Abstract: The embodiments described herein describe technologies for Module management, including Module creation and Module deployment to a target device in an operation phase of a manufacturing lifecycle of the target device in a cryptographic manager (CM) environment. One implementation includes a Root Authority (RA) device that receives a first command to create a Module and executes a Module Template to generate the Module in response to the first command. The RA device receives a second command to create a deployment authorization message. The Module and the deployment authorization message are deployed to an Appliance device. A set of instructions of the Module, when permitted by the deployment authorization message and executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision a data asset to the target device.

Abstract: A system for associating a device to a user of a service hosted at a remote location may include a device, a WAN, and equipment. The user may identify a wireless network of the device and connect to the device using equipment. An application on the equipment may generate a key and send the key to the device. The device may then connect with the service and transmit the key to the service. The application may disconnect from the device and connect with the service. The application may send a request to the service to associate with the device, sending the key with the request. The service compares the keys received from the device and the application. If the respective keys match, then the service may associate the device to the user of the service. Otherwise, the association is denied.

Abstract: A function secret sharing (FSS) scheme that facilitates multiple evaluations of a secret function. The FSS scheme includes a function share based on a secret function and at least one key of a key-homomorphic pseudo random function (PRF). At least one key and a function share are provided to each party in the FSS scheme. In turn, each party may generate an output share comprising a function share output evaluated at a function input and a masking component generated based on the at least one key in relation to the key-homomorphic PRF. In turn, the output shares of each participating party may be combined to evaluate the secret function. The FSS scheme facilitates multiple evaluations of the secret function without leaking information regarding the secret function.

Abstract: A terminal device seeking access to a mobile network retrieves a handset identifier identifying the terminal device and a cryptographic key for proving an identity of the terminal device from storage circuitry of the terminal device. The terminal device generates signature information by signing a block of information including the handset identifier using the cryptographic key. During a network connection process for negotiating access to the mobile network with a network control device, the terminal device communicates the signature information to the network control device.

Abstract: Systems and methods of defending against stack-based cybersecurity attacks that exploit vulnerabilities in buffer overflows. The embodiments disclosed herein propose applying a randomized modification to the original size of the stack frames of functions of a program. By applying a randomized modification to the length of the stack frame, e.g., randomly increasing the length of the allocated stack frame memory, it becomes harder (if not impossible) for the attacker to guess or estimate the memory location where the return address of a function is stored, regardless of the attacker's knowledge of the length of the stack frame. Multiple implementations, e.g., randomizations at transform time, load time, and run time are discussed herein.

Abstract: A processor may receive clear text data. The processor may represent at least a portion of the clear text data as at least one array encoding a description of at least one feature of the clear text data. The processor may process the at least one array using a clustering algorithm to determine whether the at least one array is grouped with a benign cluster or a sensitive cluster of a model. In response to determining that the at least one array is grouped with the sensitive cluster, the processor may generate an alert indicating that the clear text data includes sensitive information.

Abstract: Embodiments detect malicious code in distributed software components. A detector element references a source code repository (e.g., open source, commercial) containing lines of various files of a distributed artifact. Subject to certain possible optimizations, the detector inspects the individual files and lines of the artifact file-by-file and line-by-line, to identify whether any commit history information is available from a Versioning Control System (VCS). A risk assessor element receives from the detector element, results identifying those lines and/or files for which no VCS commit history is available. The risk assessor then references code features (e.g., file extension, security-critical API calls) in the results, to generate a probability of the malicious nature of the source code lacking VCS commit history information. An analysis report including this probability and additional relevant information, is offered to a user to conduct further manual review (e.g.

Abstract: Methods and network equipment for implementing security mechanism for interworking with independent security anchor function (SEAF) in 5G networks. A method performed by the standalone SEAF comprises receive a first request for a key to secure communication between the UE and a first access and mobility function (AMF) which a user equipment (UE) requests registration, wherein the request includes a first indication that indicates UE supports a standalone SEAF or not; receive, from a second AMF with which the UE requests registration for performing inter-AMF mobility to the second AMF, a second request for a key to secure communication between the UE and the second AMF, wherein the request includes a second indication that indicates the UE supports a standalone SEAF or not; and determine whether or not a bidding down attack has occurred depending at least in part on whether the first indication matches the second indication.

Abstract: The present invention relates to a method for activating at least one sensor among a plurality of sensors embedded in a multi-unit device, said at least one sensor being configured to detect attacks during an execution by said multi-unit device of a software code comprising computer code instructions, wherein: said multi-unit device comprises at least two code execution units and a sensor activation circuit, and each sensor is associated to one code execution unit, and said method comprising, performed by said sensor activation circuit before execution of a computer code instruction of said software code by one of said code execution units: —determining (S1) the code execution unit configured to execute said instruction, —activating (S2) only the sensors associated with the determined code execution unit.

Abstract: Examples described herein relate to a data aggregation system for enabling query operations on restricted data that originates from multiple independent sources.

Abstract: A computer-implemented method includes receiving deduplication information at a storage system. The deduplication information is accessible to the storage system for performing operations thereon. The deduplication information includes signatures associated with portions of client data. The method also includes receiving the client data encrypted with a client secret key. The client secret key is unavailable to the storage system. The method includes deduplicating data chunks stored in the storage system against chunks of the client data, wherein the client data chunks are selected from the client data for deduplication using the deduplication information.

Abstract: Disclosed is a computer implemented method for malware detection that analyses a file on a per packet basis. The method receives a packet of one or more packets associated a file, and converting a binary content associated with the packet into a digital representation and tokenizing plain text content associated with the packet. The method extracts one or more n-gram features, an entropy feature, and a domain feature from the converted content of the packet and applies a trained machine learning model to the one or more features extracted from the packet. The output of the machine learning method is a probability of maliciousness associated with the received packet. If the probability of maliciousness is above a threshold value, the method determines that the file associated with the received packet is malicious.

Abstract: A device includes a memory. The device also includes a controller. The controller includes a register configured to store an indication of whether an ability of a received command to alter an access protection scheme of the memory is enabled. The received command may alter the access an access protection scheme of the memory responsive to the indication.

Abstract: A system and method of protecting against control-flow attacks provides two complementary, transparent, and strong security policies for the RTL design at a hardware level. The approach performs static analysis of controller, followed by lightweight instrumentation, such that CFI is enforced in-place and at runtime. The modified controller follows conservative CFG with the help of a monitor.

Abstract: This disclosure provides systems, methods, and apparatuses for wireless communication performed by a wireless communication device. An example wireless communication device includes an access point (AP) multi-link device (MLD). The AP MLD transmits a beacon frame to a wireless station (STA) MLD, the beacon frame including a plurality of AP medium access control (MAC) addresses of respective APs belonging to the AP MLD. The AP MLD receives an association request from the STA MLD, the association request including a plurality of STA MAC addresses of respective STAs belonging to the STA MLD. The AP MLD generates, during a handshake operation with the STA MLD, one or more encryption keys configured to encrypt communications between the AP MLD and the STA MLD. The AP MLD verifies the plurality of STA MAC addresses based at least in part on the one or more encryption keys.

Abstract: A fully-automated, defensible and highly-scalable system for disposition decisioning and, where applicable deleting previously archived electronic communications. In this regard, the present invention is capable of determining, on an individual e-communication basis, whether an e-communication should be deleted/purged from archive or retained in archive taking into account applicable rules and policies based on the geographic location from which the e-communication was sent, received or posted, as well as, based on the status on the sender/poster and/or recipient.

Abstract: Techniques for governing access to third-party application programming interfaces (API's) are disclosed. A proxy service exposes an API configured to receive requests, from user-facing services, to perform functions of backend services. The proxy service stores a usage policy that defines a criterion that is (a) different from any authorization criterion and (b) associated with using a function of a backend service. The proxy service receives a request to perform the function of the first backend service for a user-facing service and determines that the request does not satisfy the usage policy. Based on determining that the request does not satisfy the usage policy, the proxy service refrains from accessing the backend service to perform the function responsive to the request, and transmits an alert to the user-facing service indicating that the request does not satisfy the usage policy.

Abstract: Embodiments are directed to methods, apparatuses, computer readable media and systems for authenticating a user on a user device across multiple mobile applications. The identity of the user is validated by encoding and subsequently validating cryptographically encrypted data in a shared data store accessible by the mobile applications tied to the same entity. Specifically, the application leverages the authentication process of a trusted mobile application (e.g. a banking mobile application) to authenticate the same user on a untrusted mobile application (e.g. a merchant mobile application).

Abstract: Techniques for hash based flexible scanning are described. A method of hash based flexible scanning may include obtaining a sample from a sample source, determining a size of the sample, generating one or more hashes of one or more blocks of the sample based on the size of the sample, and determining whether the sample is associated with a known threat by comparing the one hashes of the one or more blocks to hashes in a threat database.

Abstract: This application discloses a data processing method, system, and apparatus, a storage medium, and a device, and belongs to the field of database technologies. The method includes receiving, a trigger request; triggering, according to the trigger request, the first cloud encryptor to store a root key seed, an operating policy, a data key seed, and a data key identifier, and triggering the database proxy to store an encryption data dictionary, the operating policy indicating an operation policy of the first cloud encryptor. The method further includes receiving a data processing request from the client; sending first data that the data processing request requests to process and the data key identifier in the encryption data dictionary to the first cloud encryptor. The method further includes implementing the operating policy, processing the first data, and responding to the data processing request by using the second data.