Intel Corporation

Mcafee, Inc.

Abhilasha Bhargav-Spantzel

Hormuzd M Khosravi

Ned M Smith

Michael Raziel

Jason Martin

Mats Gustav Agerstam

Micah James Sheller

Nathan Heldt-Sheller

Steven W Deutsch

Justin E Gottschlich

Igor G Muttik

Alex Nayshtut

Oleg Pogorelik

Wei Ey Li

Conor Patrick Cahill

Narayan Biswal

Sanjay Bakshi

John B Vicente

Stephen T Palermo

Avishay Sharaga

Barnan Das

Zheng Zhang

Adrian R Pearson

Yasser Rasheed

Salmin Sultana

Mohammad R Haghighat

Li Chen

Ulhas S Warrier

Ulf Christian Bjorkengren

Adi Shaliv

Avi Priev

Uri Kahana

Sherry Chang

Hari K Tadepalli

Craig T Owen

Miguel Ballesteros

Paul Carlson

Oliver W Chen

Bhushan Girishkumar Parikh

Alex Nayshtur

Thomas Joseph O'Dwyer

Priyam Biswas

Various systems and methods for establishing network connectivity and onboarding for Internet of Things (IoT) devices and trusted platforms, including in Open Connectivity Foundation (OCF) specification device deployments, are discussed. In an example, a zero touch owner transfer method includes operations of: receiving a first request from a new device for network access to begin an onboarding procedure with a network platform; transmitting credentials of a first network to the new device, the first network used to access a rendezvous server and obtain onboarding information associated with the network platform; receiving a second request from the new device for network access to continue the onboarding procedure; and transmitting credentials of a second network to the new device, as the new device uses the second network to access the onboarding server of the network platform and perform or complete the onboarding procedure with the network platform.

Secure device onboarding techniques

An apparatus operating as a certificate authority (CA) is described. The apparatus can perform operations including receiving, from a plurality of requesting devices, a request to join a group. The request can include identification information for the group and attestation evidence for the plurality of requesting devices. Responsive to receiving the request, the apparatus can provide a group certificate for the group to the plurality of requesting devices.

Privacy protected autonomous attestation

Methods, systems, articles of manufacture and apparatus to detect process hijacking are disclosed herein. An example apparatus to detect control flow anomalies includes a parsing engine to compare a target instruction pointer (TIP) address to a dynamic link library (DLL) module list, and in response to detecting a match of the TIP address to a DLL in the DLL module list, set a first portion of a normalized TIP address to a value equal to an identifier of the DLL. The example apparatus disclosed herein also includes a DLL entry point analyzer to set a second portion of the normalized TIP address based on a comparison between the TIP address and an entry point of the DLL, and a model compliance engine to generate a flow validity decision based on a comparison between (a) the first and second portion of the normalized TIP address and (b) a control flow integrity model.

Methods, systems, articles of manufacture and apparatus to detect process hijacking

A mechanism is described for facilitating context-based access control of resources for according to one embodiment. A method of embodiments, as described herein, includes receiving a first request to access a resource of a plurality of resources. The first request may be associated with one or more contexts corresponding to a user placing the first request at a computing device. The method may further include evaluating the one or more contexts. The evaluation of the one or more contexts may include matching the one or more contexts with one or more access policies associated with the requested resource. The method may further include accepting the first request if the one or more contexts satisfy at least one of the access policies.

Mechanism for facilitating dynamic context-based access control of resources

Technologies for anonymous context attestation and threat analytics include a computing device to receive sensor data generated by one or more sensors of the computing device and generate an attestation quote based on the sensor data. The attestation quote includes obfuscated attributes of the computing device based on the sensor data. The computing device transmits zero knowledge commitment of the attestation quote to a server and receives a challenge from the server in response to transmitting the zero knowledge commitment. The challenge requests an indication regarding whether the obfuscated attributes of the computing device have commonality with attributes identified in a challenge profile received with the challenge. The computing device generates a zero knowledge proof that the obfuscated attributes of the computing device have commonality with the attributes identified in the challenge profile.

Technologies for anonymous context attestation and threat analytics

An input device of a secure authentication protocol system may receive at least one user authentication factor in a pre-boot session. The input device may verify the received authentication factors and may store the verified authentication factors. During a post-boot session, the input device may communicate the verified authentication factor and a stored post-boot session credential received during a prior post-boot session to an authentication engine executing in a trusted execution environment. The authentication engine verifies the received post-boot session credential is logically associated with an immediately preceding post-boot session. Upon successful verification of the received post-boot session credential, the verified authentication factors or data indicative of a successfully verified authentication factor received during the pre-boot session are used in the current post-boot session.

Secure authentication protocol systems and methods

Technologies for multi-factor authentication of a user include a computing device with one or more sensors. The computing device may authenticate the user by analyzing biometric and/or environmental sensor data to determine whether to allow the user access to a computing device. To do so, the computing device may determine reliability scores based on the environment during authentication for each biometric authentication factor used to authenticate the user. Additionally, the computing device may determine a login pattern based on sensor data collected during historical authentication attempts by the user over a period of time. The computing device may apply a machine-learning classification algorithm to determine classification rules, based on the login pattern, applied by the computing device to determine whether to allow the user access to the computing device. Other embodiments are described herein and claimed.

Technologies for login pattern based multi-factor authentication

Methods, apparatus, systems and articles of manufacture are disclosed to facilitate multi-factor authentication policy enforcement using one or more policy handlers. An example first policy handler to manage a global policy in a distributed environment includes a parser to identify a first sub-policy of the global policy that is capable of enforcement by the first policy handler, and an attester to sign the first sub-policy. The example first policy handler further includes a director to determine whether to forward the global policy to a second policy handler based on a signature status of the global policy, and to forward the global policy to the second policy handler when the signature status of the global policy is indicative of an unsigned second sub-policy.

Systems and methods to facilitate multi-factor authentication policy enforcement using one or more policy handlers

Method to perform secure transactions with a digital device starts with microphone receiving signal generated by the digital device. Signal includes product information in inaudible portion of signal that identifies at least one product associated with a timeframe of signal. Trusted execution environment (TEE) generates start signal based on first sensor signal from first sensor that may be inertial sensor. Start signal is generated when first sensor signals indicate that user wishes to perform transactions with digital device. TEE verifies an origin of the product information to determine integrity of the origin and data. Display device displays purchasing information to a user that is based on the product information. TEE authenticates user based on second sensor signal from second sensor that may be biometrics sensor. TEE completes transaction to purchase at least one product by providing payment information associated with user. Other embodiments are also described.

Apparatus and method for performing secure transactions with a digital device

This disclosure is directed to a context-aware proactive threat management system. In general, a device may use internal activity data along with data about external activities (e.g., provided by remote resources) for threat assessment and mitigation. A device may comprise, for example, a hostile environment detection (HED) module to coordinate threat assessment and mitigation. The HED module may accumulate internal activity data (e.g., from security services in the device), and external activity data regarding a system environment and/or a physical environment from the remote resources. The HED module may then assess threats based on the activity data and determine automated and/or manual mitigation operations to respond to the threats. In one embodiment, visualization features may also be used to, for example, visualize threats to a user, visualize automatic/manual mitigation operations, request user confirmation regarding the performance of manual mitigation operations, etc.

Context-aware proactive threat management system

The techniques described herein include configuration of channels between devices and service providers at a connectable system platform. For example, a system platform may include a receiver to receive data from a communicatively coupled device. The system platform may include a controller having logic, at least partially comprising hardware logic, to configure communications channels. The communication channels include a communication channel for transmission between the system platform and a service provider to receive the data, and a communication channel for transmission between the system platform and the coupled device. The communication channels are configured based on a context. The context comprises characteristics of the coupled device, content of the data, and security requirements associated with the service provider.

System platform for context-based configuration of communication channels

In an embodiment, at least one non-transitory computer readable storage medium includes instructions that when executed enable a system to: request, by an authentication logic of the system during a multi-factor authentication of a user of the system to obtain access to a first service, a token to be sent from a second system associated with the first service to a third system associated with the user; receive, in the authentication logic, the token from the third system without user involvement via a secure channel; and send the token from the authentication logic to the second system to authenticate the user. Other embodiments are described and claimed.

Method and apparatus for seamless out-of-band authentication

In an example, a client-server platform identity architecture is disclosed. The platform identity architecture may be used to enable a venue operator to provide online services and to collect telemetry data and metrics while giving end users greater control over privacy. When entering a compatible venue, the user's device generates a signed temporary pseudonymous identity (TPI) in secure hardware or software. Any telemetry uploaded to the venue server includes the signature so that the server can verify that the data are valid. The TPI may have a built-in expiry. The venue server may thus receive useful tracking data during the term of the TPI, while the user is assured that the data are not kept permanently or correlated to personally-identifying information.

Platform identity architecture with a temporary pseudonymous identity

Growing community of inventors

Santa Clara, CA, United States of America

Abhilasha Bhargav-Spantzel