Abstract: The invention belongs to the field of computer security and discloses a blockchain-based anonymous authentication method for the Internet of Vehicles across trusted authorities, including registering the vehicle (with onboard unit) and roadside unit in their respective trusted authorities. When the vehicle enters different trusted authority domains, both the onboard unit and roadside unit generate corresponding authentication parameters and transmit them to the consortium blockchain of the Internet of Vehicles for verification and signature, obtaining authenticated data signed by the consortium blockchain. The onboard unit and roadside unit receive and verify the authenticated data, and upon successful verification, the onboard unit calculates a session key. The onboard unit uses the session key to sequentially transmit data with the roadside unit and the consortium blockchain.

Abstract: A method and system for configuring a data change filter in a virtualized environment are provided. A data change filter is installed in a hypervisor of a virtualization host, where the hypervisor executes a virtual machine. The data change filter intercepts data change operations from the virtual machine. The hypervisor includes a certificate management service that stores a private certificate for the data change filter and a public certificate for a replication processing service. The data change filter retrieves the certificates from the certificate management service, establishes an authenticated network connection with the replication processing service using the certificates, and sends the intercepted data change operations to the replication processing service over the authenticated connection. The system enables secure replication of data changes in virtualized environments.

Abstract: In accordance with some embodiments, various examples of systems, methods, and media for detecting falsified Wi-Fi signals. A system detects a group of nearby access points (APs) broadcasting Wi-Fi signals. A determination is made whether the group of nearby APs contains at least one falsified Wi-Fi signal. Whenever it is determined that the group of nearby APs does contains at least one falsified Wi-Fi signal, an analysis is performed of each AP of the group of nearby APs. The analysis uses at least one of: a pair-wise comparison of AP locations, or an analysis of physical layer attributes of the signals broadcasted by the APs. APs of the group of nearby APs are identified that are falsified. A mitigation action is initiated relative to the falsified APs that are identified.

Abstract: A network node for a field device data network, which receives first field device data, store, the first field device data in data blocks, receives a data block request including a public key and digital monetary data, checks the digital monetary data, and if the check is successful, answers the data block request by encrypting the requested data block using the public key and transmitting the data block encrypted using the public key.

Abstract: Various aspects of the present disclosure relate to attribute-based credentials for resource access. An apparatus, such as a UE, communicates a registration request message for registration of the apparatus to a wireless communication network, the registration request message including a credentials indication associated with a credential. The apparatus receives a response message including a presentation policy for registration to the wireless communication network, and communicates a presentation token generated based at least in part on the presentation policy, the presentation token including proof information for a private key. The apparatus receives an authentication challenge, and generates, based at least in part on the authentication challenge, an authentication result using a root key and a subscription identity from the credential.

Abstract: A method is provided for temporarily enabling functionality of a secure device. The method includes storing public keys for respective trusted devices of at least one trusted device, storing device-unique data that is unique for the secure device, generating a unique hashed-based message authentication code (HMAC) key, computing, based on the HMAC key and the device-unique data, a unique HMAC, transmitting the HMAC to a trusted device of the at least one trusted device, receiving a signed HMAC from the trusted device, wherein the signed HMAC is the HMAC as signed by the trusted device using a private key of the trusted device, decrypting the signed HMAC using the public key for the trusted device, comparing the decrypted signed HMAC to the HMAC, and enabling functionality of the secure device based on a result of the comparison.

Abstract: Computer systems and methods are provided for storing a first path profile. A computing device receives a first request to access a first location of a website, transmits the first request to a server, and receives a first cookie that includes identifying information for the first location. In response to receiving the first cookie, the device stores the identifying information. The device receives a second request to access a second location of the website that is distinct from the first location. The second request includes the identifying information for the first location. The device transmits the second request to the server and receives a second cookie that includes the identifying information for the first location and for the second location. In response to receiving the second cookie, the device stores the first path profile that includes the identifying information for the first location and the second location.

Abstract: A method for access control to a wireless local area communication network, including a gateway for accessing the local area network and a plurality of user terminals capable of being connected to the local area network via the access gateway. The access control of one of the user terminals to the network includes: authenticating the user terminal on the basis of an item of information derived from a biometric print of a user of the user terminal, and applying, to the user terminal, a network access profile personalized for the user to whom the biometric print belongs.

Abstract: An information processing apparatus includes processing circuitry configured to acquire a security log including information regarding unauthorized communication stored in an upper network device being a device constituting an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower network device being a device constituting an underlay network, specify information such that, when the authentication log includes a connection source IP address that does not exist in the communication log acquired and the security log includes information regarding an access not permitted to be used from the connection source IP address, the processing circuitry specifies the information regarding the access as unauthorized communication, and give an instruction to block the unauthorized communication specified.

Abstract: A method and system for mitigating a threat associated with network data packets are provided. The method commences with receiving, by an authentication server, a request for access to a server from a client. The method further includes authenticating the client by the authentication server. The authentication includes providing an authentication token to the client. The method continues with receiving, by a mitigation device, from the client, at least one network packet directed to the server. The at least one network packet embeds the authentication token. The method further includes validating, by the mitigation device, authenticity of the authentication token and selectively forwarding, based on the validation, the at least one network packet to the server. The authentication token is independently generated by the authentication server and the mitigation device, and is unique for each packet.

Abstract: The implementations provide a method including: encrypting records on one or more computing devices using a key of the one or more computing devices to generate a first set of encrypted records; preparing a matrix indicating that each of the first set of encrypted records is present on the one or more computing devices; responsive to receiving, from a remote device, a second set of encrypted records encrypted by the second device using a key of the remote device, encrypting the second set of encrypted records using the key of the one or more computing devices; and transmitting the second set of doubly encrypted records, along with the matrix, to the remote device for the remote device to determine, using the matrix, whether at least one of the second set of encrypted records of the second device is included in the first set of encrypted records on the first device.

Abstract: Methods and systems for securely deploying an artificial intelligence (AI) model. The system can identify one or more deficiencies of the AI model, and protect the AI model from being attacked by external data based upon the identifying. The system can be used for fraud detection based on tabular data, voice authentication, facial recognition, object detection, or a combination thereof.

Abstract: A trust store management system for a network communication ecosystem is provided. The system is programmed to a) receive a DNSSEC entry address of a DNSSEC entry stored at a DNSSEC server; b) transmit a request to a DNSSEC server to access information stored in the DNSSEC entry associated with the DNSSEC entry address; c) receive, from the DNSSEC server, the information stored in the DNSSEC entry; d) receive a trust store; and e) validate the trust store based on the information stored in the DNSSEC entry.

Abstract: A system for performing a multi-party computation (MPC) operation may include an MPC node executed in a secure enclave. The MPC node includes executable instructions injected into the secure enclave to create an execution environment. The secure enclave performs an attestation check on the execution environment, generates a result of the attestation check, and cause the secure enclave to create a cryptographic signature on the result of the attestation check. The system may also include an attestation node in communication with the secure enclave. The attestation node verifies the cryptographic signature on the result of the attestation check and cause a decryption of an encrypted private cryptographic key shard to generate a decrypted private cryptographic key shard. The decrypted cryptographic key shard is used by the MPC node to perform part of the MPC operation.

Abstract: A device, system and method for providing services between a communication device and an application server is provided. A trust session is established between a gateway device and an application server. The gateway device provides, to the application server, on behalf of a communication device served by the gateway device: a service request that requests a service from the application server; an indication of successful authentication of the gateway device by the application server, the indication associated with the trust session; and a payload including an indicator of the communication device. The gateway device receives, from the application server, a verification of the service request determined using at least the indication associated with the trust session. The service is provided between the communication device and the application server via one or more of the gateway device and a network.

Abstract: A method may include obtaining a manifest file that includes various software definitions for various peripheral device functions. The method may further include determining whether the manifest file is signed by a predetermined cryptographic key. The method may further include obtaining, in response to determining that the manifest file is signed by the predetermined cryptographic key, a selection of a peripheral device function among the peripheral device functions in the manifest file. The method may further include performing the peripheral device function using a peripheral device in response to obtaining the selection of the peripheral device function.

Abstract: A computer-implemented method, according to one approach, includes: generating lookup tables for signatures during compile time, the lookup tables having cryptographic information. A secret key is used to encrypt the lookup tables, and the secret key is stored in a secure storage which is accessible only to a secure engine. Moreover, in response to experiencing an initial boot: the lookup tables are decrypted using the secret key, and the decrypted lookup tables are stored in the secure storage. Other systems, methods, and computer program products are described in additional approaches.

Abstract: The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.

Abstract: The present disclosure generally relates to methods and user interfaces for authentication, including providing and controlling authentication at a computer system using an external device in accordance with some embodiments.

Abstract: A method for controlling access to a resource in an electronic device including a secure element with a permanent memory having an OTP area. The method includes the following steps performed first when the secure element or the electronic device boots: checking presence of at least one of a secret data and an initialization value in the permanent memory and, in a negative event, generating an initialization value and storing it into the OTP area, in a positive event, if the permanent memory includes secret data, decrypting, within the secure element, the secret data by using an algorithm using a cryptographic key and, if the permanent memory further includes an initialization value, the initialization value, and checking the integrity of the secret data by using a signature stored in the permanent memory and, on successful completion, providing access to the resource.