Abstract: A method for triggering and detecting a malicious circuit on an integrated circuit device is provided. A first run of test patterns is provided to logic circuits on the integrated circuit device. Each test pattern of the first run of test patterns includes a plurality of bits, a first portion of the plurality of bits being bits that do not influence a value of a resulting first test output vector, and a second portion of the plurality of bits being bits that will influence the value of the first test output vector. The value of the first test output vector is compared to first expected values. Bit values of the first portion of the plurality of bits for each test pattern of the first run of test patterns are changed to generate a second run of test patterns. The second run of test patterns is provided to the logic circuits on the integrated circuit device. A value of the second run of test patterns is compared to second expected values.

Abstract: Methods and systems for penetration testing of a networked system by a penetration testing system (e.g. that is controlled by a user interface of a computing device) are disclosed herein. In one example, a penetration testing campaign is executed according to a manual and explicit selecting of one or more goals of an attacker of the penetration testing campaign. Alternatively or additionally, a penetration testing campaign is executed according to an automatic selecting of of one or more goals of the attacker (e.g. according to a type of attacker of the penetration testing campaign).

Abstract: Systems, methods, and/or techniques for transferring ownership or rolling-over machine-to-machine (M2M) and/or internet of things (IoT) devices from a first owner to a second owner may be disclosed. For example, at a M2M and/or IoT device, a roll-over token and/or a message with the roll-over token may be received. The roll-over token may be configured to be used to transfer ownership and/or update credentials, and/or the roll-over token may be configured to be requested by a first device management server (DMS) associated with the first owner and/or may be generated by a reset server (RS), for example, in response to the request by the first DMS. A validity of the roll-over token may be checked or determined.

Abstract: Provided is an analysis system configured to obtain an encryption key for encryption communication between an information communication apparatus and a communication network, from memory space provided in the information communication apparatus.

Abstract: Techniques for providing network security and anomaly detection are disclosed. In some embodiments, network traffic may be monitored in order to create a model of network traffic over a first period of time. Based on the model of network traffic, one or more inflated files may be created and stored on a system, wherein the inflated files are of a sufficient file size such that attempts to exfiltrate one or more of the files may be detected based by network monitoring tools. The inflated files may further include one or more indicators of sensitivity, including indicators of the presence of sensitive information that is not actually included in the inflated files. Network traffic characteristics may then be repeatedly or continuously monitored in order to update the size of the one or more inflated files based on changes in network traffic characteristics.

Abstract: Embodiments of the present invention provide a service allocation method and apparatus. The method includes: firstly, generating, by a core network side device, a first dedicated network identifier according to an association relationship sent by user equipment UE, where the first dedicated network identifier is used to identify the association relationship; secondly, sending, by the core network side device, the first dedicated network identifier to the UE; receiving, by the core network side device, a service request message sent by the UE; and finally, allocating a service to the UE according to the service request message and the first dedicated network identifier. Because each wireless router has a unique first dedicated network identifier, the core network side device can provide, according to the first dedicated network identifier, a targeted service or tariff policy for UE corresponding to each wireless router.

Abstract: The present disclosure relates to technologies for sensor networks, machine to machine (M2M) communication, machine type communication (MTC), and Internet of Things (IoT). The present disclosure may be utilized for intelligent services based on the above technologies (smart homes, smart buildings, smart cities, smart or connected cars, health care, digital education, retail businesses, security and safety-related services). The present invention relates to a method and apparatus that, when a user equipment notifies its identification information using an unsecured connection, enable the user equipment to notify the identification information in a secure manner using a one-time password (OTP) algorithm and proximity authentication and to receive services customized to user needs.

Abstract: Methods, apparatus, systems and articles of manufacture manage credentials in hyper-converged infrastructures are disclosed. An example method includes establishing, by executing an instruction with at least one processor, a communication between a software defined data center manager of the hyper-converged infrastructure and a component of the hyper-converged infrastructure using first credentials included in a known hosts file. The example method also includes generating, by executing an instruction with the at least one processor, second credentials at the component in response to a power-on event detected by the software defined data center manager. The example method also includes recording, by executing an instruction with the at least one processor, the second credentials at the known host file.

Abstract: A device assists an embedded Universal Integrated Circuit Card (eUICC) resident in the device with verification of public key information or of security materials. The verification provided by the device can be configured by the user and/or by the eUICC. The verification includes checking for expiration of public key information or presence of an associated public key in a trusted list. The trusted list in some instances includes pinning hash values. The device can warn an end user and/or an infrastructure entity, of an issue if the verification fails. An extension of certificate revocation lists includes a logical indication of at least one new public key in a CRL list. A CRL data field may also indicate a previous CRL, where the previous CRL is the most recent CRL containing a public key listing with at least one new entry.

Abstract: A router system includes a router, a memory storing a client program, and a processor configured to execute the client program. The client program is configured to enable a user to transfer a file from a source to a destination, determine whether data within the file includes sensitive information, determine a probability that transmission of the data from the source to the destination would violate a policy, send normal data packets to the router based on the file, and send a stop data packet to the router when the probability exceeds a threshold. The router forwards the normal data packets to the destination until the router receives the stop data packet.

Abstract: The disclosed technology is generally directed to secure transactions. In one example of the technology, a secure encrypted communication tunnel between the enclave and a hardware security module (HSM) may be established and used. Establishing the tunnel includes the following steps. A session public/private enclave key pair, including a session enclave private key and a session enclave public key, may be derived from the public/private key pair of the enclave. The session enclave public key may be sent to the HSM. A session HSM public key may be received from the HSM. Additional information may be encrypted with the session HSM public key. The encrypted additional information may be sent to the HSM. Further encrypted information may be received from the HSM. The further encrypted information may be decrypted with the session enclave private key.

Abstract: The disclosed technology is generally directed to secure transactions. In one example of the technology, a secure encrypted communication tunnel between the enclave and a hardware security module (HSM) may be established and used. Establishing the tunnel includes the following steps. A session public/private enclave key pair, including a session enclave private key and a session enclave public key, may be derived from the public/private key pair of the enclave. The session enclave public key may be sent to the HSM. A session HSM public key may be received from the HSM. Additional information may be encrypted with the session HSM public key. The encrypted additional information may be sent to the HSM. Further encrypted information may be received from the HSM. The further encrypted information may be decrypted with the session enclave private key.

Abstract: A method for user credential location using prefix matching is described. In one embodiment, the method may include enabling a user to generate remotely a cryptographic hash of a user credential of the user, receiving a portion of the cryptographic hash from the user, comparing the portion of the cryptographic hash with a plurality of cryptographic hashes of user credentials stored at a database, determining whether a match exists between the portion of the cryptographic hash and at least one of the plurality of cryptographic hashes, and transmitting a notification to the user indicating whether the user credential is stored at the database based at least in part on a result of the comparing.

Abstract: Embodiments of the present invention provide systems, methods, and computer storage media directed to facilitate identification of security policies for documents. In one embodiment, content features are identified from a set of documents having assigned security policies. The content features and corresponding security policies are analyzed to generate a security policy prediction model. Such a security policy prediction model can then be used to identify a security policy relevant to a document.

Abstract: Techniques for detecting suspicious file access requests indicative of potential insider threats are described. A suspicious access detection module (SADM) determines, based on access data describing a access requests issued on behalf of multiple users, groups of the users having similar patterns of accesses to folders, a set of the folders accessed by each of the user groups, and ones of the user groups that are to be considered nearby others of the user groups based on having a threshold amount of folder access similarities. The SADM causes an alert to be generated responsive to a determination that a subsequent access request is suspicious because it accesses a file of a folder that is not within the set of accessed folders of the issuing user's user group, and because the folder is not within the sets of accessed folders of any nearby user groups.

Abstract: The invention provides a system for encryptedly storing product data of a product having an attached tag centrally on a product data server, and reading out the centrally stored product data by production stations which are to process the product. The product data are encrypted with a document key which in turn is encrypted with a public key of the tag. The tag contains access information for the centrally stored product data. When a production station accesses product data on the product data server, the tag carries out a re-encryption of the document key from the key system of the tag to that of the accessing production station.

Abstract: A system for controlling accesses to network enabled devices includes a network interface over which a hub communicates with network enabled devices, a processor, and a multilayer access control layer. The access control layer includes instructions that, when executed by the processor, cause the processor to detect, at the hub, a request representing an attempt by an application executing on a remote host device to access a network enabled device communicatively coupled to the hub, characterize the request according to a user of the remote host device, the application making the attempt, and the network enabled device, and determine whether to allow or deny the request based upon the characterization and a plurality of rules. The rules may include definitions of access rights, with respect to the network enabled device, for users, applications, commands or queries made by applications, remote host devices, and network domains.

Abstract: In general, some embodiments described herein relate to using agile or dynamic addresses for multicasting that may be difficult or impossible for a malicious actor to predict. Such agile addresses may prevent a malicious actor from attacking a single static multicast address and may prevent the architecture of the multicast network from propagating the attack. Data sent to invalid (e.g., expired, revoked, and/or otherwise depreciated addresses) can be filtered out and dropped from the network. For example, a first group key associated with a first time period can be calculated based on a first shared secret and a second group key associated with a second time period can be calculated based on a second shared secret. At any given time at least one group key can be an accepted group key. When a multicast address includes a currently accepted group key, the data can be sent to a group.

Abstract: An information processing system includes a client device and a server device. The client device includes a transmitter that transmits, to the server device, a request to acquire information for connecting to an external device that provides an external service. The server device includes a storage that stores attributes of accounts of the external service, and the information for connecting to the external device by using the accounts; a receiver that receives the acquisition request from the client device; an identifier that identifies candidate accounts to be used when the client device receives the external service, the candidate accounts being identified based on information elements and the attributes, the information elements being included in the acquisition request and identifying the accounts; and a transmitter that transmits, to the client device, the information for connecting to the external device by using the identified candidate accounts.

Abstract: A memory alignment randomization method of a memory heap exploit is provided, memory alignment of objects inside a heap area is randomly performed to mitigate the exploits of the vulnerability of the software memory heap area The heap exploit is powerfully mitigated by aligning randomly obtained memory addresses instead of aligning memory addresses at multiples of 4 or 8 when the memory alignment for the objects inside the heap area.