a new network address allocated to a second subscriber of services of either the first service provider, or a second service provider provided by a second service network. The method comprises the steps of: sending a request from the network access device to the access network with user credentials for the second subscriber requesting access to the first service provider or a change to the second service provider; receiving a response from the access network; and initiating a network address change request using a configuration protocol.

Abstract: A client device is coupled with a server. The client device prompts a user to enter a number associated with a mobile device, which can be the client device, and generates data including a code. The code is typically hidden from the user when the code is generated and is saved on the client device. The client device transmits the number entered by the user and the code generated by the client device to the server, which sends a message, including the code, to the mobile device associated with the number. The client device prompts the user to enter the code included in the message. Validity of the number is based on one or more factors, including the accuracy of the code entered by the user. In addition, validity of the number can also be based on whether the second user input was entered within a predetermined time limit.

Abstract: Disclosed are systems and techniques that generate one-time passwords in a banking server in order to authenticate a mobile device for transactional functions related to a user account. At least two one-time passwords are generated at the banking server and communicated to the mobile device via different communication pathways. A first communication pathway is encrypted and a second pathway is non-encrypted.

Abstract: A system and method for code signing. The entities may be software application developers or other individuals or entities that wish to have applications digitally signed. Signing of the applications may be required in order to enable the applications to access sensitive APIs and associated resources of a computing device when the applications are executed on the computing device.

Abstract: In a method for improving client's login and sign-on security in accessing services offered by service providers over shared network resources such as Internet and particularly working within the framework of the www, a password is created for the client at a first attempt to access the service provider. The client's password is generated either at an authentication authority in trust relationship with the service provider and transmitted to the client, or the client is allowed to create his or her password on the basis of random character sequences transmitted from the authentication authority. For subsequent access to the service provider the authentication authority presents a client for characters in ordered sequences or in a diagram containing in an appropriate order a single occurrence of each password character.

Abstract: A method for operating a security device comprises receiving a request for a transaction from a programmable device executing an application obtained from an application controlling institute, and verifying a validity of the transaction. A user is alerted, in which the user indicates an acceptance of the request. A one-time identifier is generated. The one-time identifier comprises a security device identification, a transaction number, a date and a time. The one-time identifier is communicated to the programmable device, in which the application verifies a validity of the security device identification and instructs the programmable device to communicate the one-time identifier and transaction to the application controlling institute for processing. The application controlling institute verifies validity of the one-time identifier and processes the transaction, wherein said security device, application programmable device and application controlling institute securely processes the transaction.

Abstract: The present invention provides a method for obtaining a proxy call session control function address, comprising when a terminal accesses an IP multi-media subsystem through a world interoperability for microwave access (WiMAX) network in roaming scenarios, a visited authentication, authorization, and accounting server (V-AAA) of the terminal retransmitting an access request message sent by an access service network (ASN) or a dynamic host configuration protocol (DHCP) or a home agent (HA) of said terminal to a home authentication, authorization, and accounting server (H-AAA) of said terminal after receiving the access request message, and H-AAA finally deciding whether the P-CSCF is located in a visited network or a home network according to a roaming protocol and visited network capability, and returning the determined P-CSCF address information, included by H-AAA in an access accept message corresponding to said access request message, to the sender of said access request message through V-AAA.

Abstract: A method for determining biometric data for use in conducting authentication transactions is provided that includes capturing biometric data from a user during an authentication transaction and capturing conditions of the authentication transaction with a device. The captured biometric data corresponds to desired biometric data. The method also includes transmitting the captured biometric data and conditions to an authentication system that stores biometric data and conditions therein. Moreover, the method includes determining that stored biometric data corresponding to the desired biometric data, associated with conditions that best match the captured conditions, is to be used for authenticating the user.

Abstract: An access control system and an access control method thereof are provided. The access control system comprises a handheld device, an access control server and a terminal recording device. The handheld device has a user identification. The access control server is configured to store a user identification set, connect to the handheld device within a first time interval, determine that the user identification is included in the user identification set, generate a one-time password (OTP) seed set, and transmit the OTP seed set to the handheld device. The terminal recording device connects to the handhold device within a second time interval, and performs a two-way identification certification with the handheld device according to the OTP seed set so that the handheld device performs a data access to the terminal recording device after achieving the two-way identification certification.

Abstract: A device (300s) has an authentication ID generator (320) for applying a first one-way function to a combination of a process password and information to be shared, and generating an authentication ID; an anonymizer (330) for generating anonymized information from the authentication ID and the information to be shared; an information sharing section (340) for causing the anonymized information to be held on another device; and an anonymized information process requesting section (350) for sending a process request containing the process password, and requesting the other device to subject the held anonymized information to a predetermined process, the request being sent on the basis of a match between the authentication ID of the anonymized information and the result of the first one-way function being applied to the combination of the process password and the anonymized information held on the other device.

Abstract: A method and system for data loss prevention controls and protects sensitive data from being printed in an unauthorized manner. A method for controlling printing activities implemented in a computer system comprises intercepting a print job comprising print data intended for a printer driver, delaying performance of the print job, analyzing content of the print data to determine whether to allow or cancel the print job based on a security policy, and resuming or canceling the print job based on the analysis of the content of the print data.

Abstract: A method for registering user identification data in an application service provider data repository is provided, where the application service provider provides web services for a plurality of customers, each customer having a plurality of users with respective user identification data. The method includes receiving user identification data from one of the users through a website associated with one of the plurality of customers, retrieving customer identification data based on a uniform resource locator assigned to the website, concatenating the user identification data and customer identification data to create a user key, and registering a user account within the data repository based on the created user key.

Abstract: A method for generating and distributing MIP security key after Re-Authentication, including: an AAA Server generates an EMSK during a Re-Authentication process; the MS generate a new first MIP security key for the MS according to the EMSK, and replaces the corresponding old first MIP security key with the new first MIP security key; and a HA receives new second MIP security key information for the HA which is sent by the AAA Server actively, or requests from the AAA Server the new second MIP security key information for the HA, and replaces the corresponding old second MIP security key that is locally stored with the new second MIP security key that is sent by the AAA Server actively or requested from the AAA Server. The present invention ensures execution of MIP Registration process after Re-Authentication.

Abstract: Methods and apparatus involve securely hosting workloads. Broadly, computing workloads are classified according to security concerns and those with common concerns are deployed together on common hardware platforms. In one instance, security tags are bi-modally attached or not to workloads meeting a predetermined security threshold. Those with tags are deployed on a common machine while those without tags are deployed on other machines. Tags may be embedded in meta data of open virtual machine formats (OVF). Considerations for re-booting computing devices are also contemplated as are multiplexing workloads. Computer program products are further disclosed.

Abstract: A security component may be associated with a network-enabled application. The security component may initiate the display of an embedded region of a window drawn according to display information received from a relying party. The security component may define at least a portion of the appearance of the embedded region; the relying party may not define this portion. The security component may send the address of the relying party to a reputation service and query the reputation service about the reputation of the relying party. The reputation service may return reputation information about the relying party. The security component may display an indication of the relying party's reputation. If the reputation information indicates the relying party is reputable, the security component will allow the network-enabled application to exchange information with the relying party. Otherwise, the component may not allow the network-enabled application to exchange data with the relying party.

Abstract: Various embodiments of a system and method for secure password-based authentication are described. The system and method for secure password-based authentication may include an authentication component configured to request and receive authentication from an authenticating system according to a secure password-based authentication protocol. The authentication component may be configured to participate in an attack-resistant password-based authentication protocol such that an attacker who has compromised the authorizing system and/or a communication channel between the authentication component and the authenticating system may not determine a user's password and/or impersonate the user. In one embodiment, the authentication component may be configured to provide its attack-resistant password-based authentication functionality to an application (e.g., through a stand-alone application, plugin, or application extension).

Abstract: Various embodiments of a system and method for transparently authenticating a user to a digital rights management entity are described. In various embodiments, a digital rights management server may be configured to receive an authentication token from a first remote computer system. Such authentication token may indicate that a particular user of the first remote computer system was authenticated by a first content provider of one or more content providers. In various embodiments, the digital rights management server may also be configured to verify the authentication token by determining that one or more portions of the authentication token were generated based on respective authentication information issued to the first content provider. In various embodiments, the digital rights management server may also be configured to, in response to verification of the authentication token, issue to the first remote computer system one or more credentials.

Abstract: A PIN is automatically generated based on at least one rule when the user enters a password through a user device. In one example, the PIN is a truncated version of the password where each character in the truncated version is mapped onto a number. The mapping can be a truncation at the beginning or end of the password, or the mapping can be with any pattern or sequence of characters in the password. This PIN generation may be transparent to the user, such that the user may not even know the PIN was generated when the password was entered. When the user attempts to access restricted content, the user may enter the PIN instead of the password, where the user may be notified of the rule used to generate the PIN so that the user will know the PIN by knowing the password.

Abstract: A system that incorporates teachings of the present disclosure may include, for example, a non-transitory computer-readable storage medium operating in a mobile device server that has computer instructions to execute a web server application at the mobile device server. The web server application can be operable to detect a media resource center while roaming in a communication zone of the media resource center and to transmit a pairing key to the media resource center responsive to acquiring communication access to the communication zone. The web server application can be further operable to receive from the media resource center an indication that a roaming charge will be applied to a subscriber account associated with the mobile device responsive to the media resource center identifying from the pairing key that the mobile device server is a guest device. Other embodiments are disclosed.

Abstract: A partner registration module can provide for an automatic registration of partners to a central server. An entire partner registration process can be automated from end to end, providing a unified process for registering partners. The partner registration module can be fully compatible with current registration agents and next generation registration agents.

Abstract: A system and method for preventing an administrator impersonating a user from accessing sensitive resources on a target system is provided. The method comprises receiving a first request from a user to change the user's password on a target system to be changed, sending a “change password” request for the user to the target system, storing the user's new password, receiving a second request from the target system on behalf of the user for access to a sensitive resource, wherein the second request contains information about the user's password, and denying the second request if the information about the user's password is not consistent with the user's stored new password.

Abstract: A method of integrated signon is provided comprising receiving a login request to begin a desktop session, the login request comprising a first user identification and a first user password. The method comprises authenticating the first user identification and the first user password using data stored in a first authentication domain. The method comprises starting the desktop session and receiving a request from the desktop session to access an application associated with a second authentication domain. The method comprises retrieving authorization data associated with the second authentication domain from the first authentication domain based on the first user identification and the user password. The method comprises sending the request to access the application associated with the second authentication domain with the authorization data to the application associated with the second authentication domain.

Abstract: According to one aspect, there is provided a method of controlling access to a network resource. The method comprises receiving a request to grant a user access to the network resource, the request including a user identifier, determining whether the received user identifier is stored in a local user data store associated with the resource, and where it is not so determined determining, from user details stored in a master user data store, whether the user is authorized to access the resource, and where it is so determined obtaining a password, and storing the obtained password and user details in the local data store associated with the network resource.

Abstract: The present invention relates to the filed of computer access and in particular remote authentication. In one form, the invention relates to one time passwords used in computer or web-based systems. In one particular aspect, the present invention is suitable for use with certificate based credentials.

Abstract: Obfuscating a message, in one aspect, may include detecting sensitive information in a message to be broadcast into public or quasi-public computer network environment; replacing the sensitive information in the message with a representation that preserves general aspects of the sensitive information and a user interface element, the user interface element for enabling a viewer of the message to request access to details of the sensitive information; and transmitting the replaced message for broadcasting into the public or quasi-public computer network environment. De-obfuscating the message, in one aspect, may include authenticating one or more viewers or receivers of the message and based on the authentication, presenting details associated with the sensitive information.

Abstract: A centralized credential management system includes website credentials that are stored at a vault. The website credentials are encrypted based upon a key not available to the vault and are for authenticating a user to a third party website. Through a client, a user authenticates to the vault and retrieves the encrypted website credentials and parameters and code for properly injecting the credentials into a website authentication form. The website credentials are decrypted at the client and injected into the authentication form using the parameters and code.

Abstract: Establishing one or more facets of a policy includes facilitating a communication session for an access terminal at a visited network. The access terminal is associated with a home network having a home policy server. The policy is received at a visited policy server of the visited network. The policy comprises the facets. If the facets are unacceptable, the facets are negotiated until a stopping point is reached. The negotiation includes adjusting by the visited policy server at least one facet of the one or more facets, and notifying the home policy server of the adjustment. The facets are established in accordance with the negotiation.

Abstract: A method and system to facilitate dynamic service negotiation with a uniform and persistent security control plane in a wireless network. In one embodiment of the invention, a node in the wireless network determines each capability provided by each of one or more virtual nodes that it supports and transmits a frame that has information of each capability provided by each of the one or more virtual nodes. By combining all the information of each capability provided by each of the one or more virtual nodes into one frame, the node reduces the volume of management traffic required and increases the available usable channel bandwidth in one embodiment of the invention.

Abstract: A method for modifying one or more system resources is provided. One or more licenses for modifying one or more system resources on a client device can be acquired. An authenticator can be generated and stored on a remote server. The authenticator can be transferred to the client device. The client device can be connected to the remote server and the remote server can authenticate the client device via the authenticator. The remote server can confirm the availability of one or more licenses, and based on the availability of one or more licenses, modify one or more system resources disposed in, on, or about the client device. After modifying the one or more system resources the remote server can decrement the remaining license count.

Abstract: Queries regarding access permissions of users and rights to directories in a complex enterprise are executed in near real-time, using lookups to tables that form a condensed database maintained for each file server. User information is condensed by arranging users in user groups having common data access rights. Directory permissions storage is condensed by showing only distinctive permissions to a directory in a table entry, and referencing inherited permissions of parent directories. The tables indicate recursive and ancestral relationships among the user groups and directories. They are developed and updated in advance of any queries. A consolidated view of the query results is presented on a single display screen. Using the tables results can be obtained without exhaustive searches of large file system tables.

Abstract: Queries regarding access permissions of users and rights to directories in a complex enterprise are executed in near real-time, using lookups to tables that form a condensed database maintained for each file server. User information is condensed by arranging users in user groups having common data access rights. Directory permissions storage is condensed by showing only distinctive permissions to a directory in a table entry, and referencing inherited permissions of parent directories. The tables indicate recursive and ancestral relationships among the user groups and directories. They are developed and updated in advance of any queries. A consolidated view of the query results is presented on a single display screen. Using the tables results can be obtained without exhaustive searches of large file system tables.

Abstract: An system for controlling access to a network by a user device. The system includes a criteria engine that generates a plurality of criteria to be monitored on the user device and a checker that generates at least one check for each of the plurality of criteria. The system further includes a profiler that retrieves a profile for the user device, the profile including the plurality of criteria and the at least one check for each of the plurality of criteria, a comparator that compares a summary of the retrieved profile to a summary of a profile received from the user device and a communicator that communicates a message to the user device based on the comparison.

Abstract: Systems, methods and devices for creating a user credential are provided. A device for creating a user credential for user authentication includes one or more processors configured to generate a first list of credential components from a second list of credential components and a network interface component coupled to a network. The network interface component is configured to transmit the generated first list of credential components to a user device, receive a user selection of at least one credential component from the transmitted first list of credential components, at least the user selection being selected by the user during user authentication, and receive a user entry. The device also includes a memory, the memory storing a combination of the user selection and the user entry as a created user credential. Systems, methods, and devices for authenticating a user with the created user credential are also provided.

Abstract: Described in detail herein are systems and methods for managing connections in a data storage system. For example, the systems and methods may be used to manage connections between two or more computing devices for purposes of performing storage operations on the data of one of the computing devices. The data storage system includes at least two computing devices. A first computing device includes an unauthorized connection data structure and a connection manager component. The connection manager component receives a connection request from a second computing device. If the second computing device is not identified on the unauthorized connection data structure, the connection manager component can request that an authentication manager authenticate the second computing device and/or determine whether the second computing device is properly authorized. If so, the connection manager component can allow the second computing device to connect to the first computing device.

Abstract: A password element is generated for a station running an Elliptic Curve Cryptography (ECC) or a Finite Field Cryptography (FFC) group based password authenticated protocol. A password element is multiplied by a cofactor to generate a modified password element for the ECC group. The station verifies that the modified password element is not equal to a point at infinity for the ECC group. A password element is generated by exponentiating a password value to a power t, where t=(p?1)/r, p and r are primes, and r has a bit length of at least 160 bits for the FFC group. A commit-element parameter is generated using a temporary secret value and the ECC modified password element or the FFC password element, and is then transmitted to another station in a commit message. The receiving station checks if the received commit-element parameter has desired properties before continuing with the protocol.

Abstract: An account creating and authenticating method is provided. Firstly, an account is created according to a face image included in a photo. A password corresponding to the face image is also generated by a service system. During an account authenticating method, an image pickup device is used to shoot a face of a login person on the spot. If the service system judges that the shot face image of the login person on the spot complies with a predetermined face image corresponding to an existing account, the login person is allowed to login into the service system and the password is displayed. In a case that the image pickup device is provided, the service system may be authenticated by inputting the password. The method of the present can simplify the process of creating and authenticating the account.

Abstract: A method of connecting a mobile station to a communications network is provided, and includes performing an authentication of the mobile station at the network. A secure identifier, generated at the mobile station, is received at a gateway node and at an access node from an authentication node of the network if it is determined by the authentication that the mobile station is a subscriber to the network. A first secure communications tunnel is established from the access node to the mobile station using a value of the secure identifier and a second secure communications tunnel is established from the access node to the gateway node of the network using the value of the secure identifier. The first and second communications tunnels are bound together to form a communications path between the mobile station and the network.

Abstract: A system and method are provided for enabling personalization and service coordination of media services across multiple devices. The method comprises providing a first module to interface with information technology infrastructure and media services provided by an operator or third parties; and providing, using the first module, service orchestration and user lifecycle management components to enable authorized and personalized access to multiple network operator services across multiple devices and services.

Abstract: An authentication control apparatus is disclosed that includes plural authentication units that perform authentication for an operator with different authentication methods; a corresponding information management unit that manages corresponding information between the mode of an authentication request and the authentication unit to be used; and an authentication control unit that determines the authentication unit corresponding to the mode of the authentication request based on the corresponding information in response to the authentication request from the operator and causes the determined authentication unit to execute the authentication for the operator.

Abstract: Pre-registration security support in a multiple access technology environment is disclosed. For example, a method is disclosed for use in a computing device of a communication system. The communication system supports two or more access technologies for permitting a communication device to access the communication system, and at least part of a first security context is generated at the computing device for a given communication device permitting the given communication device to access the communication system via a first access technology.

Abstract: A method and system enables a user and/or an on-line site to be authenticated by comparing a received password with an expected password, transmitting a new password if the received and expected passwords match, and authenticating a communication if the new password matches what is expected by the on-line site. The initially received password may be distorted, such as with CAPTCHA.

Abstract: A credential caching system includes receiving a set of authentication credentials, storing the set of authentication credentials in a credential cache memory, wherein the credential cache memory is coupled with a management controller, and supplying the set of authentication credentials for automatic authentication during a reset or reboot. In the event of a security breach, the credential caching system clears the set of authentication credentials from the credential cache memory so that the set of authentication credentials may no longer be used for a reset or reboot.

Abstract: A multi-tenant, elastically scalable cache as a service is disclosed. Embodiments of the cache service eliminate the need for applications to manage their own cache tier. The multi-tenant cache service is implemented by maintaining/creating multiple named caches in a cache cluster and mapping each tenant's cache to a named cache in the cluster. Strict quotas are enforced on cache sizes This allows caches with different replication attributes to co-exist on the same cache server, allows migration of a cache from one cluster to another for load balancing purposes, and allows a cache to inflate/deflate to meet business needs. A network load balancer is used to route cache items to servers.

Abstract: The described embodiments relate generally to methods and systems for user authentication for a computing device. In one embodiment, the method comprises: enabling receipt of input in relation to selection of a plurality of authenticators for consecutive use by the computing device to authenticate a user; and storing reference information identifying the selected plurality of authenticators in a memory of the computing device. The computing device may comprise a mobile device.

Abstract: A multimedia messaging system for receiving/sending multimedia messages, includes: a wireless LAN; and a MMS gateway. The MMS gateway performs: receiving/sending the multimedia message to/from a MMS user device via the wireless LAN; and encrypting the multimedia message. The encryption is performed by: issuing a certificate to the MMS user device; sending a session ID and a master key encrypted by the MMS gateway's private key to the MMS user device in response to a request of the MMS user device having the certificate; generated a shared secret key using an algorithm combining the master key with the MMS user device's phone number and the session ID; and encrypting the multimedia message using the shared secret key.

Abstract: Techniques for generating and providing phrases are described herein. These techniques may include analyzing one or more sources to generate a first corpus of phrases, each of the phrases for use as an identifier and/or for association with a user. The first corpus of phrases may be generated based on characteristics associated with phrases. Once a first corpus of phrases has been generated, these phrases may be filtered to define a second corpus of phrases. Phrases of this second corpus may then be suggested to one or more users. In some instances, the phrases suggested to a particular user are personalized to the user based on information previously known about the user or based on information provided by the user.

Abstract: Systems and methods for unattended authentication of software applications to provide these applications with access to shared resources. A server password manager (SPM) module resident on a node also occupied by a requester software application requesting access to resources receives the requestor's request. The SPM module creates a request package containing the requestor's information as well as the node's identifying information. The request package is then transmitted to a credentials manager (CM) module in a CM node. The request package, encrypted by the SPM module with encryption keys previously generated by the CM module, is decrypted by the CM module. The contents are checked against data stored by the CM module regarding the SPM module and the requestor application when these were registered with the CM. If the data matches, then the CM provides credentials which are used to give the requestor application access to the requested resources.