THALES DIS CPL USA, INC.

A system and method to tokenize date and time data based on table shuffling and lookup index that preserves an original format of the date and time data with respect to a tokenized format. Look-up tables are generated efficiently for fast look up and indexing in memory, which may comprise one or both of date tables and time tables. The date tables consist of a year date table, a month date table, a 28-day month table, a 29-day month table, a 30-day month table, and a 31-day month table. The time tables consist of an hour table, a minutes table, and a seconds table. In some arrangements, the seed value is either a user provided seed by way of the one or more Connectors, or a master seed that by way of the one or more Connectors creates a seed chain with derivative seeds. Other embodiments disclosed.

Provide is a system and method for root of trust and dynamic session management of cryptographic devices servicing cryptographic requests from multi-tenant applications in a cryptographic computing environment is provided. The system comprises a Connection Manager to provide low-latency cryptographic operations, a Cache Store to support multi-tenancy, a Session Scheduler to provide high-throughput cryptographic services, and a Session Health Monitor to provide resiliency. The system tracks a state of the PKCS11 sessions and revises session assignments of client applications depending on whether a PKCS11 session with the cryptographic device is busy or in a range of error states, and detects, classifies and remedies multiple error situations occurring within a prepared Pool of session blocks in view of the health metrics to provide improved cryptographic operation performance. Other embodiments disclosed.

A system ( 100 ) or method ( 500 ) for preventing or mitigating malicious processes in a computing environment having one or more processors ( 204 ) and memory ( 202 ) operatively coupled to the one or more processors can include computer instructions which when executed causes the one or more processors to perform certain operations. The operations can include intercepting ( 502 ) all file system input and output paths using a kernel driver ( 103 ), analyzing ( 504 ) for suspect behaviors in real time on data being processed through the input and output paths and data access patterns on a live system implemented in a kernel of an operating system for the computing environment, flagging ( 512 ) the data for any suspect behaviors, and preventing ( 514 ) further processing upon detection of the suspect behaviors.

Provided is a system ( 100 ) to enhance Personal Identification Number (PIN) security with hidden factors ( 271, 272, 273, 274 ) comprises a client agent ( 111 ) and a server agent ( 130 ). The client agent ( 111 ) manages a touchscreen or keypad, handles display layout, detects and tracks a finger movement on the touchscreen, and collects input entry of a PIN ( 311 ) from the finger movement based on hidden factors that configure use of the touchscreen or keypad, where the input entry ( 310 ) consists of an entered PIN, and information ( 312 ) on how the PIN was entered. The server agent ( 133 ) can be communicatively coupled to the client agent ( 111 ), and receives the input entry for the PIN, and validates the PIN that was entered in view of the information ( 312 ) on how the PIN was entered based on a policy configuration ( 410, 420, 430, 440 ) for the hidden factors for the input entry on said touchscreen or keypad. Other embodiments disclosed.

Provided is a system and method for authenticating a user to a Hardware Security Module (HSM) with a Wallet Reader by way of a Digital Wallet on a Mobile Device. The Digital Wallet contains electronic documents and digital identities signed by at least one entity to certify the user of the Digital Wallet and the electronic documents stored therein are authentic. Certificates are chained to a trust anchor by way of an HSM provisioning process and Digital Wallet creation process. In some embodiments the HSM creates secrets and private key material that are loadable onto a secure element of the Mobile Device for hardened security. Other embodiments are disclosed.

Provided is an electronic hardware sub-system within a multi-tenant Hardware Security Module (HSM) for tamper response against physical and logical attacks against the HSM. An HSM Manager manages and orchestrates the vHSMs for dynamic fraud analysis by way of a Tamper Prevention System, wherein a Watchdog detects intrusions and declares Tamper Events, and a Tamper Enforcement Module signals HSM Actors about a tamper state action responsive to said Tamper Event and intrusions. Once enabled, it protects multi-tenant applications against cryptographic attacks and offers continuous fraud detection in a layered approach that intelligently detects a root cause of an attack and isolated an impacted area in a tenant partition. Other embodiments disclosed.

Provided is a system and method for format preserving tokenization of calendar dates, whereby disparate software connectors of a product suite each receive parameters from a global policy, individually generate a look-up date table from these parameters, shuffle the date tables in a reproduceable manner in accordance with the policy, and then tokenize to produce a shuffled date table, and detokenize sensitive date data with it separately. The connectors are a family of software components associated with a product suite that integrate applications and databases with encryption, tokenization and cryptographic key operations. The shuffled date table is uniquely and locally generated on a connector to support cross platform integrations of various disparate containers, each with their own programming language, Application Programming Interface (API), and user supplied information. Other embodiments disclosed.

Provided is a Middleware comprising an Event Generator to generate events related to access and usage of the authenticator device by one or more apps executing on an end-point; an Event Viewer that makes visible events related to certificate based PKI authenticator device interactions by the one or more apps; and an Event Uploader to upload the events. An Analytics Engine on a server side identifies an application usage status of the authenticator device in view of event and application correlations, builds analytics on usage patterns from the application usage status on PKI authenticator device interactions by the one or more apps, and reports anomalies and potential attacks on the authenticator device in view of the analytics based on an event threat analysis.

Provided is a license delivery module that delivers to or enables software for a licensee under a license at a licensee client device or a plurality of licensee client devices, a license usage collection module that collects data regarding usage of the license at the licensee client device or at the plurality of licensee client devices, one or more analyzer modules coupled to the license usage collection module for analyzing or auditing of usage based on adherence to one or more usage policies under the license, and an adaptive factor computation engine that modifies the license under one or more predetermined options for usage policies based on the analyzing or auditing of usage to provide the licensee with a more cost effective license for the licensee or a more robustly monetizable license under a modified license.

Provided is a program and computer-implemented method of obfuscating a software code, comprising adding a conditional branch instruction to the software code which, when executed, causes evaluating an opaque predicate (PT, PF, P?). The method comprises a step of generating the opaque predicate which includes performing a multiplication operation having as operands two mixed Boolean-arithmetic expressions. Other embodiments disclosed.