In embodiments of the present invention improved capabilities are described for managing digital rights management (DRM) protected content sharing in a networked secure collaborative computer data exchange environment through a secure exchange facility managed by an intermediate organizational entity amongst users of a plurality of other organizational entities, wherein computer data content and access rights for the computer data content is shared between a first and second user, the computer data content and access rights for the computer data content are transformed into a DRM protected computer data content through communications with a DRM engine, wherein the DRM engine is selected based on a content type of the computer data content, and the DRM engine is provided by an entity other than the intermediate organizational entity and other than any of the plurality of other organizational entities.

Systems and methods of secure data exchange

An apparatus and method are described for secure communication between IoT devices and an IoT service. For example, one embodiment of a system comprises: an Internet of Things (IoT) service to establish communication with an IoT device through an IoT hub or a mobile user device; a first encryption engine on the IoT service comprising key generation logic to generate a service public key and a service private key; a second encryption engine on the IoT device comprising key generation logic to generate a device public key and a device private key; the first encryption engine to transmit the service public key to the second encryption engine and the second encryption engine to transmit the device public key to the first encryption engine; the first encryption engine to use the device public key and the service private key to generate a secret; the second encryption engine to use the service public key and the device private key to generate the same secret; and wherein once the secret is generated, the first encryption engine and the second encryption engine encrypt and decrypt data packets transmitted between the first encryption engine and the second encryption engine using the secret or using a data structure derived from the secret.

Apparatus and method for establishing secure communication channels in an internet of things (IoT) system

A computer-implemented payment processing method includes receiving, by a first computer system, a funds transfer request from a sender having a first account at a first financial institution, the first financial institution being a member of a first computer-implemented payment network, the funds transfer request including an identifier for a recipient, the recipient having a second account at a second financial institution, the second financial institution being a member of a second computer-implemented payment network; based upon the identifier for the recipient, determining by the first computer system whether the recipient is registered with the second computer-implemented payment network; and upon determining that the recipient is registered with the second computer-implemented payment network, transmitting by the first computer system a funds transfer message via the first and second computer-implemented payment networks to cause funds to be transferred from the sender to the recipient.

System and method for transferring funds

A system and method are described for accurately detecting a location of a wireless device. For example, one embodiment of a method comprises: collecting signal strength data indicating signal strength between a wireless device and a plurality of IoT devices and/or IoT hubs in a user's home; associating the signal strength data with locations in the user's home and storing the association in a location database; and determining a current location of the wireless device by comparing the signal strength data in the database with current signal strength data indicating current signal strength between the wireless device and the plurality of IoT devices and/or IoT hubs.

System and method for accurately sensing user location in an IoT system

A security system detects anomalous activity in a network. The system logs user activity, which can include ports used, compares users to find similar users, sorts similar users into cohorts, and compares new user activity to logged behavior of the cohort. The comparison can include a divergence calculation. Origins of user activity can also be used to determine anomalous network activity. The hostname, username, IP address, and timestamp can be used to calculate aggregate scores and convoluted scores.

Network anomaly detection

Device identification scoring systems and methods may be provided that can increase the reliability and security of communications between devices and service providers. Users may select and configure additional identification factors that are unique and convenient for them. These factors, along with additional environmental variables, feed into a trust score computation that weights the trustworthiness of the device context requesting communication with a service provider. Service providers rely on the trust score rather than enforce a specific identification routine themselves. A combination of identification factors selected by the user can be aggregated together to produce a trust score high enough to gain access to a given online service provider. A threshold of identification risk may be required to access a service or account provided by the online service provider.

Device identification scoring

Systems and methods may be provided for masking data on public networks At a publishing node, the system may monitor data input fields in a webpage, and intercept and encode content, such as text, images, and video input at the data input fields, prior to the content being posted online on a public service provider's website A policy may be defined to control which users are permitted access to a key to decode the encoded content The policy may defer to a third party policy node in determining key access An account for a controlling entity, such as a guardian or employer, may be configured to control the encoding status of posts made by another, and decoding key access A privacy agent may process input field content to try to detect encoding markers in the input field content, which marks content to be encoded A third party key server may be used to store decoding keys A URI reference to the decoding key may be used to access the decoding key by a node attempting to view the decoded version of the input field content

Security Systems And Methods For Encoding And Decoding Digital Content

A device enrollment method and system comprising trusted application code that is executed in isolation from the primary OS of a hosting device and an access control mechanism that manages access to this code. The trusted application code provides hardware-backed cryptographic and authentication services to multiple third party applications. The value of these services is dependent on the integrity of both the trusted application and the third party service applications that access the trusted application. To assert trust, the trusted application may be installed in the device's TEE per existing industry TEE provisioning mechanisms. The process may involve the generation of a unique device key within the trusted application that is signed by a provisioning agent. Through this device key, the access control mechanism obtains cryptographic assurance of the integrity of the trusted application when controlling access to the host device in transactions with online service providers.

Device enrollment protocol

Data may be masked on public networks, such as social networking sites. At a publishing node, the system may monitor data input fields in a webpage that are processed by an internet browser. The system may intercept data, such as text, images, and video input at the data input fields, prior to the data being posted online. The publishing node may control which users are permitted access to the posted data by defining a policy associated with the data input field. The posted data may be transformed or tokenized to ensure that it is inaccessible to a user (or group of users) unless that user/group has access to the decoding key under the policy. In this way, data security and data control may be provided to a publishing user node. Data that has already been posted may be destroyed, for example, by deleting the decryption key or a token.

Steven Sprague

Papers

Device identification scoring

Security Systems And Methods For Encoding And Decoding Digital Content

Device enrollment protocol

Security Systems And Methods For Social Networking