Abstract: A device determines that a data breach of an application has been reported and determines that an individual has an account with the application based on identifying an association between an application identifier and a username the individual uses to access the application. The device receives, from a user device associated with the individual, password information used to access the application. The device uses the password information and usernames for a group of applications with which the individual has accounts to perform a login procedure for the group of applications to determine that login information for one or more of the applications includes the password information used to access the application affected by the data breach. The device provides, to the user device or another device, a recommendation to change the password information used to access the application and the one or more applications.

Abstract: A method by one or more computing devices for obfuscating challenge code. The method includes obtaining challenge code for interrogating a client, inserting, into the challenge code, code for obfuscating outputs that are to be generated by the client, where the code for obfuscating the outputs includes code for applying a first chain of reversible transformations to the outputs using client-generated random values, interning strings appearing in the challenge code with obfuscated strings, inserting code for deobfuscating the obfuscated strings into the challenge code, inlining function calls in the challenge code, removing function definitions that are unused in the challenge code due to the inlining, reordering the challenge code without changing the functionality of the challenge code, and providing the challenge code for execution by the client.

Abstract: A module with an embedded universal integrated circuit card (eUICC) can include a received eUICC profile and a set of cryptographic algorithms. The received eUICC profile can include an initial shared secret key for authentication with a wireless network. The module can receive a key K network token and send a key K module token to the wireless network. The module can use the key K network token, a derived module private key, and a key derivation function to derive a secret shared network key K that supports communication with the wireless network. The wireless network can use the received key K module token, a network private key, and the key derivation function in order to derive the same secret shared network key K derived by the module. The module and the wireless network can subsequently use the mutually derived key K to communicate using traditional wireless network standards.

Abstract: A method, system and apparatus for authenticating target recipients for digital certificates. A certificate authority authentication system receives a request from an entity for a digital certificate including untrusted certificate validation data. The authentication system initiates a communication link using to untrusted certificate validation data to generate verified untrusted certificate validation data. Subsequently or concurrently, the system obtains, from a confirmation computing system, trusted certificate validation data. The authentication system compares the verified untrusted certificate validation data with the trusted certificate validation data and, based on the comparison, authenticates the entity and issues the requested digital certificate.

Abstract: Techniques are described for metadata processing that can be used to encode an arbitrary number of security policies for code running on a processor. Metadata may be added to every word in the system and a metadata processing unit may be used that works in parallel with data flow to enforce an arbitrary set of policies. In one aspect, the metadata may be characterized as unbounded and software programmable to be applicable to a wide range of metadata processing policies. Techniques and policies have a wide range of uses including, for example, safety, security, and synchronization. Additionally, described are aspects and techniques in connection with metadata processing in an embodiment based on the RISC-V architecture.

Abstract: A secure multi-party computation implements real number arithmetic using modular integer representation on the backend. As part of the implementation, a secret shared value jointly stored by multiple parties in a first modular representation is cast into a second modular representation having a larger most significant bit. The parties use a secret shared masking value in the first representation, the range of which is divided into two halves, to mask and reveal a sum of the secret shared value and the secret shared masking value. The parties use a secret shared bit that identifies the half of the range that contains the masking value, along with the sum to collaboratively construct a set of secret shares representing the secret shared value in the second modular format. In contrast with previous work, the disclosed solution eliminates a non-zero probability of error without sacrificing efficiency or security.

Abstract: A method for detecting a fraud attempt in a communication session may include receiving, via at least one processor, a set of data associated with a communication session between a representative of an organization and a user, tagging, via the at least one processor, one or more items of the set of data as one or more tagged data items, applying, via the at least one processor, a fraud detecting algorithm to the one or more tagged data items to determine a percent likelihood of the user attempting to defraud the representative, generating, via the at least one processor, a visualization based on the percent likelihood, and displaying, via the at least one processor, the visualization via an electronic display during the communication session.

Abstract: Provided is an electronic device, an information processing apparatus, an information processing method, and an information processing system capable of improving convenience in a case where a floating license is used in an electronic device that does not directly communicate with an information processing apparatus providing the floating license.

Abstract: Methods and systems for security threat detection are disclosed. For example, a virtual machine with a network interface of a plurality of virtual machines includes a plurality of applications including first and second applications. The plurality of applications is associated with a respective plurality of application security modules, including a first and second application security modules associated with the first and second applications. A security policy engine executes on a processor in communication with a network including a network controller. The application security module detects an abnormality with a request to the first application, identifies a source and a mode of the abnormality, and reports the source and the mode to the security policy engine. The security policy engine prevents a further abnormality with the source and/or the mode from affecting the second application and commands the network controller to prevent the source from interacting with the network.

Abstract: Various embodiments are generally directed to techniques for multi-voice speech recognition commands, such as based on monitoring a telecommunications channel between first and second devices, for instance. Some embodiments are particularly directed to prompting initiation of a transaction between a first entity associated with a first device and a second entity associated with a second device based on detection of an audible request corresponding to the second entity and an audible response corresponding to the first entity.

Abstract: Verifying a hardware license and controlling hardware features includes receiving a first part of a license payload and a license signature covering the license payload from a CPU, the license signature being generated using a private encryption key; receiving a second part of the license payload from a memory, the CPU being unable to modify the second part of the license payload; generating a hash using the first part and the second part of the license payload; and verifying the license signature using the hash and a public encryption key associated with the private encryption key. When the verifying is successful, communicating with circuitry to enable functionality of the circuitry specified in the license payload.

Abstract: Security policies can be dynamically updated in response to changes in endpoints associated with those policies. A user can indicate one or more regions or networks from which access is to be granted under a specific security policy. The user can subscribe to receive notifications upon a change relating to those endpoints, such as the addition or removal of one or more endpoints. When a change is detected, new policy information can be generated automatically and published for subscribed policies, which can then have the updates applied automatically or provided for manual review and application. Such a process enables access determinations to be made based upon up-to-date endpoint information.

Abstract: A method by one or more network devices communicatively coupled to a web application layer proxy for profiling parameters of web application layer requests received by the web application layer proxy while preserving privacy. The method includes obtaining masked parameter values associated with a parameter in the web application layer requests, where the masked parameter values associated with the parameter are generated by the web application layer proxy based on masking parameter values associated with the parameter while preserving lengths of the parameter values associated with the parameter and character types of characters in the parameter values associated with the parameter, generating the profile of the parameter based on analyzing the masked parameter values associated with the parameter, and providing the profile of the parameter to the web application layer proxy.

Abstract: Methods and system for embedding digital watermark information into textual data arranged in a table of cells are provided. A first subset of cells are selected and for each primary cell key and cell partition number are determined. A portion of a digital watermark ID code is embedded at an embedding position determined based on the partition number. Methods and systems for extracting digital watermark information from the textual data are also provided. A cell is fetched from the table and the presence of portion of the digital watermark ID code is determined. A primary cell key and cell partition number are determined. A portion of the digital watermark ID code is extracted at the embedding position within the cell, the embedding position determined based on the cell partition number. The digital watermarking systems and methods provide tracking for unauthorized copying of the data while modifying only a subset of the data.

Abstract: A method for selectively providing, to a subset of authorized user accounts, wake-on-demand access to session servers during a period of scheduled unavailability includes receiving, by a service broker machine, from a client machine, at least one credential. The service broker machine requests, from a database, connection information associated with the at least one credential. The service broker machine receives, from the database, connection information. The service broker machine determines that the at least one virtual resource is unavailable. The service broker machine determines whether the received credential indicates that a user of the client machine is authorized to request reactivation of the unavailable at least one virtual resource. The service broker machine directs, reactivation of the unavailable at least one virtual resource. The service broker machine provides, to the client machine, the connection information.

Abstract: Systems and methods for redeeming digital files are disclosed. In particular, the systems and methods relate to localized sharing of digital files such that the digital file is degraded when the file is redeemed. The digital file can include a plurality of bits, and bits of the digital file can be removed upon each transfer and/or access of the digital file. When a quantity of bits in the digital file falls below a predetermined threshold, the digital file can be deactivated. The systems can include an application that degrade the digital file. The degradation can include file compression, bitrate reduction, and/or removal of parity bits from the digital file. Security measures, such as private/public encryption keys, are also disclosed herein.

Abstract: According to an aspect, there is provided a method of operating a first computing node to distribute a computation output, the method comprising: determining a first random mask; providing the first random mask as a private input to a computation by a first evaluator node and a second evaluator node; receiving, from each of the first evaluator node and the second evaluator node, a respective masked computation output, wherein each masked computation output is a function of an output of the computation and the first random mask; if the received respective masked computation outputs match, determining the output of the computation from the received masked computation output and the first random mask; and sending information to the first evaluator node and the second evaluator node to enable the first evaluator node and the second evaluator node to determine the output of the computation from the respective masked computation output.

Abstract: A substitute box includes a target input terminal, an obfuscation input terminal, a first output terminal and a second output terminal. The target input terminal is configured to receive a target input data. The obfuscation input terminal is configured to receive an obfuscation input data unrelated to a plaintext. The first output terminal is configured to output a first output data. The second output terminal is configured to output a second output data associated with the first output data. The first output data and the second output data are generated according to both the target input data and the obfuscation input data.

Abstract: Providing streaming of one or more applications from streaming servers onto one or more clients. The computer readable medium includes computer-executable instructions for execution by a processing system. The applications are contained within one or more isolated environments, and the isolated environments are streamed from the servers onto clients. The system may include authentication of the streaming servers and authentication of clients and credentialing of the isolated environments and applications the clients are configured to run. The system may include encrypted communication between the streaming servers and the clients. The system may further include a management interface where administrators may add, remove and configure isolated environments, configure client policies and credentials, and force upgrades.

Abstract: Multi-node resiliency may provide two or more points in a blockchain architecture from which a restarted peer can synchronize its local ledger with local ledgers of other peers that collectively form a distributed ledger. Storage-based resiliency may include providing storage that is separate from the nodes on which peers execute, and configuring a peer to store a copy of a synchronized local ledger to storage prior to restart, and synchronizing a new instance of a local ledger with the synchronized copy from storage upon restarting the peer. Peer-based resiliency may include obtaining a synchronized local ledger or genesis block from a first peer after restarting a second peer. Another point of resiliency may be provided by an orderer cluster that distributes blocks to the peers for committing to their local ledger. A peer may access obtain a synchronized ledger or genesis block from the orderer cluster upon restart.