Emc Corporation

Cisco Technology, Inc.

Emc IP Holding Company LLC

Motorola Mobility LLC

Google Inc.

Motorola Solutions, Inc.

Google Technology Holdings LLC

Samir Dilipkumar Saklikar

Kevin Bowers

Nikolaos Triandopoulos

Subir Saha

Salah Machani

Roy Hodgman

Todd A Morneau

Ranjit Avasarala

Dennis Moreau

Deepak Pushpakar

Ari Juels

Jayaraman R Iyer

Ronald L Rivest

Riaz Zolfonoon

John Charles Strassner

Alex Vaystikh

Thomas M Tirpak

Morteza Ansari

Liron Liptz

Robin Edgard Martherus

Robert M Polansky

Anant Athale

Jyoti Verma

Aditya Kuppa

Dennis Ray Moreau

Vishnu V P

Srivatsa M S

Pujitha Venkata Saranya Eedupalli

Hrvoje Dogan

Vihang P Dudhalkar

Kevin D Bailey

One or more lower-level attributes of a first network policy are translated to one or more higher-level attributes of the first network policy, and one or more lower-level attributes of a second network policy are translated to one or more higher-level attributes of the second network policy. The first network policy controls how first network traffic is handled, and the second network policy controls how second network traffic is handled. The one or more higher-level attributes of the first network policy are compared with the one or more higher-level attributes of the second network policy. Based on the comparing, it is determined whether the first network traffic and the second network traffic are handled in a functionally equivalent manner. If not, the first network policy is dynamically updated to generate an updated first network policy that causes the first network traffic to be handled in the functionally equivalent manner.

Network policy architecture

A network security method is provided. The method includes obtaining, at a network security device, first network traffic from a network device destined for a potential attacker; determining if the first network traffic is suspicious; when the first network traffic is determined to be suspicious: generating second network traffic based on the context of the network device and the first network traffic; providing the second network traffic to the potential attacker; obtaining, from the potential attacker, third network traffic in response to the second network traffic; and designating the potential attacker as malicious based on the third network traffic is disclosed. An apparatus and one or more non-transitory computer readable storage media are also disclosed.

Virtual traffic decoys

Methods, apparatus and articles of manufacture for authenticating by labeling are provided herein. A method includes identifying each of one or more graphical-based input elements to be associated with a computing device in response to user activity in connection with the computing device; identifying each of one or more graphical-based labels to be assigned to the one or more graphical-based input elements; displaying (i) the one or more graphical-based input elements and (ii) the one or more graphical-based labels via an interface of the computing device; generating a prompt via the computing device interface; and processing input cryptographic information entered via the computing device interface in response to the prompt against (i) the one or more graphical-based input elements and (ii) the one or more graphical-based labels.

Authenticating by labeling

Methods, apparatus and articles of manufacture for authenticating by labeling are provided herein. A method includes establishing a set of cryptographic information, wherein said set of cryptographic information comprises (i) a set of one or more graphical-based input elements and (ii) one or more graphical-based labels assigned to the set of one or more input elements in accordance with a given arrangement; generating a prompt via a computing device interface in connection with an authentication request to access a protected resource associated with the computing device; processing input cryptographic information entered via the computing device interface in response to the prompt against the set of cryptographic information; and resolving the authentication request based on said processing.

A processing device comprises a processor coupled to a memory and is configured to implement an overlay effects selection interface for use in conjunction with generation of a graphical password. An image is obtained and presented in the overlay effects selection interface with a plurality of user-selectable overlay effects. User input is received identifying at least one overlay effect selected from the plurality of user-selectable overlay effects, and a modified version of the image is presented incorporating the selected at least one overlay effect. Information characterizing the image and the selected at least one overlay effect is utilized to control access to a protected resource. For example, the information characterizing the image and the selected at least one overlay effect may be obtained as part of a graphical password enrollment process and stored as at least a portion of the graphical password for controlling access to the protected resource.

Authentication based on user-selected image overlay effects

A method, a network base station, and a user device for pausing a communication connection initiation are disclosed. A processormay begin a communication connection initiation between an origin user device and a target user device. The processormay pause the communication connection initiation. A transceivermay receive a connection action request to execute a connection action.

Mechanism of providing information to caller by temporarily pausing the call initiation request

While facilitating () a call session for a participating entity having at least one federation-based benefit, one then uses () that at least one federation-based benefit to facilitate communications mobility for the participating entity during the call session. Such a call session can comprise, for example and at least in part, a wireless call session. The federation-based benefit itself can be one provided by a content provider, a services provider, or the like.

Method and apparatus to facilitate using a federation-based benefit to facilitate communications mobility

Techniques are provided for detecting the source of an APT-based leaked document by iteratively or recursively evaluating a set of network security logs (e.g., SIEM logs and FPC logs) for events consistent with APT behavior according to a set of heuristics to generate a reduced set of security events for consideration by the CIRT. A method of detecting an APT attack on an enterprise system is provided. The method includes (a) receiving, in a computerized device, an indication that a document has been leaked outside the enterprise system, (b) evaluating a log of security events of the enterprise system using a set of heuristics to produce a reduced set of events potentially relevant to the APT attack, and (c) outputting the reduced set of events over a user interface for consideration by a security analysis team. A system and computer program product for performing this method are also provided.

Detecting advanced persistent threats

A technique to detect malware on a mobile device which stores a virtual machine image involves establishing a connection from an electronic malware detection apparatus to the mobile device, the electronic malware detection apparatus being external to the mobile device. The technique further involves transferring mobile device data from the mobile device to the electronic malware detection apparatus through the connection to form a copy of the virtual machine image within the electronic malware detection apparatus. The technique further involves performing, by the electronic detection apparatus, a set of malware detection operations on the copy of the virtual machine image to determine whether the mobile device is infected with malware.

Techniques for detecting malware on a mobile device

A method performed by a first computing device is disclosed. The method includes (a) establishing a proximity-based communications channel between the first computing device and a second computing device, one of the first device and the second device being a mobile device, (b) sending a request for authentication of identity of a remote entity from the first device to the second device, the remote entity being in possession of the second device, (c) receiving, at the first device, from the second device, an identity assertion that the remote entity is authentically identified by an identifier, the identity assertion's truth being conditional on a proximity-based condition, (d) verifying, at the first device, that the proximity-based condition is satisfied, and (e) in response to verifying, validating the identifier of the remote entity. An apparatus and computer program product for carrying out the method are also provided.

Mobile trust broker

A virtual machine computing platform uses a security virtual machine (SVM) in operational communications with a risk engine which has access to a database including stored patterns corresponding to patterns of filtered operational data that are expected to be generated during operation of the monitored virtual machine when malware is executing. The stored patterns may have been generated during preceding design and training phases. The SVM is operated to (1) receive raw operational data from a virtual machine monitor, the raw operational data obtained from file system operations and network operations of the monitored virtual machine; (2) apply rule-based filtering to the raw operational data to generate filtered operational data; and (3) in conjunction with the risk engine, perform a mathematical (e.g., Bayesian) analysis based on the filtered operational data and the stored patterns in the database to calculate a likelihood that the malware is executing in the monitored virtual machine. A control action is taken if the likelihood is sufficiently high.

Malware detection using risk analysis based on file system and network activity

A method and system for adding a caller () in a blocked list is provided. The blocked list is stored at a communication server (). The method includes receiving () a call from the caller () at a communication device (). Further, the method includes receiving () a set of inputs at the communication device () in response to the call. The set of inputs includes a set of instructions to add the caller () in the blocked list. Furthermore, the method includes transmitting () a call termination request to the communication server (). The call termination request includes the set of instructions to add the caller () in the blocked list. Transmission of the call termination request initiates addition of the caller () in the blocked list at the communication server ().

Method and system for adding a caller in a blocked list

A method, apparatus, and electronic device for hierarchical communications are disclosed. A connection interfacemay receive a query. A processormay select an initial expert from the hierarchical expert tree based upon the query and direct the query towards the initial expert. A session initiation protocol servermay generate a hierarchical expert tree from an expert pool.

Growing community of inventors

Bengaluru, India

Samir Dilipkumar Saklikar