Cisco Technology, Inc.

Nds Corporation

Synamedia Limited

Check Point Serverless Security Ltd.

Syamedia Limited

Hillel Michael Solow

Steve Epstein

Yossi Tsuria

Erez Waisbard

Harel Cain

Avraham A Poupko

Steven Jason Epstein

Arnold Zucker

Yaacov Belenky

Chaim Shen-Orr

Ezra Darshan

Eliphaz Hibshoosh

Perry Smith

Shabtai Atlow

Carmi Bogot

Zvi Shkedy

Gyora M Benedek

Nadav Avikasis

Shali Mor

Orly Ovadia Amsalem

Yaron Sella

Aviad Kipnis

David Wachtfogel

Vered Anikster

Moshe Kravchik

Anatoly Seldin

Itay Harush

Uri Porat

Asaf Cohen

Benyamin Hirschberg

Arie Haenel

Ezra Galili

Daniel Ratner

Sergei Rosenberg

Shamir Ahituv

Sharon Deitch

Yegor Gorshkov

David Mail

Benny Zemmour

Tsion Gonen

Avraham Poupko

Ariel Imber

Roee Friedman

Melvyn Adam Mildiner

Bogot Carmi

Seldin Anatoly

Chaim Shen Orr

Gyora Benedyk

Systems, methods, and software products, determine permission profiles for computer executable functions (functions). The systems, methods and software products, utilize both static analysis and dynamic analysis, in order to determine the minimal set of permissions based on the inter-relations between these two analysis methods, i.e., static analysis, and dynamic analysis, to determine the permission profiles for computer executable functions (functions).

System and method for determining permission profiles for computer executable functions

In one embodiment, a computing device includes: a media player operative to at least play a content item on the computing device, a blockchain-based wallet application operative to transfer a transaction amount to a publisher wallet ID via an associated blockchain-based transaction service, a secure digital rights management (DRM) client application operative to verify the transfer of the transaction amount to said publisher wallet ID according to a public transaction ledger associated with the associated blockchain-based transaction service and upon successful verification of the transfer of the transaction amount to the publisher wallet ID at least unlock a locked version of the content item, and a processor operative to execute the media player, the blockchain-based wallet application, and the DRM client application.

Decentralized content distribution

In one example, a method includes for each one time period of a plurality of time periods performing a weighted random selection of a first set of intrusion detection/protection system rules from a plurality of rules, each rule of the plurality of rules having an associated probability of selection, preparing a packet inspection plan including the first set of intrusion detection/protection system rules, and sending the packet inspection plan to a network distribution device to inspect packets according to the packet inspection plan. Related apparatus and methods are also described.

Dynamic packet inspection plan system utilizing rule probability based selection

In one illustrative example, TV usage data associated with a residential set-top box (STB) are obtained and stored over a plurality of repeated (e.g. weekly) time periods. TV usage pattern data associated with the residential STB are derived based on the stored TV usage data. A suspected illegitimate use of the residential STB is identified based on identifying a match or correlation between the TV usage pattern data and one of a plurality of predetermined commercial TV usage patterns. Further, for each listing data of one or more published listings of business hours, types, and themes associated with one or more commercial establishments, a comparison or correlation is performed between the TV usage pattern data and the listing data. A commercial establishment associated with illegitimate use is identified based on identifying a match or correlation between the TV usage pattern data and the listing data associated with the commercial establishment.

Method and device for identifying and verifying the illegitimate use of residential set-top boxes

In one embodiment, a method includes receiving an access request for a video service from a client device, authorizing the client device to access the video service when the client device is initiating connection to the video service via a home Internet access point in a home associated with an authorized account for the video service, determining a time restriction for access to at least part of the video service when the client device is initiating connection to the video service via a non-home Internet access point located outside the home, a duration of the time restriction being dependent upon a usage behavior of the client device, and authorizing the client device to access the at least part of the video service subject to the time restriction when the client device is initiating connection to the video service via the non-home Internet access point.

Behavior-based authentication

In one embodiment, an instruction is received at a blockchain server from a first digital rights management (DRM) client, the instruction including an instruction to transfer a DRM license to an encrypted content item to a second DRM client. A block to be recorded in a blockchain, is created, the block including a content item ID of said encrypted content item, one of a device ID of a device including the second DRM client or a user ID of a user of the second DRM client, DRM license information for said DRM license, and a DRM decryption key for decrypting said encrypted content item. The block is recorded in the blockchain. A confirmation message is sent to the second DRM client confirming that the block was written to the blockchain. Related systems, methods, and apparatuses are also described.

Method and system for content and service sharing

In one embodiment, a system includes a central processing unit (CPU) to identify a ransomware process which encrypted a plurality of files yielding a plurality of encrypted files, in response to identifying the ransomware process, dump a memory space and a state of the CPU yielding a memory dump, and search the memory dump for a plurality of candidate encryption keys, and a decryption engine to attempt to decrypt at least one encrypted file of the plurality of encrypted files with different candidate encryption keys of the plurality of candidate encryption keys until the at least one encrypted file is successfully decrypted with one candidate encryption key of the different candidate encryption keys, and decrypt the plurality of encrypted files using the one candidate encryption key. Related apparatus and methods are also described.

Ransomware key extractor and recovery system

In one embodiment, a method for assessing security posture for entities in a computing network is implemented on a computing device and includes: receiving behavior data from one or more of the entities, where the behavior data is associated with at least activity on the computing network by the one or more entities, calculating a risk score for at least one of the entities by comparing the behavior data with a classification model, where the classification model represents at least a baseline for normative network behavior by the entities in a computing network, assessing a security posture for the at least one the entities based on the risk score, and allocating network security resources to the at least one of the entities at least in accordance with the security posture.

Dynamic selection of security posture for devices in a network using risk scoring

A Headend system including a packer to pack media content into a plurality of packets including a first packet and a second packet, a packet scheduler to schedule when the packets will be broadcast/multicast to a plurality of end-user devices, and calculate a plurality of timing values including a first timing value which provides an indication of how long the second packet will arrive at the end-user devices after the arrival of the first packet at the end-user devices, and an encryption engine to: encrypt the media content of the packets and the timing values, wherein the media content of the first packet and the first timing value are encrypted by different encryption algorithms, or the same encryption algorithm with different cryptographic keys.

Content consumption frustration

In one embodiment, a method includes receiving usage data regarding usage of a subscription-based media service account, generating a plurality of sharing scores based on the usage data, each of the plurality of sharing scores being indicative of a confidence that the usage of the subscription-based media service account is subject to a respective type of sharing, comparing each of the plurality of sharing scores to a respective threshold, and, in response to one of the plurality of sharing scores exceeding its respective threshold, presenting a challenge associated with the respective type of sharing.

Account sharing detection

A method and system for media consumption are described. The method including tagging each one of a plurality of content items with at least one metadata tag, the metadata tag including a descriptor of at least one topical attribute describing the content item, the plurality of content items being adapted for consumption on a plurality of user devices, wherein the plurality of content items are provided in multiple file formats; acquiring a history of user consumption of the plurality of content items on a plurality of user devices associated with a single user; storing a user record including the acquired user history, a plurality of metadata tags associated with user consumed content, and including a list of devices comprising the plurality of user devices associated with a single user; building a playlist based, at least in part, on the following criteria, wherein each content item which is listed on the playlist has at least one tag which is also one of a plurality of tags already stored in the user record: a) including a content item which has been started but not completely consumed, b) not including content items marked in the acquired history as being completely consumed, unless the content items have changed with respect to the version consumed, and c) including content items which have not been consumed; selecting at least one content item from the playlist; and pushing the selected at least one content item to at least one of the plurality of user devices associated with a single user, wherein if the selected at least one content item is not suitable for consumption on the at least one of the plurality of user devices, then a next item in the playlist is pushed to the least one of the plurality of user devices.

Continuity of content

A method of distributing audio video content is described. The method includes: receiving configuration data for a plurality of devices; for each device in the plurality of devices, computing a set of bit rates based, at least in part, on the configuration data; encoding audio video content at each bit rate in each set of bit rates to produce a plurality of encoded audio video content streams; splitting each encoded audio video content stream in the plurality of encoded audio video content streams into chunks to produce a plurality of chunked encoded audio video content streams; for each device in the plurality of devices, creating a separate index file, each separate index file including references to at least one of the plurality of chunked encoded audio video content streams; publishing a locator for each separate index file in a catalogue; and transmitting the plurality of chunked encoded audio video content streams and each separate index file to a network. Related systems, apparatus, and methods are also described.

Distributing audio video content

A device including a receiver to receive a media stream including media content for a plurality of services, the content packed into packets each having a header and payload including a part of the content of one of the services, a mapping table(s) directly or indirectly mapping, the services to packet-IDs such that each service is mapped to one packet-ID, thereby enabling the packets including the content of a service to be identified via the packet-ID identifying that service, encrypted packet-IDs such that each packet includes its encrypted packet-ID in its header, and a packet filter to derive the packet-ID of that service from the mapping table(s), calculate the encrypted packet-ID from the derived packet-ID, and filter, from the media stream, the packets with the header including the calculated encrypted packet-ID yielding the packets including the part of the content of that service. Related apparatus and methods are also described.

A method and system of preventing control word sharing, the method and system including receiving a temporal key, denoted TK, at a removable security element, receiving an entitlement control message (ECM), the ECM including a control word derivable by the removable security element, deriving the control word from the ECM at the removable security element, combining at least the control word and a value associated with an ID of the removable security element, thereby producing combined control word and removable security element ID data, encrypting the combined control word and removable security element ID data according to an encryption function, wherein the encrypting includes using TKas an encryption key, and at a time after a removable security element interface has received TK, but prior to a start of a crypto period with which the control word is associated, sending the encrypted combined control word and removable security element ID data to the removable security element interface. Related apparatus, methods and systems are also described.

Method and system for prevention of control word sharing

Growing community of inventors

Bet Shemesh, Israel

Hillel Michael Solow