Abstract: A method of monitoring network traffic for cryptojacking activity is provided. A request is received from a protected host. It is determined whether the request is a cryptocurrency request based on whether the request uses a protocol specified for requests belonging to the cryptocurrency communication. In response to a determination that the request is a cryptocurrency request for the cryptocurrency, a second request is submitted to a destination indicated by the request, wherein the second request is formatted as a cryptocurrency request for the cryptocurrency. A determination is made whether a reply to the second request from the destination is a cryptocurrency response for the cryptocurrency based on whether the response uses a protocol specified for a response that belongs to communication associated with the cryptocurrency. An intervention action is caused in response to a determination that the reply to the second request from the destination is a cryptocurrency response for the cryptocurrency.

Abstract: A controller that is separate from a processor of the system verifies controller code for execution on the controller. In response to verifying the controller code, the controller verifies system boot code.

Abstract: To allow access to encrypted data stored in the memory of a user terminal, the corresponding secret encryption key is stored in a secure element integrated into the user terminal and this secure element serves as a highly secure relay toward an access device to this data, used by a third party. To do so, a secure communication channel is established between the third party and the secure element. The EAC standard allows mutual authentication accompanied by the establishment of such a secure communication channel. The secure element performs an encryption conversion of the data so that the latter is protected by a session (or transport) key associated with the secure communication channel, and no longer by the initial secret key. The third party can thus access the encrypted data without even knowing the initial secret key.

Abstract: A device, method, or computer program product for conducting a cryptographic operation in a vehicle is disclosed herein. The device is arranged to receive key data and input data, and to conduct a cryptographic computation of the input data to output data using the key data. The cryptographic computation is conducted with or without side channel attack counter measures, which are toggled based on the key data or based on a control input.

Abstract: A system includes one or more “BotMagnet” modules that are exposed to infection by malicious code. The BotMagnets may include one or more virtual machines hosting operating systems in which malicious code may be installed and executed without exposing sensitive data or other parts of a network. In particular, outbound traffic may be transmitted to a Sinkhole module that implements a service requested by the outbound traffic and transmits responses to the malicious code executing within the BotMagnet. Credentials for services implemented by a BotSink may be planted in an active directory (AD) server. The BotSink periodically uses the credentials thereby creating log entries indicating use thereof. When an attacker accesses the services using the credentials, the BotSink engages and monitors an attacker system and may generate an alert. Decoy services may be assigned to a domain and associated with names according to a naming convention of the domain.

Abstract: The invention relates to methods and devices for updating encrypted biometric data of a user at a trusted network node. In an aspect of the invention a method performed by a first client device is provided of updating encrypted biometric data of a user, the encrypted biometric data to be updated having been previously captured by the first client device and registered at a trusted network node. The invention relates to methods and devices for updating encrypted biometric data of a user at a trusted network node. In an aspect of the invention a method performed by a first client device is provided of updating encrypted biometric data of a user, the encrypted biometric data to be updated having been previously captured by the first client device and registered at a trusted network node.

Abstract: Systems, methods, and devices for authenticating an authorization of a user of a motor vehicle can include sending a request signal for an authentication code and providing the authentication code via the computer to a device included in the motor vehicle.

Abstract: Systems, methods, and computer media for collaboratively securing software applications are provided herein. Through a collaborative approach, the described examples allow detection and management of unauthorized users across applications and application suites. By communicating details regarding cyber-attacks among applications, threats to applications can be managed pre-emptively. For example, applications can use attacks on other applications to implement new honeytokens, threat detection points, and blacklisted usernames or other identifiers to limit data access in future attacks.

Abstract: The disclosed technology can acquire a first set of data from a first group of data sources including a plurality of network components within an energy delivery network. A first metric indicating a likelihood that a particular network component, from the plurality of network components, is affected by cyber vulnerabilities can be generated based on the first set of data. A second set of data can be acquired from a second group of data sources including a collection of services associated with the energy delivery network. A second metric indicating a calculated impact on at least a portion of the energy delivery network when the cyber vulnerabilities affect the particular network component can be generated based on the second set of data. A third metric indicating an overall level of cybersecurity risk associated with the particular network component can be generated based on the first metric and the second metric.

Abstract: Various embodiments relate to a method performed by a processor of a computing system. An example method includes generating a symmetric content encryption key. Content is encrypted using the content encryption key to generate cipher text. A hash of the cipher text is generated. Each of the hash and the content encryption key is signcrypted using each of a signcrypting party public key, a signcrypting party private key and a recipient public key to generate a signcrypted envelope message. The cipher text is embedded in a component of the signcrypted envelope message. The signcrypted envelope message is transmitted to a recipient. The recipient can designcrypt the signcrypted envelope message using each of the recipient public key, a recipient private key, and the signcrypting party public key to retrieve the content encryption key and hash of the cipher text. The recipient can decrypt the cipher text using the content encryption key.

Abstract: Techniques are described for automatically incorporating lifecycle information for a secured environment (SE) into an intrusion detection system monitoring the secured environment's operations. In one example, a secured environment including at least one component is monitored, where the secured environment is associated with a lifecycle operations manager (LOM) responsible for managing lifecycle operations associated with at least one component in the SE. One or more log files associated with operations of each of the at least one components are obtained, along with log files associated with lifecycle operations executed by the LOM. A determination is made as to whether the particular activities documented in the log files indicate a violation of at least one malicious action rule. In response to determining that the log files are associated with a malicious action rule, a mitigation action associated with the violation is triggered.

Abstract: A method of provisioning a first digital certificate and a second digital certificate based on an existing digital certificate includes receiving information related to the existing digital certificate. The existing digital certificate includes a first name listed in a Subject field and a second name listed in a SubjectAltName extension. The method also includes receiving an indication from a user to split the existing digital certificate and extracting the first name from the Subject field and the second name from the SubjectAltName extension of the existing digital certificate. The method further includes extracting the public key from the existing digital certificate, provisioning the first digital certificate with the first name listed in a Subject field of the first digital certificate and the public key, and provisioning the second digital certificate with the second name listed in a Subject field of the second digital certificate and the public key.

Abstract: A relay apparatus is connected to a communication apparatus, a service providing apparatus and a browser-equipped apparatus.

Abstract: In one example, a system is disclosed, which may include a network device, a new server connected to the network device, and a management server communicatively connected to a cloud-based service and the network device. The management server may include a server deployment engine to discover the new server in the system using the network device; obtain an encrypted data blob associated with the new server from the cloud-based service; establish a trust, via a secure protocol, with the new server using the encrypted data blob; and deploy the new server in the system upon establishing the trust with the new server.

Abstract: A method for tokenizing credentials is disclosed. In addition to a token, a verification value can be provided for each interaction. The verification value can be generated based at least in part on a dynamic data element. The dynamic data element may be kept secret, while the verification value can be distributed for use during an interaction. When the verification value is used, it can be validated by re-creating the verification value based at least on the stored dynamic data element.

Abstract: The present disclosure provides a detailed description of techniques used in methods, systems, and computer program products for associating anonymous information with personally identifiable information without sharing any personally identifiable information. A method receives a specification record comprising one or more specified demographic attributes to be used in user record selection operations, the results of which operations include user records that comprise a user identifier and at least some non-personally-identifiable information. A candidate group is formed by applying a set of rules over the retrieved user records to exclude one or more user records that comprise mutually-exclusive characteristics with respect to the other user records in the candidate group. An anonymity measure is calculated over the candidate group to satisfy a threshold of anonymity. If needed to satisfy the threshold of anonymity, additional user records are added to the group before any sharing operations.

Abstract: A device-to-device (hereinafter referred to as “D2D”) discovery for D2D communication and a related security method during the D2D communication are provided when a proximity based service (hereinafter referred to as “ProSe”), ProSe discovery, ProSe communication, and the D2D communication are performed in a mobile communication network, and thus a device for performing communication is capable of carrying out a security method for the ProSe discovery and the ProSe communication.

Abstract: An administrator may set restrictions related to the operation of a virtual machine (VM), and virtualization software enforces such restrictions. There may be restrictions related to the general use of the VM, such as who may use the VM, when the VM may be used, and on what physical computers the VM may be used. There may be similar restrictions related to a general ability to modify a VM, such as who may modify the VM. There may also be restrictions related to what modifications may be made to a VM, such as whether the VM may be modified to enable access to various devices or other resources. There may also be restrictions related to how the VM may be used and what may be done with the VM. Information related to the VM and any restrictions placed on the operation of the VM may be encrypted to inhibit a user from circumventing the restrictions.

Abstract: In general, the techniques are described for locally and adaptively managing license token requests for a licensed capacity feature without an explicit grant of license tokens from a centralized license server. For example, a network device for a licensed customer may locally manage a license token request for a capacity feature operating in network license mode and thus shared/contended for among multicast network devices associated with the customer. The network device may locally determine a number of locally-available tokens for the licensed capacity feature, based at least in some examples, on a number of available network-wide tokens as indicated by the license server, the number of network devices contending for the tokens, and a number of tokens already requested by the network device.

Abstract: Techniques for establishing connectivity may include receiving a first login command from an initiator port at a target port; and determining whether the first login command includes valid login authentication information for the initiator port that sent the first login command, and whether the initiator port identifier of the initiator port that sent the first login command includes a key. If the first login command does not include valid login authentication information and the initiator port identifier includes the key, first processing may be performed including: recording first information about the first login command in a registration table; and rejecting the first login command. A second login command may be received from the initiator port at the target port. If the second login command includes valid login authentication information for the initiator port, the second login command may be successfully processed to log the initiator port into the target port.