Abstract: A computer-implemented method according to one embodiment includes compressing an uncompressed instance of data to create a compressed instance of data; encrypting the compressed instance of data in response to determining that a size of the compressed instance of data is less than a predetermined threshold; creating a message authentication code (MAC) for the encrypted compressed instance of data; and adding a variable-length zero pad and the MAC to the encrypted compressed instance of data to create a formatted string.

Abstract: Communication methods and apparatus are described. One communication method includes that user equipment (UE) sends an N1 message to a security anchor function (SEAF), where the N1 message carries a Diffie-Hellman (DH) public parameter or a DH public parameter index, the N1 message further carries an encrypted identifier of the UE, and the encrypted identifier is obtained by encrypting a permanent identifier of the UE and a first DH public key. The UE receives an authentication request that carries a random number and that is sent by the SEAF. The UE sends, to the SEAF, an authentication response used to respond to the authentication request, where the authentication response carries an authentication result calculated based on a root key and the random number.

Abstract: A key exchange system, for generating a shared key for performing encrypted communication between multiple communication devices, includes the multiple communication devices. Each of the multiple communication devices includes a memory, and a processor configured to generate a short term private key by using a private key, generate a short term public key on one of asymmetric pairing groups used for the ID based encryption, by using the short term private key, and generate a shared key for performing encrypted communication with another communication device by performing a first pairing operation using a private key generated on another one of the asymmetric pairing groups and a short term public key generated in the other communication device, and performing a second pairing operation using the short term private key of the communication device and public information used in generating a private key of the other communication device.

Abstract: An information handling system includes a BIOS and a service processor. The BIOS may generate, during a POST, a secret key that includes a symmetric key and a HMAC key and transmits the secret key to the service processor via an high-speed communication interface. After the POST, the BIOS transmits an SMI message that includes an encrypted message and a first hash value of the encrypted message. The encrypted message is encrypted using the symmetric key and the first hash value of the encrypted message is calculated using the HMAC key. The service processor calculate a second hash value of encrypted message based on the HMAC key and verify the encrypted message by comparing the first hash value and the second hash value. After a successful verification, the service processor decrypts the encrypted message and transmits a response to the BIOS.

Abstract: A biometric processing system for authentication combines multiple biometric signals using machine learning to map the different signals into a common argument space that may be processed by a similar fuzzy extractor. The different biometric signals may be given weight values related to their entropy allowing them to be blended to increase security and availability while minimizing intrusiveness.

Abstract: Aspects of the present invention disclose a method, computer program product, and system for detecting a malicious process by a selected instance of an anti-malware system. The method includes one or more processors examining a process for indicators of compromise to the process. The method further includes one or more processors determining a categorization of the process based upon a result of the examination. In response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, the method further includes one or more processors executing the process in a secure enclave. The method further includes one or more processors collecting telemetry data from executing the process in the secure enclave. The method further includes one or more processors passing the collected telemetry data to a locally trained neural network system.

Abstract: An enhanced robust input protocol for secure multi-party computation (MPC) via pseudorandom secret sharing is provided. With this enhanced protocol, the servers that participate in MPC can generate and send a single random sharing [R] to a client with k inputs (rather than a separate random sharing per input), and the client can derive k pseudorandom sharings from [R] without any further server interactions.

Abstract: Security features for a wireless communications system including encryption and decryption of communications, secure key exchange, secure pairing, and secure re-pairing are provided. The encryption/decryption mechanism uses AES-256 block cypher with counter mode to generate blocks of cypher bits used to encrypt and decrypt communications between a master and devices. Session keys are generated using a random salt and a counter value. The random salt is generated using a secure random number generator. A master key or device key is also used in generating session keys. Impermanent session keys are used to encrypt/decrypt finite amount of data. Thereafter, the session key is replaced and cypher bits are generated using the new session key. A synchronized key jump procedure ensures that the master and device switch to the new session key at the same time.

Abstract: Techniques for identifying attack behavior based on scripting language activity are disclosed. A security monitoring system generates a behavior profile for a first client device based on scripting language commands included in a first set of raw machine data received from the first client device, where the first client device is coupled to a network, and the first set of raw machine data is associated with network traffic received by or transmitted from the first client device. The security monitoring system analyzes a second set of raw machine data received from the first client device, where the second set of raw machine data is associated with subsequent network traffic received by or transmitted from the first client device. The security monitoring system detects an anomaly in the second set of raw machine data based on the behavior profile, and initiates a mitigation action in response to detecting the anomaly.

Abstract: A method for encrypting and decrypting data across domains based on privacy computing is provided. A data provider deploys a base key for a data user in advance, and when the data user needs to use the data at a later stage, the data provider generates a data token about a data key based on the base key, and then transmits encrypted data and the data token to the data user. The user obtains the data key based on its own base key in a privacy environment according to the data token, and uses the data key in the privacy environment to realize use of the encrypted data. A transmission process does not involve transmission of the key; therefore, even if a transmission channel is not secure, security of the data can still be ensured, and even if private data is used, the data itself cannot be obtained.

Abstract: It is provided a method for managing central secret keys of a plurality of user devices associated with a single public key. The method is performed in a key manager and comprises the steps of: receiving, from a first user device, transformation data and an identifier of a second user device; obtaining a first central secret key associated with the first user device; generating a second central secret key by applying the transformation data to the first central secret key, wherein the transformation data is applied in reverse to how the same transformation data is applied by the first user device to a device secret key of the first user device; and storing the second central secret key in association with the second user device.

Abstract: Systems and methods are provided for refreshing encryption and decryption keys. The disclosed techniques can improve refreshing encryption keys by allowing for the process to be automated, preventing downtime in each system and reducing developer labor in preparing and facilitating the exchange. In addition, the embodiments of the present disclosure can enable organizations to store keys (both old keys and newly generated keys) along with metadata in a known location accessible to the other organization.

Abstract: The present disclosure involves systems, software, and computer implemented methods for user-controlled access control for user information. One example method includes sending an authentication request to authenticate as a requesting entity to a first decentralized resource directory of a providing entity. An authentication challenge is received, via the connection, from the providing entity, and in response to the authentication request, to store an authentication challenge value for an authentication challenge key in a second decentralized resource directory of the requesting entity. The authentication challenge value for the authentication challenge key is stored in the second decentralized resource directory. An authentication challenge response is sent to the providing entity requesting the providing entity to verify the authentication challenge.

Abstract: Security features for a wireless communications system including encryption and decryption of communications, secure key exchange, secure pairing, and secure re-pairing are provided. The encryption/decryption mechanism uses AES-256 block cypher with counter mode to generate blocks of cypher bits used to encrypt and decrypt communications between a master and devices. Session keys are generated using a random salt and a counter value. The random salt is generated using a secure random number generator. A master key or device key is also used in generating session keys. Impermanent session keys are used to encrypt/decrypt finite amount of data. Thereafter, the session key is replaced and cypher bits are generated using the new session key. A synchronized key jump procedure ensures that the master and device switch to the new session key at the same time.

Abstract: A method of obtaining digitally signed data is disclosed. The method comprises sending first data (e2) from at least one of a plurality of first participants to at least one second participant, wherein the first data is based on second data (e) accessible to at least one said first participant, and the second data is inaccessible to the or each said second participant. A digital signature (s1) of the first data is received from at least one said second participant, and the digital signature of the first data is processed, by a plurality of the first participants, to provide shares of a digital signature(s) of the second data, wherein the digital signature of said second data is accessible by means of a threshold number of said shares and is inaccessible to less than said threshold number of shares.

Abstract: An example operation may include one or more of receiving storage requests endorsed by blockchain peers of a blockchain, selecting a group of the endorsed storage requests to be stored together and ordering the group of endorsed storage requests with respect to each other based on timestamps, encoding the group of ordered and endorsed storage requests into an image, and storing the encoded image within a data section of a block of the blockchain.

Abstract: A cryptographic system comprising an encryption device to generate a ciphertext; a master re-encryption key generation device to generate a master re-encryption key that cannot decrypt a ciphertext generated by the encryption device, but can generate a re-encryption key for changing an access range for a ciphertext generated by the encryption device; re-encryption device to generate a re-encryption key for re-encrypting a target ciphertext generated by the encryption device, using the master re-encryption key, and re-encrypts the target ciphertext to generate a re-encrypted ciphertext, using the generated re-encryption key; and a decryption device to decrypt at least one of the ciphertext generated by the encryption device and the re-encrypted ciphertext generated by the re-encryption device.

Abstract: An apparatus for processing data comprises memory access circuitry to enforce ownership rights of a plurality of memory regions within a first memory. The memory access circuitry is responsive to a first export command received from a first export command source to perform a first export operation to encrypt the given owned data to form given encrypted data and to store the given encrypted data in a second memory. The memory access circuitry is responsive to a second export command for the given memory region received from a second export command source while the first export operation is being performed to determine whether said second export command source has higher priority than the first export command source and, when the second export command source has a higher priority, to interrupt the first export operation and to perform a second export operation specified by the second export command.

Abstract: The disclosure relates to detecting vulnerabilities in managed client devices. A system determines whether a vulnerability scan of a computing device is required to be performed. The system installs a vulnerability detection component in the computing device in response to determining that the vulnerability scan is required to be performed. The system requests the vulnerability detection component to perform the vulnerability scan of the computing device. The system transmits a result of the vulnerability scan to a remote management service for the computing device.

Abstract: Techniques for location based security in service provider networks (e.g., service provider networks for mobile subscribers) are disclosed. A system/process/computer program product for location based security in service provider networks includes monitoring network traffic on a service provider network at a security platform to identify a location for a new session; associating the location with the new session at the security platform; and determining a security policy to apply at the security platform to the new session based on the location.