Abstract: The technology described in this document can be embodied in a computer-implemented method that includes receiving, at one or more servers from a first computing device, (i) first identification information identifying the first computing device or an application executing on the first computing device, and (ii) second identification information identifying a second computing device. The second identification information is obtained by the first computing device by detecting changes to one or more parameters of a magnetic field generated by the second computing device. The method also includes determining, by the server based on the first information, identity information of a user associated with the first computing device, and transmitting, from the one or more servers to the second computing device, the identity information, such that the identity information is usable by the second computing device to verify an access attempt by the user.

Abstract: A system is described that can perform a method for receiving a request to modify a universal integrated circuit card, generating a package comprising configuration data for modifying the universal integrated circuit card, instructing an over-the-air system to transmit the package encrypting the package with a transport key to generate an encrypted package, and transmitting the encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card. The system can also perform a method of providing a mobile network operator trusted service manager system information relating to the configuration data to enable the mobile network operator trusted service manager system to manage content and memory allocation of the universal integrated circuit card.

Abstract: A method for connecting a network access device to a wireless network access point includes: initiating an access request to a wireless network access point, wherein when detecting that the network access device is not authenticated, the wireless network access point redirects the access request to an authentication portal, the access request carrying an authentication server address; obtaining, by an application client on the network access device, an authentication parameter after obtaining authentication authorization of a user on the authentication portal; encrypting the authentication parameter by using a wireless access key; initiating, according to the authentication server address, an authentication request carrying the encrypted authentication parameter to an authentication server; receiving the login address and the encrypted signature from the authentication server; accessing the login address on the authentication server; and connecting to the wireless network access point to access the Internet a

Abstract: A communication apparatus which performs communication in a wireless LAN by operating as a base station or a terminal station of the wireless LAN determines, if currently connected to the wireless LAN as the terminal station when receiving the connection request from a first another apparatus, whether to cause the first another apparatus to connect to the currently connected wireless LAN. Then, the communication unit communicates with the first another apparatus via a second another apparatus which operates as the base station in the currently connected wireless LAN when determining to cause the first another apparatus to connect to the currently connected wireless LAN, and communicates with the first another apparatus not via the second another apparatus when determining not to cause the first another apparatus to connect to the currently connected wireless LAN.

Abstract: The present disclosure relates to secure communication over a cellular network between a mobile terminal 30 and a network entity 40 via a node of a cellular network, wherein a Home Public Land Mobile Network, PLMN, of the mobile terminal generates a ciphering key, CK, and/or an integrity key, IK, for authentication of the mobile terminal and wherein performance of an Authentication and Key Agreement, AKA, procedure between the mobile terminal and the node of the cellular network permits the mobile terminal to determine CK and/or IK. In particular, there is provided the method comprising applying a special key to allow communication of user-plane data between the mobile terminal and the network entity in a trusted manner, wherein the special key is generated from the CK and/or IK but is different from the CK and IK.

Abstract: The present invention relates to a forensic analysis method performed on a Distributed Computing System (DCS) (10) comprising a server (18) and at least one client machine (14). The method comprises collecting data in a client machine (14) of the DCS (10) to form a first data set, the collected data being a function call to a resource comprised in the DCS. The method further comprises applying a data reduction model to the first data set to form a second data set and processing the second data set in the server (18) of the DCS (10) to provide for detection of suspect behaviour at the client machine (14). The data reduction model is configured to extract a subset of data from the first data set to form the second data set, the subset of data comprising: user account identifier; and process and object identifier.

Abstract: Systems, apparatuses, and methods for implementing digital rights management using a GPU are disclosed. In one embodiment, a system includes at least a GPU, a security processor, and a memory. The GPU is configured to execute a first portion of a binary and detect that a second portion of the binary is encrypted. The second portion of the binary includes enhanced content that is available for purchase. If the user purchases the enhanced content, a license server generates a token specific to the security processor of the system and conveys the token to the system. Next, the security processor decrypts the second portion of the binary using the token and stores the decrypted second portion of the binary at a memory location accessible by the first processor. Then, the first processor executes the second portion of the binary.

Abstract: To provide a VPN access control system, an operating method thereof, a non-transitory computer-readable recording medium having a program recorded thereon, a VPN router, and a server capable of reducing the effort of work of an administrator and quickly permitting remote access. A VPN access control system includes a VPN router and an image server. The VPN router executes a router authentication process based on router authentication information, and the image server executes a server authentication process based on server authentication information. The image server receives an access right granting request from a portable terminal of a registered user to which the access right has been granted and executes a first user registration process. The VPN router executes a second user registration process based on a command from the image server, and transmits an authentication information notification to a user who is an access right granting target.

Abstract: Exemplary features pertain to establishing an Exclusive Execution Environment domain that Trusted Execution Zone components are forbidden to access. In one example, a system-on-a-chip (SoC) is equipped with a Reduced Instruction Set Computing (RISC) processor along with an application DSP (ADSP) and/or Graphics Processing Unit (GPU), where the ADSP and/or GPU is configured to provide and enforce the Exclusive Execution Environment domain. By forbidding access to Trusted Execution Zone components, security can be enhanced, especially within minimally-equipped devices that do not have the resources to implement a full Trust Execution Environment, such as low-power devices associated with the Internet of Things (IoT). Among other features, the systems and methods described herein allow application clients to build exclusive execution environments and claim exclusive access to buffer objects and hardware resource groups. Method and apparatus examples are provided.

Abstract: Method and apparatus are disclosed for controller area network message authentication. An example disclosed vehicle includes a data bus and a first control unit communicatively coupled to the data bus. The example first control unit generates a secured message by (a) calculating a message authentication code, (b) truncating the message authentication code, (c) truncating a freshness value used to generate the message authentication code, and (d) placing portions of the truncated message authentication code and the truncated freshness value in separate portions of the secured message.

Abstract: Vulnerable code allows outside actors to interfere with the normal operation of current systems. To help defend against these outside actors, it is desirable to identify vulnerabilities in existing systems, including systems where the original source code is not available for study. Described herein are methods for identifying functional attributes that change the intended operation of a compiled binary extracted from a target system.

Abstract: An authentication device has internal circuitry operable to execute specific digital processing, a digital token, an image-capturing mechanism and circuitry, and an output interface. The image-capturing mechanism captures an image providing biometric identity of a user, the internal circuitry executing a first specific digital process creates a first digital string unique to the image providing biometric identity, the internal circuitry executing a second specific digital process combines the first digital string with the digital token, creating a combined digital string, and the combined digital string is provided to the output interface.

Abstract: Methods and systems for carrying out campaigns of penetration testing for discovering and reporting security vulnerabilities of a networked system. Penetration testing campaigns are carried out based on pre-defined penetration testing scenarios associated with respective time tags. A penetration testing scenario is selected by a user from a set of pre-defined test scenarios, the set containing only pre-defined test scenarios with time tags matching a scheduled starting time of a penetration testing campaign.

Abstract: According to an example embodiment of the present invention, there is provided an apparatus (110) comprising a receiver (114) configured to receive at least part of a key in scrambled form, and at least one processing core configured to descramble the at least part of the key and to apply the key in a cryptographic procedure, the descrambling being based at least in part on at least one environmental condition.

Abstract: A method for changing a processor instruction randomly, covertly, and uniquely, so that the reverse process can restore it faithfully to its original form, making it virtually impossible for a malicious user to know how the bits are changed, preventing them from using a buffer overflow attack to write code with the same processor instruction changes into said processor's memory with the goal of taking control of the processor. When the changes are reversed prior to the instruction being executed, reverting the instruction back to its original value, malicious code placed in memory will be randomly altered so that when it is executed by the processor it produces chaotic, random behavior that will not allow control of the processor to be compromised, eventually producing a processing error that will cause the processor to either shut down the software process where the code exists to reload, or reset.

Abstract: Method, system and product for controlling integrated software components. One method comprises receiving an application program which utilizes a software component that is integrated into the application program. The method further comprises producing a modified application program based on the application program, by: automatically wrapping one or more functions associated with the software component with one or more wrappers, wherein each wrapper is configured to selectively disable or enable invocation of the function based on modifiable configurations; whereby allowing for selectively enabling or disabling invocation of the one or more functions during runtime of the application program by modifying the modifiable configurations without re-deploying the application program.

Abstract: Managing private key access in multiple nodes is described. A piece of data (e.g., a private key) is encrypted using identity-based broadcast encryption and identity-based revocation encryption so that only certain servers in a distributed network of servers can decrypt the piece of data. The piece of data is encrypted with a key encryption key (KEK). The KEK is split into two pieces. The first piece is encrypted using identity-based broadcast encryption with an identified location as input such that only servers of the identified location can decrypt the first piece, and the second piece is encrypted using identity-based revocation encryption so that certain identified servers of the identified location cannot decrypt cannot decrypt the second piece. The keys are transmitted to the servers.

Abstract: A method, system and computer program product are provided for implementing block extent granularity authorization model processing in Coherent Accelerator Processor Interface (CAPI) adapters. The CAPI adapter includes an authorization table and a file system authorization function to authenticate data access for a client at an extent granularity and to prevent an application from accessing unauthorized data in the CAPI adapter. Each authorization table entry provides for the CAPI client, a CAPI client identification (ID), a CAPI server register space assigning resource ownership to the CAPI client with a CAPI set of allowed functions.

Abstract: Example embodiments of the present disclosure provide methods, devices, and computer programs for authorization detection. The first system receives, from the second system unauthorized by the first system, a request for operating a resource of the first system. The first system causes a detection of an authorization chain to be detected based on the first record that at least indicates one or more systems that are authorized by the first system. The authorization chain includes at least a third system that authorizes the second system and is authorized by the first system. If the authorization chain is detected, the first system authorizes the operation of the resource of the first system.

Abstract: A security apparatus that can detect unauthorized alterations of physical arrangement of a computing system or unauthorized movements of a computing system through the use of acoustic signals is designed. Modules of a computing system including the security apparatus are able to generate acoustic measurements from received returned acoustic signals. Also, the modules are able to derive baseline acoustic measurements based on stored acoustic profiles. If, for any module of the computing system, its generated acoustic measurements do not substantially match its baseline acoustic measurements, the mismatch may indicate that there is an unauthorized alteration of physical arrangement of the computing system or an unauthorized movement of the computing system. Thus, the security apparatus in the module may take actions to prevent access to the sensitive data stored in the module.