Bicdroid Inc.

Blackberry Corporation

Other

Bicroid

Jin Meng

Xiang Yu

En-hui Yang

Dake He

En-Hui Yang

Hongtao Zhang

Tomas Szuchewycz

Chang Sun

Rodney M Ruddock

Method, device and computer program product for providing quarantined workspaces. A virtualization application operates on a host to simulate a virtual guest. A management application operates within the virtual guest. The management application controls transmission between guest applications and locations external to the virtual guest. The management application stores encryption keys inaccessible to the host. The management application intercepts attempted transmissions from guest applications to locations outside the virtual guest. Secure data files are identified in the attempted transmissions and encrypted before leaving the virtual guest using the encryption keys. The management application also prevents any unencrypted data from being provided to non-kernel host processes that have not been previously identified as permitted host processes while allowing unencrypted data transmission from the non-kernel host processes to any of the guest application processes.

Method and system for creating quarantined workspaces through controlled interaction between a host and virtual guests

Systems and method are provided for data self-protection. The systems and methods may involve installing a sentry on a computer system, the sentry including a file system filter installed on a kernel of that computer system; providing a central sentry platform in communication with the sentry, operating the central sentry platform to send a data self-protection policy to the sentry, the data self-protection policy being encrypted so that it can only be modified by the central sentry platform; operating the file system filter to control access to encrypted data stored on the computer system, by, for each process making a file access request to the encrypted data, the file system filter receiving and handling that file access request according to the data self-protection policy; and, operating the central sentry platform to monitor the sentry and to receive information from the sentry regarding access to the encrypted data.

Methods and systems for data self-protection

The described embodiments relate to data protection methods, systems, and computer program products. A process-based encrypted data access policing system is proposed based on methods of encrypted data file management, process authentication and authorization, Trojan detection for authorized processes, encryption key generation and caching, and encrypted-file cache management. The process-based encrypted data access policing system may be implemented as a kernel level file system filter and a user-mode filter companion application, which polices the reading/writing of encrypted data in either a server system or an endpoint computer and protects data from data breaches and known or unknown attacks including ransomware and/or phishing attacks.

Methods, systems and computer program products for data protection by policing processes accessing encrypted data

An access control system includes a processor configured to provide a trusted execution environment isolated from a rich execution environment. A rich OS operates in the rich execution environment while a trusted OS operates in the trusted execution environment. A plurality of protected data files are stored in non-volatile memory. When a process requests access to a protected data file, the computer system can permit the requesting process to access the requested data file only if a validated application token is present that corresponds to the requesting process. An application token is generated for the associated application by: detecting initiation of a first process associated with the associated application; determining that a valid user code is available within the trusted execution environment; and generating the application token using the valid user code upon determining that the valid user code is available within the trusted execution environment.

Personalized and cryptographically secure access control in operating systems

An access control system includes a processor configured to provide a trusted execution environment isolated from a rich execution environment. A rich OS operates in the rich execution environment while a trusted OS operates in the trusted execution environment. An access monitoring module operates within the kernel of the rich OS and a trusted application operates in the trusted OS. The access monitoring module intercepts file requests directed at the file systems of the rich OS, and forwards the file requests to the trusted application. The trusted application then evaluates whether the file request is permitted and provides the access monitoring module with a response. The access monitoring module forwards the request to the file system only if the trusted application approves the request.

Personalized and cryptographically secure access control in trusted execution environment

The described embodiments relate to method and products for organizing a plurality of images. Specifically, the methods and products can automatically organize a plurality of images into a plurality of groups of images using allocation criteria. The allocation criteria for each image include a similarity distance between that image and at least one other image that measures how similar those images are. Each image can be allocated to at least one similar image group based on the similarity distance. The methods and products can also be used to visualize and display representative images for each of the groups of images.

Display, visualization, and management of images based on content analytics

Systems, methods and computer program products for determining perceptual similarity between independent images are described. The described systems, methods and computer program products use a similarity distance to determine the perceptual similarity between a first image having a first arrangement of pixels and a second image having a second arrangement of pixels. A processor can determine a first image array corresponding to the first arrangement of pixels and a second image array corresponding of the second arrangement of pixels. The processor can generate a first pixel group set based on the first image array and a second pixel group set based on the second image array. A plurality of pixel group pairs can be generated, and each pixel group pair can be associated with a corresponding pixel group pair distortion. The similarity distance between the first image and the second image can be determined based on the plurality of pixel group pair distortions.

Methods and systems for determining a perceptual similarity between images

The described embodiments relate to methods, systems, and products for providing verification code recovery and remote authentication for a plurality of devices configured for electronic communication with a server. Specifically, in the methods, systems, and products, the user entrusts information about the user's verification code to the service provider, and only with cooperation between the user and the service provider can a lost verification code be recovered. The service provider can further authenticate the user before cooperating in the recovery process by way of a time-sensitive authentication sequence that involves the user device.

Methods, systems and computer program product for providing verification code recovery and remote authentication

The described embodiments relate to methods, systems, and products for providing data protection and encryption on a plurality of devices configured for electronic communication with a server. Specifically, the methods, systems, and products can automatically and securely synchronize a user's file encryption/decryption keys across a plurality of devices, authenticating the user on each device before receiving and processing information from the server necessary to recreate the user's file encryption/decryption keys.

Methods, systems and computer program product for providing encryption on a plurality of devices

Encoding input data including one or more frames includes: generating a residual block based on a difference between a first block of data for multiple pixels in a first frame and a second block of data derived from information in the input data; generating a first block of coefficients based on a transform performed on the residual block; generating reference information based on the second block of data; and determining portions of a code value representing respective portions of the first block of coefficients based on at least one value derived from at least a portion of the reference information.

Coding of residual data in predictive compression

To better handle the flat tail phenomenon commonly seen in transform coefficients such as DCT coefficients, a system and method having a model dubbed a transparent composite model (TCM) are described. Given a sequence of transform coefficients, a TCM first separates the tail of the sequence from the main body of the sequence. A first distribution such as a uniform, truncated Laplacian, or truncated geometric distribution can be used to model transform coefficients in the flat tail while at least one parametric distribution (e.g. truncated Laplacian, generalized Gaussian (GG), and geometric distributions) can be used to model data in the main body. A plurality of boundary values can be used to bound a plurality of distribution models. The plurality of boundary values and other parameters of the TCM can be estimated via maximum likelihood (ML) estimation or greedy estimation.

System and method having transparent composite model for transform coefficients

Encoding input data includes: generating a first block of coefficients based on a transform performed on a residual block of data for multiple pixels; generating reference information based on a reference block of data corresponding to the residual block of data; and determining losslessly decodable code values representing the first block of coefficients based on the reference information.

Growing community of inventors

Waterloo, Canada

Jin Meng