Abstract: A method and system for managing device association and access is disclosed. Some embodiments may include receiving, from a user device, a request to access a network device. The request may include a public key of the user device. The request may include a digital certificate, wherein the digital certificate may include the public key of the user device. A distributed database address of the user device may be determined by applying a deterministic function to the public key of the user device. A distributed database entry may include the address of the user device. A distributed database entry may be generated. The distributed database entry may include the address of the user device. Based on the address of the user device, access to the network device may be granted to the user device.

Abstract: Remote Triggered Black Holes (RTBHs) can be precisely placed on networks that are not directly physically connected to a target of an attack. A network source of a potential attack can be determined. A path between the network source and the target can be identified, and a determination can be made as to which networks along that path subscribe to an attack mitigation service. From multiple identified subscriber networks, a subscriber network can be identified that is determined to be appropriate for placement of a black hole to mitigate the attack. Once selected, the identified network can receive attack information and acknowledge placement of the black hole. The subscriber network can then begin discarding traffic for the attack target. A subscriber-owned list of network prefixes can be reviewed before allowing RTBH injection for a corresponding address space.

Abstract: Systems, apparatus, methods, and techniques for functional safe execution of encryption operations are provided. A fault tolerant counter and a complementary pair of encryption flows are provided. The fault tolerant counter may be based on a gray code counter and a hamming distance checker. The complementary pair of encryption flows have different implementations. The output from the complementary pair of encryption flows can be compared, and where different, errors generated.

Abstract: Techniques are described for budget tracking in a differentially private security system. A request to perform a query of a private database system is received by a privacy device from a client device. The request is associated with a level of differential privacy. A privacy budget corresponding to the received request is accessed by the privacy device. The privacy budget includes a cumulative privacy spend and a maximum privacy spend, the cumulative privacy spend representative of previous queries of the private database system. A privacy spend associated with the received request is determined by the privacy device based at least in part on the level of differential privacy associated with the received request. If a sum of the determined privacy spend and the cumulative privacy spend is less than the maximum privacy spend, the query is performed. Otherwise a security action is performed based on a security policy.

Abstract: A system includes one or more “BotMagnet” modules that are exposed to infection by malicious code. The BotMagnets may include one or more virtual machines hosting operating systems in which malicious code may be installed and executed without exposing sensitive data or other parts of a network. In particular, outbound traffic may be transmitted to a Sinkhole module that implements a service requested by the outbound traffic and transmits responses to the malicious code executing within the BotMagnet. Credentials for services implemented by a BotSink may be planted in an active directory (AD) server. The BotSink periodically uses the credentials thereby creating log entries indicating use thereof. When an attacker accesses the services using the credentials, the BotSink engages and monitors an attacker system and may generate an alert. Decoy services may be assigned to a domain and associated with names according to a naming convention of the domain.

Abstract: Systems and methods are provided to identify security vulnerabilities related to containerization platforms. Container images may be received from a repository, and scanned for security vulnerabilities. Containers may be automatically generated and updated with security updates when the images are extracted and identified. Updated versions of images may be generated based on the updated containers. Stored security vulnerability may be automatically updated with CVE information received from external databases at regular intervals, or upon receiving a scan request. Scan results may be generated, stored and compared. Vulnerability comparisons may be generated for an initial version of an image and an updated version of the image that includes the implemented security updates that rectify the identifiable security vulnerabilities.

Abstract: Generation of a first prediction model is caused based on first training data, where the first prediction model enables determining whether an exploit to be developed for software vulnerabilities will be used in an attack. For each training instance in the first training data, the first prediction model is used to generate a score. Each training instance is added to second training data if the score is greater than a threshold value. The second training data is a subset of the first training data. Generation of a second prediction model is caused based on the second training data, where the second prediction model enables determining whether an exploit to be developed for software vulnerabilities will be used in an attack.

Abstract: An integrated circuit device that includes a secure or protected memory component is herein disclosed and enabled. The integrated circuit may be a wireless communication device or a smart card or an USB device. Additionally, the integrated circuit may be part of or in a computing device or mobile device. The integrated circuit device includes a private memory section for storing protected data that is not accessible by a user at the private memory section, but is accessible by a memory controller included in the integrated circuit device. The memory controller accesses the protected data with a combination of security operations that may include cryptography. The integrated circuit device may further include a wireless component for establishing a wireless connection with wireless computing devices or readers for wirelessly transmitting the protected data accessed by the memory controller to the wireless computing devices.

Abstract: A real time, on-the-fly data encryption system is shown operable to encrypt and decrypt the data flow between a secure processor and an unsecure external memory system. Multiple memory segments are supported, each with its own separate encryption capability, or no encryption at all. Data integrity is ensured by hardware protection from code attempting to access data across memory segment boundaries. Protection is also provided against dictionary attacks by monitoring multiple access attempts to the same memory location.

Abstract: Systems and methods are provided to authorize users to anonymously access resources of different web sites. For example, a business listing service may authenticate users and allow the authenticated users to access the resources of the businesses listed via the business listing service, without the users having to create separate accounts with the businesses and without having to reveal the identities of the users to the businesses.

Abstract: One embodiment provides a method, including: receiving, at a server from a device, a request for device authentication across an unsecure network, the request including a device registration token; generating, at the server, a shared registration key utilizing the device registration token; verifying, at the server, the device registration token by comparing the device registration token to a function of the shared registration key; and producing, at the server and responsive to verifying the device registration token, a one-time activation token and sending the one-time activation token to the device. Other aspects are described and claimed.

Abstract: Privacy-preserving leakage-deterring public-key encryption techniques are provided. A sender system sends to an authority system a commitment to leakage-deterring-data, and proves in zero-knowledge that the sender system has access to an opening to the commitment. The sender system receives a signature corresponding to a signed commitment to the leakage-deterring-data and an identifier of the sender system. The sender system encrypts a message to a receiver system by applying a one-time pad to the message using a one-time-pad key, and encrypts the result of the application with the public key of the receiver system. The sender system encrypts the one-time-pad key with an attribute-based encryption scheme with a public key of an oblivious decryptor system. The sender system forms a ciphertext from a combination of the encrypted message and the encrypted one-time-pad key and sends the ciphertext to the receiver system.

Abstract: Techniques are described for automatically incorporating lifecycle information for a secured environment (SE) into an intrusion detection system monitoring the secured environment's operations. In one example, a secured environment including at least one component is monitored, where the secured environment is associated with a lifecycle operations manager (LOM) responsible for managing lifecycle operations associated with at least one component in the SE. One or more log files associated with operations of each of the at least one components are obtained, along with log files associated with lifecycle operations executed by the LOM. A determination is made as to whether the particular activities documented in the log files indicate a violation of at least one malicious action rule. In response to determining that the log files are associated with a malicious action rule, a mitigation action associated with the violation is triggered.

Abstract: An electronic key pre-distribution device for configuring multiple network nodes with local key information is provided. The key pre-distribution device applies at least a first hash function and a second hash function to a digital identifier of a network node. The first and second hash functions map the digital identifier to a first public point and a second public point on a first elliptic curve and second elliptic curve. A first and second secret isogeny are applied to the first and second public elliptic curve points, to obtain a first private elliptic curve point and second private elliptic curve point that are part of private key material for the network node.

Abstract: A method detects intrusions in an audit log including records of user sessions with activity features and a user label of a claimed user of the user session. Probabilities that a user session belongs to a user are predicted. A probability is predicted for each combination of a user and a user session of the audit log based on the activity features of the user sessions. A user group including users with similar activity features is constructed based on the predicted probabilities. An anomaly score for a user session of the audit log and a claimed user of the user session belonging to the user group is determined based on a probability that the user session belongs to the user group. An intrusion is detected if the anomaly score of the user session and the claimed user exceeds a predetermined threshold.

Abstract: Credentials for an account on a remote server requiring credentialed access by a client device are created, credentials are transmitted to the remote server, and response data including the credentials is received from the remote server, while restricting access to the credentials by the client device at all times. Session data transmitted by the remote server is also restricted from the client device to prevent side loading of session secrets onto client devices that may be used to attempt to gain unauthorized access to the remote server. Cookies are used to allow the client device to access more than one remote server without having to authenticate individually to each remote server.

Abstract: A near field communication system can include a near field generator configured to generate a near field detectable information signal. The near field generator and supporting circuitry also produces incidental electromagnetic radiation. A masking signal transmitter is used with the near field generator and radiates a masking electromagnetic signal. The masking electromagnetic signal may substantially mask the incidental electromagnetic radiation.

Abstract: A technique for detecting malware involves loading known malware information, finding a string in the known malware information, saving the string in a first database, identifying a first contiguous string block from the known malware information, assigning a confidence indicator to the first contiguous string block, attempting to find the first contiguous string block in a second database containing one or more contiguous string blocks extracted from known malware, and responsive to a determination the first contiguous string block meets a predetermined threshold of similarity with a second contiguous string block contained in the second database, labelling the first contiguous string block.

Abstract: At least some aspects of the present disclosure feature systems and methods for obfuscating data. The method includes the steps of receiving an input data stream including a sequence of n-grams, mapping at least some of the sequence of n-grams to corresponding dictionary terms using a dictionary, and disposing the corresponding tokens to an output data stream.

Abstract: A system includes a processor configured to wirelessly broadcast a message obtained from a first originating vehicle BUS or controller, following a determination that the message was on a pre-approved list for broadcast and having encrypted the message utilizing a temporary random key generated for a message session. The system may include vehicle controllers, a gateway module, and vehicle BUSSES connecting the system controllers to the gateway module. The gateway module may include a memory storing a list of pre-approved message types and corresponding source types, and a processor configured to receive a message from one of the vehicle controllers over one of the vehicle BUSSES to determine if a message type and source type of the received message matches an element of the list.