Abstract: Data is encoded to be incrementally authenticable. A plaintext is used to generate a ciphertext that comprises a plurality of authentication tags. Proper subsets of the authentication tags are usable to authenticate respective portions of plaintexts obtained from the ciphertext. Portions of the plaintext can be obtained and authenticated without decrypting the complete ciphertext.

Abstract: Method for authenticating at least one ventilator with at least one remote station, wherein the ventilator can connect itself via at least one interface to the remote station, at least one authentication file is stored on the ventilator, the authentication file contains at least one signature code of a signing authority, and a public keycode of the signing authority is known to the remote station, the ventilator sends the authentication file to the remote station when establishing the connection to the remote station, the remote station checks the signature code of the authentication file using the public keycode as to whether the signature code originates from the signing point and the ventilator is authenticated when the remote station recognizes the signature code as originating from the signing authority.

Abstract: A scheme for restoring a password-protected endpoint device (e.g., a memory device) of a computer system to an operational state from a low power state without requiring user input of a device password. A password received for unlocking the device during a boot process is stored in a secure memory. The password-protected endpoint device subsequently enters the low power state, causing it to lock. During a transition from the low power state to an operational state, it is detected that the password for the endpoint device is stored in the secure memory. The password is fetched from the secure memory and used to unlock the endpoint device, thereby restoring the endpoint device to an operational state.

Abstract: A solution is proposed for performing authentications. A corresponding method comprises storing a verification string corresponding to applying a one-way function iteratively starting from a secret string. An authentication request is received in association with an authentication string (or more) being generated by applying the one-way function iteratively starting from the secret string for a lower number of times. A result of the authentication request is determined by comparing the verification string with a comparison string being generated by applying the one-way function to the authentication string (or a few times iteratively). Corresponding computer programs and a computer program products for performing the method are also proposed. Moreover, corresponding systems for implementing the method are proposed.

Abstract: Various embodiments are described herein for systems and methods that can be used to determine a destination location in a network fabric. In one example embodiment, the method comprises receiving an application server attribute at a fabric controller from a source port, generating at the fabric controller a destination location based on the application server attribute and mapping information stored on the fabric controller, and transmitting the destination location to the source port, where the source port transmits packetized data to a destination location based on the destination location.

Abstract: Method and apparatus relating to a wireless device supporting 3GPP 4G and 5G radio interfaces and also supporting non-3GPP access, i.e., WiFi, for selecting a security gateway of a first type e.g., ePDG or a security gateway of a second type, e.g., N3IWF for accessing to the core network of first type, e.g., EPC or of a second type e.g., SGC. As the access methods via ePDG and N3IWF are not the same, the wireless device has to determine based on information obtained by a function in the network and its capabilities whether to use an ePDG or an N3IWF for untrusted non-3GPP access. The wireless device may take into account in the selection whether it is connected to the Core network over 3GPP 4G or 5G radio access network. A corresponding apparatus claim is provided.

Abstract: Systems and methods for mutual authentication of a user and a container administrator computer system. A container administrator computer system receives a request from a mobile computing device for a user to access a secure container. The request includes a user identifier. The administrator system receives a first authentication factor corresponding to the user. The administrator system authenticates the user by verifying that the first authentication factor matches a first reference authentication factor associated with the user identifier. The administrator system sends a second authentication factor associated with the administrator system to a human-machine interface associated with the secure container or the mobile computing device. The administrator system receives a notification of authentication of the administrator system using the authentication factor. The administrator system transmits an unlock signal to unlock the secure container.

Abstract: A Reference Time Scale Dissemination System (RTS-DS) is provided that includes a RTS Dissemination Data Provider (RTS-DDP) and a User Terminal. The RTS Dissemination Data Provider is equipped with a radio receiver designed to receive radio signals and to compute a RTS-DDP Computed Time Scale based on received radio signals. The User Terminal (UT) is equipped with a Radio Receiver designed to receive radio signals and to compute a UT Computed Time Scale based on received radio signals, and with a Clock Device designed to be locked to the UT Computed Time Scale and to provide a UT Local Time Scale resultingly locked to the UT Computed Time Scale.

Abstract: A system for bidirectional device authentication between two computing devices is disclosed. A first processor generates a first random number sequence, performs a first operation on the first random number sequence to determine a first table address, and retrieves a first entry in the first table based on the first table address. The processor also executes a first transformation function on the first entry to generate a first transformed entry, transmits the first random number sequence to the second computing device, receives an encoded entry from a second computing device in response to transmission of the first random number sequence, and decodes the encoded entry to determine a second transformed entry. The first transformed entry matches the second transformed entry, and the first processor performs an update to a dynamic table by replacing each entry of the dynamic table with an associated transformed entry.

Abstract: A method for maintaining an availability of a storage system, the method may include obtaining, by a control module of the storage system, problem related information generated by one or more compute nodes of the storage system, the problem related information is indicative of one or more problems associated with an execution of one or more storage operations; determining, by the control module and based on the problem related information, whether to forbid an execution of a storage operation of the one of more storage operations; and updating, by the control module, and based on the determining, a forbidden storage operation data structure that is accessible to the compute nodes of the storage system.

Abstract: An apparatus may include a pipeline circuit configured to process packets and an authentication engine configured to authenticate packets and to provide an authentication signal to the pipeline circuit based on whether packets have been authenticated. The apparatus may further include a control circuit configured to route a given incoming packet to both the authentication engine and to a bypass path. The bypass path may be configured to provide a copy of the given incoming packet to the pipeline circuit to bypass the authentication engine.

Abstract: Methods and systems for a browser extension system are disclosed. In some embodiments, a browser extension server includes a communication device configured to communicate with a first computing device executing a browser extension application and a web browser application and a second computing device executing an authentication application. The browser extension server further includes a memory storing instructions, and a processor configured to execute the instructions to perform operations. The operations may include receiving from the first computing device an indication of a financial service account associated with the first computing device, detecting a payment field in a web page provided by the computing device through the web browser application and, in response, generating a secure token mapped to the financial service account.

Abstract: A method for utilizing a registration authority to facilitate a certificate signing request is disclosed. In at least one embodiment, a registration authority computer may receive a certificate signing request associated with a token requestor. The registration authority may authenticate the identity of the token requestor and forward the certificate signing request to a certificate authority computer. A token requestor ID and a signed certificate may be provided by the certificate authority computer and forwarded to the token requestor. The token requestor ID may be utilized by the token requestor to generate digital signatures for subsequent token-based transactions.

Abstract: A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by public and/or private certificate authorities. In an embodiment, when a new certificate is generated, a certificate template is used to apply various settings and policies for the new certificate. In various examples, templates may be used to establish default values, enforce required and optional values, place restrictions on one or more data fields, and enforce signature requirements. In some embodiments, the template establishes rules for rejecting certificate requests that don't conform to the template.

Abstract: A method is provided. The method includes receiving a request message, the request message relating to a transaction between a first client and a second client, the request message including first client data and second client data, the first client data identifying an account to be used by the first client in the transaction, the second client data indicating if the second client is subscribed to a service. The method further includes determining if the second client is subscribed to the service, and generating an authentication request message if the second client is not subscribed to the service, the authentication request message requesting confirmation that a holder of the account is the first client. The method further includes sending the authentication request message, and receiving an authentication response message from the external server in response, the authentication response message including an indication whether the holder is the first client.

Abstract: The present invention is the invention for providing a guidance service by using a robot. For example, the robot may provide the guidance service in an airport. The robot may receive a destination, acquire a movement path from a current position to the destination, and transmit the movement path to the mobile terminal. The mobile terminal may receive the movement path from the robot and display a guidance path representing a movement path and a user path representing a position movement of the mobile terminal and overlapping the guidance path.

Abstract: Provided is an electromyogram (EMG) signal-based user authentication apparatus and method. The apparatus includes an EMG signal receiver configured to receive an EMG signal measured using an EMG sensor, a pre-processor configured to remove a partial signal from the received EMG signal according to a preset frequency band, and a controller configured to authenticate a user by comparing a pre-stored EMG signal with the EMG signal in which the partial signal has been removed.

Abstract: An electronic device may include a printed circuit board having a physically unclonable function (PUF) source. The electronic device may also include an integrated circuit (IC) chip positioned on the printed circuit board, and the first PUF source may be embedded in or formed on the printed circuit board external to the IC chip. The IC chip has processing circuitry that is configured to determine PUF data based on the PUF source. The processing circuitry is further configured to determine a cryptographic key or authentication token based on the PUF data and to perform at least one secure operation using the cryptographic key or authentication token.

Abstract: A data storage device including a non-volatile memory and a micro-controller is provided. The non-volatile memory stores a firmware file. The micro-controller is coupled to the non-volatile memory, and performs an encryption procedure on the firmware file. The encryption procedure includes: using a first key and a first algorithm to encrypt the firmware file to generate a signature, using the first key and a second algorithm to scramble the signature to generate a scrambled signature, and attaching the scrambled signature to the firmware file.

Abstract: Disclosed are various examples for multi-party authentication and authentication. In one example, a user can gain access to secured data stored by a managed device based on the presence of the minimum quantity of other users within a threshold proximity of the user who desires access.

Abstract: A system and method for at least partially completing a user profile. The method includes analyzing the user profile to identify at least one missing informational element in the user profile, wherein identifying the at least one missing element further comprises determining at least one concept based on the user profile and matching the determined at least one concept to a plurality of category concepts, each concept including a collection of signatures and metadata describing the concept, wherein each category concept is associated with at least one required informational element, wherein each missing informational element is one of the at least one required informational element that is not included in the user profile; sending a query for the missing informational element; and updating at least a portion of the user profile based on a response to the query.

Abstract: Data messages such as data packets in an IPv4 or IPv6 format are processed with a view to compression/decompression, using information obtained from sources other than the field data packet itself, or the stream to which it belongs. This may involve additional dynamic processing defined in specifications identified by a shared marker, or obtained from an additional data source such as a static file, database application or the like. Embodiments described herein enhance this approach with a dynamic determination of data components.

Abstract: An example operation may include one or more of connecting to a blockchain configured to store transactions executed by the participating node, executing a transaction to produce a transaction trail, assigning a transaction identifier (ID) to the transaction, generating a transaction tag based on the transaction ID, and sending to the blockchain the transaction tag and the transaction trail to be entered into the blockchain.

Abstract: An information processing apparatus includes an acquisition unit that acquires first communication information for connecting with an apparatus via a first network and second communication information for connecting with the apparatus via a second network, a determination unit that determines whether communication between an information processing apparatus and the apparatus via the first network based on the first communication information is possible, a connection unit that connects the information processing apparatus with the apparatus via the second network based on the second communication information when the communication via the first network is impossible, and a request unit that transmits a processing request to the apparatus via the first network when the communication via the first network is possible, and transmits the processing request to the apparatus via the second network when the information processing apparatus is connected with the apparatus via the second network.

Abstract: Blockchain-based, smart contract platforms have great promise to remove trust and add transparency to distributed applications. However, this benefit often comes at the cost of greatly reduced privacy. Techniques for implementing a privacy-preserving smart contract is described. The system can keep accounts private while not losing functionality and with only a limited performance overhead. This is achieved by building a confidential and anonymous token on top of a cryptocurrency. Multiple complex applications can also be built using the smart contract system.

Abstract: Systems and methods are provided for a network appliance comprising a plurality of virtual private network nodes operating on the network appliance, each virtual private network node being configurable to connect to selectable virtual private network end points in an on-demand computing network. A web interface is configured to connect a client device to the network appliance and to identify a selected virtual private network end point, where the client device is connected to a particular one of the virtual private network nodes and the particular virtual private network node is connected to the selected virtual private network end point based on interactions with the web interface.

Abstract: In various embodiments described herein, a content extension and programming interface enable third-party content extensions to supply transformation and filtering actions and associated criteria to native web clients on a system. In one embodiment, the native web client loads data for a third-party content filtering, blocking, or transformation extension and conducts extension defined actions without requiring additional intermediation by the third-party content. In one embodiment, a third-party application downloaded to a mobile or handheld device can include an extension data object that provides actions and triggers that are loaded by a native web client of the system. The third-party application is not required to execute continuously and can exit or be terminated once the web client retrieves the extension data object.

Abstract: A text comparison method is adapted for comparing a query file with an existing file. The text comparison method includes: converting the existing file, by an irreversible method, to obtain a first intermediate file, wherein the first intermediate file includes a plurality of characters, and a number of different characters of the plurality of characters is a predetermined value; receiving a second intermediate file which is a file converted from the query file by the irreversible method; and according to a predetermined string length, comparing the second intermediate file with the first intermediate file by a high repeating-character comparison method to output a comparison result. Therefore, the second intermediate file can be created offline and then only the second intermediate file but not the original query file is submitted through internet for private text comparison.

Abstract: A system and method to access one or more insights to display in a context-specific display pane based on PIM application context data, filter the one or more insights to display in the context-specific display pane, and display the filtered one or more insights in the context-specific display pane.

Abstract: A network device may receive, from a first network, a network packet of a first network packet type that encapsulates a fragment of a second network packet of a second network packet type, where the network packet is part of a flow of a plurality of network packets of the first network packet type that encapsulates fragments of the second network packet, and where the network packet includes a flow label that indicates a source port for the second network packet. The network device may perform an anti-spoof check on the fragment of the second network packet based at least in part on the source port for the second network packet that is indicated by the flow label of the network packet. The network device may, based on the fragment passing the anti-spoof check, forward the fragment of the second network packet to a second network.

Abstract: Plugins are authenticated for purposes of accessing and using application program interfaces (APIs) of a management service of a virtualized computing environment. In an authentication process, each plugin is associated with a session ticket that is unique to the plugin. The session ticket may be in the form of a single-use token that has a finite duration, and which may be used by the plugin to establish a session with the APIs of the management service. Because of the single-use and finite duration constraints of the token, the plugin is unable to use the token for other sessions and other plugins are also unable to use the same token to conduct their own sessions with the management service.

Abstract: A System-on-Chip (SoC) performs secure communication operations. The SoC may include a peripheral interface configured to communicate with a host system. The SoC may also include a network interface configured to receive network packets in a secure communication session. The SoC may further include a processor configured to execute an Operating System (OS) software and a secure communication software stack to process at least one received network packet in the secure communication session. In addition, the SoC may include a secure communication engine configured to perform cryptographic operations and generate at least one decrypted packet in the secure communication session. The at least one decrypted packet may be provided to the host system via the peripheral interface.

Abstract: Software for immutably storing computational determinations using distributed ledgers. The software performs the following operations: (i) receiving an indication that a first computational model is ready to be deployed; (ii) storing a copy of the first computational model in a first distributed ledger; (iii) computing a hash of the first computational model using a cryptographic hash function; (iv) receiving an indication that a second computational model has been used to produce a first computational determination; (vi) receiving a hash of the second computational model; and (vii) in response to determining that the hash of the second computational model matches the hash of the first computational model, storing a record of the first computational determination in a second distributed ledger, wherein the record of the first computational determination identifies the second computational model as being the first computational model and includes the hash of the first computational model.

Abstract: A method for authorizing access includes generating a public identity parameter and a private identity parameter for each server, and using the public identity parameter of a first server indicated by a first credential from a resource owner to perform identity encryption on the first credential and a first random parameter so as to generate and transmit a first request message to the first server. The private identity parameter is used to decrypt the first request message. The public identity parameter of a second server indicates by the second credential to perform identity encryption on the second credential and a second random parameter so as to generate and transmit a second request message. The second server uses the private identity parameter to perform decryption on the second request message, and the method determines, according to the decrypted second credential, a resource to be provided to the client.

Abstract: An aspect of performing logical validation on loaded data in a database includes a rule engine configured to, in response to an addition or update of a new rule for logical validation, determine a delta rule that includes a delta part of the new rule with respect to existing rules. An aspect also includes an object container containing object instances that have been validated using the existing rules. The object instance contains only data related to the existing rules and extracted from the database. An aspect further includes a validation engine configured to, upon determining that the delta rule relates to extra data other than the data contained in the object instance, extract the extra data from a database and add it to corresponding object instances, and use at least a part of the new rule to perform logical validation on the relevant object instances in the object container.

Abstract: The present disclosure provides a method of embedding finer grained information such as user identity and application identity in IPv6 addresses used for end-to-end communications within a network. The finer grained information can be used for improved policy enforcement within the network. In one aspect, generating an address for an end-to-end communication within a network, the address including a user identifier and an application identifier for network policy enforcement; assigning the address to an application used in the end-to-end communication; and performing network segmentation and the network policy enforcement within the network using the address.

Abstract: Embodiments of the present invention are directed to validating extraction rules. In embodiments, a set of events for which field extraction is desired is obtained. Thereafter, an extraction rule is applied to the set of events to extract fields of the events. The application of the extraction rule can be monitored to determine that the applied extraction rule is invalid. Based on the applied extraction rule being invalid, a new extraction rule can be generated to apply to the set of events.

Abstract: Systems, methods, and software are disclosed herein for maintain the responsiveness of a user interface to an application. In an implementation, a synchronous operation is commenced on a main thread of an application. The application monitors for a request by an additional thread to interrupt the synchronous operation in favor of an asynchronous operation. The synchronous operation is canceled in response to the request and is retried after completing the asynchronous operation.

Abstract: The present invention particularly concerns a method for executing a program (P) intended to be interpreted by a virtual machine (M), the method comprising steps of determination (102) of a reference code instruction to be interpreted when executing the program, interpretation (112) by the virtual machine of the reference code instruction using machine code. This method also comprises read-out (106) of interpretation rights data (DR) indicating a portion (P1) of the program containing code instructions interpretable by the virtual machine and, on the basis of read-out data, checking the presence (110) of the reference code instruction in the portion (P1) of the program (P), the interpretation of the reference code instruction being implemented by the virtual machine (M) only if the reference code instruction is contained in the portion (P1) of the program (P).

Abstract: The disclosed computer-implemented method for identifying potentially risky traffic destined for network-connected devices may include (1) receiving, at a cloud-based server, characteristics of a network-connected device being adding to a network, (2) creating a digital virtual image of the network-connected device on the cloud-based server, (3) receiving a request sent to a port on the network-connected device and (4) performing a security action including (A) sending the request to the digital virtual image of the network-connected device, (B) identifying the request as a potentially risky request by monitoring a runtime reaction of the digital virtual image of the network-connected device to the request, and (C) sending, to a network monitoring device, a message indicating the request is a potentially risky request. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A kernel driver on an endpoint is configured to monitor processes executing on the endpoint that use network communications, and to transmit process information to a firewall for the endpoint. The firewall can, in turn, use process this stream of information from individual endpoints or groups of endpoints as context for observed network activity in order to control secure network communications and otherwise manage network activity.

Abstract: An apparatus comprises at least one processing device that includes a processor coupled to a memory. The processing device is configured to establish a secure enclave in cloud infrastructure as part of a trust domain, to load the secure enclave with a program for execution in the secure enclave, and to provide the secure enclave with information sufficient to allow the secure enclave to prove to one or more clients of the trust domain that the secure enclave was established within the trust domain. The provided information customizes the secure enclave for the trust domain in a manner that is detectable by the one or more clients of the trust domain. The establishing, loading and providing are illustratively performed at least in part by an orchestrator component that is part of the trust domain and is implemented using a first physical machine that is separate from a second physical machine used to implement the secure enclave.

Abstract: System and method embodiments are provided for accessing a wireless network. The embodiments enable establishing and releasing session resources in a wireless local area network (WLAN) corresponding to packet data network (PDN) connections in a 3 GPP enhanced packet core (EPC). In an embodiment, a method in a network component for establishing a control channel with a user equipment (UE) includes setting up, by the network component, a link layer channel, sending, by the network component, an identifier of the link layer channel to the UE; and communicating, by the network component, with the UE over the link layer channel using a WLAN control protocol (WLCP), wherein the WLAN comprises a trusted WLAN Access Network (TWAN).

Abstract: Embodiments are directed to a computer implemented method of controlling a host computing device connected to at least one subordinate computing device. The method includes configuring a host virtual machine manager (VMM) of the host computing device to perform a method that includes deploying an instance of a subordinate virtual machine (VM) on the subordinate computing device, and deploying another instance of the subordinate VM on the host computing device. The method further includes administering features or functions of the instance of the subordinate VM on the subordinate computing device, and administering features or functions of the another instance of the subordinate VM on the host computing device.

Abstract: A document management system includes a memory for storing machine-readable code and a processor configured to execute the machine-readable code. The processor stores a first document, a first hash of the first document, and a first key in the memory. The first document is encrypted with the first key. The processor further receives a request for the first key. The request includes a second hash of a second document where the second document is purported to be a copy of the first document. The processor further compares the first hash to the second hash and sends the first key in response to the request when the first hash matches the second hash.

Abstract: Techniques for generating and validating credentials are disclosed. A server generates credentials using only a single current key, up to a threshold number of credentials. The server accepts client connection requests with credentials that were generated using n most recently used keys, including the current key and one or more legacy keys. The server rejects connection requests with credentials that were generated using any other key. When the current key has been used to generate the threshold number of credentials, the server updates the current key to a new key.

Abstract: Systems and methods for incentivizing a user to satisfy a goal for attending twelve step meetings. The method includes the steps of: providing the user with a mobile device; detecting the presence of the mobile device at a first location and at a first time selected by the user; comparing the first time and the first location to a database of approved meetings, wherein the comparing is substantially contemporaneous with the first time; and providing a reward to the user upon confirming that: i) the first time and the first location correspond to an approved meeting; and ii) the user is proximate the mobile device at the first time.

Abstract: Automatic detection of software that performs unauthorized privilege escalation is disclosed. The techniques cause a programmable device to obtain a trace event of a program from an event logger, parse the trace event to determine a privilege level for an event, compare the privilege level for the event to an expected privilege level, and block execution of the program based on the comparison.

Abstract: The present disclosure involves systems, software, and computer-implemented methods for asynchronous session storing. An example method includes receiving, by a first thread of a data processing apparatus, a backup trigger for backing up session of an application being executed by a second, separate thread of the data processing apparatus; serializing, by the first thread of the data processing apparatus, session, wherein serializing the session comprises blocking execution of the application by the second thread of the data processing apparatus; storing the serialized session into a database; and validating the stored session.

Abstract: Systems and techniques are provided for trust agents. Trust agents may be enabled. A state determination may be received from each of the enabled trust agents. The state determination may indicate either a trusted state or an untrusted state. The received state determinations may be combined to determine a security state. A security measure may be enabled or disabled based on the determined security state.