Abstract: A mailbox mechanism is used for communication of secure messages from a server to the firmware of a device. Mailbox content provided by the server is authenticated in a driver execution environment of the device, using reboots across the communication sessions, and then stored in secure storage. The communication sessions include first receiving a signed server key, and then receiving a message from the server that is based on a hash of a nonce generated by the device.

Abstract: A system includes at least one processor and at least one memory communicatively coupled to the at least one processor. The at least one processor is configured to receive a plurality of doubly-encrypted secret parts that were encrypted using at least a public key belonging to a public/private keypair. The at least one processor is also configured to decrypt each of the plurality of doubly-encrypted secret parts into a corresponding singly-encrypted secret part using a private key belonging to the public/private keypair. The at least one processor is also configured to decrypt each corresponding singly-encrypted secret part into a corresponding secret part. A secret is reconstructed from a quantity of corresponding secret parts that is a subset of a total number of secret parts previously created from the secret.

Abstract: Exemplary embodiments relate to techniques for end-to-end encrypted interactive messaging between users of a communication system. For example, the interactive messaging may be based on a message template. An end-to-end encrypted message may be sent to a recipient. The encrypted message may contain at least a template identifier associated with the message template and one or more dynamic parameters. The receiving device may decrypt the message and hydrate the message template with the one or more dynamic parameters.

Abstract: Seamless connectivity utilizing multi-domain security by storing a global key on each participant computing devices. When a participant computing device tries to connect to a network, the network sends encryption keys for that network in response to that participant computing device providing the global key and not being blacklisted. The participant computing device can then connect to the network using that network's encryption key. A meta-message container is generated for the message based on a next participant in a route from the transmitting participant to the destination participant. One or more series of one or more line items are generated for the message, with each line item being tagged tag with network information. The line items are encrypted based on the network information. The meta-message container and the encrypted series of line items are then transmitted to the next participant.

Abstract: Technologies for trusted I/O attestation and verification include a computing device with a cryptographic engine and one or more I/O controllers. The computing device collects hardware attestation information associated with statically attached hardware I/O components that are associated with a trusted I/O usage protected by the cryptographic engine. The computing device verifies the hardware attestation information and securely enumerates one or more dynamically attached hardware components in response to verification. The computing device collects software attestation information for trusted software components loaded during secure enumeration. The computing device verifies the software attestation information. The computing device may collect firmware attestation information for firmware loaded in the I/O controllers and verify the firmware attestation information.

Abstract: A method for remote attestation includes establishing, using a cryptographic protocol, a communication session between a first computing device and a second computing device. The communication session includes communications encrypted by an ephemeral session key. The method includes receiving, at the first communication device via the communication session, from the second computing device, an attestation request requesting the first computing device to provide an attestation report. The method includes generating, by the first computing device, the attestation report based on the ephemeral session key and sending, using the communication session, the attestation report to the second computing device.

Abstract: A platform security system and method improve security by binding an identity of a self-contained certificate signing request (SC CSR) requestor to the SC CSR to prevent malicious tampering, such as man-in-the-middle attacks. In at least one embodiment, the requestor, such as a client computer system or other source of a request, requests certificates from a certificate authority (CA). Binding the identity of the SC CSR to the requestor can prevent unauthorized system and/or data access and potentially resultant unauthorized access, malicious tampering, such as man-in-the-middle attacks, and other unauthorized actions or observations. Validation can be performed at the CA on the SC CSR to determine the integrity of the requestor and authorization to receive certificates before the CA sends the certificate to the requestor.

Abstract: A control apparatus includes a first interface for communicating with a first device over a local area network and a second interface for communicating with a second device over a wide area network. A processor is configured to perform an authentication operation on first device after connection to the first interface. The processor receives a first data transmission addressed to the second device from the first device, and then controls the second interface to permit the first data transmission to be transmitted to the second device over the wide area network when the first device has been authenticated. The second interface is controlled to prevent the first data transmission from being transmitted to the second device when the first device has not been authenticated.

Abstract: Methods and systems for remote dynamic isolation of IoT devices are provided. One system includes a first IoT device and a second IoT device configured with an active communication channel with the first IoT device and a role certificate. An operator device is configured to interact with a distributed ledger to issue and revoke role certificates for a plurality of devices including the first IoT device and the second IoT device. The first IoT device periodically validates a role certificate proof received from the second IoT device with an entry of the role certificate proof recorded on the distributed ledger.

Abstract: Replica is an encryption algorithm where security is based on lavish use of randomness rather than on mathematical complexity and the cipher is decoy-tolerant, namely it can readily distinguish between bona fide ciphertext bits and randomized meaningless bits. This attribute allows its users to project as much security as they care by mixing the message bits with more and more decoy bits. It also allows its user to conceal their pattern of communication in a fixed rate of message bit flow.

Abstract: A data managing method. Metadata including a sharing policy is applied to a data file on a computing device. A sharing of the data file from the computing device via a network to a platform hosted by a computing system is detected. It is determined whether the platform is in compliance with the sharing policy, and it is reported whether the platform is in compliance with the sharing policy.

Abstract: Systems and methods for implementing confidential communications between nodes of a network provide reduced power consumption, require less memory, and provide improved security, relative to previously-known systems and method. Preferred embodiments implement protocol functions in hardware, as opposed to software, to yield some or all of the foregoing improvements. Some embodiments use a hashing circuit for multiple purposes, while maintaining its ability to compute successive intermediate hash values. Some embodiments improve security of systems using circuits configured to leverage a favorable data format.

Abstract: Permission control and management for messaging application bots is described. A method can include providing a messaging application, on a first computing device associated with a first user, to enable communication between the first user and another user, and detecting, at the messaging application, a user request. The method can also include programmatically determining that an action in response to the user request requires access to data associated with the first user, and causing a permission interface to be rendered in the messaging application, the permission interface enabling the first user to approve or prohibit access to the data associated with the first user. The method can include accessing the data associated with the first user and performing the action in response to the user request, upon receiving user input from the first user indicating approval of the access to the data associated with the first user.

Abstract: An apparatus includes a processor and a memory operatively coupled to the processor and associated with an instance of a distributed database at a first compute device. The processor is configured to select an anonymous communication path. Each blinded public key from a sequence of blinded public keys associated with the anonymous communication path is associated with a pseudonym of a compute device from a set of compute devices that implement the anonymous communication path. The processor is configured to generate an encrypted message encrypted with a first blinded public key. The processor is configured to generate an encrypted data packet including the encrypted message and a compute device identifier associated with a second compute device. The encrypted data packet is encrypted with a second blinded public key. The processor is configured to send the encrypted data packet to a third compute device.

Abstract: Techniques are disclosed for managing encrypted storage resources based on key-metadata. The per-key key-metadata is stored in a key management system/server (KMS) along with respective cryptographic keys. The cryptographic keys in the KMS may be data keys or wrapping keys for the data keys. The management of the storage resources is provided via a central console which is a user interface of a console server in authenticated communication with the KMS. The key-metadata associates cryptographic keys to their respective encrypted storage resources. This association is used by the console server to drive the console. The console allows an admin to view/list all encrypted storage resources and related cryptographic objects including keys and digital certificates, as well as to perform various administrative/management functions on them.

Abstract: An improved telecommunications network that can reduce the network load on a rich communication services (RCS) server and/or local routers that implement 1-to-N and/or M-to-N services is described herein. In particular, the improved telecommunications network may include an improved RCS server that can route secure multicast messages instead of and/or in addition to unicast messages. For example, the improved RCS server can create a multicast group for a group of UEs in response to a request from a UE to create a group of UEs. Creation of the multicast group may include creating a shared multicast group key (SMGK) for the multicast group and/or selecting a security algorithm for the multicast group. The improved RCS server can then distribute the SMGK and/or the selected security algorithm to the UEs such that the UEs can use the SMGK and/or the selected security algorithm to encrypt and/or decrypt messages.

Abstract: A system may be configured to perform secure low-latency and low-throughput support of REST APIs in IoT devices. In some aspects, the system may establish a first encrypted communication channel with an application of a management device, receive a certificate signing request including a public key of the application via the private channel, sign the public key of the application using read-only birth secret information to generate first signed certificate, and transmit the first signed certificate vis the private channel. Further, the system may receive an authentication request including a second signed certificate via a second encrypted communication channel, determine that the second signed certificate matches the first signed certificate via the read-only birth secret information, and transmit an application credential to the application via the second encrypted communication channel.

Abstract: Adaptive security profiles are supported on an electronic device. One or more security profiles may be automatically or selectively applied to the device based on the device's location and one or more geographic zone definitions. The security profiles may be used to determine the level of authentication or number of invalid authentication attempts for a particular feature or application or set of features or applications.

Abstract: Methods and network equipment in a core network for intercepting protected communication between core network (CN) network functions (NFs). A method performed by network equipment in a core network may include establishing a first connection with a first NF for which the network equipment serves as a proxy and establishing, on behalf of the first NF, a second connection that is towards a second NF and that is secure. The method may also include selectively forwarding communication between the first and second NFs over the first and second connections, including transmitting and/or receiving the communication on behalf of the first NF over the second connection. The method may further include intercepting the communication that the network equipment selectively forwards between the first and second NFs.

Abstract: Visually enrolling a camera using an optical code and a picture file, including: receiving the picture file and the optical code from the camera, wherein the optical code includes a public key of the camera; generating a visual challenge using a nonce created by a random number generator; transmitting the visual challenge to a user of the camera to capture the visual challenge; receiving the captured visual challenge from the camera; extracting a response from the captured visual challenge; comparing the response to the nonce to verify a signature of the captured visual challenge using the public key of the camera and to convert the optical code received from the camera into a valid certificate; and enrolling the camera and adding the valid certificate to a key store.