Honeywell International Inc.

Secure Computing Corporation

Garrett Transportation I Inc.

Mcafee, Inc.

Thomas R Markham

William E Boebert

Bruce W Anderson

Alexander Chernoguzov

Edward L Cochran

Tomo Foote-Lennox

Kevin Staggs

Robert A Olmsted

Raymond Lu

Mark H Hanson

Alan Dowd

David Apostal

Robert Otto Hanzlik

Geoffrey A Lowe

Lynn Marquette Meredith

Yunqian Ma

Robert Charles Becker

Jeffrey Mathew Rye

Harshal Haridas

Ben Miller

Kevin P Staggs

Walter Heimerdinger

Julie Hull Roskos

Andrew H Johnson

Jessica Bogle

David T Spoor

Charles N Payne, Jr

Harshal S Haridas

Julie J Hull Roskos

Geoffrey Lowe

An authentication system having a communications bus, a transmitter connected to the bus, and a receiver connected to the bus. A physical layer signal may be applied by the transmitter to a message on the bus for authenticating the transmitter. The physical layer signal may incorporate an identifier (ID) of the transmitter. The receiver may receive the message and decode the physical layer signal on the message. Decoding the physical layer signal on the message may reveal the ID of the transmitter sending the message. The receiver may look up the ID on a list of IDs corresponding to transmitters approved to send the message, to determine whether the ID of the transmitter sending the message matches an ID on the list. Only if the ID of the transmitter matches an ID on the list, then the transmitter may be authenticated and authorized to send the message.

Authentication system for electronic control unit on a bus

The disclosure reveals a system having secured electronic access. The system may have one or more vehicle buses, one or more electronic control units on a vehicle connected to the one or more vehicle buses, a security module connected to the one or more vehicle buses, and a vehicle access port connected to the security module. An accessing entity may attempt connection to the vehicle access port. Messages injected or extracted by the accessing entity may be authorized or unauthorized at the security module based on a security policy.

Approach for securing a vehicle access port

A vehicle security system having controller area network buses, electronic control units connected to the controller area network buses, a vehicle security module connected to the controller area network buses, and an on board diagnostics connector connected to the vehicle security module. The vehicle security module may according to a policy discriminate between authorized and unauthorized signals that are input to the on board diagnostics connector. Authorized signals may be forwarded by the vehicle security module to the controller area network busses. Authorized signals may affect operation of one or more of the components of the vehicle via the electronic control units. Authorized signals may change the policy used by the vehicle security module. Unauthorized signals may be refused entry to the controller area network busses. The on board diagnostics connector may receive the signals from diagnostic instrumentation, control instrumentation, tracking instrumentation, a dongle, and so forth.

Vehicle security module system

Devices, systems, and methods for role-based access control permissions are disclosed. One method includes a policy decision point that receives up-to-date security context information from one or more outside sources to determine whether to grant access for a data client to a portion of the system and creates an access vector including the determination; receiving, via a policy agent, a request by the data client for access to the portion of the computing system by the data client, wherein the policy agent checks to ensure there is a session established with communications and user/application enforcement points; receiving, via communications policy enforcement point, the request from the policy agent, wherein the communications policy enforcement point determines whether the data client is an authorized node, based upon the access vector received from the policy decision point; and receiving, via the user/application policy enforcement point, the request from the communications policy enforcement point.

Role-based access control permissions

A method includes generating at least one access vector associated with a specified device in an industrial process control and automation system. The specified device has one of multiple device roles. The at least one access vector is generated based on one or more communication policies defining communications between one or more pairs of devices roles in the industrial process control and automation system, where each pair of device roles includes the device role of the specified device. The method also includes providing the at least one access vector to at least one of the specified device and one or more other devices in the industrial process control and automation system in order to control communications to or from the specified device.

Policy-based secure communication with automatic key management for industrial control and automation systems

Devices that receive data while not directly powered and methods of operating devices that receive data while not directly powered are described herein. One or more device embodiments include an interface configured to receive data from an additional device while the device is not directly powered, a memory coupled to the interface and configured to receive the data from the interface while the device is not directly powered and store the data while the device is not directly powered, and a user interface configured to permit a user to interact with the computing device. The computing device is configured to operate in at least two different power modes, wherein the computing device is powered only via the interface while operating in a first power mode and the computing device is powered by a non-radio frequency (non-RF) power source while operating in a second power mode.

Devices that receive data while not directly powered

Devices, methods, and systems for assured pipeline threat detection are described herein. One method for assured pipeline threat detection includes receiving a first set of data at a firewall from an unsecured network, moving the first set of data from the firewall to a number of virtual machines, performing a number of threat detection analyses on the first set of data in the number of virtual machines that are organized in a first assured pipeline, and sending the first set of data to a secured target network if no threat was detected.

Assured pipeline threat detection

Systems, methods, and computer-readable and executable instructions are provided for providing a universal access device. Providing a universal access device can include storing access data for each of a number RFID readers, wherein each of the RFID readers accepts a particular RFID protocol. Providing a universal access device can also include selecting a particular RFID protocol for one of the number of RFID readers while the universal access device is within an activation zone of the RFID reader. Furthermore, providing a universal access device can include providing the access data for the particular RFID reader via the particular RFID protocol.

Universal access device

A vehicle screening method and system. A vehicle occupant can be identified utilizing one or more biometric identifiers input by or obtained from the vehicle occupant via a biometric input device. A barcode can also be provided by the vehicle occupant from a scanned card or other structure upon which the barcode is maintained. Additionally, a unique identification number can be provided by the user in order to match the unique identification number against a database of identification numbers, thereby permitting the vehicle occupant to be remotely screened and verified for entry into a secure facility based on the biometric identifier(s), the barcode and the unique identification number.

For a kiosk for a vehicle screening system

A system includes a multi-core computer processor. One or more cores of the multi-core computer processor are configured as a security co-processor for the system and for other cores of the multi-core processor, and one or more cores of the multi-core computer processor are configured as a safety manager co-processor for the system and for other cores of the multi-core processor. An operating system of the security co-processor and an operating system of the safety manager co-processor are independent of operating systems of the other cores of the multi-core processor. The security co-processor and the safety manager co-processor are configured to boot before the other cores and to enforce security policy and/or safety policy on the other cores.

Security and safety manager implementation in a multi-core processor

A physical security system having a plurality of sensors and a sensor report aggregator. The sensors may detect a large number of physical activities. The aggregator may cluster a large number of detected reports to a small number of sets of reports. The sets of reports may be reduced to hypotheses. From the hypotheses, the aggregator may develop hypotheses about the physical environment which the sensors are monitoring in view of a security reference model. The security reference model may include, but not be limited to, facility models, physical security models, and/or attack models. The hypotheses may have probabilities assigned to them according to their certitude of likelihood and severity of danger.

Physical security management system

A system includes a motion detection processor, a motion tracking processor, a people detection processor, a controller, a fusion processor, an appearance model generator processor, a database, a fast search processor, and a matching processor. The motion detection processor, the motion tracking processor, the controller, the people detection processor, the fusion processor, and the appearance model generator processor comprise an analytics pipeline, and the database and the fast search processor comprise a data index pipeline.

System for finding archived objects in video data

A vehicle screening system for screening vehicles and occupants for entrance to a secured facility is disclosed. The system can include a processor and an interface that communicates with the processor, wherein the interface displays identification information extracted from a vehicle occupant associated with a vehicle for processing by the processor. Additionally, a plurality of controls are associated with the interface and the processor, wherein the plurality of controls facilitates the handling and management of the information extracted from the vehicle occupant to either permit or deny the vehicle occupant and the vehicle entry to a secured facility through a security gate.

Real-time screening interface for a vehicle screening system

A network security modeling system which simulates a network and analyzes security vulnerabilities of the network. The system includes a simulator which includes a network vulnerabilities database and a network configuration module having network configuration data. The simulator determines vulnerabilities of the simulated network based on the network configuration data and the vulnerabilities database.

Network security modeling system and method

A system and method for secure group communications is provided. One embodiment provides a method for implementing a virtual private group network. The method includes creating a virtual private group definition on a policy server, establishing a plurality of secure connections between the policy server and a plurality of group nodes, sending a copy of the virtual private group definition from the policy server to the group nodes, sending a shared traffic encryption key from the policy server to each of the group nodes, and sharing secure communication information among the group nodes using the shared traffic encryption key, wherein each group node is included in the virtual private group definition.

Growing community of inventors

Fridley, MN, United States of America

Thomas R Markham