Abstract: Embodiments described herein provide for a system, method, and apparatus to provision domains in a secure enclave processor to support multiple users. One embodiment provides for an apparatus comprising a first processor to receive a set of credentials associated with one of multiple user accounts on the apparatus and a second processor including a secure circuit to provide a secure enclave, the secure enclave to receive a request from the first processor to authenticate the set of credentials, the request including supplied credentials and an authentication type, where the secure enclave is to block the request from the first processor in response to a determination that the user account has exceeded a threshold number of successive failed authentication attempts for the authentication type.

Abstract: Methods and systems for device authentication based on generating and displaying an optically scannable visual representation of a public portion of a hardware secured encryption key (EK) are described herein. A client certificate is encrypted with the public portion of the EK based on a scan of the displayed visual representation. A connection may be established between a computing device and a server using the encrypted client certificate and a private portion of the EK to authenticate the computing device. In some implementations, a request is received from a second computing device to access a first computing device, and includes data encrypted using a public portion of an EK acquired from a displayed optically scannable visual representation of the public portion of the EK. The second computing device is provided access to the first computing device based on decryption of the encrypted data using a private portion of the EK.

Abstract: In some aspects, methods and systems for a digital trust architecture are provided. In some aspects, the architecture includes a user account provisioning process. The provisioning process may make use of in person verifications of some personal information to ensure authenticity of the user information. Once the authenticity of user information is established, an account may be created. The user account may include a user email account, with integrated access to digital certificates linked to the user account. Account creation may also automatically publish the new user's public key in a publicly accessible directory, enabling encrypted email information to be easily sent to the new user.

Abstract: Certain aspects of the present disclosure provide techniques for managing security keys for enciphering and deciphering packets transmitted in a wireless communications system. According to certain aspects, a method of wireless communication by a user equipment (UE) is provided. The method generally includes obtaining an indication of a key area identifier (ID) of a first cell node, wherein the key area ID identifies a set of cell nodes that are associated with a network node that uses a first key for enciphering or deciphering messages and communicating a first set of messages with the first cell node using the first key for enciphering or deciphering the first set of messages.

Abstract: Provided is a more versatile technique that makes it possible to input dummy information in response to an attacker seeking to collect normal information that cannot be replaced with dummy information. In the present invention, a dummy information insertion device inserts dummy information into a second location that is determined using: first location information indicating a first location that contains normal information, from among all normal information in a computer, which cannot be replaced with other information; and insertion condition information that indicates conditions for determining the second location into which dummy information is to be inserted, with such dummy information resembling the normal information that cannot be replaced and not being present in the computer or in a local network connected to the computer.

Abstract: Embodiments disclosed systems and methods to broadcast a message to one or more virtual data processing (DP) accelerators. In response to receiving a broadcast instruction from an application, the broadcast instruction designating one or more virtual DP accelerators of a plurality of virtual DP accelerators to receive a broadcast message, the system encrypts the broadcast message based on a broadcast session key for a broadcast communication session. The system determines one or more public keys of one or more security key pairs each associated with one of the designated virtual DP accelerators. The system encrypts the broadcast session key based on the determined one or more public keys. The system broadcasts the encrypted broadcast message, and the one or more encrypted broadcast session keys to adjacent virtual DP accelerators for propagation.

Abstract: Disclosed in some examples are methods, systems, and machine readable mediums for secure end-to-end digital communications involving mobile wallets. The result is direct, secure, in-band messaging using mobile wallets that may be used to send messages such as payments, requests for money, financial information, or messages to authorize a debit or credit.

Abstract: Disclosed in some examples are methods, systems, and machine readable mediums for secure end-to-end digital communications involving mobile wallets. The result is direct, secure, in-band messaging using mobile wallets that may be used to send messages such as payments, requests for money, financial information, or messages to authorize a debit or credit.

Abstract: A method for verifying a secret decryption of an escrow agent by a client operatively connected to the escrow agent includes initiating enrollment of the client with the escrow agent, wherein the enrollment results the escrow agent generating a key pair comprising a public key and a private key, obtaining the public key from the escrow agent, wherein the private key is not shared with the client, encrypting the secret with the public key to obtain an encrypted secret, after encrypting the secret, encrypting, based on a verification trigger, a verification value using the public key to obtain an encrypted verification value, sending the encrypted verification value to the escrow agent, obtaining a secret decryption response from the escrow agent, making a determination, based on the secret decryption response, that the escrow agent is not capable of decrypting the secret, and based on the determination, performing a remediation action.

Abstract: Systems and methods for selectively sharing of portion of unstructured data containers/documents based on security attributes or policies used to encrypt/decrypt data within the unstructured data containers using standard encryption schemes are provided herein. In some embodiments, a system includes a key generation authority to generate encryption keys based on a selected cryptographic security scheme and one or more security attributes or security policies; an encryption service to selectively encrypt one or more data subgroups using the one or more public keys and based on one or more security attributes or security policies assigned to the one or more data subgroups with the unstructured data containers; and a decryption service to decrypt the one or more data subgroups within unstructured data containers using the one or more secret keys and the one or more public keys.

Abstract: A method of managing priority in an electronic device, wherein the electronic device comprises a contact-less communication domain and a secure element domain, wherein the contact-less communication domain and the secure element domain are connected via a domain interface, and wherein the secure element domain comprises two or more interfaces.

Abstract: A method of separating identity IPs for identification of applications from the locator IPs for identifying the route is provided. A virtual service layer (VSL) protocol stack uses the IP addresses assigned by network administrators to the application endpoints to support the TCP/IP stack as the identity IP addresses that are not published to the underlay network for routing. On the other hand, the VSL stack uses the IP addresses assigned by the underlay network to the VSL enabled endpoints and VSL enabled routers as the locator IP addresses for routing packets. The VSL stack formats application flow packets with identity headers as identity packet and encapsulates identity packet with the locator header to route the packet. The separation of the identity and locator identifications are used to eliminate the network middleboxes and provide firewall, load balancing, connectivity, SD-WAN, and WAN-optimization, as a part of the communication protocol.

Abstract: Disclosed are various examples of utilizing blockchain for tracking and auditing of systems and processes that involve Internet-of-Things (IoT) devices. A command to install an IoT event definition that defines an IoT event for a specified asset type is transmitted. IoT event data that indicates an IoT event has been triggered based on the IoT event definition is received. An IoT event block is recorded to a blockchain, the IoT event block comprising sensor data and an indication that at least one IoT device triggered the IoT event.

Abstract: Systems and methods are provided for calculating authenticity of a human user. One method comprises receiving, via a network, an electronic request from a user device, instantiating a video connection with the user device; generating, using a database of questions, a first question; providing, via the network, the generated question to the user device; analyzing video and audio data received via the connection to extract facial expressions, calculating, using convolutional neural networks, first data and second data corresponding predetermined emotions based on facial expressions and audio data; generating candidate emotion data using the first and second data; determining whether the candidate emotion data predicts a predetermined emotion, and generating a second question to collect additional data for aggregating with the first and second data or determining the authenticity of the user and using the determined authenticity to decide on the user request.

Abstract: A device may determine that a network function of a network is to use a secure communication protocol. The network function may be configured to facilitate communication via the network. The device may identify a component of a resource configuration that is to instantiate the network function. The device may instantiate, using the component, a proxy for the network function. The device may configure the proxy to obtain a certificate that is associated with the secure communication protocol. The device may cause the proxy to use the certificate to communicate with another proxy that is associated with the network function to perform an operation associated with the network function.

Abstract: A system for switching between communication platforms using a secure healthcare communication system the system comprising: a healthcare provider server device. Transmitting a communication switch request to a first communication platform and establish a first communication channel between the user device and the healthcare provider server device to communicate one or more messages to the first communication platform. Transmit an encoded message over the first communication channel to the first communication platform in response to receiving the communication switch initiation request, the encoded message including an identifier associated with a second communication platform. Switch to an encrypted second communication channel from the first communication channel in response to receiving an encrypted communication initiation request. Encrypted communication initiation request is generated based on the identifier.

Abstract: A key agreement system, method, and apparatus are provided. The method includes: generating, by a first device, a private-public key pair, sending a public key in the private-public key pair to a second device, and receiving a ciphertext and a commitment value; obtaining, by the first device, a first result, obtaining an original key based on a private key in the private-public key pair and the ciphertext, determining a second bit string based on some bits in the original key, calculating a second result based on the second bit string and the first result, and sending the second result to the second device; and receiving, by the first device, an opening value, performing authentication on the second device based on the opening value and the commitment value to obtain an authentication result, and generating a session key used to communicate with the second device.

Abstract: A method includes calculating, at a first time, an identifier for a distributed database by using a first address book of the distributed database. The method includes receiving a transaction to at least one of (1) add a compute device to the first set of compute devices, (2) remove a compute device from the first set of compute devices, or (3) modify a compute device from the first set of compute devices, to define a second set of compute devices. The method includes defining, at a second time, a second address book. The method includes receiving, a state proof associated with data of the distributed database after the second time. The method includes verifying the data of the distributed database by confirming that a predetermined number of compute devices from the first set of compute devices have digitally signed the second address book.

Abstract: The present invention relates to data rights management and more particularly to a secured system and methodology and production system and methodology related thereto and to apparatus and methodology for production side systems and are consumer side systems for securely utilizing protected electronic data files of content (protected content), and further relates to controlled distribution, and regulating usage of the respective content on a recipient device (computing system) to be limited strictly to defined permitted uses, in accordance with usage rights (associated with the respective content to control usage of that respective content), on specifically restricted to a specific one particular recipient device (for a plurality of specific particular recipient devices), or usage on some or any authorized recipient device without restriction to any one in specific, to control use of the respective content as an application software program, exporting, modifying, executing as an application program, viewing,

Abstract: Disclosed are various approaches for signing documents using mobile devices. A request is sent to a certificate authority for a signing certificate. The signing certificate is then received from the certificate authority. The signing certificate is then stored in the memory. Next, a file is received from a client application executed by the processor of the computing device. Then, the file is signed with the signing certificate to create a signed file. The signed file is then returned to the client application.