Abstract: A secure front-end interface for a PLC, RTU or similar device is disclosed. A first server is coupled to the PLC via a communications link and is configured to receive status information from the device and transmit the information to a second server via a one-way data link. The second server has a network interface for coupling to a network and receives the information from the first server via the one-way data link and outputs the information via the network interface based upon a user request. The front-end interface may further include a second one-way data link coupled from the second server to the first server to allow user command entry. The secure front-end interface may alternatively consist only of a single server coupled between the device and the network which requires a user to enter a password before obtaining access to the status information.

Abstract: Generating user authentication challenges based in part on preferences of one or more contacts of a user includes receiving an authentication request from a user. One or more contacts of the user associated with the authentication request are determined. One or more preferences of the close contact or contacts are determined. An authentication challenge based on the one or more preferences of one or more of the user's contacts is generated. The authentication request is allowed or denied based on the completion on the authentication challenge.

Abstract: Various aspects are discussed, for example, a method is described for authentication of devices in a wireless network involving NFC (Near Field Communication), wherein a device periodically switches its mode from a read mode, in which it is able to receive authentication data from one or more other devices, to a write mode, in which it sends out authentication data to the one or more other devices, according to a random time slot scheme. The device authenticates itself after having received authentication data from another device during the read mode, and the device switches permanently its mode to the write mode after being authenticated.

Abstract: Described herein are techniques and apparatuses for scanning a computing device for malware and/or viruses. In various embodiments, a trusted operating environment, which may include a trusted operating system and/or a trusted antivirus tool, may be utilized with respect to a computing device. More particularly, the trusted operating system may be used to boot the computing device. Moreover, the trusted antivirus tool may search the computing device for malware definition updates (e.g., virus signature updates) and use the trusted operating system to scan the computing device for malware. In other embodiments, the trusted antivirus tool may scan the computing device and remove any viruses detected by the trusted antivirus tool. The trusted operating system may then reboot the computing device into a clean environment once any detected viruses are removed.

Abstract: Methods and apparatuses that collect tracking data items into a plurality of data stores for one or more domain in response to resources received from the domains are described. Each tracking data item may be accessible for one of the domains. Relationships of the domains may be identified among the tracking data items across multiple data stores according to the resources received. One or more of the domains may be selected according to the identified relationships to control accessibility of the tracking data items for the domains. The data stores may be updated to prohibit accessing at least a portion of the tracking data items for the selected domains.

Abstract: A system, method, and computer program are provided for providing a vulnerability assessment of a network of industrial automation devices. A user interface that enables a user to select an IP address range and a plurality of industrial automation protocols is provided. The system attempts to establish a communication session with each device within the selected IP address range using each of the selected industrial automation protocols. If a communication session is established with a device, the system attempts to read device information. If device information can be read, the system determines a threat level associated with the device using the device information. The system then provides a vulnerability assessment to the user, identifying each device with which a communication session was established and the industrial automation protocol(s) with which the communication session was established and any threat level determined for the device.

Abstract: Method and apparatus for secure processing. The method includes detecting communication among secure and non-secure data entities, prohibiting execution of non-secure executable instructions on secure data entities unless the non-secure executable instructions are recorded in a permitted instruction record, and prohibiting execution of non-secure executable instructions if the non-secure executable instructions are recorded in a prohibited instruction record.

Abstract: A method and system for authenticating a device, board, assembly or system includes obtaining or processing test/scan information provided via extraction of ECID or other unique identifying information regarding a board. A re-authentication process is performed to verify that the board contains only legitimate ECID or other uniquely identified devices, via comparison of re-extracted codes of devices at known positions against a reference record, the reference record being established by an initial authentication process that utilizes information regarding authentic/unique ECID or other uniquely identified codes of devices delivered to populate the board to derive the reference record for the device.

Abstract: A method for decrypting multicast data by a mobile station in a wireless communication system is described. The method includes receiving an identifier of a group from a base station, receiving parameters for generating a group traffic key from the base station, wherein the parameters include an authentication key for the group, a group security seed and a counter, performing a key derivation function to generate the group traffic key based on the identifier and the parameters and decrypting multicast data using the group traffic key.

Abstract: A method to securely store a data file in a dispersed storage network (DSN) in a manner to increase difficulty in hacking the data file begins by a dispersed storage (DS) processing module encoding the data file into a plurality of data portions. The method continues with the DS processing module dispersed storage error encoding a first data portion to produce a set of encoded data slices, generating a set of DSN addresses, and sending the set of encoded data slices to a first set of storage units using the set of DSN addresses. The method continues with the DS processing module dispersed storage error encoding a second data portion to produce a second set of encoded data slices, generating a second set of DSN addresses, and sending the second set of encoded data slices to a second set of storage units using the second set of DSN addresses.

Abstract: Described herein are systems and methods for secure configuration provisioning of network credentials to configure a device to join one or more networks. One implementation provides for distribution of network credentials to associated devices without user intervention while maintaining security and avoiding distribution of the network credentials to external devices, such as a third-party server. Devices may be associated by purchase from a common merchant, registration to a common account, and so forth.

Abstract: This disclosure addresses systems and methods for the protection of hardware and software in a computing environment. A hypervisor-monitor may be nested between the hardware of a host system and a hypervisor that is capable of supporting one or more guest virtual machines. The hypervisor-monitor may intercept exceptions generated by one or more processors in the host system and inspect software instructions for the hypervisor and the guests. Inspection may include performing a hash of the software instructions and a comparison of the hash with authorized software modules or a set of known malware. In this manner the hypervisor-monitor may monitor prevent the execution of malware by the hypervisor or the guests or provide a record of when code of an unknown origin was executed.

Abstract: A storage cluster of symmetric nodes includes a data privacy scheme that implements key management through secret sharing. The protection scheme preferably is implemented at install time. At install, an encryption key is generated, split, and the constituent pieces written to respective archive nodes. The key is not written to a drive to ensure that it cannot be stolen. Due to the secret sharing, any t of the n nodes must be present before the cluster can mount the drives. To un-share the secret, a process runs before the cluster comes up. It contacts as many nodes as possible to attempt to reach a sufficient t value. Once it does, the process un-shares the secret and mounts the drives locally. Given bidirectional communication, this mount occurs more or less at the same time on all t nodes. Once the drives are mounted, the cluster can continue to boot as normal.

Abstract: Techniques and apparatus for utilizing bits in a translation look aside buffer (TLB) table to identify and access security parameters to be used in securely accessing data are provided. Any type of bits in the TLB may be used, such as excess bits in a translated address, excess attribute bits, or special purpose bits added specifically for security purposes. In some cases, the security parameters may include an index into a key table for use in retrieving a set of one or more keys to use for encryption and/or decryption.

Abstract: A mobile communications device having a digital certificate authenticating the device itself is proposed. A server for authenticating the device and a method of authenticating the device are also disclosed. The device comprises a transmitter, a processor, a memory and a computer readable medium. The memory includes a certificate certifying the authenticity of the mobile communications device, the certificate comprising device-specific data and a digital signature signed by an authority having control of the authenticity of the mobile communications device. The computer readable medium has computer readable instructions stored thereon that when executed configure the processor to instruct the transmitter to transmit a copy of the certificate to a service provider in response to a request to authenticate the mobile communications device with the service provider.

Abstract: Embodiments of the present disclosure provide for improved capabilities in the detection of malware, where malware threats are detected through the accumulated identification of threat characteristics for targeted computer objects. Methods and systems include dynamic threat detection providing a first database that correlates a plurality of threat characteristics to a threat, wherein a presence of the plurality of the threat characteristics confirms a presence of the threat; detecting a change event in a computer run-time process; testing the change event for a presence of one or more of the plurality of characteristics upon detection of the change event; storing a detection of one of the plurality of characteristics in a second database that accumulates detected characteristics for the computer run-time process; and identifying the threat when each one of the plurality of characteristics appears in the second database.

Abstract: Methods, apparatus, and systems are described for providing an accessor device an access credential to interact with a device resource on an accessee device. An authorization entity having a trust relationship with the accessee device, or a linked subordinate authorization entity, generates the access credential. The access credential includes a modification detection indicator, at least one access privilege, and an accessor public key. The at least one access privilege corresponds to at least one device resource on the accessee device. The authorization entity forwards the access credential to the accessor device, which presents the access credential to the accessee device for authentication. Once authenticated, the accessee device grants access to one or more device resources, and controls requests to insure they are within the scope of the at least one access privilege.

Abstract: A security appliqué provides a secure deployment environment (SDE) for a wireless communications device. The Security appliqué isolates the security features, requirements, and information security boundaries such that no hardware modifications are required to a wireless communications device. Rather, a security module thin client is provided to the wireless communications device to provide the Secure Deployment Environment (SDE). The wireless communications device is coupled to the security appliqué via the standard connection interface. Through the standard connection interface, the security appliqué provides the SDE for the wireless communications device without implementing modifications to the wireless communications device.

Abstract: A secure front-end interface for a PLC, RTU or similar device is disclosed. A first server is coupled to the PLC via a communications link and is configured to receive status information from the device and transmit the information to a second server via a one-way data link. The second server has a network interface for coupling to a network and receives the information from the first server via the one-way data link and outputs the information via the network interface based upon a user request. The front-end interface may further include a second one-way data link coupled from the second server to the first server to allow user command entry. The secure front-end interface may alternatively consist only of a single server coupled between the device and the network which requires a user to enter a password before obtaining access to the status information.

Abstract: A device such as a mobile receiving unit (28) may include a memory (74) having a software image (106) therein. The memory (74) has a first stored signature (104) therein. A controller (60) may include a boot loader module (69) that generates a second signature from a portion of the software image (102A-E) less than a full image. The controller (60) authenticates the software image using the first signature and the second signature.