Abstract: A computing device and method of controlling access to a computing device. An application to be used when the computing device is in a locked state is selected, wherein in the locked state, only use of the selected application is permitted. The computing device enters the locked state. Use of the selected application without unlocking the computing device is allowed.

Abstract: A method can be used for generating personalized profile package data for integrated circuit cards. The method includes encrypting data records corresponding to profile data with a respective data protection key thereby obtaining encrypted data records. Each record includes a number of personalization fields to store different types of personalization values. The method also includes encrypting a file for a profile package with a master encryption key thereby obtaining an encrypted file for the profile package. The file includes fields to be personalized corresponding to one or more of the personalization fields to store different types of personalization values. The encrypted file for the profile package and encrypted data records are transmitted to a data preparation entity where the encrypted data records and the encrypted file can be decrypted and combined to obtain personalized profile packages.

Abstract: A system that uses a computing device to encrypt data by obtaining multiple series of random numbers, and then time-correlating these series to form a series of composite elements. By selecting a section of the series of composite elements, the computing device can obtain a key for encrypting data.

Abstract: A data processing system has a processor, a system memory, and a hypervisor. The system memory stores program code and data in a plurality of memory pages. The hypervisor controls SLAT (second level address translation) read, write, and execute access rights of the plurality of memory pages. A portion of the plurality of memory pages are classified as being in a secure enclave portion of the system memory and a portion is classified as being in an unsecure memory area. The portion of the memory pages classified in the secure enclave is encrypted and a hash is generated for each of the memory pages. During an access of a memory page, the hypervisor determines if the accessed memory page is in the secure enclave or in the unsecure memory area based on the hash. In another embodiment, a method for accessing a memory page in the secure enclave is provided.

Abstract: An artificial intelligence (AI) platform to support optimization of container builds and virtual machine mounts in a distributed computing environment. A provisioning file is subject to natural language processing (NLP) and a corresponding vector representation of the file is created and subject to evaluation by a set of artificial neural networks (ANN). A first ANN assesses the representation of the file with respect to compliance and operability, and the second ANN selectively assesses the representation of the file with respect to provisioning efficiency. The provisioning file is selectively process based on the provisioning efficiency, with the processing directed at provisioning a container build or mounting a VM.

Abstract: The present disclosure relates to a pre-5th-Generation (5G) or 5G communication system to be provided for supporting higher data rates Beyond 4th-Generation (4G) communication system such as Long Term Evolution (LTE). Embodiments herein provide method and system for end-to-end security over signaling plane in a mission critical data (MCData) communication system. The proposed method includes various ways of securing MCData data payload transmitted over signaling plane using short data service (SDS). The proposed method allows usage of multiple security keys to encrypt the MCData SDS message as per the requirements. Various Keys such as, signaling plane key or media plane key or a dedicated MCData data payload signaling key can be used independently or in a combination thereof to achieve the desired security context. The proposed method allows protection of all the application level components with the signaling plane security context.

Abstract: A method for generating a synthetic dataset involves generating discretized synthetic data based on driving a model of a cumulative distribution function (CDF) with random numbers. The CDF is based on a source dataset. The method further includes generating the synthetic dataset from the discretized synthetic data by selecting, for inclusion into the synthetic dataset, values from a multitude of entries of the source dataset, based on the discretized synthetic data, and providing the synthetic dataset to a downstream application that is configured to operate on the source dataset.

Abstract: Examples of the present disclosure describe systems and methods for a behavioral threat detection engine. In examples, the behavioral threat detection engine manages execution of one or more virtual machines, wherein each virtual machine processes a rule in relation to a context. The behavioral threat detection engine uses any of a variety of techniques to identify when events occur. Accordingly, the behavioral threat detection engine provides event indications, in the form of event packets, to one or more virtual machines, such that corresponding rules are able to process the events accordingly. Eventually, a rule may make a determination as to the presence or absence of a behavior. As a result, execution of the associated virtual machine may be halted, thereby indicating to the behavioral threat detection engine that a determination has been made. Thus a behavioral threat detection engine employs a behavior-based approach to detecting malicious or potentially malicious behaviors.

Abstract: A provisioning client obtains an identifier from a public server and a one-time password from a trusted server. The provisioning client combines the one-time password with the identifier to create an activation code for a client device and presents the activation code to the client device. The activation code enables the client device to download trusted cryptographic information from the trusted server in a communication session that is secured using the one-time password.

Abstract: A conference management system (“system”) facilitates data compliance in recording conversations between users. A host user can send an electronic invitation for a meeting to participants. Upon accessing the invitation, the participants can be presented with two options to join the conference—a first option using which a participant can join the meeting by providing consent to recording the meeting and a second option using which the participant can join the meeting by opting-out of recording of the meeting. When a participant opts-out of the recording of the meeting, the conference management system ensures that the recording is performed in compliance with a data compliance policy applicable to the participant who opted out of recording.

Abstract: Disclosed is a dual-link wireless ad hoc network and a security defense method in an emergency scene, aiming at comprehensively improving its security defense capability. The method comprises: sending, by a source node, the secret key and other messages which are not security defense messages through the second link; detecting, by a destination node, abnormal messages from the acquired valid messages after matching with abnormal message feature library, filtering the abnormal messages out, and quickly broadcasting the features of new abnormal messages through the first link; checking, by a new node to be added to the network, the identity and hardware state, authorizing the new node without abnormality, and broadcasting the authorization result information through the first link; adding, by other nodes receiving the security defense messages, the features of the new abnormal messages to their own abnormal message feature library, and allowing the entry of the new node.

Abstract: Apparatuses, systems, and methods for a wireless device to perform methods for improvements to security checks in a fifth generation (5G) New Radio (NR) network, including mechanisms to avoid redundant access stratum (AS) security checks. The wireless device may determine that an on-demand system information block (SIB) request is pending transmission and may buffer the on-demand SIB in response to determining that a connection establishment procedure will be initiated within a specified time period. The wireless device may then perform a unified security procedure for the on-demand SIB request and the connection establishment procedure, including confirming connection security. Further, in response to confirming connection security, the wireless device may use an on-demand SIB received from the network without confirming a corresponding on-demand SIB signature.

Abstract: Provided is a method for assigning a time-to-live (“TTL”) value for a domain name system (“DNS”) record at a recursive DNS server. The method comprises obtaining, from a client, the TTL value for the DNS record; and storing, in a memory of the recursive DNS server, the TLL value, an identifier of the client, and the DNS record.

Abstract: Methods, devices, systems and computer program products enable monitoring and responding to cyber security attacks. One such system relates to a consortium of monitoring companies and an infrastructure including one or more central monitoring stations or local handling stations for a monitoring company are provided. A central monitoring station of a monitoring company detects a cyberattack that has been launched against a client computer system, and requests a local station to respond to the cyberattack via onsite visits or requests additional resources from other monitoring companies through the consortium system. The central monitoring station also sends to the consortium system updates on a cyberattack that is detected or mitigated by a central monitoring station or local handling station of the monitoring company. The monitoring consortium enables stronger capabilities than any individual monitoring company can offer by the combination and coordination of the efforts and resources of the members.

Abstract: Embodiments disclosed herein relate to methods, systems, and computer programs for automatically determining an outcome associated with a reasoning graph, based on one or more data sets. The methods, systems, and computer programs compare hash values associated with different data sets to determine if they match to assign the outcome associated with a pre-existing hash to the later provided hash and data set associated therewith.

Abstract: A method performed by a device for identifying a network node within a network to which data will be replicated is disclosed. The method comprises encrypting a session key according to an attribute-based encryption scheme; broadcasting the encrypted session key within the network; receiving at least one message encrypted using the session key from at least one network node within the network; and selecting a network node from the at least one network node to which data will be replicated. A further method, a device and a non-transitory machine-readable medium are also disclosed.

Abstract: Disclosed are various approaches for providing authentication of a user and a client device. A user's credentials can be authenticated by an identity provider. In addition, a device posture assessment that analyzes the device from which the authentication request originates is also performed. An authentication request can be authenticated based upon whether the device posture assessment reveals that device to be a managed device that is in compliance with compliance rules.

Abstract: Techniques for refreshing security keys for enciphering and deciphering packets in a wireless communications system are provided. An exemplary method generally includes transmitting, while in a state with no dedicated resources allocated to the UE, a first message to request resumption of a radio resource control (RRC) connection, the first message encrypted using a first set of one or more keys, receiving, in response to the first message, a second message encrypted using the first set of one or more keys or a second set of one or more keys, determining, based on an indication in the second message or received prior to the second message, whether portions of the second message are encrypted using the second set of one or more keys, and processing the second message using the first set of one or more keys or the second set of one or more keys, based on the determination.

Abstract: Systems and methods for enhanced hash transforms are disclosed. In particular embodiments, biometric data is concatenated with non-biometric data for generating a fixed-sized vector, and furthermore performing various permutations and projections on the vector. The resulting vector may be stored in a registry, and a corresponding key may be generated and provided to the user associated with the biometric data. The hash transformation may be a lossy process, such that the resulting hash includes less bytes than the initial biometric data, and a hash reversal fails to generate an exact copy of the original biometric data.

Abstract: According to one or more embodiments of the present invention, a computer implemented method includes enabling, by a secure interface control of a computer system, a non-secure entity of the computer system to access a page of memory shared between the non-secure entity and a secure domain of the computer system based on the page being marked as non-secure with a secure storage protection indicator of the page being clear. The secure interface control can verify that the secure storage protection indicator of the page is clear prior to allowing the non-secure entity to access the page. The secure interface control can provide a secure entity of the secure domain with access to the page absent a check of the secure storage protection indicator of the page.