A method prevents unauthorized access to user data files on a computing device. The device receives a request from an application to open a data file (including file name path). The device determines whether the path corresponds to a designated storage location for user data files and determines whether access to the data file has previously been granted for the application. When the file is a user file with no permission for the application, the device uses a volition table to determine whether access volition has been asserted for the data file by the application within a preceding predefined period of time. When access volition has been asserted, the device permits the application to access the data file. When access volition has not been asserted, the device displays a user interface box prompting a user to decide whether or not to grant the application access to the data file.
Methods, systems, and devices for parsing text are described herein. A method of securing executable files is performed at a computing device having one or more processors and memory. The memory stories one or more programs configured for execution by the one or more processors. The computing device obtains source text that comprises a disassembled executable file and identifies, via a general parser module, the syntax of the source text by performing a recursive descent parsing of the source text. The device generates an abstract syntax tree (AST) for the source text based on the identified syntax and generates a transformed AST from the generated AST by replacing one or more system calls with respective protected system functions. The device also generates a secured executable file by assembling the transformed AST.
The various implementations described herein include methods and devices for preventing unauthorized access to files and networks. In one aspect, a method includes installing a first application at a computing device, the first application designated as writing to user files. Installing the first application includes: (i) storing application data files for the first application within a first portion of the memory, where files stored in the first portion are designated as read-only for the first application; and (ii) allocating a second portion of the memory for user data files to be used by the first application. The method further includes installing a second application at the computing device, the second application designated as writing to application data files. Installing the second application includes: (i) allocating a third portion of the memory for prototype writable application data files; and (ii) allocating a fourth portion of the memory for network-based data access.
Providing optical watermark signals for a visual authentication session by performing at least the following: receive, at an anti-spoof engine, an instruction to perform visual authentication operations for a visual authentication session, generate, with the anti-spoof engine, an optical watermark signal based on receiving the instruction, wherein the optical watermark signal includes at least one optical identifier to authenticate images captured during the visual authentication session, obtain, with the anti-spoof engine, an image source that includes captured images of the visual authentication session, determine, with the anti-spoof engine, whether the image source includes a reflected optical watermark signal, and compare, with the anti-spoof engine, whether the reflected optical watermark signal matches the generated optical watermark signal based on the determination that the image source includes the reflected optical watermark signal.
Updating computer program(s) installed on a programmable device using a distributed ledger that is based on cryptography and blockchain technology is described. A distributed ledger logic/module can commit, to the distributed ledger, a first configuration of a computer program installed on a device. The logic/module can also receive requests to apply a first update and a second update to the first configuration. The logic/module can receive a second configuration of the computer program that is based on the first update and the first configuration, and also commit the second configuration to the distributed ledger. Furthermore, the logic/module can determine that the second update cannot be applied to the first configuration and receive a third configuration of the computer program that is based on the second update and the second configuration. The logic/module can also commit the third configuration to the distributed ledger. Other advantages and embodiments are described.
Dynamically identifying and utilizing an opportunistic device by performing at least the following within a discovery offloading module: receive an offloading alert message from a service device, wherein the offloading alert message indicates the service device is unable to provide one or more services to the client device, receive a discovery message from a candidate device, wherein the discovery message indicates the candidate device is capable of performing the services provided to the client device, select, using the dedicated execution environment, an opportunistic service device based on the discovery message from the candidate device; and trigger the restart of host execution instruction within the client device by obtaining the one or more services from the opportunistic service device, wherein the discovery offloading module operates independently from the host execution instructions within the client device.
Pairing two devices includes detecting, by a first device, a trigger event that indicates that a second device is within a predetermined proximity, obtaining a first time stamp indicating a time of the trigger event as recorded by the first device, determining whether a difference between the first time stamp and a second time stamp satisfy a predetermine threshold, where the second time stamp indicates a time of the trigger event as recorded by the second device, and in response to determining that the difference between the first time stamp and the second time stamp satisfies the predetermined threshold, allowing the first device to pair with the second device.
Managing authentication of a child device includes receiving, by a host device, sensor data from a child device, deriving simplified authentication data from the sensor data based on a capability of the child device, storing the simplified authentication data in an authentication profile for the child device, and transmitting the simplified authentication data to the child device, wherein the simplified authentication data is sufficient to allow the child device to authenticate a user without the host device.
A method, a computer-readable medium, and a device for dynamically identifying criticality of services and data sources. Service-related metrics are received from all IoT network elements in a network. The service-related metrics are parsed to extrapolate a network topology. From the topology, a set of critical service delivery points are determined based on data extracted from the service-related metrics. The critical service delivery points may be monitored for service interruptions and alerts may be generated in response to interruptions. Additionally the extrapolated network topology may be compared to a previously recorded topology of the network, and based on the delta, alerts may be generated when the delta meets a threshold.
In an embodiment, a processor for Return Oriented Programming (ROP) detection includes at least one execution unit; a plurality of event counters, each event counter associated with a unique type of a plurality of types of control transfer events; and a ROP detection unit. The ROP detection unit may be to: adjust a first event counter in response to detection of a first type of control transfer events; in response to a determination that the first event counter exceeds a first threshold, access a first configuration register associated with the first event counter to read configuration data; identify a set of ROP heuristic checks based on the configuration data read from the first configuration register; and perform each ROP heuristic check of the identified set of ROP heuristic checks. Other embodiments are described and claimed.
G06F 21/52 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/71 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
G06F 21/81 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
A pre-boot initialization technique for a computing system allows for encrypting both a manufacturer and original equipment manufacturer firmware routines, as well as handing off data between the manufacturer and original equipment manufacturer firmware routines encrypted with a key provisioned in field programmable fuses with an original equipment manufacturer key. By encrypting the firmware routines and handoff data, security of the pre-boot initialization process is enhanced. Original equipment manufacturer updatable product data may also be encrypted with the original equipment manufacturer key. Additional security may be provided by using trusted input/output capabilities of a trusted execution environment to display information to and receive information from a user. Furthermore, multiple secure phases of configuration may be achieved using wireless credentials exchange components.
A graymail detection and filtering system predicts whether a user will consider an email to be graymail using a classifier model based on features extracted from the email. The email is labelled as graymail or non-graymail based on the prediction. User actions are tracked on the email to determine whether the user actually considered the email to be graymail or non-graymail and the classifier model is trained using machine learning techniques to improve the prediction, without requiring explicit user feedback on whether the user considered the email to be graymail or non-graymail.
An improved anti-malware protection system protects computers against exploits in a scripting language that may be run in a browser. The system comprises a recorder that records scripting language execution events, a trace generator that transforms the recorded scripting language execution events into an execution trace, and a security engine that scans the execution trace and advises a security software about exploits found in the execution trace. By hooking the recorder into a runtime application programming interface for the scripting language, the improved protection system can detect exploits dynamically without the need for a browser-dependent plugin. An optional plugin can be included to perform file-based analysis of the script in addition to the runtime analysis of the script. The system can provide an application programming interface that can be used by multiple security software programs from multiple vendors to create an enhanced security software product.
A cloud storage server-based approach allows detection of ransomware activity in cloud storage systems caused by ransomware infections on an endpoint device. A heuristic or rule- based technique is employed for recognizing sequences of file operations that may indicate ransomware activity. In some embodiments, users may be offered an opportunity to approve or disapprove of the possible ransomware activity. In others, cloud system file activity may be suspended or halted for the affected user upon recognition of possible ransomware actions. Enhanced recovery of files affected prior to recognition of the ransomware activity may be performed in some embodiments.
A computer readable storage medium, system and method for improving automated testing systems to include a first and second behavioral data. The first behavioral data is collected periodically and the second behavioral data is collected in real time. The receipt of the first behavioral data and a second behavioral data are followed by the receipt of a system configuration template. A test case is updated based on the first and second behavioral data, and an automated test environment is reconfigured based on the first behavioral data, second behavioral data, and the system configuration template. The test executes in the automated test environment producing a test result.
A flock of drones provide a drone-assisted mesh network for first responders. Network modules attached to the drones interconnect with other network modules and provide network access points for first responder devices, allowing the first responder devices to communicate with each other via the drone-assisted mesh network. The drones may autonomously reposition themselves to create a desired network coverages area, including adjusting the network coverage area as instructed via a drone controller. The network modules may communicate with a gateway to an external network, allowing first responder devices to communicate with the external network via the drone-assisted mesh network. Network modules may be selected for field-attachment to the drones based on characteristics of the first responder devices.
Technologies for a distributed Internet of Things (IoT) system are disclosed. Several IoT devices may form a peer-to-peer network without requiring a central server. Information may be stored in a distributed manner in the distributed IoT system, allowing for storing information without transmitting it to a remote server, which may be costly and introduce security or privacy risks. Each IoT device of the distributed IoT system includes a machine learning algorithm that is capable of uncovering patterns in the input of the distributed IoT system, such as a pattern of user inputs in certain situations, and the distributed IoT system may adaptively anticipate a user's intentions.
Particular embodiments described herein provide for system that can be configured to deliver a notification to a user based on the user's preference for each device that receives the notification. The user's preference is based on how the user interacted with similar notifications in the past and the system can change how it will deliver similar notifications to the user in the future based on how the user interacts with the notification.
Particular embodiments described herein provide for an electronic device that can be configured to analyze data to determine one or more unique topics for a first class and one or more common topics that are common with the first class and a second class, where the topics that are common with the first class and the second class include one or more subtopics, assign one or more classifications to the data based, at least in part, on the one or more subtopics, and store the one or more classifications assigned to the data in memory. The one or more unique topics and one or more common topics can be determined by using a Jaccard Index. Also, the one or more subtopics can be determined using Latent Dirichlet Allocation.
Providing security to a device includes detecting, in a first device, a first function call, determining whether the first function call is forbidden for the first device, and in response to determining that the particular function is forbidden for the first device, preventing the function call from executing.
Preventing anomalous connections includes detecting by a programmable device an attempt by a first device to connect to a second device, detecting a first connection anomaly responsive to characteristics of the first device and characteristics of one or more other devices, and prohibiting a connection between the first device and the second device responsive to detecting the first connection anomaly.
In an example, a system and method for predictive user authentication is disclosed. The system may include proximity sensors, computer vision systems, and other provisions for monitoring users' movements throughout a facility. A predictive security engine may also be programmed with heuristic data to recognize such factors as a user's face, gait, or average appearance. When a user approaches a terminal, the system may preemptively compute a confidence score regarding the user's authenticity. Based on the confidence score, the system will determine how much additional authentication is necessary. The system may also provide context-sensitive data to the user based on location or activities. Thus, authentication to the system is made easier to the user, and the user receives more relevant data for his or her activities.
Particular embodiments described herein provide for an electronic device that can be configured to receive script data, determine a checksum tree for the script data, compare each checksum of the checksum tree to one or more subtree checksums, and assign one or more classifications to the script data. In one example, the checksum tree is an abstract syntax tree.
Particular embodiments described herein provide for an electronic device that includes a binder kernel driver. The binder kernel driver can be configured to receive an application program interface (API) call, extract metadata from the API call, determine that the API call should be hooked based on the extracted metadata, and hook the API call.
Securely distributing a backup file includes identifying a file to be stored, generating a plurality of file chunks from the file, transmitting from a first device, each of the plurality of file chunks to one of a plurality of storage locations, and generating, at the first device, a map that identifies the storage location for each chunk. Retrieving a distributed backup file includes receiving a request to retrieve a file, obtaining a map corresponding to the file, wherein the map identifies a storage location for each of a plurality of file chunks of the file, retrieving the plurality of file chunks from the identified locations, and generating the requested file by combining the plurality of file chunks.
G06F 11/14 - Error detection or correction of the data by redundancy in operation, e.g. by using different operation sequences leading to the same result
H04L 9/30 - Public key, i.e. encryption algorithm being computationally infeasible to invert and users' encryption keys not requiring secrecy
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
26.
MEMORY ACCESS PROTECTION USING PROCESSOR TRANSACTIONAL MEMORY SUPPORT
Technologies for detecting unauthorized memory accesses include a computing device with a processor having transactional memory support. The computing device executes a security assistance thread that starts a transaction using the transactional memory support. Within the transaction, the security assistance thread writes arbitrary data to one or more monitored memory locations. The security assistance thread waits without committing the transaction. The security assistance thread may loop endlessly. The transactional memory support of the computing device detects a transactional abort caused by an external read of the monitored memory location. The computing device analyzes the transactional abort and determines whether a security event has occurred. The computing device performs a security response if a security event has occurred. The monitored memory locations may include memory-mapped operating system libraries, kernel data structures, executable images, or other memory structures that may be scanned by malicious software. Other embodiments are described and claimed.
Distributed favorite files are stored in a favorite storage device. An agent dynamically monitors usage statistics for a plurality of files, wherein the plurality of files are located on a plurality of devices, designates a first file of the plurality of files as a favorite file based on usage statistics for the first file, and in response to designating the first file as a favorite file, stores a copy of the first file on a favorites storage device.
Particular embodiments described herein provide for an electronic device that can be configured to intercept a process, store execution profiling for the process if the process involves a privileged resource or a privileged operation, and analyze the code involved in each stack frame to determine malicious activity. If the process does not involve a privileged resource or a privileged operation, then the process is not analyzed.
Particular embodiments described herein provide for an electronic device that can be configured to identify a process running on the electronic device, assign a reputation to the process if the process has a known reputation, determine if the process includes executable code, determine a reputation for the executable code, and combine the reputation for the executable code with the reputation assigned to the process to create a new reputation for the process.
Particular embodiments described herein provide for an electronic device that can be configured to acquire a plurality of reputations related to an object and combine the plurality of reputations to create a total reputation for the object. The object can include a plurality of sub-objects and each of the plurality of reputations can correspond to one of the sub-objects.
Systems and methods for real-time user verification in online education are disclosed. In certain example embodiments, user identifying information associated with a user and a request to access online education content may be received from a user device. A face template including historical facial image data for the user can be identified. Current facial image data can be compared to the face template to determine if a match exists. Biometric sensor data, such as heart rate data, may also be received for the user. The biometric sensor data may be evaluated to determine if the user is currently located at the user device. If the user is currently located at the user device and the current facial image data matches the face template, access to the online education content may be provided to the user at the user device.
G06Q 20/40 - Authorisation, e.g. identification of payer or payee, verification of customer or shop credentialsReview and approval of payers, e.g. check of credit lines or negative lists
32.
DETERMINING A REPUTATION THROUGH NETWORK CHARACTERISTICS
Particular embodiments described herein provide for an electronic device that can be configured to monitor network traffic to and from a device, compare the monitored network traffic to characteristics of the device to determine if the monitored traffic is outside the characteristics of the device, and take remedial action if the monitored traffic is outside the characteristics of the device.
In an example, a DHN (DHN) is provided for enabling grantees to access digitally- controlled assets of a principal. The principal (level 0) establishes a digital testament (DT), identifying one or more grantees on levels 1 - n. Each grantee receives a digital heritage certificate (DHC), which may be based on the PKI certificate definition. The DHC includes a "PREDECESSORS" field, identifying one or more predecessor certificates that must be revoked before the DHC is valid. All grantee DHCs have the principal's level 0 DHC as a predecessor certificate. Level n certificates may also be valid only if all certificates at level n— 1 have been revoked. In practice, a DHC may be revoked when a user of the certificate passes away, so that nth generation grantees inherit only when generation n— 1 has passed away.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
H04L 29/06 - Communication control; Communication processing characterised by a protocol
34.
EXECUTION PROFILING DETECTION OF MALICIOUS OBJECTS
In an example, there is provided a system and method for execution profiling detection of malicious software objects. An execution profiling (EXP) engine may be provided in conjunction with a binary translation engine (BTE). Both may operate within a trusted execution environment (TEE). Because many malware objects make assumptions about memory usage of host applications, they may cause exceptions when those assumptions prove untrue. The EXP engine may proactively detect such exceptions via the BTE when the BTE performs its translation function. Thus, malicious behavior may be detected before a binary runs on a system, and remedial measures may be provided.
In an example, a computing device may have an input verification engine (IVE) that provides input verification services within a trusted execution environment (TEE), including a memory enclave. Taking a Java-based Android application as an example, the IVE securely verifies and validates user inputs for sensitive computing applications, without exposing the inputs to external applications. The IVE may be implemented in native C/C++ or similar, or may provide instructions to dynamically provision an enclave and import a minimal Java Virtual Machine (JVM) into the enclave so that the IVE can run in Java. The IVE may also contain binary analysis tools to analyze an input binary to identify and tag portions that receive user input, so that in a binary translation, those portions can be run within the enclave.
In an example, a computing device includes a trusted execution environment (TEE), including an enclave. The enclave may include both a binary translation engine (BTE) and an input verification engine (IVE). In one embodiment, the IVE receives a trusted binary as an input, and analyzes the trusted binary to identify functions, classes, and variables that perform input/output operations. To ensure the security of these interfaces, those operations may be performed within the enclave. The IVE tags the trusted binary and provides the binary to the BTE. The BTE then translates the trusted binary into a second format, including designating the tagged portion for execution within the enclave. The BTE may also sign the new binary in the second format and export it out of the enclave.
G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
G06F 21/52 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure
In an example, a system and method for real-time mobile security posture updates is provided. A mobile device management (MDM) agent may run on the mobile device, and may register with the operating system one or more mobile security posture change events that may affect the mobile security posture. These may include, for example, installation of an MDM agent, uninstallation of a program, connecting to a secured or unsecured network, or similar. When any such event occurs, the OS lodges the event with the MDM agent, which then communicates with an MDM server engine to potentially receive new security instructions. Lodging the event may include providing a joint user-and-device authentication to the MDM server, such as via SAML.
Particular embodiments described herein provide for an electronic device that can be configured to include an authentication module. The authentication module can be configured to receiving a request to access an electronic device, where the electronic device is separate from the authentication module, collect authentication data, communicate the authentication data to a network element, receive an authentication key, and communicate the authentication key to the electronic device.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
Technologies are provided in embodiments to establish trust between a trusted execution environment (TEE) and a peripheral device. Embodiments are configured to communicate with an attestation server to generate an encryption key, and to establish, using the encryption key, a secure connection with an authentication server to enable communication between the authentication server and the peripheral device. Embodiments are also configured to receive a pairwise master key if the peripheral device is authenticated and to receive a trusted communication from the peripheral device based, at least in part, on the pairwise master key. Embodiments may also be configured to identify a connection to the peripheral device before the peripheral device is authenticated to the authentication server, receive an identifier from the peripheral device, and establish a connection to an attestation server based on at least a portion of the identifier.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
This disclosure describes systems, methods, and computer-readable media related to an incident response tool using data exchange layer. In some embodiments, a data collector may be generated by an incident response server. The incident response server may transmit a data collector to multiple broker servers, where each broker server may transmit the data collector to multiple user devices associated with the broker server. The incident response server may receive data from the data collectors executing on the user devices and may analyze the received data.
Certain embodiments herein relate to pairing an external device and a computer using a random user action. The random user action may be generated based on the type of device. After an external device is connected to the computer, the external device is segregated from one or more resources of the computer. A random user action based on the device type, and to be received from the external device, is generated and requested. If the random user action is received, the external device is paired with the computer and provided access to the one or more resources of the computer.
Particular embodiments described herein provide for an electronic device that can be configured to determine when a peripheral is connected to the electronic device, determine a peripheral identification for the peripheral, and monitor the data going to and from the peripheral. Based on the monitored data, a type for the peripheral can be determine. The peripheral identification can be compared with the determined type for the peripheral and if they do not match, then communication to and from the peripheral can be blocked.
Particular embodiments described herein provide for a portable electronic device that can be configured to receive data from an electronic device, where the portable electronic device is removably connected to the electronic device and receives its operating power from the electronic device. The portable electronic device can analyze the data using at least a portion of a protected area of memory located in the portable electronic device to determine if the data is malicious, where the protected area of memory is not accessible by the electronic device. The portable electronic device can also include an operating system and processor that is independent of an operating system of the electronic device.
G06F 21/79 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
Particular embodiments described herein provide for an electronic device that can be configured to identifying a digital certificate associated with data and assigning a reputation to the digital certificate, where the digital certificate is classified as trusted if the digital certificate is included in an entry in a whitelist and the digital certificate is classified as untrusted if the digital certificate is included in an entry in a blacklist.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
H04L 29/06 - Communication control; Communication processing characterised by a protocol
In an example, a system and method are provided for validating the sender of a message, such as an e-mail, text message, voice mail, network message, internet posting, or other electronic message. An authenticity server engine may first prescreen the message with anti-spam, anti-malware, and other filters. The screened message is then provided to the end user. If the end user deems the message suspicious, he may request additional validation. The authenticity server engine may then apply an example four-phase validation scheme, including analyzing header data for consistency with the message body, analyzing public data sources, analyzing private data sources, and receiving a result of an off-channel challenge to the sender. The server may then assign the message a sender validity confidence score.
In an example, a computing device may include a trusted execution environment (TEE) for executing signed and verified code. The device may receive a trusted binary object in a first form, but the object may need to be converted to a second format, either on-the-fly, or in advance. This may include, for example, a bytecode interpreter, script interpreter, runtime engine, compiler, just-in-time compiler, or other species of binary translator. The binary translator may be run from the TEE, and the output may then be signed by the TEE and treated as a new trusted binary.
G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
In an example, a system and method for outbreak pathology inference are described. In certain computational ecosystems, malware programs and other malicious objects may infect a machine, and then attempt to infect additional machines that are "networked" to the first machine. In some cases, the network may be a physical or logical network, such as an enterprise network. However, "social networking" may also connect one machine to another, because users may share files or data with one another over social networks. In that case, client devices may be equipped with a telemetry engine to gather and report data about the machine, while a system management server receives reported telemetry. The system management server may use both logical networks and social networks to infer potential outbreak paths and behaviors of malware.
In an example, a system and method are described for providing trusted updaters and trusted processes. An updater may be subject to a whitelist of files that it, and any child processes, are allowed to modify. But trust inheritance may break across reboots and over interprocess communication. Thus, it is desirable to provide a system and method to maintain trust across such events. In the case of a trusted installer, inheritance may be maintained by cross referencing a digital certificate to a workflow grid. In the case of updater processes, trust may be maintained by using a combination of digital certificates that are part of a trust chain and a unique identifier for each trust chain workflow.
The present disclosure relates to receiving a request for recovery of an account associated with a user, sending a CAPTCHA challenge to a user device associated with the user, receiving an answer to the CAPTCHA challenge and a confirmation code wrapped by an encryption key derived from a provisional master password, sending a notification of the request for recovery to one or more trusted entities associated with the user, and receiving a confirmation of the request from one or more of the trusted entities. The confirmation includes a recovery token associated with the particular trusted entity and an encrypted confirmation code.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
The present disclosure relates to a system and method for providing conditional login promotion. An example system includes at least one processor and at least one memory element, wherein the system is configured for receiving an indication of a local operating system login by a user from a client device associated with the user; receiving one or more authentication factors associated with the user from the client device; and determining whether the local operating system login is to be promoted to a relying party entity based upon the one or more authentication factors associated with the user.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
In an example, there is disclosed a computing apparatus, including: a network interface; one or more logic elements providing a security orchestration server engine operable for: receiving contextual data from a client via a network interface; providing the contextual data to a security orchestration state machine, the security orchestration state machine operable for deriving a policy decision from the contextual data; and receiving the policy decision from the policy orchestration state machine. There is also disclosed one or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions for providing a security orchestration engine, and a method of providing a security orchestration engine.
Computing platform security methods and apparatus are disclosed. An example apparatus includes a security application to configure a security task, the security task to detect a malicious element on a computing platform, the computing platform including a central processing unit and a graphics processing unit; and an offloader to determine whether the central processing unit or the graphics processing unit is to execute the security task; and when the graphics processing unit is to execute the security task, offload the security task to the graphics processing unit for execution.
G06F 21/50 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
G06F 21/78 - Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
Computing platform security methods and apparatus are disclosed. An example apparatus includes a security application to configure a security task, the security task to detect a malicious element on a computing platform, the computing platform including a central processing unit and a graphics processing unit; and an offloader to determine whether the central processing unit or the graphics processing unit is to execute the security task; and when the graphics processing unit is to execute the security task, offload the security task to the graphics processing unit for execution.
In one or more examples, there is disclosed a system and method of detecting agent presence for self-healing. An out-of-band monitoring process, such as Intel® AMT, or any process in firmware executing on a co-processor, may monitor one or more processes to determine if one goes down or otherwise meets a security criterion. Crashed processes may be reported to an enterprise security controller (ESC). The ESC may notice trends among affected machines and instruct the machines to take appropriate remedial action, such as booting from a remedial image.
In an example, a client-server platform identity architecture is disclosed. The platform identity architecture may be used to enable a venue operator to provide online services and to collect telemetry data and metrics while giving end users greater control over privacy. When entering a compatible venue, the user's device generates a signed temporary pseudonymous identity (TPI) in secure hardware or software. Any telemetry uploaded to the venue server includes the signature so that the server can verify that the data are valid. The TPI may have a built-in expiry. The venue server may thus receive useful tracking data during the term of the TPI, while the user is assured that the data are not kept permanently or correlated to personally-identifying information.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
Particular embodiments described herein provide for an electronic device that can be configured to receive data in a data flow, extract a data visa from the data flow, wherein the data visa is related to the data, and determine a reputation of the data from the data visa. The data visa can include reputation determination information obtained by previous network elements in the data flow. In addition, the electronic device can update the data visa, and communicate the updated data visa and data to a next network element in the data flow.
In an example, there is disclosed a security architecture for enhanced, non-invasive whitelisting of executable objects. When an executable object tries to perform an action, a security engine seamlessly intercepts the action and determines whether the action is whitelisted, blacklisted, or graylisted, assigning the action a corresponding security score. Whitelisted actions may be allowed, blacklisted actions may be disallowed, and graylisted actions may require additional verification from a user. Because the score is assigned to the combination of the executable object and the action, false positives may be avoided, such as those that may occur when an executable object is prefetched but has not yet tried to perform any useful work.
In an example, a stack protection engine is disclosed for preventing or ameliorating stack corruption attacks. The stack protection engine may operate transparently to user- space processes. After a call to a subroutine from a parent routine, the stack protection engine encodes the return address on the stack, such as with an exclusive or cipher and a key selected from a key array. After the subroutine returns control to the main routine, the stack protection engine decodes the address, and returns control. If a stack corruption attack occurs, the malicious return address is not properly encoded, so that when decoding occurs, the program may simply crash rather than returning control to the malicious code.
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/52 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure
59.
DETECTION AND MITIGATION OF MALICIOUS INVOCATION OF SENSITIVE CODE
Particular embodiments described herein provide for an electronic device that can be configured to identify regions of code to be monitored, probe and lock code pages that include the identified regions of code, and remap the code pages as execute only. The code pages can be remapped as execute only in an alternate extended page table view.
In an example, one or more computing devices operate to provide a context-aware reputation of a place, such as in relation to a human user. Context may include the user's identity and purpose, as well as environmental factors such as time of day, weather, and political drivers. The device may communicate with a server to receive globalized safety intelligence. When the user enters a zone, the device may determine a context-sensitive reputation, such as "Green," "Yellow," or "Red." Depending on the reputation, the device may then take an appropriate action, such as warning the user or providing additional information.
G08B 21/02 - Alarms for ensuring the safety of persons
G08B 5/36 - Visible signalling systems, e.g. personal calling systems, remote indication of seats occupied using electric transmissionVisible signalling systems, e.g. personal calling systems, remote indication of seats occupied using electromagnetic transmission using visible light sources
61.
DATA MINING ALGORITHMS ADOPTED FOR TRUSTED EXECUTION ENVIRONMENT
Distributed systems for protecting networked computer assets from compromise are disclosed. The distributed system includes one or more enterprise event sources, such as endpoint(s). The system also includes a server, such as a Big Data Analytics server, and optionally a security management server such as a Security Information and Event Management server. The Big Data Analytics server processes data collected from the enterprise event sources and produces behavioral profile models for each endpoint (or group of similar endpoints). The profiles, models, and ontology analysis are provided to the endpoints. Endpoint analytics use the output from the analytics servers to detect deviations from the endpoint' s behavioral profile.
A collection of wearable communicating devices generates signals that may be detected and analyzed to produce a fingerprint of the collection of wearable devices. An analysis unit may recognize patterns or other information in detected signals and generate a fingerprint of a body area network corresponding to the collection of wearable devices. The fingerprint may be fuzzy fingerprint, matchable with a fingerprint of a similar, but not necessarily identical, collection of wearable devices that has been previously generated or obtained. The fingerprint may be used for tracking or other purposes. Some embodiments may allow the generation of additional signals that modify the fingerprint.
Particular embodiments described herein provide for an electronic device that can be configured to receive untrusted input data at an enclave in an electronic device, isolate the untrusted input data from at least a portion of the enclave, communicate at least a portion of the untrusted data to an integrity verification module using an attestation channel, and receive data integrity verification of the untrusted input data from the integrity verification module. The integrity verification module can perform data integrity attestation functions to verify the untrusted data and the data integrity attestation functions include a data attestation policy and a whitelist.
In an example, a vulnerability assessment engine is disclosed. The vulnerability assessment engine may include a shim application and a shim agent. The shim application sits at a relatively low level in an operational stack, such as just above the operating system itself. It may intercept system calls through operating system hooks or other means, so as to determine whether an action taken by an executable object should be allowed. The vulnerability assessment engine sends an identifier, such as a common platform enumeration (CPE)-like string to a server, which queries a database to determine a response code for the action. The response code may indicate that the action should be allowed, blocked, allowed with a warning, or other useful action. A shim agent may also be installed to receive notifications from the server or to query the server for available updates or patches for the executable object.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/50 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
In an example, a mobile device is configured to automatically lock when a detector, such as a GPS receiver, determines that the device is in motion above a certain speed threshold, such as 10 mph. Additional detectors may be used to determine whether the device is operated by the user or by a passenger, so that intelligent decisions can be made about whether to lock the device. During the lock, certain selected apps such as a GPS navigation system or music player may be enabled, with limited controls as appropriate. In some cases, hands-free operations may be available. The mobile device may also be configured to provide an automated response to incoming calls and messages.
In an example, a detection engine identifies potential malware objects according to behavior. In order to circumvent blacklists and fingerprint-based detection, a malware server may frequently change domain names, and change the fingerprints of distributed malware agents. A malware agent may perform only an initial DNS lookup, and thereafter communicate with the malware command-and-control server via "naked" HTTP packets using the raw IP address of the server. The detection engine identifies malware agents by this behavior. In one example, if an executable object makes repeated HTTP requests to an address after the DNS lookup "time to live" has expired, the object may be flagged as potential malware.
In an example, a cross-view detection engine is disclosed for detecting malware behavior. Malware may attempt to avoid detection by remaining in volatile memory for as long as possible, and writing to disk only when necessary. To avoid detection, the malware may also provide a pseudo-driver at a file system level that performs legitimate-looking dummy operations. A firmware-level driver may simultaneously perform malicious operations. The cross-view detection engine detects this behavior by deconstructing call traces from the file system-level operations, and reconstructing call traces from firmware-level operations. If the traces do not match, the object may be flagged as suspicious.
Particular embodiments described herein provide for an electronic device that can receive, at a rating system, a request for a data rating of data, determine a rating type for the data, receiving rating logic for the rating type, and rate the data using the rating logic. The rating logic for the rating type is included in a dedicated rating database. Also, the rating logic may separate from the rating system and the rating logic can be updated without having to update the rating system.
In an example, a classification engine compares two binary objects to determine whether they can be classified as belonging to a common family. As an example application, the classification engine may be used to detect malware objects derived from a common ancestor. To classify the object, the binary is disassembled and the resulting assembly code is normalized. Known "clean" functions, such as compiler-generated library code, are filtered out. Normalized blocks of assembly code may then be characterized, such as by forming N-grams, and checksumming each N-gram. These may be compared to known malware routines.
Systems and methods for detection of domain generated algorithms (DGA) and their command and control (C&C) servers are disclosed. In one embodiment, such an approach includes examining DNS queries for DNS resolution failures, and monitoring certain set of parameters such as number of levels, length of domain name, lexical complexity, and the like for each failed domain. These parameters may then be compared against certain thresholds to determine if the domain name is likely to be part of a DGA malware. Domain names identified as being part of a DGA malware may then be grouped together. Once a DGA domain name has been identified, activity from that domain name can be monitored to detect successful resolutions from the same source to see if any of the successful domain resolutions match these parameters. If they match specific thresholds, then the domain is determined to be a C&C server of the DGA malware and may be identified as such.
A technique allows associating host applications and user agents in network traffic and detecting possible malware without relying on signatures of the user agents. A database of host applications and user agents is maintained, allowing automatic update of the database when a new application or new application to user agent mapping is discovered. Partial matches may be made when a change is made to the application, allowing learning the new mapping automatically. If an application is associated with more than a threshold number of user agents, an indication may be generated that the application is suspicious and possibly malware.
In an example, a network is described with a plurality of data sources. Each data source may provide a feature, such as a data type that the data source collects or generates. A data aggregator may be connected to the network, and configured to collect, classify, and merge features as appropriate. The data aggregator includes a discriminator for classifying features, a merger, unmerger, converter, and evaluator. Features are provided to one or more expert systems configured to control one or more systems based on the features. Feedback to the data aggregator is used to evaluate the success of a merge. When a merge is found to be unhelpful, features may be unmerged.
Technologies for secure content packaging include a source computing device that transmits a secure package to a destination computing device. The destination computing device establishes a content policy trusted execution environment and a key policy trusted execution environment. The content policy trusted execution environment may be established in a secure enclave using processor support. The key policy trusted execution environment may be established using a security engine. The key policy trusted execution environment evaluates a key access policy and decrypts a content key using a master wrapping key. The content policy trusted execution environment evaluates a content access policy and decrypts the content using the decrypted content key. Similarly, the source computing device authors the secure package using a content policy trusted execution environment and a key policy trusted execution environment. The master wrapping key may be provisioned to the computing devices during manufacture. Other embodiments are described and claimed.
Particular embodiments described herein provide for an electronic device that can be configured to receive a function call for a function, determine a current stack pointer value for the function call, and determine if the current stack pointer value is within a pre-defined range. The electronic device can include a stack pivoting logging module to log a plurality of function calls. The electronic device can also include a stack pivoting detection module to analyze the log of the plurality of function calls to determine, for each of the plurality of function calls, if the current stack pointer value is within a pre-defined range.
G06F 21/52 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure
G06F 21/50 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
By way of example, a computing system may include an enclave or other similar secured memory location or process. When the system receives new content or data, it may classify the content as potentially harmful and initially render and display the content in the enclave. The user may then select portions of the content to enable or disable in a final version. The content may also be converted to a known "safe" equivalent format that always renders in the enclave. Enclave-rendered content may be signed by the enclave so that they can be considered "trusted" so long as the certificate remains valid and the content is correctly signed.
A tracking station detects a mobile data processing system (DPS) within communication range of a short range wireless module of the tracking station. In response to detecting the mobile DPS, the tracking station obtains identification data for the mobile DPS from a security module of the mobile DPS. The tracking station uses the identification data to obtain credentials to access secure storage on the mobile DPS. The tracking station automatically generates security configuration data for the mobile DPS, based on multiple factors pertaining to the mobile DPS, such as identity of the mobile DPS, a location of the mobile DPS, capabilities of the mobile DPS, etc. The tracking station uses the credentials to write the security configuration data to the secure storage of the mobile DPS. The security configuration data calls for the mobile DPS to automatically disable or enable at least one component. Other embodiments are described and claimed.
An example touch key system may include a master device, one or more carrier devices and protected devices, and a server. The master device may automatically detect a predefined trigger action. In response, the master device may automatically generate a carrier device credential and a corresponding cloud credential. The master device may then automatically send the cloud credential to the server. The master device may also automatically detect the carrier device in electrical communication with the master device. In response, the master device may automatically determine whether the carrier device credential from the key pair is intended for the carrier device. If so, the master device may automatically transfer the carrier device credential to the carrier device. The carrier device may use the carrier device credential to obtain access to the protected device. Other embodiments are described and claimed.
Systems and methods are provided in example embodiments for mitigating malicious calls. The system can be configured to receive a function call, determine the location of a memory page that initiated the function call, determine if the memory page is associated with a trusted module, and block the function call if the memory page is not associated with the trusted module. In addition, the system can determine the return address for the function call and block the function call if the return address does not belong to the trusted module. Further, the system can determine a parameter for the function call, determine if the parameter is a known parameter used by the process that called the function, and block the function call if the parameter is not the known parameter used by the process that called the function.
Particular embodiments described herein provide for an electronic device that can be configured to determine that a program related to a process begins to run, trace events related to the program when it is determined that the program should be monitored, and determine a number of events to be traced before the trace is concluded. The number of events to be traced can be related to the type of program. In addition, the number of events that are traced can be related to the activity of the program. A number of child events to be traced can be determined if the program has a child program. The traced child events can be combined with the events traced and the results can be analyzed to determining if the process includes malware.
Systems and methods are provided in example embodiments for mitigating malicious calls. The system can be configured to determine a series of checksums for a file, compare the series of checksums to a checksum tree, where the checksum tree includes a plurality of nodes that each include a fuzzy checksum of known malware, and assign one or more classifications to the file, where each of the one or more classifications is based on each node of the checksum tree that matches a checksum in the series of checksums and includes whether the file includes malware or benign checksums.
Systems, devices and methods are disclosed to assist in configuring devices and policies to protect a regional network (e.g., home network) and its users. Users on the network are monitored to determine appropriate configuration settings and preferences by utilizing a combination of internally configured information and externally gathered information for each user. For example, externally gathered information may include information obtained about a user from one or more social media Internet sites. Automatically obtained information may be used to provide or augment policy information such that a user's preference relative to internet content (e.g., content blocking software configuration) may be achieved without requiring an administrator to individually prepare each users security profile and configuration.
In an example, an audio stream such as a voice call or live-streaming service may have mixed therein a user identification, which may identify the user as an authorized participant in the audio stream. For example, a user may identify himself to a smart phone, and then initiate a call with his bank. The smart phone may mix a user identification into the voice stream. A receiving device at the bank may demix the identification, and determine that the user is authorized to call about this account. In another example, identification may be used for DRM purposes, to identify a user as a legitimate participant in an audio stream. When a user is not authorized, an appropriate action may be taken, such as dropping the user, degrading the quality of the audio stream, or providing a notification that the user is not authorized.
A system is disclosed that includes a processor including watermark logic to output a first watermark to an output device that outputs a first watermark signal, based on the first watermark, to an acoustic transmission medium. The processor also includes recording logic to capture, at a first time period, an authentication submission comprising the first watermark signal convolved, via the acoustic transmission medium, with a first passphrase signal. The system also includes a dynamic random access memory (DRAM). Other embodiments are disclosed and claimed.
A technique allows for transparently managing, suspending, restoring, sharing, limiting and migrating user sessions on a device without having access to user credentials. A user may automatically log in and out of each or all their online accounts instantaneously and, in doing so, the user may share sessions without sharing passwords across client devices as well as with other authenticated and authorized users. Sharing may be done in a secure manner with the initiating- user being able to restrict shared session rights, as well as being able to remove access to each of the shared sessions.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
A geo-location provider station signs geo-location data and a previous signature provided by a mobile device, returning a new signature to the mobile device. The mobile device uses the new signature when requesting a signature from another geo-location provider station. The mobile device stores the geo-location data and the signatures provided by geo-location provider stations. The stored geo-location data may be verified upon request by using the stored signature data.
In one example, a data security system may determine prevalence of a file based query data for an object (e.g., a file or a hash or a file). An example algorithm may provide using a statistically justifiable estimate of the prevalence while storing few data records, and therefore may provide prevalence information in O(1) time complexity (i.e., constant time). Such an algorithm may be applied in near real-time to provide, e.g., an immediate response to a query for the prevalence of a file.
Technologies for detecting unauthorized memory accesses include a computing device having transactional memory support. The computing device executes a transactional memory execution envelope within a security thread. Within the transactional envelope, the security thread reads one or more memory locations. The computing device detects a transactional abort originating from the transactional envelope, and determines whether a security event has occurred. A security event may include an unauthorized write to the monitored memory locations from outside the transactional envelope, including from non-transactional code. The computing device reports any security events that are detected. The computing device may execute several security threads that each monitor a different, non-overlapping memory location. The computing device may spawn a new security thread to monitor a memory location while a previous security thread is handling a transactional abort. Other embodiments are described and claimed.
Methods and processes are disclosed for iOS based systems and mobile devices that permit a user to securely inject passwords and related information into environments that are traditionally impossible to control, along with preserving the security of confidential information against third party attacks be they intrusive or already embedded. The methods and processes utilize a locally installed proxy securely communicating with a remote server that permit injecting a secret into the code on devices that otherwise would not have the option of doing so. In at least one embodiment this is done by using network hooks and controlling the data flow between the injected component, a proxy and an application. It is contemplated that the user can control which credentials are used, without revealing them and minimizing attacker discovery.
H04L 12/22 - Arrangements for preventing the taking of data from a data transmission channel without authorisation
H04L 9/00 - Arrangements for secret or secure communicationsNetwork security protocols
H04L 9/06 - Arrangements for secret or secure communicationsNetwork security protocols the encryption apparatus using shift registers or memories for blockwise coding, e.g. D.E.S. systems
89.
MECHANISMS FOR CONSERVING RESOURCES OF WEARABLE DEVICES
The present disclosure relates to a system and method for providing a service on a wearable device where the wearable device is limited in its functionality in some way when compared with a companion device. In particular, the disclosure describes use cases for configuring the wearable device, and use cases for configuring a wearable device and performing service application functions on the wearable device while leveraging a companion device.
The present disclosure relates to a system and method for providing a secure context exchange cloud service which enables context information to be shared among devices, and providing a safety application which utilizes the context information being shared. In one example, the context exchange cloud service provides secure exchange of the context information, which in turn enables a safety application to enhance personal safety.
Particular embodiments described herein provide for an electronic device that can be configured to receive a request to share data, determine metadata for the data to be shared, communicate the metadata to a social drive, where the social drive is separate from the electronic device and the data is not located on the social drive, and communicate the shared data to a member of the social drive when the member requests the data.
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
An executable file is loaded into memory. The executable file is analyzed to determine whether one or more dynamically linked libraries are referenced in an import table of the file. It can then be determined whether one or more dynamically linked libraries is adapted to contact a network
Systems and methods for detection of malicious exploitations in a multimedia file are disclosed. In one embodiment, such an approach includes parsing the compiled bytecode of a multimedia file to detect identified key instructions and determine if such key instructions are repeated in specific patterns that signify the presence of malicious exploitation. The approach may also include examining the contents of the constant pool table in a compiled multimedia file to detect specific shellcode strings that are indicative of presence of malicious exploitation. When the bytecode or the constant pool table indicates that malicious exploitation is present, an approach may be utilized to reduce instances of false positive identification of malicious exploitation.
By hooking application programming interfaces in an execution environment, the return address for hooked application programming interface calls can be logged and used to determine when a packed binary has been unpacked. In one approach, memory allocations are detected and the return address is checked against the memory regions allocated. In another approach, the contents of memory at the return address in a pre-execution copy of the executable binary is compared with the contents of memory at the return address in the executing copy of the binary. This allows efficient detection of the completion of unpacking without knowledge of the unpacking technique. The unpacked binary may then be analyzed for possible malware.
In an example embodiment, there is disclosed an anti-malware system and method that analyzes applications and other executable objects at the subroutine level. Each subroutine may be assigned an execution frequency score, which may be based on simulated execution in an insulated environment, on real-world operating conditions, or on static analysis. Each subroutine may be assigned an execution frequency score based on how frequently it is executed. Based on this score, each subroutine may also be assigned a reputation score. To aid in cross-referencing to occurrences of the same subroutine in other applications, the subroutine may also be assigned a pseudo-unique identifier, such as a fuzzy fingerprint.
Systems, devices and methods to protect a regional network (e.g., home network) by monitoring devices connected to and attempting to connect to the regional network. Monitoring includes assessing and addressing security concerns regarding devices attempting to or available to connect to the regional network as well as monitoring configurations and activity of connected devices. Devices to monitor include: computers, Personal Digital Assistants (PDAs), laptops, tablets, home appliances, smartphones, smart televisions, and any other type of device in the logical proximity of the regional network.
A firewall provides improved network security by allowing the use of dynamic objects in firewall rules, where the dynamic objects evaluate to a variable set of devices. The dynamic objects may be updated from real-time data sources and non-real time inventories of data. Dynamic objects may be used for either or both of source and destination in a firewall rule. Where the dynamic object includes non-real time data, the dynamic object may be synchronized with the non-real time data inventory on a configurable basis. By using dynamic objects, the firewall can provide flexibility in the rules to allow control over user-owned and controlled devices.
A pre-encryption process for symmetric encryption processes that inputs a bit stream into any existing or future encryption standard to increase encryption complexity with a disproportionate increase in processing time. The first encoding step is the two-stage generation of two strong keys based on a seed strong crypto key and known information from the Source Data bit stream. The second step is to split and encode the bit stream based on entropy levels. After entropy coding, the aligned bit streams are multiplexed in a cyclic fashion to generate one resulting bit stream. The third step is to slice the resulting bit stream into blocks, encrypting each block and adding each block to a coded output bit stream. Each new strong crypto key is derived from the previous crypto key and the previous pre-processed bit stream data. The decoding process is provided that is a simplified inverse of the encoding process.
Usage patterns of an authentic user of a mobile device are generated from data collected representing usage by the authentic user. These usage patterns may then be compared to monitored usage of the mobile device. If usage of the mobile device exceeds a threshold based on one or more of the usage patterns, access to data on the mobile device can be prevented.
Technologies are provided in embodiments to protect private data. Embodiments are configured to intercept a network flow en route from a server to a client device, identify a request for a private data item in an object of the network flow, identify the private data item in a data store, provide, to the client device, a modified object including an authorization request, and send the private data item to the server when valid authorization information is received. Embodiments are also configured to receive authorization information from the client device, determine whether the authorization information is valid, and obtain the private data item if the authorization information is determined to be valid. Embodiments may also be configured to determine an unlocking mechanism for the private data item, and create a modified object including the authorization request based, at least in part, on the unlocking mechanism.
H04L 9/32 - Arrangements for secret or secure communicationsNetwork security protocols including means for verifying the identity or authority of a user of the system
