Abstract: Some network architectures include perimeter or edge devices which perform network address translation or otherwise modify data in a network traffic packet header, such as the source address. The modification of the source address prevents downstream devices from knowing the true or original source address from which the traffic originated. To address this issue, perimeter devices can insert the original source address in an X-Forwarded-For field of the packet header. Firewalls and related security services can be programmed to record the original source address in the XFF field in addition to the other packet information and to consider the original source address during security analysis. Using the original source address in the XFF field, services can determine additional characteristics about the traffic, such as geographic origin or associated user accounts, and use these characteristics to identify applicable rules or policies.

Abstract: A rule generation apparatus 100 is an apparatus that automatically generates rules used to analyze an attack, and includes a collection unit 200, an attack success condition generation unit 300, an attack-time history generation unit 400, and a rule generation unit 500.

Abstract: A smart card is provided. The smart card includes a peripheral circuit configured to control a fingerprint sensing array and generate a raw image, an authentication information processing module configured to process the raw image into fingerprint information for verification, a security module configured to determine whether the fingerprint information for verification matches registered fingerprint information to determine usage approval or disapproval for a payment request, and an active shield overlapping the security module. The peripheral circuit, the authentication information processing module, and the security module are integrated into one chip.

Abstract: A communication device and method are provided for communicating data, such as a cryptographic key, wirelessly to another communication device. The communication device and the other device each include an oscillator circuit portion, an inverter, a non-inverting buffer, and a switch for switching between the inverter and non-inverting buffer. A circular loop is formed wirelessly between the oscillator circuit portions of both devices by placing both communication devices near each other. A control circuit in each device measures a parameter such as frequency or waveform pattern of the circulating signal to determine how to position the switches. The oscillator circuit portions may be portions of the same oscillator distributed between the devices, such as a delay line-controlled oscillator or a chaotic oscillator. Inverting and not inverting the circulated signal changes the parameter of the signal so that it is difficult for an eavesdropper to learn the communication.

Abstract: Disclosed is a fault injection attack method including determining a trigger start point in time based on an input signal for a crypto device; determining a trigger end point in time based on an output signal of the crypto device; setting a trigger based on the trigger start point in time and the trigger end point in time; and performing a fault injection attack based on the set trigger.

Abstract: A system and a method are disclosed for on-device storage at a mobile bug of data of a one-way communications session where quality deteriorates. In an embodiment, a mobile bug receives a request to establish a one-way communications session, and responsively transmits data to a database for storage while refraining from storing the transmitted data subsequent to the transmission of the data. The mobile bug detects a deterioration in the one-way communications session that prevents, at least in part, the transmission of the data. Responsive to detecting the deterioration, while the deterioration is detected, the mobile bug stores the data in an encrypted format. The mobile bug detects a request for the data stored at the mobile bug, and responsively transmits the data to the database and deletes the data from the mobile bug.

Abstract: An encrypting entity encrypts an instance of data using a cryptographic key and a cryptographic technique to generate the encrypted data instance; generates a decryption application based on the cryptographic key and at least one credential, the decryption application configured to decrypt the encrypted data instance; bundles the encrypted data instance and the decryption application to generate an encryption bundle; and provides the encryption bundle to be stored by an external data repository. In an example embodiment, the cryptographic technique is a post-quantum cryptographic technique.

Abstract: A data comparison device holds first and second encrypted data of first and second plaintext, respectively. The first plaintext is divided into a plurality of blocks and the first encrypted data is generated by executing encryption of each of the plurality of blocks and shuffling of the plurality of blocks. The second plaintext is divided into a plurality of blocks and the second encrypted data is generated by executing encryption of each of the plurality of blocks. In at least one of the first encrypted data and the second encrypted data, a plaintext value is embedded as a value indicating a magnitude comparison result, and the data comparison device compares blocks at the same position before shuffling of the first encrypted data and the second encrypted data based on the embedded value and determines a magnitude relationship between the first plaintext and the second plaintext.

Abstract: A routing method, apparatus, and system, related to the field of communications technologies, to update a routing indicator in a subscription concealed identifier when a user is migrated to a new unified subscriber data management UDM network element and the routing indicator in the subscription concealed identifier changes. The method includes: sending, by an authentication server function AUSF network element, a first authentication vector obtaining request to a first unified data management UDM network element; and if the AUSF network element receives a routing indicator RI sent by the first UDM network element, sending the RI to an access and mobility management function AMF network element. The method is applied to a process in which a terminal updates the RI.

Abstract: Various embodiments of the present technology generally relate to management of big data storage and data access control systems. In some embodiments, a data access system for use in multiple application service and multiple storage service environments comprises a sandbox database for users, wherein the sandbox database is a virtual database environment via which a user may access datasets according to one or more access policies. In some embodiments, the data access system receives a user request to access a dataset stored in a database into the sandbox environment, wherein the database is associated with the data access system. In response to the request, the data access system may retrieve the corresponding data from the database, determine any associated sandbox access policies, and generate an anonymized data table in the sandbox environment.

Abstract: A data privacy protection tool operates on behalf of a user to effectuate countermeasures and protections for selected portions of their privacy data as provided to a digital service provider (DSP) sites/apps. The countermeasure can be tailored to increase and/or incentivize compliance by DSPs with distribution or access rules for the user data.

Abstract: An apparatus and a method for registering a device in a cloud server are provided. The apparatus includes detecting the device by using short-range communication, requesting an authentication code used for registering the device in the cloud server from an account server in response to the device being detected, receiving the authentication code from the account server, and transmitting the received authentication code and connection address information of the cloud server to the device.

Abstract: Techniques for securing an identifier of user equipment for a request external to a communication network are disclosed. For example, a method comprises receiving, at a network entity, a request for identification information for user equipment from an entity external to a communication network to which the network entity belongs. The network entity generates a secure identifier for the user equipment, wherein the secure identifier comprises an encrypted form of a public subscription identifier associated with the user equipment. The network entity sends the secure identifier to the external entity. The network entity receives the secure identifier in a subsequent request from the external entity. The network entity utilizes the received secure identifier to confirm the received secure identifier corresponds to the user equipment.

Abstract: The technical problem of matching records in different datasets, for example a host dataset and a partner dataset storing records representing respective users, while maintaining the privacy of each dataset, is addressed by providing a privacy safe joint identification protocol. The privacy safe joint identification protocol computes respective anonymous joint identifiers for records in the two datasets. An anonymous joint identifier is generated such that the host-assigned and the partner-assigned identifies that have been determined to represent the same user are mapped to the same anonymous joint identifier.

Abstract: A domain registry (DR) service executing within a service provider network protects data, such as account data, that is associated with different accounts for testing and/or performing other operations/actions by registering an account with one or more domains. The DR service may register an account in one or more domains based on a request by a user. The operations performed that uses/changes data associated with accounts may be restricted based on the domains for which an account is registered. For example, an account that is registered in a “testing” domain may have different workflows/operations performed using the account data associated with the account registered in the testing domain as compared to an account that is not part of the testing domain.

Abstract: The linkability of trajectory data based on similarities to candidate trajectory data is measured and quantified as describer herein. Methods may include: receiving a set of probe data points defining a target trajectory from a probe apparatus; characterizing the trajectory based on features of the target trajectory; identifying a plurality of candidate trajectories sharing at least some features with the target trajectory; calculating, for each of the plurality of candidate trajectories, a similarity score with respect to the target trajectory; calculating a privacy score representing a likelihood of identifying the probe apparatus from the target trajectory based on a number of trajectories in the plurality of candidate trajectories and their respective similarity score; and providing information associated with the target trajectory for location-based services in response to the privacy score satisfying a predetermined value.

Abstract: Providing an accurate and on-demand status of audit compliance is disclosed. A security policy, agreed upon by a service provider and a service user, is provisioned in a compliance log. A service provider requests to add a first update to the compliance log, the first update indicating that a compliance action has been taken. The first update is added to the compliance log, and a first computational digest of the compliance log is added after adding the first update. An auditor of the compliance action requests to add a second update to the compliance log. The second update is added to the compliance log, and a second computational digest of the compliance log is added after adding the second update. Thereby, the user is provided a more current view of audit compliance that that can be trusted based on the tamper-proof compliance log.

Abstract: In some implementations, a masking device may receive rules and a document object model (DOM) structure. Each rule may indicate a corresponding element, a corresponding pattern, and a type of remediation. The DOM structure may include elements, where each element is associated with text. The masking device may traverse the DOM structure to identify elements that map to corresponding elements indicated by the rules. The masking device may determine whether text, associated with the identified elements, is sensitive information by determining whether the text maps to corresponding patterns indicated by the rules. The masking device may perform validation on the sensitive information. The masking device may modify the DOM structure based on the sensitive information, the validation, and a type of remediation indicated by the rules. Accordingly, the masking device may output the modified DOM structure.

Abstract: A wireless communication network performs quantum authentication for a wireless User Equipment (UE). In the wireless communication network, quantum circuitry selects polarization states for qubits, generates and transfers the qubits, exchanges cryptography information with edge quantum circuitry, generates cryptography keys based on polarization states and cryptography information, and transfers the cryptography keys to network authentication circuitry. The edge quantum circuitry receives and process the qubits, determines the polarization states for the qubits, exchanges the cryptography information with the network quantum circuitry, generates the cryptography keys based on the polarization states and cryptography information, and transfers the cryptography keys to the wireless UE. The wireless UE generates authentication data based on the cryptography keys and wirelessly transfers the authentication data for delivery to the network authentication circuitry.

Abstract: A System Platform establishes a Genuine User ID (“GUID”), creates a user profile for an Intended User, generates a unique data set based upon input associated with the user profile and a digital device it has registered to the Intended User. The output of the GUID in combination with the output of an algorithm in a provisioning application enables the digital device to respond to Access Requests at an Access Point. The response from the genuine Intended User's application on their genuine digital device produces a unique data package which combines the GUID, a device ID for the digital device and the output of the algorithm using the payload obtained from one or more data management sources. The unique data package can be tailored for many different uses by the intended user, including uses which are attended or unattended, with varying levels of security.