Abstract: A parameter checking method includes substituting a plurality of initial parameters into a data integrity algorithm to obtain syndrome data using a processor, and using a hardware cipher to calculate a calculation result based on the data integrity algorithm based on a plurality of calculation parameters corresponding to the initial parameters. Moreover, when the processor determines that the syndrome data is not the same as the calculation result, the processor outputs a hacker attack message, indicating that at least one of the calculation parameters has been tampered with.

Abstract: One embodiment provides a method, including: receiving, at a database proxy acting as an intermediary between a plurality of database clients and a service provider providing data management services for the plurality of database clients, a set of queries, of at least one of the plurality of database clients, for data stored at the service provider in an encrypted form, wherein the database proxy maintains a security budget defining a maximum threshold amount of data leakage for the plurality of database clients; batching the set of queries into query batches; transforming, for each query batch, each query within the query batch, wherein the transforming includes changing the query to reduce data leakage; performing, responsive to transforming each query within the query batch, a transformation on each of the query batches to reduce data leakage; executing, at the database proxy and utilizing an order-preserving encryption algorithm, the query batches; and calculating a remaining security budget based upon da

Abstract: A model parameters security protection method is implemented in a computing device in communication connection with at least one security protection device. The method includes training a data model based on an artificial neural network using a number of images and obtaining parameter information of the data model, encrypting the parameter information and generating a configuration file comprising the encrypted parameter information, and sending the configuration file to the at least one security protection device. The parameter information includes at least one of a weight of neuron and an offset value of the neuron of the artificial neural network.

Abstract: This disclosure relates to systems and methods for enabling the use of secret digital or electronic information without exposing the sensitive information to unsecured applications. In certain embodiments, the methods may include invoking, by a client application executing in an open processing domain, a secure abstraction layer configured to interface with secret data protected by a secure processing domain. Secure operations may be securely performed on the secret data by the secure abstraction layer in the secure processing domain based on an invocation from a client application running in the open processing domain.

Abstract: Systems and methods for securing firmware function calls are discussed. More particularly, mechanisms for reducing the chance of tampering and information disclosure attacks against firmware function calls implemented in SMM/MM are described. Data may be passed to and from a calling entity to platform firmware via a communication channel where both the data and the means of decrypting the data are protected from potential snooping OS applications, drivers or DMA-enabled hardware devices.

Abstract: A retrieval system includes a first management unit which stores, in a first storage area that cannot be browsed by an administrator of a provider machine, management information in which an encrypted retrieval keyword used for a retrieval performed by the provider machine, and an encrypted ID, which is associated with the encrypted retrieval keyword, are associated and, of the management information, decrypts, and then once again encrypts, the encrypted retrieval keyword corresponding to the encrypted query from a browsing machine and the encrypted ID corresponding to the encrypted retrieval keyword, and a second management unit which stores, in a second storage area, index information in which the encrypted retrieval keyword used for the retrieval performed by the provider machine, and one or more encrypted IDs associated with the encrypted retrieval keyword, are associated, and, of the index information, updates the encrypted retrieval keyword and the encrypted ID.

Abstract: A secret search system is configured to generate a search key TDv in which a position of each character of a search character string is specified and set, and to search for, from among a plurality of encrypted tags ETx in which a position of each character of a character-string-to-be-searched is specified and set, an encrypted tag ETx corresponding to the generated se arch key TDv. In particular, the secret search system is configured to search for an encrypted tag ETx including the search key TDv as a partial character string by setting a position t of each character in one of the search key TDv and the encrypted tags ETx, setting a position ?t of each character having a sign obtained by inverting a sign of the position t in the other thereof, and cancelling out, during the search, the position t and the position ?t.

Abstract: Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, an exemplary method comprises receiving encrypted code that includes implementing a cryptographic algorithm from a service via a network, wherein the encrypted code further includes a symmetric encryption key; decrypting, by a cryptographic coprocessor, the encrypted code; executing, by the cryptographic coprocessor, the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm and the symmetric encryption key; and sending the cryptogram to the service via the network.

Abstract: A system for protected data storage in a data memory of a computing device includes an encoder and a decoder. The encoder encrypts unencrypted data using encryption information to generate encrypted data, and stores the encrypted data and the encryption information in data memory. The decoder accesses the encrypted data and the encryption information from the data memory, and decrypts the encrypted data using the encryption information to re-generate the unencrypted data. Each time the unencrypted data is read from data memory or the unencrypted data is to be written to the data memory, the encoder re-encrypts the unencrypted data using newer encryption information to generate newer encrypted data, and replaces previous encrypted data and previous encryption information with the newer encrypted data and the newer encryption information, respectively, in the data memory. The encoder and the decoder are integrated, to operate in a single thread of execution.

Abstract: The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.

Abstract: A cyber security system that uses artificial intelligence, such neural networks, to monitor the security of a computer network and take automated remedial action based on the monitoring. The security system autonomically learns behavior profiles, attack profiles and circumvention techniques used to target the network. The remedial action taken by the system includes isolating any misuse that has been identified, surveilling the misuse in the isolated environment, analyzing its behavior profile and reconfiguring the network to enhance security.

Abstract: A method of providing end-to-end encryption for data stored in a storage system, including: receiving a request to read encrypted data from a logical volume of a storage system; decrypting the encrypted data using a decryption key associated with at least one property of the storage system; performing at least one of a data operation to reconstitute the data; encrypting the data using an encryption key associated with at least one property of the data to generate new encrypted data; and providing a response to the request that includes the new encrypted data.

Abstract: A method for data isolation in a multi-tenant environment includes a vault API that is programmed to generate a key ID corresponding to a client ID associated with received entity data and pass an encryption request to a separate computer system that generates a data key to encrypt the entity data. The encrypted data is then returned to the vault API that then stores the encrypted data in a client collection associated with the client ID.

Abstract: Embodiments are directed to trusted local memory management in a virtualized GPU. An embodiment of an apparatus includes one or more processors including a trusted execution environment (TEE); a GPU including a trusted agent; and a memory, the memory including GPU local memory, the trusted agent to ensure proper allocation/deallocation of the local memory and verify translations between graphics physical addresses (PAs) and PAs for the apparatus, wherein the local memory is partitioned into protection regions including a protected region and an unprotected region, and wherein the protected region to store a memory permission table maintained by the trusted agent, the memory permission table to include any virtual function assigned to a trusted domain, a per process graphics translation table to translate between graphics virtual address (VA) to graphics guest PA (GPA), and a local memory translation table to translate between graphics GPAs and PAs for the local memory.

Abstract: In one example an apparatus comprises a computer readable memory; and a signature module to generate a set of cryptographic keys for attestation of group member devices and a set of leaf nodes in a sub-tree of a Merkle tree corresponding to the set of cryptographic keys, forward the set of leaf nodes to a group manager device, receive, from the group manager device, a subset of intermediate nodes in the Merkle tree, the intermediate nodes being common to all available authentications paths through the Merkel tree for signatures originating in the sub-tree, and determine a cryptographic key that defines an authentication path through the Merkle tree, the authentication path comprising one or more nodes from the set of leaf nodes and one or more nodes from the intermediate nodes received from the group manager device. Other examples may be described.

Abstract: A method includes partitioning a received data chunk into first and second data sectors to be stored in respective first and second store units. The method also includes generating first and second random keys. The method further includes encrypting the first data sector with the second random key, and encrypting the second data sector with the first random key. The first and second random keys are encoded with channel codes. Thereafter, the first encoded random key is appended to the first encrypted data sector to obtain first appended data, and the second encoded random key is appended to the second encrypted data sector to obtain second appended data.

Abstract: A multifunction device includes: a non-volatile memory storing encrypted information, which is information that is encrypted; a TPM for decrypting the encrypted information; and a main board communicating with the non-volatile memory and the TPM. The non-volatile memory and the TPM are attachable to and removable from the main board, as a single body. More specifically, the multifunction device includes: a first sub board which has the non-volatile memory attached thereto and is attachable to and removable from the main board; and a chip board which has the TPM attached thereto and is attachable and removable from the first sub board.

Abstract: An in-line security device to transfer cryptographic key material, the device comprising: a first connector configured to connect, via wire, with a host device; a second connector configured to connect, via wire, with a data storage device; a pass-through circuit between the first connector and the second connector to facilitate data communication between the host device and the data storage device; and a communication interface to send cryptographic key material to the data storage device via the second connector.

Abstract: An apparatus comprises: processing circuitry to perform data processing in one of a plurality of security domains including at least a secure domain and a less secure domain, and memory access checking circuitry to check whether a memory access is allowed depending on security attribute data indicating which domain is associated with a target address. In response to a given change of program flow from processing in the less secure domain to a target instruction having an address associated with the secure domain: a fault is triggered when the target instruction is an instruction other than a gateway instruction indicating a valid entry point to the secure domain. When the target instruction is said gateway instruction, a stack pointer verifying action is triggered to verify whether it is safe to use a selected stack pointer stored in a selected stack pointer register.

Abstract: In some examples, a controller includes a secure memory to store a key, and a processor to access a system memory that is external of the controller and that is accessible by a main processor separate from the controller, protect information retrieved from the system memory using the key to produce protected information, and store the protected information in the system memory.