Abstract: Provided is a method for assigning a time-to-live (“TTL”) value for a domain name system (“DNS”) record at a recursive DNS server. The method comprises obtaining, from a client, the TTL value for the DNS record; and storing, in a memory of the recursive DNS server, the TTL value, an identifier of the client, and the DNS record.

Abstract: Encryption of data across an environment, such as a shared resource environment, can be updated using keys generated using one or more revocable stream cipher algorithms. Data stored in the environment can be encrypted under a first key, or other such secret. When it is desired to update the encryption, a second key can be generated under which the data is to be re-encrypted. Instead of distributing the second key, a revocable stream cipher generator can generate an intermediate key based on the first and second keys, that when processed with the first key will produce the second key. Such an approach enables data to be re-encrypted under the second key without distributing the second key. Further, the unencrypted data will not be exposed in the process. In some embodiments, the re-encryption can be performed on an as-needed basis in order to reduce processing requirements.

Abstract: According to one general aspect, a method of using a first probing device may include monitoring one or more encrypted communications sessions between a first computing device and a second computing device. In some implementations of the method, each encrypted communications session includes transmitting a plurality of encrypted data objects between the first and second computing devices. The method may include deriving, by the first probing device, timing information regarding an encrypted communications session. The method may also include transmitting, from the first probing device to a second probing device, the derived timing information.

Abstract: A method of managing a plurality of client nodes in a network is disclosed. A plurality of domains is provided in the network, each domain isolating data from other domains. A plurality of applications is also provided, each application of the plurality of applications allowed to operate in one or more of the plurality of domains. Each of the plurality of client nodes is allowed to operate in one or more of the plurality of domains. The method includes assigning the plurality of applications to the plurality of client nodes, such that each application of the plurality of applications is assigned to a client node that is allowed to operate in a domain that the application is allowed to operate in.

Abstract: Systems for performing a network scan of one or more targets are provided. The systems select, from functions related to performing a network scan of a target, a first group of functions that are ready to execute at a first time. The first group of functions may be executed by a distributed computing system in parallel to generate first and second results. A third function may then be identified as ready to execute based on the first result, and a fourth function may be excluded from the network scan based on the second result.

Abstract: Methods and systems for providing a third party application with access to files stored on a server are disclosed. A method may include receiving, from a browser at a client device, a request for a file stored on the server, wherein the request is received via a web page provided by the third party application and rendered by the browser, the web page comprising an embedded user interface (UI) component associated with the server to access the file stored on the server, wherein the request includes a document identifier associated with the file, an application identifier of the third-party application, and an origin identifier, wherein the origin identifier is associated with the web page provided by the third party application and rendered by the browser.

Abstract: Systems, apparatuses and methods may provide for generating, in response to a decrease in trustworthiness with respect to a controller, a notification message and generating a message authentication code (MAC) based on the notification message and one or more locally stored keys. Additionally, the notification message and the MAC may be sent to the controller, wherein the notification message is directed to one or more peers in a network associated with the controller. In one example, the notification message includes one or more of an indication that the controller is compromised or an indication that the controller is suspected to be compromised.

Abstract: A method and system for connecting an Internet of Things (IoT) hub to a wireless network. One embodiment of the method includes establishing a secure communication channel between an IoT hub and an IoT service through a client device using a first secret; generating a second secret on the client device and transmitting it to the IoT hub; encrypting a wireless key using the second secret to generate a first-encrypted key and transmitting it to the IoT service; encrypting the first-encrypted key using the first secret to generate a twice-encrypted key and transmitting it to the IoT hub over the secure communication channel; decrypting the twice-encrypted key at the IoT hub using the first secret to generate the first-encrypted key and decrypting it using the second secret to generate the wireless key usable to establish a secure wireless connection between the IoT hub and the local wireless network.

Abstract: A customer of a resource provider environment can apply policies at the data object level that will live with a data object during its lifecycle, even as the object moves across trusted boundaries. A customer can classify data, causing tags and/or predicates to be applied to the corresponding data object. Each tag corresponds to a policy, with predicates relating to various actions that can be performed on the data. A chain of custody is maintained for each data object, such that any changes to the object, tags, or policies for the data can be determined, as may be required for various audit processes. The support of such policies also enables the resource provider environment to function as an intermediary, whereby a third party can receive the data along with the tags, policies, and chain of custody as long as the environment trusts the third party to receive the data object.

Abstract: A device and method for placing the device in a locked state having an associated set of permitted tasks so as to permit the device owner to share the device with others but maintain security over aspects of the device. A task change request is evaluated to determine whether the requested task is permitted and, if so, the requested task is allowed; if not, then an authorization process is invoked to prompt the user to input authorization data. Upon verification of the authorization data, the device may be unlocked and the requested change implemented. The permitted tasks may designate specific applications, specific operations or functions within applications or at the operating system level, one or more currently open windows, and other levels of granularity.

Abstract: In a computing system, methods for secure OS level login authentication for internal users to access servers. Some or all servers in a group each utilize a local ID Service for generating and validating a challenge responsive to an OS login request. The challenge is processed in a centralized secure server HSM. Rather than copying individual user public keys to each host in the data center, we need only copy the public key of the HSM to each host in the group. When a user attempts OS level login to a host, it encrypts the challenge using the public key of the HSM and forwards the request for processing in the HSM. There, it decrypts the challenge using the private key in the HSM and re-encrypts the challenge with the public key of the individual user. The user's mobile device, previously registered, is required to complete the authentication process.

Abstract: A method, system and computer-usable medium for generating a security analysis effort, cost and process scope estimates, comprising: analyzing a software system; identifying a complexity level of a security analysis, the complexity level of the security analysis comprising identification of an effort level for the security analysis; and, generating the security analysis effort estimate, the security analysis effort estimate comprising an estimate of an effort expenditure to perform a security analysis on the software system at the identified complexity level.

Abstract: Embodiments for performing self-contained, consistent data masking in a distributed computing environment by a processor. A data masking operation is performed on one or more datasets in one of a plurality of data formats such that a key of each value of each key-value pair representing a common set of columns or paths for the one or more datasets is masked.

Abstract: A computing device includes a first component, a second component and a monitoring component. The monitoring component, receives, from the first component, a command to issue one or more transactions or data to the second component, and determines whether the first component is authorized to issue the one or more transactions, according to one or more policies or rules, which are received through an out-of-band mechanism to which the first component does not have access. If the monitoring component determines that the first component is authorized to issue the one or more transactions or data to the second component, it forwards the one or more transactions data to the second component. Otherwise, the monitoring component blocks the one or more transactions or data from being issued to the second component.

Abstract: Embodiments provided herein determine if an electronic subscriber identity module (eSIM) associated with a requested service can be installed in a secure element (SE) housed in a wireless device. Before requesting deployment of an eSIM suitable for the requested service from an eSIM delivery server, a carrier server asks that an original equipment manufacturer (OEM) server validate that an eSIM corresponding to a customer request should be deployed. The OEM server obtains information about the wireless device and information about the SE. When the carrier server requests validation, the OEM server evaluates the wireless device information and/or the SE information. If the OEM server indicates that deployment of the eSIM should proceed, the OEM server also indicates the eSIM type that is compatible with the wireless device and with the SE housed in the device.

Abstract: Embodiments are provided to allow institutions and individuals the ability to subscribe to notifications regarding DDoS attacks on certain types of institutions, e.g., institutions that fall into certain market verticals or categories. Subscriber data can be integrated with an attack monitoring platform (AMP), which can push out certain information to a system, which tabulates and analyzes the information regarding attacks. If an attack is detected based on predefined thresholds and conditions, a database lookup is performed and a notification that contains certain attack attributes can be sent out to the appropriate subscribers. Subscribers can also be provided with a mechanism to modify their level of DDoS attack notification threshold.

Abstract: A processor-implemented method alters a computer resource based on its new geolocation. One or more processors receive a message that a computer resource has moved from a first geolocation to a new geolocation. The processor(s) receive an identifier of the new geolocation for the computer resource. In response to receiving the identifier of the new geolocation for the computer resource, the processor(s) request and receive encrypted data from the new geolocation. The processor(s) apply decryption information to the encrypted data from the new geolocation, where the decryption information is specifically for decrypting encrypted data from the new geolocation. In response to the decryption information failing to decrypt the encrypted data from the new geolocation, the processor(s) determine that the identifier of the new geolocation is false and apply a geolocation based resource policy to alter the computer resource at the new geolocation.

Abstract: Some embodiments provide a method for securing communication of data messages of a particular machine that includes a dynamic first level address. The method identifies a fixed second level address for a particular data. The fixed second level address is associated with an interface of the particular machine. Based on the fixed second level address, the method identifies a set of security policies for securing the communication of the particular data message. The method applies the set of security policies to the particular data message.

Abstract: Disclosed are an encryption apparatus and method. The encryption apparatus includes a storage configured to store a static key table, and at least one processor configured to implement an authenticator configured to perform authentication with an external apparatus and acquire authentication information and a key table generator configured to generate a dynamic key table using authentication information acquired through the authentication.

Abstract: An apparatus for locking an electronic device includes an actuator, a return mechanism, and an arm. The actuator includes an actuator SMM wire that is configured to apply a contraction force. The return mechanism includes a return SMM wire that is configured to apply a return force opposite the contraction force. The arm is movable toward an unlocked position by the actuator and movable toward a locked position by the return force. The arm has at least one equilibrium position with less than 1 Newton of force on the arm from the actuator and less than 1 Newton of force on the arm from the return mechanism.