Abstract: According to various embodiments, a cellular architecture for enhanced privacy regarding identity and location of a computing device is disclosed. The architecture includes a next generation core (NGC). The NGC includes an authentication server function (AUSF) configured to determine whether the computing device contains a valid subscriber identity module (SIM) card, and a user plane function (UPF) configured to allow a computing device to connect to the Internet. The architecture further includes a gateway connected to the UPF, the gateway configured to authenticate the computing device while hiding the identity of the computing device by verifying authentication tokens that represent units of access.

Abstract: A computer-implemented method to enable short-range wireless communication via a webpage on a computing device includes receiving, via a web-browser executing on the computing device, from the webpage, a first request to execute a computer-executable instruction, the computer-executable instruction requests data from an enterprise server. The method also includes triggering, in response to a second request from the enterprise server to authenticate the first request, the web-browser to execute a predetermined computer program. The method also includes scanning, by the predetermined computer program a cryptogram from a contactless card to authenticate the cryptogram and cause the enterprise server to send the data. The method also includes executing, via the web-browser, the computer-executable instruction from the first request in response to receiving the data sent by the enterprise server.

Abstract: Techniques are disclosed for generating a message stream configured to indicate a source of the various messages within the message stream. In particular, the indicators identify which interface the messages were received at a terminal (e.g., of a mobile handset). The terminal receives messages on various interfaces, and separates the messages received via different interfaces with interface switch indicators within the message stream. In one embodiment, the smart card receives a message stream that includes sets of messages and interface switch indicators therein. The smart card delivers messages from the message stream to a single logical partition of the smart card up until an interface switch indicator is identified in the message stream. From that point, the smart card delivers messages from the message stream to a different logical partition of the smart card up until another interface switch indicator is identified in the message stream.

Abstract: Briefly, example methods, apparatuses, and/or articles of manufacture may be implemented, in whole or in part, using one or more computing devices to obtain, from a communications device, an identifier of the communications device transmitted via a communications network. The communications network may transmit a request for one or more parameters unique to a subscriber of the communications network. The method may also include processing signals indicative of the requested one or more parameters in response to the subscriber entering the one or more parameters into a graphical user interface of the communications device. The method may further include transmitting, to the communications device, one or more signals to provide a complement of subscriber parameters.

Abstract: A content management system enables a central server to connect to remote nodes at client sites. Software modules on the remote node is responsible for making necessary calls to the central server in order to create an index of the relevant data (or metadata) and fetch the appropriate binary information and files for the related metadata. Remote nodes are populated with data from the content management system via crawl/synchronize methods, or alternatively a hard drive of the data is initially configured at headquarters whereby data is saved to prevent trafficking data over a potentially unreliable connection over an extended period of time. The hard drive is then installed at the remote site and synchronized with the software module running in high performance enterprise library (HPEL) mode. The HPEL enabled server is configured to crawl and synchronize all the data and pick up differences in data using differential crawls.

Abstract: A method for operating a software framework is provided. The method may be applied to a software framework applicable to a gateway device, the software framework includes an application service layer and a basic service layer, the application service layer includes at least one device service registered in advance, and the basic service layer includes a data bus built in advance. The method includes: realizing a capability of a device associated with the gateway device based on the device service; and realizing communication between the device service and an external service based on the data bus, where the external service includes a device service belonging to a same gateway device as the device service or a different gateway device than the device service.

Abstract: Techniques for routing service mesh traffic based on whether the traffic is encrypted or unencrypted are described herein. The techniques may include receiving, from a first node of a cloud-based network, traffic that is to be sent to a second node of the cloud-based network and determining whether the traffic is encrypted or unencrypted. If it is determined that the traffic is encrypted, the traffic may be sent to the second node via a service mesh of the cloud-based platform. Alternatively, or additionally, if it is determined that the traffic is unencrypted, the traffic may be sent to the second node via an encrypted tunnel. In some examples, the techniques may be performed at least partially by a program running on the first node of the cloud-based network, such as an extended Berkeley Packet Filter (eBPF) program, and the like.

Abstract: Systems and methods are provided for creating and running an instance of a dynamic access control system (DACS). Trust providers may be defined in a trust broker of the DACS such that trust information associated with the trust providers can be used to create a custom data structure. Resources and resource groups may be defined in the DACS. Policies may be configured or coded in the DACS to map the custom data structure to recourses or resources groups. Additionally, policies may be configured or coded in the DACS to route the data structure and request to network segments or shared with other parties.

Abstract: Embodiments of the invention are directed to systems and methods for validating transactions using a cryptogram. One embodiment of the invention is directed to a method of processing a remote transaction initiated by a communication device provisioned with a token. The method comprises receiving, by a service provider computer, from an application on the communication device, a request for a token authentication cryptogram, wherein the token authentication cryptogram includes encrypted user exclusive data. The service provider computer may generate the token authentication cryptogram to include the user exclusive data. The service provider computer may send the token authentication cryptogram to the application, where the token authentication cryptogram can be used to validate the transaction, and the user exclusive data is extracted from the token authentication cryptogram during validation.

Abstract: A mobile device may comprise a secure memory. The mobile device may receive a request from a mobile application executing on the mobile device to store data in the secure memory. The request may comprise the data and a group identifier associated with the mobile application. A primary symmetric key associated with the group identifier may be determined. The data may be encrypted, using the primary symmetric key, to produce first encrypted data. A secondary symmetric key associated with the group identifier may be determined. The first encrypted data may be encrypted, using the secondary symmetric key, to produce second encrypted data. The second encrypted data may be stored to the secure memory.

Abstract: A computing device operating on a Linux or Android platform for adding features to an in-vehicle infotainment system of a vehicle; it has an input/output interface; a power source input; a processor; and memory storing program code that, when executed by the processor, causes the processor to receive an Android-based smartphone infotainment application program; scan program code of the Android-based smartphone infotainment application program using a predefined pattern to locate a base certificate in the program code of the Android-based smartphone infotainment application program; generate a certificate-key pair from the base certificate; transmit the certificate of the certificate-key pair to the infotainment system for authentication and to enable communication with an Android protocol between the computing device and the infotainment system; and cause a display of information associated with a feature application program for display on the infotainment system; methods of use thereof.

Abstract: A computer-implemented method to secure an interaction between at least two users in a network, whereas at least two network nodes are connected via the network. The method includes: a first user connects to the network via a first of the two network nodes, the first user creates in the network a first identity corresponding to the first user via a software application running on the first network node, whereas the creation includes the first user providing first biometric information characterizing the first user, the first biometric information is stored in encrypted form by a computer-implemented identity management system, a second user accesses the network via a second network node, the second user requests via the network consent of the first user, whereas the request is sent via the identity management system, the first user denies or approves the request of the second user via the software application.

Abstract: A system for awarding prizes to users via an electronic game of chance is disclosed. The system is configured to generate digital tokens that are cryptographically linked to respective virtual representations of a set of winnable items. The system further includes a mystery box system that is configured to serve a mystery box game to a client device, wherein the mystery box game includes a mystery box recipe that designates a respective probability of winning each winnable digital token of the set of digital tokens and is configured to randomly select a winning digital token from the set of digital tokens in accordance with the mystery box recipe. The mystery box system is further configured to award the winning digital token to the user, wherein the winning digital token is redeemable for the respective winnable item corresponding to the winning digital token.

Abstract: An apparatus stores a security token in a memory associated with the apparatus. The security token is a software security artifact used to uniquely identify the apparatus. The apparatus receives a query message to provide the security token. The apparatus transmits the security token to be verified. In response to the security token being verified, the apparatus participates in a secured communication channel with a user device. The apparatus receives a second security token that is used for a subsequent authentication of the apparatus. The apparatus stores the second security token in the memory.

Abstract: Distributed security key management for protecting roaming data via a trusted platform module is performed by systems that include first and second processors, and first and second respective hardware security modules. The first security module encrypts a security key using a public key from the second security module, and the encrypted security key is provided to the second security module. A virtual machine (VM) executed by the first processor has a first virtual security module instance having state data that includes a storage key encrypting VM virtual disk data and that is encrypted with the security key. When a transfer condition is determined, the VM is transferred and executed by the second processor, using a second virtual security module instance, based on decrypting the security key by the second security module using a private key and decrypting the state data for the second virtual security module using the security key.

Abstract: Methods and systems for retrieving information from secondary computing systems using network access tokens are disclosed. The system can provide a user interface that lists a plurality of secondary computing systems to a client application executing at a client device associated with a user profile of the primary computing system. The system can receive, from the client device, a network token identifying a permission for accessing a second profile maintained at the secondary computing system, and retrieve the subset of data records from the secondary computing system according to a retrieval policy. The system can then update the user interface at the client application to present the subset of data records of the second profile.

Abstract: Techniques are provided for performing user operations by a first system on a second system using user impersonation. One method comprises receiving, by a first system, a log in of a user to the first system and an operation to be performed by a second system; sending an impersonation request, by the first system to the second system, to obtain an impersonated user access token of the given user for the second system; receiving, by the first system from the second system, in response to the impersonation request, the impersonated user access token of the given user; and providing, by the first system to the second system, the operation with the impersonated user access token of the given user, wherein the second system performs the operation based at least in part on a result of an access validation of the impersonated user access token of the given user.

Abstract: A method for awarding prizes to users via an electronic game of chance is disclosed. The method includes executing, by a gaming device, a mystery game that includes a recipe that defines a respective probability corresponding to each respective winnable token and a manner by which a winning digital token is randomly selected. The method also includes randomly selecting the winning digital token from the set of winnable digital tokens based on the mystery box recipe, wherein the winning digital token is redeemable for a corresponding winnable item that is represented by the winning token. The method includes awarding the winning digital token to user, wherein the winning token is redeemable for the won item. The method includes upon selecting the winning digital token, transmitting a signal indicative of winning token to a mystery box system that initiates a transfer of the winning token to an account of the user.

Abstract: A test and measurement system that allows a user to use an activation code coupled with a user-owned communication device to provide security credentials to cloud or web-based services with security enhancements or preferences. The test and measurement system includes a test and measurement instrument that can initiate the connection and a remote server which provide an activation code for a user to enter on the communication device to connect the test and measurement instrument to the cloud or web-based services.

Abstract: Implementations described herein relate to memory command assignment based on command processor workload. In some implementations, a memory device may determine a first command type of a first memory command. The memory device may identify a first command processor, associated with the first command type, that is one of multiple command processors configured to execute memory commands. The first command processor may be configured to execute only commands having the first command type unless a computational credit condition, associated with another command processor, is satisfied. The memory device may determine that a cumulative computational credit value associated with the first command processor does not satisfy a condition. The memory device may assign the first memory command to the first command processor for execution based on determining that the cumulative computational credit value associated with the first command processor does not satisfy the condition.

Abstract: Described are automated systems and methods for employing certificate authority meta-resources to facilitate automatic renewal and/or rotation of certificates and/or certificate authorities in a PKI hierarchy. For example, embodiments of the present disclosure can provide creating a certificate authority meta-resource, which can maintain and monitor certain information to facilitate automatic renewal and rotation of certificates and/or certificate authorities in a PKI hierarchy. The certificate authority meta-resource can also keep track of the active certificate authorities and certificates to ensure that trust is maintained without manual configuration of the PKI hierarchy.

Abstract: A real-world object-based method and system of performing an authentication of a person in order to permit access to a secured resource is disclosed. The system and method are configured to collect image data from an end-user in real-time that includes objects in their environment. At least one object is selected and its image data stored for subsequent authentication sessions, when the system can determine whether there is a match between the new image data and image data previously collected and stored in a database. If there is a match, the system verifies an identity of the person and can further be configured to automatically grant the person access to one or more services, features, or information for which he or she is authorized.

Abstract: A vehicular apparatus is configured to authenticate a user of a vehicle. In response to authenticating the user, a user management table, which manages an association between the user and a permitted or prohibited operation of the user for each vehicle scene, is referred to, and the permitted or prohibited operation of the user authenticated is specified to provide a specified result. An application corresponding to the permitted or prohibited operation of the user is notified of the specified result to manage the operation of the user.

Abstract: A method of downloading or opening a file in response to a user input made through an application running in the computer system, includes the steps of detecting by the application that the user input is to download or open a file, issuing a request by the application to a file sanitation server to sanitize the file to remove embedded codes in the file and return the sanitized file, and upon receiving the sanitized file by the application, saving the sanitized file in a folder where the sanitized file can be opened.

Abstract: Systems, methods, and computer program products are provided for monitoring network security in a mesh network. An example method includes receiving trust of service information relating to a user. The trust of service information includes one or more security details associated with at least one of a user device or a user network associated with the user. The method also includes determining a security level of a session involving the user based on the trust of service information relating to the user. The method further includes determining a security protocol for the session based on the determined security level. The security protocol determines at least one of a user access level or an additional security measure. The method still further includes causing an execution of the session based on the security protocol determined.

Abstract: A wireless access method, device and system is disclosed that enables remote dynamic configuration of wireless devices which emulate wireless tags, while maintaining compatibility with prior art access systems. This enables wireless tags to be shared in a manner that allows copies of the tags to remain synchronised with each other. The system includes a remote server, configured to selectively provide tag data to the wireless devices to enable the wireless devices to emulate the one or more wireless tags using the selectively provided tag data. In use, the wireless tags are configured to first retrieve tag data from the remote server, and subsequently emulate one or more wireless tags according to the retrieved tag data.

Abstract: Examples provide a multi-factor device holder (MDH) for storing multi-factor authentication devices. A housing encases a set of ports configured to connect to the set of connectors on two or more multi-factor authentication devices placed within the MDH. An external port can connect the MDH to a port on a user device. A selection device, such as a user interface, enables user selection of an authentication device from the set of authentication devices. A locking mechanism secures the housing in a closed configuration to prevent unauthorized access to the authentication devices stored within the MDH. The MDH can include a user authentication device, such as a biometric reader, to authenticate a user attempting to utilize the MDH. If authorized, the selected authentication device is unlocked and provided with power. The selected authentication device transmits a code to the user device via the external port connector.

Abstract: According to one embodiment, a service management system includes a relay device to relay communications between a client and a server providing a service that comprises one or more microservices. The relay device generates an authentication token, authenticates the authentication token when included in a service request from the client, and issues a command to the server to execute a service requested by the client after the authentication token is successfully authenticated. A token issuing server is provided to communicate with the relay device and the client and includes a storage unit and a processor. The processor is configured to store an access key issued by the relay device in the storage unit, acquire the authentication token from the relay device by using the access key, and send the acquired authentication token to the client in response to a token request from the client.

Abstract: A decentralized secure repository is used as a medium for distribution of a one-time password (OTP) from an authentication system to a user's client device. End-to-end encryption of the OTP is provided: the OTP is both stored encrypted at rest on the decentralized secure repository, and is also encrypted when it is transmitted over computer networks between different systems, thereby thwarting attempts at eavesdropping. The decentralized secure repository itself also has a number of properties that enhance security of the OTP, such as tamper-proofness and auditability. The decentralized secure repository may be implemented with techniques such as a blockchain protocol.

Abstract: An authentication system facilitates efficient generation of authentication integrations with third-party identity providers for client systems. The authentication system provides one or more interfaces configured to receive requests to make authentication integrations available for a third-party identity provider. The requests to make authentication integrations available include integration information for the relevant identity provider. Based on the request to make authentication integrations available, the authentication system generates an identity provider profile for the identity provider that can be used to generate authentication integrations with the identity provider for one or more client systems. Once the identity provider profile is generated, the authentication system uses the identity provider profile to generate authentication integrations for one or more client systems that request authentication through the third-party identity provider.

Abstract: There is provided an access system for controlling access to an inspection area and a product inspection apparatus. The access system comprises an area access controller configured to control an inspection area access means for controlling access to an inspection area; a product inspection apparatus controller configured to control access to one or more functions of a product inspection apparatus within the inspection area; a first RFID reader configured to read an external RFID tag of a user; and one or more memory devices configured to store authorised RFID data corresponding to one or more RFID tags each associated with an authorised user.

Abstract: A communication apparatus, when it perform data communication using a master base station and a secondary base station, stops communication with the secondary base station, confirms with a user whether or not the data communication is to continue in a case where communication with the secondary base station is stopped, and in a case where it was confirmed that the data communication is not continue, stops communication with the master base station.

Abstract: A system and method for a hybrid development platform for project development that integrates local and continuous integration (CI)-based building and testing. The system and method can make use of a build cluster, that executes individual commands within build targets; a build cache that stores partial results of previous executions; an artifact and image storage system, that stores and updates artifacts and container images; and a secrets repository that manages local and global project secrets. The system and method function as an automated build platform that enables an execution environment agnostic build platform for development over local development and extended network computing environments.

Abstract: A system and method for PIN authentication issuance from a MFP QR Code includes a QR code presented on an authentication screen of multifunction peripheral display. A user requiring a personal information number to access a multifunction peripheral printing system managed by a print server scans the QR code with their secure smartphone or tablet. The scanned QR code opens a web portal to the sever on the user's device where they can select a new PIN. The new PIN is stored on the server for the user' account and access to the MFP is then granted when the user enters their new PIN.

Abstract: Aspects of the subject disclosure may include, for example, initializing a secure timer in a wireless device, determining whether a subscriber identification module (SIM) card installed in the wireless device comprises a carrier identity that matches a carrier identity stored in the machine-readable medium, establishing a network connection with a trusted server, starting the secure timer if the SIM card and network connection are satisfactory, periodically checking the network connection and SIM card until expiry of the secure timer, penalizing the secure timer responsive to a failure of the network connection or SIM card check, and responsive to expiry of the secure timer, unlocking a SIM lock. Other embodiments are disclosed.

Abstract: An authentication method, a content delivery network CDN, and a content server are provided. The method includes: receiving, by a CDN, a content access request that is sent by a client and that carries a first authentication credential and a second authentication credential, where the first authentication credential is generated by a content server based on a first key allocated by the CDN, and the second authentication credential is generated by the content server based on a second key allocated by a cloud server; performing, by the CDN, authentication on the first authentication credential by using the first key; and performing, by the cloud server, authentication on the second authentication credential by using the second key. In this manner, the CDN and the cloud storage server separately allocate different keys to the content server.

Abstract: A virtual session manager of an electronic device maintains a web session for a user across multiple electronic devices. The virtual session manager receives an authentication request from a first electronic device that is in a communication range of the device. The virtual session manager transmits the authentication request to an endpoint device with a grant token without providing the first electronic device with any access to the grant token. The virtual session manager will receive, from the endpoint device, a first access token in response to the first authentication request. The virtual session manager will transmit the first access token to the first electronic device so that the first electronic device can establish a virtual session with the first web resource.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer-storage media, for web application generation. In some implementations, a method includes receiving an identifier for code written for execution on a local device; determining, by analyzing the code, contextual information for executing the code; generating, using the contextual information, a web services layer for the code that enables execution of the code in a cloud computing environment; creating configuration settings i) for the code and ii) that include first data defining the web services layer and second data defining one or more access tokens, each access token enabling calling of a respective function in the code; and storing, in memory, the configuration settings for use during deployment of the code in response to receipt of a request to execute at least one function in the code.

Abstract: Systems and techniques for automatic escalation of trust credentials are described herein. Requestor data may be received that describes workloads of a requestor. A set of trust credentials may be determined by using an escalation prediction model to evaluate the requestor data. The multi-access token may be assembled from the set of trust credentials. The multi-access token may be transmitted to an information provider to fulfill a request of a requestor.

Abstract: Systems and methods for secure user authentication are described. In certain embodiments, a client device such as a smartphone may be provisioned with a secure key and/or other secret information. The client device may be used to generate unique secure tokens and/or other credentials used in connection with an authentication process. A user may provide the generated tokens and/or other credentials to a service provider in connection with a request to access a managed service. The validity of the generated tokens and/or other credentials may be verified by an authentication service in communication with the service provider.

Abstract: Disclosed are various approaches for performing biometric authentication of users using an application running on a client device. A biometric model can be trained using biometric data from a population of users. The biometric model can be used by the client application to authenticate users and can be separate from system-level biometric authentication capabilities of the client device.

Abstract: Systems and methods for passing account authentication information via parameters. A server can provide, to a client device, an account parameter derived from an account credential used to authenticate a first application to insert into a link. The link can include an address referencing a second application. The account parameter can be passed from the first application to the second application responsive to an interaction on the link. The server can receive from the second application of the client device, subsequent to passing the account parameter from the first application to the second application, a request to authenticate the second application including the account parameter. The server can authenticate the client device for the second application using the account parameter. The server can transmit, responsive to authenticating the client device for the second application, an authentication indication to the second application of the client device.

Abstract: Systems/Methods are disclosed of establishing a capability at a smartphone to be able to conduct a financial transaction and then using the established capability in performing the financial transaction by paying for a product. According to some embodiments, said establishing is performed responsive to sensing a physiological parameter and determining that the physiological parameter sensed satisfies a criterion. Then, an authorization to establish said capability is requested and, responsive to receiving the authorization, the capability to be able to conduct the financial transaction is established at the smartphone. The capability that has been established may then be used in performing the financial transaction responsive to the smartphone sensing proximity to an access point maintained by a vendor and responsive to the physiological parameter being sensed and satisfying the criterion.

Abstract: Methods, systems, and apparatuses are described herein for improving computer authentication processes by generating authentication questions based on the location of a user. Transaction data indicating a plurality of transactions associated with a user account may be received. Location data indicating a plurality of locations of a user device might be received. At least a subset of the plurality of transactions may be tagged, based on the location data, with an indication that a user was present for a respective transaction. For example, a location of a merchant might be compared to a user device location indicated by the location data. A plurality of authentication questions might be generated based on the subset of the plurality of transactions. Access to the user account might be provided based on responses to the plurality of authentication questions.

Abstract: A method is disclosed. The method includes establishing, by a first device, a wireless connection to a second device; transmitting a request, by the first device and to the second device, for location data indicative of a location of the second device; receiving, by the first device and from the second device, the location data indicative of the location of the second device; determining, by the first device, a distance between the first device and the second device based at least in part on the received location data; generating, by the first device, an altered value based on the received location data and the determined distance; and transmitting, by the first device and to the second device, the altered value and an account identifier associated with a user of the first device.

Abstract: A method is disclosed and includes receiving, by a record server computer from a first processing network computer, a token, a device identifier associated with a user device, a session identifier associated with a registration request, and metadata about the token, and then receiving a metadata request from a second processing network computer in response to the second processing network computer receiving an authorization request message comprising the token, and the device identifier and/or the session identifier. The metadata request comprises at least the device identifier and/or the session identifier. The method also includes retrieving, by the record server computer, metadata associated with the metadata request, and providing the metadata to the second processing network computer. The second processing network computer processes the authorization request message using the token and the metadata.

Abstract: Presented are user-friendly battery powered touchless identity card emulator systems and methods that allow existing ID management installations, such as physical card reader systems, to securely operate without requiring a physical key and irrespective of type, model, shape, and size of reader and card format. Various embodiments integrate wireless functionality to existing systems to enable mobile access to provide advanced user/identity management capabilities for access control systems.

Abstract: A smart door lock system and a control method thereof are proposed. More specifically, in the smart door lock system and the control method thereof, door-lock area information is displayed on an outer side of a door, the door-lock area information including: any one or more pieces of door-lock area state information on states of a door lock area entered through a door lock in which a smart door lock is installed; and door-lock area user information of users who use the door lock area.

Abstract: A method and a system for securely controlling a remote measurement device. A connection between at least one remote measurement device and a server, such as a server computer, connected to the Internet is established. By a firewall, the at least one remote measurement device is protected from unauthorized access via the Internet. In case of an event of the at least one remote measurement device, an event notification is sent from the at least one remote measurement device to the server via the firewall. A temporary access token is generated by the server in response to the event notification received from the remote measurement device. Access is temporarily granted to the at least one remote measurement device based on the temporary access token.

Abstract: Improved techniques for secure access to cloud-based services via a gateway proxy. The improved techniques can efficiently manage remote access to cloud-based services by local processing agents in a secure manner using an intermediate authentication token issued by a gateway proxy to authorized local processing agents. The intermediate authentication token can be used to obtain authentication credentials of service providers that are needed to access the cloud-based services that are offered by service providers. In some embodiments, the authentication credentials of service providers need only be distributed to the gateway proxy and need not be distributed beyond the gateway proxy. The improved techniques are well suited for used with robotic process automation systems in which local processing agents, such as software agents, perform user tasks in an automated fashion.