Micro Focus Lcc

Compaq Computer Corporation, Inc.

Netiq Corporation

Hewlett-packard Development Company, L.p.

Compaq Information Technologies Group, L.p.

Other

Hewlett-packard Company

Watchsoft, Inc.

Michael F Angelo

Douglas M Grover

Lloyd Leon Burch

Sompong Paul Olarig

Baha Masoud

Kenneth A Jansen

David R Wooten

David L Collins

George David Wisecup

Carolyn Bennion McClain

E David Neufeld

Chi Kim Sides

Dipto Chakravarty

Robert Skousen Stilmar

Craig A Miller

Ramkrishna Prakash

Martin Arlitt

David F Heinrich

Thomas J Bonola

Manuel Novoa

Richard Dickert Powers

William F Whiteman

Larry N McMahan

Alexander Michael Hoole

Alexander Hoole

Richard O Waldorf

Andrew Brown

Dwight L Barron

Hung Q Le

Jeff W Wolford

Daniel J Driscoll

Ramkrishna V Prakash

Drue A Reeves

Stephan F Jou

Chai S Heng

Richard Churchill

Keith Lutsch

Peter J Michels

Manny Novoa

William (Bill) Floyd Whiteman

David Heisey

Harry Q Le

Mark B Tellez

Raymond A Toves

Steve H Park

Derace M Fridel

Donald D Kim

Dan J Driscoll

Peter Andre De Souza

Larry Hal Henderson

Duane F Buss

Michael A Aday

Carol Erickson

Guy McSwain

Douglas Max Grover

A software build environment is scanned for one or more potentially malicious code paths. In response to scanning the software build environment for the one or more potentially malicious code paths, one or more potentially malicious code paths are identified. The identified one or more potentially malicious code paths comprise at least one of: a typo squat code path, a dependency confusion code path, and a brandjack code path. In response to identifying the one or more potentially malicious code paths a microprocessor does at least one of: generate a notification identifying the one or more potentially malicious code paths, automatically change and/or remove the one or more potentially malicious code paths and deny the start of a build process.

Typo squatting, dependency confusion, and brandjacking detection

A determination is made to see if a user has authenticated to a computer system using a plurality of authentication levels. For example, the user may have had a first session where the user is authenticated at authentication level one and a second session where the user is authenticated at authentication level two. Behavior of the user is separately tracked at each of the plurality of authentication levels to identify separate usage patterns of the user at each of the plurality of authentication levels. Anomalous behavior of the user is identified based on one or more variations from the separate usage patterns of the user at, at least one of the plurality of authentication levels. An action is taken based on identifying the anomalous behavior of the user. For example, the user's account may be locked, or an administrator may be notified.

Anomaly detection based on multi-level authentication

A current thread pattern is identified. For example, a thread pattern of a running software application is identified. Current resource information associated with the current thread pattern is identified. For example, the current resource information may include disk usage, packets sent, ports used, accounts created, etc. The current thread pattern and the current resource information associated with the current thread pattern are compared to an existing malicious thread pattern associated with a type of malware and existing malicious resource information associated with the existing thread pattern. A determination is made if the comparison meets a threshold. For example, if the current thread pattern is 90% similar to the existing malicious thread pattern and the current resource information is within 75% of the existing malicious resource information, the threshold is met. In response to the comparison meeting the threshold, an action is taken to mitigate the type of malware.

Identification of malicious programs using thread patterns and related data

A blockchain is created. The blockchain comprises an authentication block that defines one or more authentication credentials that are required to be provided by an endorser to add a first type of transaction block to the blockchain. For example, a user may be required to provide a username/password to add a smart contract transaction block to the blockchain. A request to add the first type of transaction block to the blockchain is received. The first type of transaction block is added to the blockchain. Adding the first type of transaction block to the blockchain is based on the endorser providing the one or more authentication credentials.

Managing smart contracts using a distributed ledger

A communication stream is received. For example, the communication stream may be a part of a communication session, such as, a voicemail, a videomail, a voice conference call, a video conference call, and/or the like. A determination is made if the communication stream is completely generated using a session watermark. The session watermark is associated with the communication session. In response to determining that the communication stream is completely generated using the session watermark, the communication stream is identified as a legitimate communication stream. In response to determining that the communication stream has not been completely generated using the session watermark, the communication stream is identified as potentially a vishing communication steam.

Prevention of vishing attacks

A request to add a new block to a blockchain is received. Data associated with the new block is scanned to identify malware and/or an anomaly. In response to identifying the malware and/or the anomaly in the data associated with the new block, an action is taken. The action includes: rejecting the request to add the new block to the blockchain, or removing the malware/anomaly from the new block and adding the new block to the blockchain. In a second embodiment, a malware event is identified that identifies malware/an anomaly in a block in a blockchain. In response to the malware event, an action is taken. The action includes: consolidating the blockchain, bypassing the block in the blockchain, consolidating the blockchain and bypassing the block in the blockchain, and deleting an encryption key that was used to encrypt the associated data that comprises the malware and/or the anomaly.

Blockchain malware protection

Thread information generated by one or more computing systems is captured. A thread pattern is identified from the captured thread information. The thread pattern is compared to a learned thread pattern. An anomaly is identified in the thread pattern based on a variance from the learned thread pattern. In response to identifying the anomaly in the thread pattern, an action is taken based on the anomalous thread pattern. For example, a user may be notified. The thread patterns may be extended to compare between operating systems, hypervisors, containers, and/or virtual machines.

Using thread patterns to identify anomalous behavior

A multi-factor authentication request of a user is received. For example, the multi-factor authentication request may include a valid username/password and a valid fingerprint scan. A first authentication factor of the multi-factor authentication request is an access authentication factor (e.g., the valid username/password) and a second authentication factor (e.g., the valid fingerprint scan) of the multi-factor authentication request is one of: a time-only authentication factor; a multi-session authentication factor; and a location-only authentication factor. The user is authenticated based on the first authentication factor and the second authentication factor. Access is granted to one or more resources according to one or more rules associated with the first authentication factor and second authentication factor.

Time-only based authentication factors

A first node in a distributed blockchain ledger validates all remaining nodes in the distributed blockchain ledger to secure the distributed blockchain ledger. The remaining nodes in the distributed blockchain ledger can be validated in various ways. For example, an encrypted package can be exchanged to obtain a unique session key for each of the remaining nodes in the distributed blockchain ledger. Another alternative is to receive split-key fragments from all the nodes in the distributed blockchain ledger. The received split-key fragments are used to generate a common key for validating all the remaining nodes in the distributed blockchain ledger.

Private secure blockchain

An anomaly on a computer network is identified by processing data generated by the computer network. The anomaly is identified based on a first anomaly threshold of a plurality of anomaly thresholds associated with the anomaly. In response to determining that the anomaly has met the first anomaly threshold of the plurality of anomaly thresholds associated with the anomaly, a first authentication level associated with the first anomaly threshold is identified. The plurality of anomaly thresholds associated with the anomaly have a plurality of associated authentication levels. A user interface is displayed to an administrator that includes a prompt to authenticate the administrator at the first authentication level. Authenticating the administrator at the first authentication level allows the administrator to take an action associated with the anomaly. For example, the administrator may unload an application that may likely have been compromised.

Tying anomalies to authentication levels

A request to install a first version of a software application is received. The first version of the software application is stored in a first blockchain in a first distributed blockchain ledger. In response to receiving the request to install the first version of the software application, the first version of the software application is validated by running a hash of the first blockchain. In response to validating the first version of the software application, the first version of the software application is installed from the blockchain to a device. The software application may also be validated after being installed to the device.

Installation and authentication of applications using blockchain

Sensitive information is identified. For example, the sensitive information may be a set of medical records. A request is received to send the sensitive information from a first domain to a second domain. For example, the request may be to send the sensitive information from a first corporation to a second corporation. The sensitive information is encrypted. The encrypted sensitive information comprises an authentication field. The authentication field identifies one or more authentication factors that are required to unencrypt the sensitive information. For example, the authentication field may indicate that a user is required to provide a username/password and a fingerprint scan to access the sensitive information. The encrypted sensitive information is sent to the second domain. The user in the second domain is required to authenticate using the one or more authentication factors to access the sensitive information.

Protecting sensitive information based on authentication factors

A request to authenticate is received. For example, the request to authenticate may be to authenticate to a software application or a device. The request to authenticate is for a first authentication level for a user. The first authentication level is one of a plurality of authentication levels for the user. The request to authenticate is authorized based on a provided one or more authentication factors (e.g., a valid username/password). A plurality of authentication tokens are retrieved. The plurality of authentication tokens are associated with the first authentication level. In addition, each authentication token of the plurality of authentication tokens is associated with an individual application of a plurality of applications. Access to information in the plurality of applications is granted based on the plurality of authentication tokens.

Providing single-sign-on for multifactor authentication

A secondary fragment of an encryption key is received. The secondary fragment is associated with an authentication process of a user. The secondary fragment is one of a plurality of secondary fragments of the encryption key. The user is authenticated (e.g., by validating a username/password). The encryption key is regenerated using the secondary fragment and a primary fragment of the encryption key. In response to regenerating the encryption key using the secondary fragment and the primary fragment, and authenticating the user: access is granted, to the user, by unencrypting an encrypted data record using the regenerated encryption key.

System and method for managing fragmented encryption keys for granting access

Growing community of inventors

Spring, TX, United States of America

Michael F Angelo