A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.

Secure execution of enterprise applications on mobile devices

An information processing system comprises one or more processing devices of at least one processing platform. In one embodiment, the system comprises cloud infrastructure that is configured to validate an externally-generated security token issued to a user, to extract one or more claims from the validated externally-generated security token, and to create a session object to hold the extracted claim or claims. The cloud infrastructure issues an internally-generated security token based on the session object that allows the user to be identified to a protected resource. The internally-generated security token is validated in conjunction with a request from the user for access to the protected resource, and information associated with at least one extracted claim is selectively released responsive to validation of the internally-generated security token. Access of the user to the protected resource is granted or denied based on the selectively-released information.

Privacy-preserving user attribute release and session management

Embodiments are directed to authenticating a user to a remote application provisioning service. In one scenario, a client computer system receives authentication credentials from a user at to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications. The client computer system sends the received authentication credentials to an authentication service, which is configured to generate an encrypted token based on the received authentication credentials. The client computer system then receives the generated encrypted token from the authentication service, stores the received encrypted token and the received authentication credentials in a data store, and sends the encrypted token to the remote application provisioning service. The encrypted token indicates to the remote application provisioning service that the user is a valid user.

User authentication in a cloud environment

Various aspects of the disclosure relate to providing secure containers or data vaults for data of one or more managed applications. In some embodiments, each managed application may be assigned its own private data vault and/or may be assigned a shared data vault that is accessible to at least one other managed application. As the managed application executes, calls for access to the data may be intercepted and redirected to the secure containers. Data stored in a secure container may be encrypted according to a policy. Other aspects relate to deleting data from a secure container, such as via a selective wipe of data associated with a managed application. Further aspects relate to configuring and creating the secure containers, retrieving key information required to encrypt/decrypt the data stored in the secure containers, and publishing the managed applications, policy information and key information for download to a mobile device.

Controlling mobile device access to secure data

A context-sensitive viewing system is disclosed in which various data visualizations, also referred to a contextual views, of a common set of data may be viewed by a user on an electronic device. Data in the system may comprise data objects and associated properties and/or metadata, and may be stored in one or more electronic data stores. As a user of the system views and manipulates a first contextual view of a set of data objects, one or more other contextual views of the same set of data objects may be updated accordingly. Updates to the secondary contextual views may, in various embodiments, happen real-time. Further, the secondary contextual views may be visible to the user simultaneously with the primary contextual view. A user may switch from one view to another, and may manipulate data in any view, resulting in updates in the other views.

Context-sensitive views

A method to enable access to resources hosted in a compute cloud begins upon receiving a registration request to initiate a user's registration to use resources hosted in the compute cloud. During a registration process initiated by receipt of the registration request, a federated single sign-on (F-SSO) request is received. The F-SSO request includes an assertion (e.g., an HTTP-based SAML assertion) having authentication data (e.g., an SSH public key, a CIFS username, etc.) for use to enable direct user access to a resource hosted in the compute cloud. Upon validation of the assertion, the authentication data is deployed within the cloud to enable direct user access to the compute cloud resource using the authentication data. In this manner, the cloud provider provides authentication, single sign-on and lifecycle management for the user, despite the “air gap” between the HTTP protocol used for F-SSO and the non-HTTP protocol used for the user's direct access to the cloud resource.

Cross-protocol federated single sign-on (F-SSO) for cloud enablement

Taking the leap between analytical chemistry and artificial intelligence: A tutorial review.

A smart card includes a processing circuit, a memory that contains a protected object, an activity detector that receives a signal that describes a planned activity of a person who is in physical possession of the smart card, and an activity analyzer that evaluates features of the planned activity. In response to the activity analyzer determining that a predefined risk associated with the planned activity exceeds a predetermined value, the activity analyzer issues an instruction to a user to provide a biomarker to a biosensor. A blending logic blends real-time biometric data with a security object to generate a hybrid security object. A conversion logic uses the hybrid security object to convert a protected object into a usable object that can be utilized by the processing circuit within the smart card. A matrix barcode generator generates a matrix barcode that contains information about the user of the smart card.

Secure management of a smart card

A method, system, and/or computer program product securely manages smart card transactions. A processing entity receives a smart card identifier from a smart card. The smart card identifier is a transaction-specific identifier for a transaction, and contains no financial data about a holder of the smart card. The smart card identifier is hidden from a second party to the transaction. The processing entity receives transaction data for the transaction from the second party, where the transaction data is blocked from the smart card. In response to determining that the transaction is valid, the processing entity issues a transaction confirmation to the smart card and a transaction approval to the second party to the transaction.

Secure management of transactions using a smart/virtual card

A host machine provisions a virtual machine from a catalog of stock virtual machines. The host machine instantiates the virtual machine. The host machine configures the virtual machine, based on customer inputs, to form a customer's configured virtual machine. The host machine creates an image from the customer's configured virtual machine. The host machine unwraps a sealed customer's symmetric key to form a customer's symmetric key. The host machine encrypts the customer's configured virtual machine with the customer's symmetric key to form an encrypted configured virtual machine. The host machine stores the encrypted configured virtual machine to non-volatile storage.

Jeb R. Linton

Papers

Cross-protocol federated single sign-on (F-SSO) for cloud enablement

Taking the leap between analytical chemistry and artificial intelligence: A tutorial review.

Secure management of a smart card

Secure management of transactions using a smart/virtual card

Virtual machine images encryption using trusted computing group sealing